TRW & Co · AML, sanctions and investigations
Whistleblowing in the UAE: Protections, Policies and Pitfalls
Whistleblower protection UAE law offers is spread across several regimes rather than one statute. Onshore employees rely on the Labour Law and AML reporting protections, while the DIFC and ADGM have dedicated whistleblowing rules. This guide explains who is protected, what employers must have in place, and how to handle a report without creating new liability.
Key pointThere is no federal private-sector whistleblowing law, but ADGM now requires every registered entity to have whistleblowing arrangements. A programme built to ADGM's standard will usually satisfy every other UAE regime.
At a glance
No single federal law
Onshore protection comes mainly from the Labour Law's arbitrary dismissal rule and the AML law's protection for good-faith suspicious transaction reporting.
DIFC regime since 2022
DFSA-regulated entities must keep effective whistleblowing procedures, and qualifying whistleblowers are protected from liability, dismissal and detriment.
ADGM covers everyone
ADGM's 2024 regulations apply to all registered entities, with written policies required for regulated firms, DNFBPs and larger establishments.
Anonymous reports allowed
Both financial free zone regimes protect anonymous disclosures, so channels should allow two-way anonymous follow-up rather than demanding identification.
Watch tipping off
A report about suspicious payments may trigger AML reporting duties, and confronting the subject early can breach the tipping-off prohibition.
Swipe or scroll →
The short answer: what whistleblower protection UAE law offers
Whistleblower protection UAE law provides is real but fragmented. There is no single federal whistleblowing statute covering the private sector. Instead, protection comes from four places: the federal Labour Law's rule against dismissal for a genuine complaint, the anti-money laundering law's shield for good-faith reporting, emirate-level public-sector schemes, and the dedicated regimes of the DIFC and ADGM financial free zones.
Which of those applies depends on where the employer is established and what is being reported. A compliance officer in an ADGM fund manager has detailed statutory protection and a regulator that expects written policies. A finance manager in a mainland trading company relies mainly on employment law and the criminal law's reporting rules.
For employers, the practical message is the same everywhere: a credible internal channel, confidentiality, a clear anti-retaliation rule and a disciplined triage process. As of October 2026, regulators in the DIFC, ADGM and onshore financial sector all expect to see those arrangements working, not just written down.
The legal framework for whistleblower protection UAE-wide
Onshore: the Labour Law
The Labour Law (Federal Decree-Law No. 33 of 2021) treats dismissal as unlawful where it is because an employee filed a serious complaint with the Ministry of Human Resources and Emiratisation, or brought a claim against the employer that proves valid. An employee dismissed in those circumstances can claim compensation, which the law caps at three months' wages.
That protection is narrow. It covers complaints to the Ministry and valid claims, not internal reports to a manager, a hotline or an external regulator. It also compensates rather than reinstates, so its deterrent value is limited for senior employees.
Criminal law and reporting duties
The Crimes and Penalties Law (Federal Decree-Law No. 31 of 2021) contains general duties to report crimes, and specific duties for people who learn of certain crimes through their work. It also contains an exemption from punishment for a briber or recipient who reports a bribery offence before it is discovered. These are reporting obligations and incentives, not employment protections, but they shape how internal whistleblowing reports must be handled.
AML law: protection for good-faith reporting
Federal Decree-Law No. 10 of 2025 on anti-money laundering, which took effect in October 2025, requires financial institutions, designated non-financial businesses and professions, and virtual asset service providers to file suspicious transaction reports with the Financial Intelligence Unit. Reporting entities and their staff who report in good faith are protected from liability for breaching confidentiality. The same law prohibits tipping off the subject, which affects how a company responds once an internal whistleblower raises a financial-crime concern.
Public-sector schemes
In Dubai, Financial Audit Authority Decision No. 2 of 2025 introduced job protection for whistleblowers in the public service. It covers employees of Dubai government entities under the Authority's supervision, including some free zone regulators and companies with a significant Dubai government shareholding, and it excludes federal government employees. Reports go through a confidential portal, and protection status follows validation of the report. Federal and other emirate bodies run their own confidential reporting channels for public-sector misconduct.
The DIFC and ADGM regimes
The two financial free zones offer the most developed whistleblower protection UAE employees can rely on. Both regimes are modelled loosely on UK practice, but they differ in scope.
DIFC: DFSA-regulated entities
Amendments to the DIFC Regulatory Law and the DFSA Rulebook in force since April 2022 created a statutory regime for entities regulated by the DFSA. A person who in good faith discloses a reasonable suspicion that a regulated entity, or its officers or employees, has breached DFSA-administered legislation or been involved in money laundering, fraud or other financial crime is protected.
The disclosure must be made internally, or to the entity's auditor, the DFSA or a law enforcement agency. A qualifying whistleblower, who may remain anonymous, must not be subjected to civil or contractual liability, must not have a contractual or other remedy enforced against them for the disclosure, and must not be dismissed or subjected to detriment. Regulated entities must keep effective policies and procedures for receiving, assessing and escalating concerns and for protecting the whistleblower's identity.
ADGM: every registered entity
ADGM went further. Its Whistleblower Protection Regulations 2024, published in July 2024 with guidance and parallel changes to the ADGM employment regulations, apply to all ADGM registered entities, not only regulated firms. Entities had to have arrangements in place by 31 May 2025.
FSRA-regulated firms, designated non-financial businesses and professions, DLT foundations and "large establishments" must also document their arrangements in written policies. ADGM issued supplementary guidance in July 2025. The Registrar can sanction failures, and whistleblowers can seek relief through the ADGM Courts. Our page on ADGM financial regulation explains the wider supervisory context.
| Regime | Who is covered | What reports qualify | Main protection | Employer duty |
|---|---|---|---|---|
| Onshore Labour Law | Private-sector employees onshore and in most free zones | Serious complaints to the Ministry; valid claims against the employer | Dismissal treated as arbitrary; compensation capped at three months' wages | No express duty to run a whistleblowing channel |
| AML law | Staff of financial institutions, DNFBPs and VASPs | Good-faith suspicious transaction reporting | No liability for breach of confidentiality | Internal escalation to the compliance officer; goAML reporting |
| Dubai public sector | Employees of entities under the Financial Audit Authority | Misconduct affecting public funds | Job protection once status is granted | Cooperate with the Authority's process |
| DIFC | Anyone reporting about a DFSA-regulated entity | Breaches of DFSA legislation, money laundering, fraud, financial crime | No civil or contractual liability; no dismissal or detriment | Effective policies and procedures |
| ADGM | Anyone reporting about an ADGM registered entity | Breaches of ADGM legislation, money laundering, fraud, financial crime | No civil or contractual liability; employment protection | Proportionate arrangements; written policies for specified entities |
Onshore regulated firms: what supervisors expect
Outside the financial free zones, whistleblower protection UAE regulators expect from licensed firms comes through governance rules rather than a dedicated statute.
Onshore banks, insurers and payment firms answer to the Central Bank of the UAE, and listed companies and capital markets firms to the Capital Market Authority, which replaced the Securities and Commodities Authority. Their governance rules expect boards to oversee arrangements that let staff raise concerns confidentially, and supervisors look at those arrangements during inspections. The Central Bank also runs its own confidential channel for reporting concerns.
The practical effect is that, even without a federal statute, a regulated onshore firm that cannot show a working speak-up process will struggle to explain its governance to a supervisor. That is particularly so after a fraud or AML failure that staff knew about but did not feel able to report. Our pages on corporate governance and AML compliance cover the board-level expectations.
How to build a whistleblowing programme that works
A programme that meets the strictest regime, ADGM, will usually satisfy the others. The steps below reflect what regulators and courts look for.
- Map the regimes that apply. List each entity in the group by location: onshore, ordinary free zone, DIFC or ADGM, and whether it is regulated. The answer decides whether written policies are mandatory and which external recipients must be named.
- Write a short, readable policy. Explain what can be reported, how, to whom, what protection applies and what happens next. Name the external routes required in the DIFC or ADGM, such as the regulator or Registrar.
- Offer more than one channel. Provide a route that bypasses line management, ideally including an independent hotline that accepts anonymous reports in Arabic and English, and a direct line to the audit committee for reports about senior management.
- Set a triage protocol. Decide in advance who assesses reports, how conflicts are managed, and how quickly a report is escalated where it may trigger an AML filing, a regulatory notification or a crime-reporting duty.
- Protect identity and data. Restrict access to case files, minimise personal data and apply the federal Personal Data Protection Law or the DIFC or ADGM data protection regime as relevant.
- Prohibit retaliation and monitor it. Make retaliation a disciplinary offence, and check the whistleblower's appraisals, bonus and role changes for a period after the report.
- Investigate and close properly. Run a proportionate workplace investigation, give feedback where appropriate, and keep records. ADGM requires records of disclosures and investigations to be retained for a set period after closure.
- Report to the board. Give the board or audit committee anonymised data on volume, themes, timeliness and outcomes, and test the channel periodically.
An employer's response to a whistleblower can itself create liability. Moving the reporter, cutting their bonus or starting a performance process soon after a report will look like retaliation in the DIFC or ADGM, and will support an arbitrary dismissal claim onshore. Document legitimate reasons separately and before acting, and take advice where timing is sensitive.
Illustrative scenario
This scenario is illustrative only. A regional group has a holding company in ADGM, an asset manager regulated by the DFSA in the DIFC, and a mainland Dubai distribution business. An accountant in the mainland business emails the group general counsel alleging that a sales director is paying "commissions" to a customer's procurement manager through an intermediary.
The allegation concerns a mainland company, so the DIFC and ADGM statutory protections do not apply directly to the accountant. But private-sector bribery is a crime under federal law, payments routed through the group's bank accounts may raise money laundering suspicions, and the group's ADGM policy, if drafted well, already promises confidentiality and non-retaliation to all group staff.
The general counsel restricts access to the report, preserves email and payment records before the sales director is aware, appoints external counsel to direct a privileged-as-possible review, and considers with the regulated entities whether any reporting obligation is triggered. The accountant's appraisal is ring-fenced from the sales director. Whatever the findings, the group can show a regulator or court a defensible process. Our guide to fraud and internal investigations covers the investigation steps in more detail.
Risks and common mistakes
Most failures we see are not about the absence of a policy but about how a live report is handled. The following mistakes undermine whistleblower protection UAE regimes are designed to give, and create avoidable exposure for the employer.
Assuming a policy written for London or New York works in the UAE
Group policies often cite UK or US statutes, promise protections UAE law does not give, or omit routes UAE regimes require. In ADGM and the DIFC, the policy must reflect the local definitions of a protected disclosure and name the right external recipients. Onshore, a policy that promises legal privilege or absolute confidentiality may be impossible to honour if prosecutors or courts demand documents. A local overlay, rather than a translated global policy, is usually needed. It should also be available in Arabic where the workforce needs it.
Treating anonymous reports as worthless
Both the DIFC and ADGM regimes allow anonymous disclosures, and many genuine reports in the region arrive that way because employees fear for their residence status as well as their job. Dismissing anonymous reports, or trying to unmask the reporter, undermines the programme and can breach confidentiality duties. The better approach is a channel that allows two-way anonymous communication so investigators can ask follow-up questions without learning the reporter's identity.
Missing a reporting or tipping-off obligation
A whistleblowing report about fraud, bribery or suspicious payments can trigger a suspicious transaction report, a regulatory notification or a crime-reporting duty. At the same time, the AML law prohibits tipping off. Confronting the subject early, or circulating the allegation widely, can breach that prohibition and destroy evidence. Build an escalation check into triage so the compliance officer and legal team see financial-crime reports on day one.
Confidentiality and defamation exposure
Onshore, publicising an allegation can expose the company and individuals to defamation and privacy claims, even where the allegation is true. Investigation reports should be circulated on a need-to-know basis, and findings communicated carefully. The whistleblower should also be told not to share the allegation outside the designated channels, because the protections in the DIFC and ADGM regimes attach to disclosures made through recognised routes.
Settlement agreements that silence the reporter
Exit agreements sometimes include confidentiality clauses broad enough to stop a former employee reporting to a regulator. In the DIFC and ADGM, a clause that purports to prevent a protected disclosure is likely to be unenforceable and will look bad to the regulator. Draft confidentiality and non-disparagement clauses with an express carve-out for reports to regulators and law enforcement.
Cross-border angle
Groups with UAE operations often have whistleblowing obligations elsewhere: under the UK's public interest disclosure regime, the EU Whistleblowing Directive, US securities law, or rules in Singapore, India or Saudi Arabia. A global hotline is efficient, but the data it collects about UAE employees is subject to UAE data protection rules, and transfers abroad need a lawful basis.
A report made in the UAE may also concern conduct elsewhere, for example a bribe paid in Bangladesh or a sanctions breach involving a third country. The investigation must then respect foreign law on evidence, employee rights and privilege. We coordinate these matters through TRW & Co's network in Dhaka, Singapore, London and other offices, alongside local counsel where needed. See also our page on white-collar crime and investigations.
Checklist: next steps for employers
- Map each group entity against the onshore, DIFC and ADGM regimes and confirm which need written policies.
- Update the policy to describe whistleblower protection UAE rules accurately, with the right external recipients.
- Provide at least one independent, anonymous, bilingual channel.
- Agree a triage protocol linking whistleblowing to AML, regulatory and criminal reporting decisions.
- Make retaliation a disciplinary offence and monitor the reporter's treatment.
- Review settlement and exit templates for carve-outs.
- Train managers, who receive most first reports, on what to do and what not to do.
- Report anonymised metrics to the board and test the channel periodically.
Whistleblower protection UAE arrangements are an area where good design is cheap and failure is expensive. To review or build your programme, or to handle a live report, contact TRW & Co at info@trw.co or +971 58 942 1012. Where representation before UAE onshore courts or the DIFC or ADGM Courts is required, we work alongside locally licensed advocates and registered practitioners.
Frequently asked questions
01Is there a whistleblower protection law in the UAE?
There is no single federal law protecting private-sector whistleblowers. Protection comes from several sources: the Labour Law treats dismissal for a serious complaint to the Ministry of Human Resources and Emiratisation as arbitrary, the AML law protects good-faith suspicious transaction reporting, Dubai has a public-sector scheme, and the DIFC and ADGM have dedicated statutory regimes. Which applies depends on where the employer is established and what is being reported, so the first step is always to map the relevant regime.
02Can I be dismissed for reporting my employer in the UAE?
Onshore, dismissal because you filed a serious complaint with the Ministry, or brought a claim that proves valid, is treated as arbitrary dismissal and gives a right to compensation capped at three months' wages. In the DIFC and ADGM, a person who makes a protected disclosure about a regulated or registered entity must not be dismissed or subjected to detriment. Protection depends on reporting in good faith through a recognised channel, so keep records of what you reported, when and to whom.
03Do DIFC companies need a whistleblowing policy?
DFSA-regulated entities in the DIFC must have effective policies and procedures for whistleblowing, including internal channels to receive, assess and escalate concerns, protection of the whistleblower's identity and protection against detriment. These obligations have applied since April 2022. Non-regulated DIFC companies are not subject to the DFSA regime, but many adopt a policy as good governance and because group or client requirements demand one.
04What do the ADGM whistleblowing regulations require?
ADGM's Whistleblower Protection Regulations 2024 require every ADGM registered entity to have appropriate and effective whistleblowing arrangements, proportionate to its business, by 31 May 2025. FSRA-regulated firms, DNFBPs, DLT foundations and large establishments must document those arrangements in written policies. Entities must inform staff of the protections and channels, protect confidentiality, prevent retaliation and keep records. The Registrar can impose sanctions for failures.
05Are anonymous whistleblowing reports protected in the UAE?
Yes, in the DIFC and ADGM regimes a qualifying disclosure can be made anonymously, although ADGM guidance notes that anonymity can make investigation harder. Onshore, there is no general rule either way, but many regulated firms and government bodies operate anonymous channels. Employers should accept anonymous reports and use systems that allow follow-up questions without revealing the reporter's identity.
06Do UAE whistleblowers receive financial rewards?
No. Neither the onshore framework nor the DIFC or ADGM regimes provide financial rewards for whistleblowers of the kind available under some US programmes. Protection in the UAE is about freedom from liability and retaliation, not payment. A UAE-based employee may, however, be eligible for rewards under foreign schemes if the conduct falls within their scope, which raises separate advice questions.
Sources and official materials
- Federal Decree-Law No. 33 of 2021 on Employment Relations — Arbitrary dismissal for complaints to the Ministry
- Federal Decree-Law No. 31 of 2021 (Crimes and Penalties Law) — Crime-reporting duties and bribery exemption
- Federal Decree-Law No. (10) of 2025 on AML/CFT — Suspicious transaction reporting and tipping off
- ADGM: Whistleblowing obligations — Whistleblower Protection Regulations 2024 and deadlines
- ADGM Supplementary Guidance on Whistleblowing — July 2025 guidance for ADGM entities
- Dubai Financial Services Authority — DIFC whistleblowing rules for regulated entities
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
