TRW & Co · AML, sanctions and investigations
Fraud and Internal Investigations in the UAE
An internal investigation UAE companies run after a fraud must establish the facts, preserve usable evidence and manage reporting duties without creating new liability. This guide explains the legal framework, how privilege and confidentiality differ onshore and in the DIFC and ADGM, the step-by-step process, and the mistakes that most often turn a contained fraud into a regulatory problem.
Key pointOnshore UAE law has no common-law legal privilege, so the format of the investigation report matters as much as its findings: assume anything written down may reach a prosecutor, a court or the person it names.
At a glance
No onshore privilege
Onshore law protects lawyer confidentiality through advocates' professional duties rather than common-law privilege; the DIFC and ADGM courts recognise privilege more fully.
Reporting runs early
The Penal Code imposes crime-reporting duties, and regulated firms must file suspicious transaction reports with the FIU through goAML without tipping off the subject.
Preserve before confronting
Image company devices and export mailboxes before custodians are told; accessing personal devices without consent risks breaching the Cybercrimes Law.
Truth is not enough
UAE defamation rules can apply even to true statements, so investigation reports should be factual, evidence-based and tightly distributed.
Independent oversight
Boards or special committees should set the mandate and wall off implicated executives, which supports credibility with regulators, auditors and investors.
Swipe or scroll →
The short answer: how to run an internal investigation UAE regulators and courts will respect
An internal investigation UAE companies commission after a fraud alert has to do three things at once: find out what happened, preserve evidence that will stand up later, and protect the business from new liability created by the investigation itself. In the UAE that last point carries more weight than in London or Singapore, because onshore law offers no common-law style legal privilege, treats some disclosures as defamation even when true, and imposes reporting duties that can start running on day one.
In practice, a defensible investigation starts within hours, not weeks. The board or an independent committee sets the mandate, external counsel is engaged early and directs any forensic accountants, data is secured before custodians are told, and interviews are run carefully. Throughout, someone must keep asking whether the facts trigger a duty to report to the Public Prosecution, the Financial Intelligence Unit or a financial regulator.
This guide explains the legal framework, the step-by-step process, how privilege and confidentiality really work onshore and in the DIFC and ADGM, an illustrative scenario, and the mistakes that most often turn a contained fraud into a regulatory problem.
The legal framework behind a corporate investigation
There is no single UAE statute on corporate investigations. Instead, an internal investigation UAE businesses run sits at the intersection of several federal laws, emirate-level rules and, for regulated firms, rulebooks issued by the financial regulators.
Criminal law and reporting duties
The Crimes and Penalties Law (Federal Decree-Law No. 31 of 2021) defines the core fraud-related offences: fraud, breach of trust, forgery, embezzlement and bribery, including bribery in the private sector. It also contains general duties to report crimes to the authorities, and a specific duty on people who learn of certain crimes through their work. Those duties are framed as requiring reporting without undue delay, so a long internal fact-finding exercise before any report can itself create risk.
Legal persons can be criminally liable for offences committed in their name or for their account by their representatives, directors or agents. That is why boards, not just individual wrongdoers, have a stake in how quickly and how competently a fraud is handled.
Anti-money laundering law
Where the suspected fraud produced proceeds, money laundering is rarely far behind. Federal Decree-Law No. 10 of 2025 on anti-money laundering, counter-terrorist financing and proliferation financing replaced the 2018 law and took effect in October 2025. Financial institutions, designated non-financial businesses and professions, and virtual asset service providers must file suspicious transaction reports with the UAE Financial Intelligence Unit through goAML, and must not tip off the subject. Our guide to the 2025 AML law explains these duties in detail.
Data protection, cybercrime and employment law
Reviewing emails, chat logs and device images means processing personal data. Onshore, the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) applies, and it does not recognise legitimate interest as a free-standing lawful basis, so investigators usually rely on contractual consent, legal claims or another recognised ground. The DIFC and ADGM have their own data protection regimes and commissioners.
The Cybercrimes Law (Federal Decree-Law No. 34 of 2021) criminalises unauthorised access to electronic systems and invasions of privacy through technology. Covert monitoring of a personal device or private account is therefore dangerous, even when the employer suspects fraud. The Labour Law (Federal Decree-Law No. 33 of 2021) governs suspensions, disciplinary steps and dismissal, and protects employees who complain to the Ministry or bring claims.
Regulated firms and the free zones
Banks, insurers and capital markets firms face additional notification duties to the Central Bank of the UAE, the Capital Market Authority, the DFSA or the FSRA, typically covering significant fraud, misconduct by key individuals and material control failures. These duties often bite earlier than criminal reporting duties and should be mapped at the start. Our pages on regulatory investigations and white-collar crime and investigations cover the enforcement side.
Privilege and confidentiality: the UAE reality
The biggest conceptual shift for international general counsel is privilege. Onshore UAE law has no doctrine of legal professional privilege in the common-law sense. What exists is a professional duty of confidentiality on licensed advocates and legal consultants, backed by criminal sanctions for disclosing secrets, which restricts what the lawyer can be compelled to reveal. It binds the lawyer, not the client, and its application to in-house counsel is uncertain.
The DIFC and ADGM, as common-law jurisdictions, recognise privilege more fully in proceedings before their courts. The DFSA also recognises privileged communications in its own regime, while preserving certain supervisory access rights. But protection in DIFC Courts proceedings does not stop an onshore prosecutor or court from seeking the same document.
| Forum | What protects legal advice | Practical consequence |
|---|---|---|
| Onshore UAE courts and prosecution | Advocates' statutory duty of confidentiality; no common-law privilege | Assume that documents held by the company may be ordered or seized; keep findings oral where appropriate |
| DIFC Courts | Common-law style privilege recognised under the court rules and practice | Stronger protection for legal advice and litigation documents in DIFC proceedings |
| ADGM Courts | English common law applies, including privilege principles | Similar protection in ADGM proceedings |
| DFSA and FSRA supervision | Regulator-specific rules on privileged communications | Protection exists but supervisory access rights must be checked |
| Foreign proceedings (UK, US) | Local privilege law of the foreign forum | Structure the engagement so that foreign privilege can be claimed later |
Two practical rules follow. First, external counsel should engage forensic accountants and IT specialists directly, so their work sits inside the lawyer's confidentiality and, abroad, inside privilege. Second, the final report should be written for the decision it needs to support. A long written narrative full of conclusions about named individuals is a liability onshore: it may be disclosable and, under UAE defamation law, truth is not a complete defence.
Before anything is written down, decide which forum the material is most likely to end up in. A report designed for a DIFC Courts claim, a criminal complaint in Dubai and a US regulator will look different, and the format is far harder to change once the report exists.
Running an internal investigation UAE-style: the process step by step
The sequence below reflects how a well-run internal investigation UAE companies can defend later actually unfolds. Steps overlap, and the reporting assessment runs throughout.
- Triage the allegation. Record the source, the allegation and who already knows. Decide within a day whether it needs a full investigation, a limited review or a referral. Check whistleblower protections before identifying the reporter to anyone.
- Set the mandate and governance. The board or an independent committee approves terms of reference, the scope, the reporting line and who is conflicted. Implicated executives must be walled off from oversight.
- Engage counsel and experts. Instruct external counsel, who then engages forensic accountants and digital forensics providers. Put confidentiality and data processing terms in every engagement letter.
- Preserve evidence. Issue a document hold, suspend auto-deletion, image company devices and export mailbox and chat data, ideally before custodians are told. Record chain of custody for every source.
- Assess reporting duties. Map possible duties to the Public Prosecution, the police, the Financial Intelligence Unit and any financial regulator. Decide what must be reported now and document the reasoning.
- Review documents and transactions. Run targeted searches, trace payments and reconcile accounting records. Keep personal-data processing proportionate and logged.
- Interview witnesses. Interview lower-risk witnesses first and the subject last. Give an explanation that counsel acts for the company, use two interviewers and keep accurate notes.
- Report and remediate. Deliver findings in the agreed format, decide on disciplinary, civil and criminal steps, fix control weaknesses and record board decisions.
Evidence preservation and witness interviews
Most UAE fraud investigations are won or lost on evidence preservation. Company-issued laptops, phones and email accounts can generally be collected under the employment contract and IT policies, provided the policies are clear and the processing is proportionate. Personal devices and private messaging accounts are different: accessing them without consent can breach the Cybercrimes Law and data protection law, and evidence obtained that way may taint the case.
If you suspect an employee will delete material, collect first and notify afterwards. Where assets are moving, consider urgent court relief: onshore precautionary attachment, a DIFC or ADGM freezing order, or both. Our guide to freezing orders and interim relief sets out the options and evidence each court expects.
Interviews are where reputational and legal risks concentrate. Employees are not obliged to attend a criminal-style interrogation, and pressure tactics can undermine later use of the evidence. Tell each interviewee that counsel acts for the company, that the conversation is confidential, and that the company may decide to share what is said with the authorities. Avoid group sessions and avoid showing one witness another's account.
Disciplinary action should follow the workplace investigation procedure in the employment contract and policies. Paid suspension is usually safer than an early dismissal, which can look retaliatory if the employee is also a whistleblower.
Choosing who investigates: options compared
The right investigation model depends on seniority of those implicated, regulatory exposure and the likelihood of litigation.
| Model | Best for | Strengths | Limits |
|---|---|---|---|
| In-house compliance or internal audit | Low-value, contained matters with junior staff | Fast, low cost, deep knowledge of systems | Weak confidentiality onshore; perceived lack of independence |
| External counsel with forensic support | Senior staff, regulatory exposure, likely litigation | Professional confidentiality; independence; structured for later use | Higher cost; needs clear scope to control spend |
| Board or special committee oversight with external counsel | Allegations touching executives or directors | Credible to regulators, auditors and investors | Requires disciplined governance and conflict management |
| Joint investigation with a regulator or prosecutor in view | Matters already reported or under official inquiry | Shapes the narrative; may support cooperation credit | Less control over timing; disclosure decisions are complex |
Whatever the model, the board must be able to show it acted promptly and in good faith. Our directors' duties page explains why delay and wilful blindness are the usual sources of personal exposure for directors after a fraud.
An illustrative scenario
Illustrative only; the parties and facts are generic. A Dubai mainland trading company receives an anonymous email alleging that its procurement manager has been approving inflated invoices from a supplier owned by a relative. The finance director wants to confront the manager the same afternoon.
A better path: the chair convenes a small committee that excludes the procurement line. External counsel is instructed and engages a forensic accountant. That evening, IT images the manager's company laptop and phone and exports mailbox data under the company IT policy. Counsel reviews whether the facts suggest a reportable crime and whether the company's bank should be told, given that payments went through company accounts.
The review shows a pattern of overpayments and a side payment to the manager's personal account. The committee approves a criminal complaint, a civil claim for recovery and a precautionary attachment over the supplier's assets. The written report is short and factual; detailed analysis is given orally to the committee. The control gap, a single approver for supplier onboarding and payment, is fixed within the month.
Risks and common mistakes
Confronting the suspect before preserving evidence
The instinct to ask the employee for an explanation is natural, but it is the most common reason evidence disappears. Messages are deleted, devices are reset and co-conspirators are warned. Collect and image company devices and accounts first, then notify. If you suspect assets will be moved, prepare the court application for attachment or a freezing order in parallel so it can be filed as soon as the subject is aware. A short delay in confronting the suspect rarely harms the company; lost evidence often does.
Treating the investigation report as privileged
Onshore, there is no general privilege for an investigation report held by the company. A report that names individuals and draws conclusions can be demanded by a court or prosecutor, used by a dismissed employee in a labour claim, or found defamatory. Agree the report format in advance, keep conclusions factual and evidence-based, limit distribution and consider oral briefings for the most sensitive analysis. Where DIFC, ADGM or foreign proceedings are likely, structure the work to preserve privilege there.
Missing a reporting deadline
General crime-reporting duties, AML suspicious transaction reporting and regulatory notifications all require prompt action. A company that spends two months investigating before telling anyone may find that the delay itself is criticised. The fix is to make the reporting assessment an explicit workstream from day one, record the reasoning for each decision and revisit it as facts emerge. Reporting early does not prevent the internal investigation from continuing.
Accessing personal devices or private accounts
Fraud often runs through personal WhatsApp accounts or private email. Accessing them without consent can breach the Cybercrimes Law and data protection rules, exposing investigators to criminal complaints and undermining the evidence. Ask for voluntary production with documented consent, rely on company systems, or seek court-ordered disclosure. Make sure IT and acceptable-use policies clearly cover company devices and business messaging.
Retaliating against the whistleblower
Dismissing or sidelining the person who raised the concern invites claims under the Labour Law and, in the DIFC and ADGM, specific whistleblower protections. It also deters future reports. Keep the reporter's identity confidential, document legitimate reasons for any employment decision and review your whistleblowing policy. Our guide to whistleblowing in the UAE covers the protections in detail.
Cross-border investigations
Many UAE frauds have a foreign leg: a parent in London, a supplier in China, a bank account in Singapore, or proceeds sent to Bangladesh or India. That raises three questions. Which country's privilege rules will govern the material? Can data lawfully leave the UAE, the DIFC or ADGM? And do foreign laws such as the UK Bribery Act or the US FCPA create their own disclosure expectations?
Onshore data transfers outside the UAE need a lawful route under the PDPL, and the DIFC and ADGM have adequacy and safeguard mechanisms. Our page on cross-border data transfers explains the options. For recovery, foreign judgments and awards can be enforced in the UAE, and UAE judgments abroad, but the route matters; see enforcing foreign judgments in the UAE.
TRW & Co's offices in Dhaka, Singapore, London and elsewhere allow coordinated evidence gathering and asset tracing across borders. Where representation before UAE onshore courts or the DIFC or ADGM Courts is required, we work alongside locally licensed advocates and registered practitioners.
Checklist: what to do in the first 72 hours
Use this list to test your readiness for an internal investigation UAE regulators or courts may later scrutinise.
- Record the allegation, its source and who knows; protect the reporter's identity.
- Convene an independent group to oversee the internal investigation UAE management cannot influence.
- Instruct external counsel and have counsel engage forensic and IT experts.
- Issue document holds and image company devices before notifying custodians.
- Map reporting duties to the Public Prosecution, the FIU and any financial regulator.
- Consider urgent attachment or freezing relief if assets may move.
- Agree the report format and distribution list before drafting begins.
- Plan remediation: controls, training, disciplinary and recovery steps.
If you need help structuring an internal investigation UAE-wide or across borders, contact TRW & Co by email at info@trw.co or on +971 58 942 1012. Related reading: anti-bribery and corruption law in the UAE.
Frequently asked questions
01Is an internal investigation report privileged in the UAE?
Not in the common-law sense onshore. UAE law protects confidentiality through the professional duties of licensed advocates and legal consultants, which limit what the lawyer can be required to disclose, but a report held by the company itself may be ordered produced or seized. The DIFC and ADGM courts recognise privilege more fully in their own proceedings. Engage external counsel early, have counsel instruct experts, limit distribution and agree the report format before drafting, especially if foreign proceedings may follow.
02Do we have to report a suspected fraud to the police?
Often, yes, or at least you must consider it promptly. The Crimes and Penalties Law contains general duties to report crimes and specific duties for people who learn of crimes through their work. Regulated firms also have suspicious transaction reporting duties to the Financial Intelligence Unit and notification duties to their regulator. Make the reporting assessment a formal workstream from day one and record the reasoning behind each decision.
03Can we search an employee's phone during a fraud investigation?
Company-issued devices can usually be collected and imaged under the employment contract and IT policies, provided processing is proportionate and documented. Personal devices and private accounts are different: accessing them without consent may breach the Cybercrimes Law and data protection law and can taint the evidence. Ask for voluntary production with written consent, rely on company systems, or seek a court order.
04Can we suspend an employee while we investigate?
Yes, suspension is a common protective step, but it must follow the Labour Law, the employment contract and internal disciplinary policies. Paid suspension pending investigation is usually lower risk than dismissal, which can look retaliatory, especially if the employee is also a whistleblower. Document the reasons and keep the suspension under review. DIFC and ADGM employers should check their own employment laws, which differ from the onshore regime.
05Should we use external lawyers or our internal audit team?
Internal audit or compliance suits small, contained matters involving junior staff. Where senior management, regulators, potential litigation or cross-border elements are involved, external counsel with forensic support is usually safer. It brings professional confidentiality, independence and experience structuring evidence for later use in courts or before regulators. A board committee should oversee matters touching executives or directors.
06How do we recover money lost to fraud in the UAE?
Recovery typically combines a criminal complaint with civil claims and urgent interim relief. Onshore courts can grant precautionary attachments, and the DIFC and ADGM courts can grant freezing orders. Where assets are abroad, foreign proceedings and enforcement routes come into play. Speed matters: apply for interim relief before the wrongdoer realises the investigation has started, and preserve the evidence the court will need to see.
Sources and official materials
- Federal Decree-Law No. 31 of 2021 (Crimes and Penalties Law) — Fraud, breach of trust, bribery and crime-reporting duties
- Federal Decree-Law No. (10) of 2025 on AML/CFT — Suspicious transaction reporting and tipping-off
- Federal Decree-Law No. 45 of 2021 on Personal Data Protection — Processing employee data during investigations
- Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes — Unauthorised access and privacy offences
- Federal Decree-Law No. 33 of 2021 on Employment Relations — Suspension, discipline and dismissal
- UAE Financial Intelligence Unit — goAML reporting
- Dubai Financial Services Authority — DIFC regulator notifications and enforcement
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
