UAE's legislative and structural reforms in white collar crime and investigations during 2023 and predictions for 2024

In the anti-money laundering (AML), counter-terrorist financing (CTF) and sanctions space, the UAE has continued to enhance its regulatory regime, with a view to securing removal from the Financial Action Task Force’s (FATF) ‘grey list’ of jurisdictions under enhanced monitoring. In June 2023, the FATF recognised the significant progress made by the UAE. Now that the required regulatory structures are in place, the key area for further development is enforcement activity. There has already been a dramatic increase in UAE enforcement activity and regulatory engagement over the course of 2023 (compared with 2022) and this trend is expected to continue in 2024.

Investigations trends/developments

AML, CTF and sanctions compliance continues to be a strategic priority for the UAE

The UAE was placed on the FATF’s ‘grey list’ in early 2022 because it was assessed by the FATF as having a number of structural deficiencies in its AML, CTF and sanctions regime.

Following a number of legislative and structural reforms in 2022, the FATF conducted a further interim assessment on the UAE and concluded in June 2023 that the UAE has substantially completed the action plan set by the FATF. The enhancements that led the FATF to reach this conclusion included:

• increases in outbound mutual legal assistance requests to facilitate money laundering (ML) and terrorist financing investigations
• the provision of additional resources to the UAE Central Bank’s Financial Intelligence Unit (FIU) to enhance its capabilities and improve the use of financial intelligence, including from foreign counterparts, in the pursuit of high-risk ML threats
• a sustained increase in effective investigations and prosecutions of different types of ML cases consistent with the UAE’s risk profile
• the effective implementation of targeted financial sanctions by sanctioning noncompliance among reporting entities and demonstrating a better understanding of United Nations’ sanctions evasion within the private sector.

For further details on the June 2023 FATF report, please see our separate update here.

A further inspection by the FATF is scheduled for early 2024 to review the UAE’s reforms and consider whether the UAE should be removed from the FATF’s ‘grey list’.

Increased enforcement activity reflects the UAE’s strategic priorities in AML and CTF compliance

In 2023 there was a focus on enforcement activity and regulatory engagement by the UAE authorities. Statistics released by the UAE’s Executive Office of Anti-Money Laundering and Counter Terrorism Financing (the UAE Executive Office) in October 2023 demonstrate this trend.

Between March 2023 and July 2023:

• the relevant UAE investigation and prosecution authorities launched 183 ML cases; of these, 51 cases were based on FIU reports; 164 cases were investigated by the public prosecutor; and 99 cases were referred to court
• the UAE Executive Office reported a conviction rate of 92.1%
• approximately 45.3% of the associated police investigations were generated by formal and informal international cooperation, such as incoming mutual legal assistance requests, FIU-to-FIU, and police-to-police cooperation
• the UAE confiscated assets worth more than AED1.309 billion relating to AML/CTF activities
• fines of more than AED199 million were imposed on Financial Institutions and Designated Non-Financial Businesses and Professions (DNFBPs)
• private sector reporting of targeted financial sanctions, terrorist financing and proliferation financing increased by approximately 93% from the previous reporting period
• in H1 2023, there was a 17% increase in Suspicious Transaction Reports submitted to the FIU. Submissions by DNFBPs increased by 14%.

As regards the enforcement activities of the authorities in the UAE’s financial free zones, the Dubai Financial Services Authority (DFSA) completed five enforcement actions in 2023 (up from four in 2022). The Abu Dhabi Global Market’s (ADGM) Financial Services Regulatory Authority (FSRA) completed five enforcement actions in 2023 (up from one in 2022).

Increased regulatory protections for whistleblowers

In December 2022, the ADGM published non-binding principles for ADGM entities on the implementation of whistleblowing policies and to encourage whistleblowing disclosures, eg on non-retaliation against whistleblowers, confidential disclosures and good faith reporting.

The ADGM indicated in its 2024 Business Plan that it intends to introduce a comprehensive whistleblowing regime. These steps are in line with global trends in favour of increasing corporate accountability. We expect to see these trends develop further in the UAE’s onshore jurisdictions in 2024.

Whistleblowing regimes are already in place in the Dubai International Financial Centre (DIFC).

Legislative developments/law reforms

Cybersecurity and data protection

As in many jurisdictions, cybersecurity and data protection is a hot topic in the UAE, particularly within the UAE’s financial sector.

The DFSA has published cyber risk management rules which come into force on 1 January 2024 and which all DFSA licensed firms are expected to implement. The rules address the following matters:

• maintaining a cyber risk management framework to identify, assess and manage cyber risk;
• regular screening of IT systems through anti-malware software;
• maintaining a comprehensive programme to test the resilience of IT systems and a robust cyber incident response plan; and
• licensed firms notifying the DFSA of cyber incidents within 72 hours of becoming aware of them.

The DFSA has also been focused on improving cyber resilience by encouraging better crisis management planning and response, eg in May 2023, 17 DFSA licensed firms took part in a crisis simulation exercise, which mimicked real-world cyberattacks.

In September 2023, the DIFC expanded its Data Protection Law (DIFC Law No 5 of 2020) in the following areas:

• the handling of data that is processed through autonomous and semi-autonomous systems;
• personal data breach reporting obligations;
• the use and collection of personal data for electronic marketing and digital communications; and
• the powers of the DIFC Commissioner of Data Protection to conduct investigations and enforcement activities.

New legislation regulating virtual assets 

2023 has also seen further substantial regulatory reform in relation to virtual assets in the UAE. Of most significance was the issuance of UAE Cabinet Decision No. 111 of 2022 (the Cabinet Decision), which came into force on 15 January 2023. The Cabinet Decision sets out a comprehensive framework for the regulation of virtual assets at the UAE Federal level and applies to all virtual assets and virtual asset services providers (VASPs) in the UAE (including the free zones, but excluding the DIFC and the ADGM). The objectives of the Cabinet Decision are to: (i) develop a legislative system for the virtual assets sector; (ii) ensure that VASPs comply with all applicable AML and CTF regulations; (iii) support the UAE Government’s efforts to attract international investment in the virtual asset sector; and (iv) protect investors and consumers.   

On 7 February 2023, Dubai’s Virtual Assets Regulatory Authority (VARA) issued regulations to supplement the operation of Dubai’s Virtual Assets Law (Law No. 4 of 2022), which was enacted in March 2022. The regulations define regulated activities, set out licensing requirements, and detail VARA’s investigative and enforcement powers.

Tax evasion

In 2022, the UAE implemented its first federal corporate tax scheme, imposing a tax rate of 9% on applicable businesses, effective for financial years starting on or after 1 June 2023.

On 10 July 2023, the UAE Ministry of Finance issued Cabinet Decision No. 75 of 2023, outlining the monetary penalties for failure to comply with the new tax requirements. This includes a 14% monthly penalty for each month the payable tax is not settled and separate fines for failing to maintain records.

Cross-border and interagency cooperation

2023 has seen a sustained increase in cross-border and interagency cooperation by UAE authorities:

• over the first half of 2023, the UAE sent 119 mutual legal assistance requests to over 40 jurisdictions and received 202 mutual legal assistance requests. As at October 2023, the UAE had responded to approximately 73% of them (with the remaining still under process);
• the DFSA entered into a memorandum of understanding with the FIU;
• the UAE’s Executive Office for Trade Control and Non-proliferation and the FIU signed an MOU to enhance bilateral cooperation and co-ordination to implement targeted financial sanctions set by the United Nations and to combat the financing of arms proliferation; and
• the UAE hosted Interpol’s Asian Regional Conference, with over 150 law enforcement officials from 42 countries in attendance.

Predictions for 2024

Over the course of 2024, it is anticipated that the UAE will continue to focus on increasing enforcement activities together with increased inter-agency and cross-border collaboration. Businesses should therefore be alert to increased enforcement risks.

The development of whistleblowing regulation also looks set to be point of focus for a number of UAE authorities in 2024.  Looking ahead, it is becoming increasingly important for businesses to develop and implement effective whistleblowing policies and procedures. 

This article is part of our Cross-Border White Collar Crime and Investigations Review. Please click here for our overviews and insights in other jurisdictions.