Whistleblowing in an international company: UAE requirements and best practices

Whistleblowing in an international company: Requirements and Best Practices Practical Guide for International Business in the UAE

Mainstream

Whistleblowing in an international company is not just a hotline. It is a strategic element of protecting business from regulatory and reputational disasters.

The question is not whether you have a policy of reporting violations. The main question is whether this policy will actually protect the company when information about misconduct will go beyond the perimeter of the organization.

The effective whistleblowing system in the UAE is based on three checks:

• Does it comply with applicable regulations—federal law, free zone rules, and extraterritorial requirements?
• Does it provide real privacy and protection from reprisals, rather than a formal declaration?
• Can it turn an internal signal into a controlled investigation, reducing the risk of external regulatory interference?

If these three issues are not resolved in advance, the company risks not just a fine or investigation, but a complete shutdown of business in the region.

When the whistleblowing system becomes critical

An international company is required to build a working mechanism for whistleblowing if:

• it is subject to the laws of countries requiring channels of information (including EU Directive 2019/1937);
• • operates in the financial sector of Dubai or Abu Dhabi under the supervision of the DFSA or FSRA;
• It is part of the DIFC, ADGM or other free zone with autonomous regulation.
• its employees, contractors or public persons may report corruption, fraud, sanctions violations, money laundering;
• The company prepares for M&A, audit, due diligence or regulatory review.
• There is a dispute with a former employee or partner who is able to initiate an external proceeding.
• Businesses are associated with government contracts, critical infrastructure, or sensitive data.

The mistake most companies make

Many people use whistleblowing to the following pattern: They publish a policy, hang a box, and consider the issue closed.

It doesn't work.

The right approach doesn’t start with a form, but with three scenarios:

• How does the company know the signal before the regulator?
• How she'll conduct an investigation without leaking, losing evidence, and breaking local regulations.
• How will she demonstrate to the UAE authorities that she has taken comprehensive measures to reduce the risk of criminal or administrative liability?

Whistleblowing in the UAE is not a personnel function, but a tool to prevent corporate catastrophe.

Step 1. Identify applicable regulatory layers

Unlike many jurisdictions, the UAE does not have a single federal law covering all industries. Regulation is fragmented and an international company must consider several levels:

• Federal legislation: Federal Decree-Law No. 37 of 2022 on the Protection of Witnesses, Experts and Persons Reporting Violations (in the Part of Criminal Proceedings); Federal Decree-Law No. 32 of 2021 on Commercial Companies (requirements for corporate governance and internal control); The Labor Act (Federal Decree-Law No. 33 of 2021) is the absence of direct protection for whistleblowers, but the general rules on non-discrimination and termination of employment relations.
• Financial areas: DIFC (Dubai International Financial Centre) – Operating Law, DFSA Rulebook, reporting requirements of misconduct ADGM: FSRA regulations, including infringement disclosure obligations for regulated entities.
• Sectoral regulation: Banks and financial institutions under the supervision of the UAE Central Bank and SCA are required to have reporting mechanisms for violations, including reporting suspicious transactions.
• Extraterritorial requirements: If the parent is located in the EU, Directive 2019/1937 if the company is subject to the UK Bribery Act or US FCPA, the relevant expectations are for whistleblowing policies and applicant protection.

Without mapping all applicable levels, the system would be incomplete. A mistake at this stage leads to the company believing itself to be protected, but the regulator does not.

Step 2. Assess jurisdictional risks for the applicant and the company

Whistleblowing in the UAE is not only a corporate policy, but also a criminal law context. It is necessary to analyze in advance:

• risks to the applicant in disclosing information that may be regarded as defamation, disclosure of trade secrets or violation of bank secrecy under UAE law;
• Cybercrime and data protection: Federal Law No. 34 of 2021 on the fight against cybercrime, Federal Decree-Law No. 45 of 2021 on the protection of personal data – the boundaries of collection and storage of information about the applicant;
• National security and state secrets, especially for companies with state participation;
• Applicability of DIFC Data Protection Law or ADGM Data Protection Regulations if the processing of messages is carried out through servers in free zones;
• The risk of jurisdictional conflict: The same message may be legal whistleblowing under EU law but violate UAE local privacy rules.

A company that does not take this layer into account may accidentally put an employee at risk of criminal prosecution — or become a defendant in the investigation itself.

Step 3. Collect and record the evidence base of the policy

A working whistleblowing system does not require declarations, but documents. Before the first signal, it is necessary to prepare:

• A policy of reporting violations adapted to the UAE (in Arabic and English);
• the procedure for receiving, registering and escalating messages;
• Procedure for conducting an internal investigation taking into account local procedural restrictions;
• Informed consent forms and privacy notices;
• Protocols of interaction with external lawyers to maintain legal privilege;
• Protection from retaliation (anti-retaliation policy)
• documents confirming the training of employees and familiarization with the policy;
• The history of processing training signals or test messages.

The evidence that the company has not only adopted the policy, but also systematically applies it is particularly valuable: records of the review of communications, reports of the compliance committee, correcting the measures following the investigations. This is what the regulator is doing when it comes to checking.

Step 4. Determine the applicable regime of the applicant’s protection

The applicable protection regime answers the question: that the company is obliged to guarantee to the applicant by law and that it guarantees, in addition, voluntarily.

This has an impact on:

• confidentiality of the person;
• prohibition of dismissal, demotion, change of working conditions, pressure;
• admissibility of anonymous messages;
• the procedure for disclosure of data to third parties;
• immunity from liability for a good faith report;
• data retention periods;
• the possibility of submitting an external message to the regulator without prior internal information;

In the UAE, the protection of applicants does not yet reach the level of the EU Directive. Therefore, an international company often has to provide additional contractual and corporate guarantees to make sure that whistleblowing really works and employees are not afraid to use it.

Step 5. Check the channels and their jurisdictional binding

A communication channel is not just an email or a phone. It's a jurisdictional choice.

It is necessary to determine:

• where the servers processing the messages are physically located;
• Whether the data is subject to the DIFC/ADGM data protection regime or the federal PDPL;
• Whether cross-border transfer of data about the applicant to the group headquarters (e.g. in the EU or the USA) is permitted;
• How to ensure confidentiality when mandatory notification of local management;
• the possibility of receiving communications in Arabic, English and other languages;
• There is an independent external channel (external ombudsman, law firm) that allows you to bypass the hierarchy within the company.

An incorrect channel architecture can lead to leakage, violation of local laws and loss of trust in the entire system.

Step 6. Select an investigation strategy: internal, external or mixed

The UAE’s investigation strategy should take into account not only corporate standards, but also potential engagement with law enforcement and regulators.

Options:

• Internal investigation by the compliance team is permissible if there is no conflict of interest and the subject matter of the communication does not require the authorities to be informed.
• External investigations involving independent lawyers are critical when the signal concerns top management, fraud, corruption or sanctions violations. It allows you to maintain legal privilege and prepare a defense position before contacting the regulator.
• The mixed model is internal logging with external legal control and parallel assessment of the risks of criminal prosecution.

In Dubai and Abu Dhabi, it is particularly significant that the results of an internal investigation can be sought by the prosecutor’s office or the financial regulator. The form, procedure and legal framework of the investigation therefore have a direct impact on the outcome of the eventual case.

Step 7. Protect against retaliation and document it

Protection from repression is not a promise, but a system of action.

It should include:

• monitoring of personnel decisions in relation to the applicant after the communication;
• fixing all changes in position, salary, bonuses and disciplinary measures;
• a separate mechanism for filing a complaint against retaliation;
• arrangements with an external lawyer for the applicant;
• Risk analysis under the UAE Labor Law and, if necessary, parallel registration of protection through DIFC/ADGM standards.

If the company does not, whistleblowing goes from being an early warning mechanism to a labor dispute and additional external investigation.

Step 8. Integrate whistleblowing into the overall risk management system

The stand-alone hotline is an illusion of protection.

Whistleblowing should be built into:

• the corporate structure of compliance;
• due diligence procedures of counterparties;
• monitoring of sanctions risks;
• anti-corruption program;
• Internal control system of financial reporting;
• Response plans to searches, seizures and regulators’ requests;
• Staff training program (with mandatory module on whistleblowing on local material).

In the UAE, regulators are increasingly assessing not the existence of a policy, but its actual performance – the number and quality of the messages reviewed, the measures taken, and the independence of the function.

How to strengthen your position before an incident occurs

The best whistleblowing system is not built after a scandal, but in a quiet period.

In an international company operating in the UAE, it is advisable to introduce:

• policies that are consistent with both UAE federal law, free zone regulations and the requirements of the country of origin of capital;
• channels protected by legal privilege;
• an external backup channel through an independent law firm in Dubai;
• the prescribed rules of confidentiality;
• clear deadlines for consideration of communications;
• the procedure of escalation to the board of directors;
• Regular stress tests (mystery reporting)
• Training managers at all levels to respond to whistleblowing correctly
• Arrangements with outside lawyers in case of immediate interaction with the prosecutor’s office, police or financial regulator;
• An internal register of communications ready to be presented without risk of self-incrimination.

The whistleblowing policy should not be written for a tick, but for a scenario where one message can paralyze a business.

Common Mistakes of International Companies in the UAE

1. Copy global politics without adapting to the UAE. What is allowed in the EU can be criminalized in Dubai. Local privacy, slander and banking secrecy features require separate setup.
2. Ignore DIFC/ADGM. Free zone companies often fail to realize that they are subject to autonomous regulations that are more stringent in terms of whistleblowing than mainland legislation.
3. Not to provide an Arab version of politics. The regulator and local employees have the right to work with the document in Arabic. The lack of translation can be interpreted as an incomplete implementation.
4. Do not conduct an investigation before contacting the regulator. If a company learns of fraud but fails to launch an immediate, legally protected investigation, it risks being charged with inaction or cover-up.
5. Keeping records haphazardly. The protocols of the examination of whistleblowing messages can be seized during the search. They should not contain language that could form the basis of the accusation.
6. Mixing compliance and PR. Public statements before the investigation is completed may exacerbate legal risks.
7. Not to manage cross-jurisdictional conflict. The parent company may require immediate disclosure of information, while local UAE law prohibits it.

Checklist of an international company in the UAE

Before implementing or auditing a whistleblowing system, 15 questions must be answered:

1. What jurisdictions is the company tied to (Federal Law of the UAE, DIFC, ADGM, country of registration of the holding)?
2. Are there any industry requirements (DFSA, FSRA, Central Bank)?
3. Does the EU Directive 2019/1937 apply to the company?
4. Is the policy in Arabic and English tailored to local legal specifics?
5. Is the applicant’s confidentiality guaranteed in terms of local data protection laws?
6. Where is the data from the whistleblowing channel physically stored?
7. Is there a way to escalate that eliminates a conflict of interest?
8. Is there an independent external channel?
9. Is there a legal procedure that is protected by legal privilege?
10. Are anti-retaliation measures and enforcement procedures in the UAE recorded?
11. Has a legal risk analysis been carried out for the applicant under the libel and disclosure articles?
12. Is there a protocol for interaction with local law enforcement and regulators?
13. Is whistleblowing integrated into compliance and anti-corruption procedures?
14. Was there any training in real-world whistleblowing scenario simulation in Dubai?
15. Is all of the above documented for presentation to the regulator or auditor?

What a strong whistleblowing strategy looks like in the UAE

A strong strategy usually includes five levels:

1. Regulatory Mapping: Identify all applicable legal regimes and their intersections.
2. Channel Architecture: Building channels with jurisdiction, privacy and legal privilege in mind.
3. Investigation Protocol: Internal and external investigation procedures ready for immediate launch.
4. Protection Framework: Real mechanisms for preventing reprisals and protecting the applicant and the company.
5. Defense Readiness Action Plan in case of regulatory inspection, search or criminal case.

Without a fifth tier, the top four may not save a business from a stop or reputational damage.

FAQ

Is a company in mainland Dubai required to have a whistleblowing policy?

There is no single general obligation at the level of federal law, but it arises from corporate governance requirements for certain types of companies, as well as from industry regulation and extraterritorial norms. The absence of a system in the event of an incident will be considered an aggravating factor.

Does the EU Whistleblowing Directive apply to the UAE office?

Yes, if a company falls within the scope of the Directive (e.g. an EU entity with a branch in Dubai), it is obliged to extend the requirements to local employees, adapting them to UAE law without violating local regulations.

Can anonymity be guaranteed in the UAE?

Technically, yes. Legally, it should be borne in mind that in a criminal investigation, the authorities may require disclosure of data. Therefore, the policy should honestly inform the applicant about the limits of confidentiality.

What if the whistleblowing message is about top management?

Immediately engage an external independent lawyer, isolate the investigation from internal influence, and assess the regulatory notice obligation. Any delay could be regarded as a cover-up.

How does whistleblowing relate to a company’s criminal liability protection?

Having an effective whistleblowing system and responding in a timely manner can be grounds for mitigation or even exemption from liability if the company demonstrates proactive compliance and cooperation with the authorities.

Can the whistleblowing investigation be used in court?

It is possible, but the form of their collection and fixation must meet the requirements of admissibility of evidence in the UAE and exclude the violation of the rights of participants. Incorrectly executed protocol may be considered inadmissible or even become the basis of a counterclaim.

More importantly: Is it internal policy or external communication with the regulator?

It is more important for businesses to keep control of the situation. This is possible only if the internal system is properly built and the line of interaction with the UAE authorities is prepared in advance.

Related services

• Corporate Investigations, Regulatory Investigations & Business Integrity
• International Regulatory Risk & Strategic Advisory
• Compliance Program Design & Health Checks
• Employment & Executive Disputes (DIFC/ADGM/UAE)
• Anti-Bribery, Anti-Corruption & Financial Crime
• Data Protection & Privacy (UAE, DIFC, ADGM, GDPR)
• Internal Audit & Corporate Governance Support

Related material

• How to Conduct Internal Investigations Without Risk for a Company in the UAE
• DIFC and ADGM: Differences in Regulatory Regulatory Regimes for International Business
• Anti-corruption compliance in Dubai: What has changed for international companies
• Protection of personal data in the UAE: How to Avoid Conflict with Federal Law
• Legal privilege in the UAE: How to Protect Internal Investigation Documents
• Responding to regulatory checks in Dubai Free Zones
• How to build a compliance function from scratch in the Middle East
• Protection of applicants and witnesses under new UAE law

Conclusion

Whistleblowing, a global company operating in the UAE, does not require formal copying of global standards, but rather a deep adaptation to Dubai’s multi-layered legal environment, DIFC, ADGM and federal law.

A strong position is based on accurate mapping of regulatory requirements, legally protected architecture of channels, ready-made protocol of investigation and a real system of prevention of repression.

In an environment where one uncontrolled message can trigger a chain of regulatory and criminal consequences, it is not the one who declares zero tolerance that wins. The winner is the one who has built whistleblowing as a tool to protect business, not as a pretext for accusation.