April 14, 2022

New Whistleblowing Regime Introduced by the Dubai Financial Services Authority

You've Reached Your
Free Article Limit This Month
Subscribe now to get unlimited access to all OnPractice content. Your subscription is free.
Subscribe Now

Speed Read

  • On 7 April 2022, the Dubai Financial Services Authority (DFSA) introduced a new whistleblowing regime (the Regime).
  • The Regime has significant parallels with that enforced in the United Kingdom by the Financial Conduct Authority (FCA), although certain of the more advanced requirements incorporated into the FCA's regime are yet to be introduced by the DFSA.
  • The Regime aims to provide better legal protection for those who report concerns within the Dubai International Financial Centre (DIFC), improve whistleblowing culture in DFSA regulated entities, encourage greater reporting (both internally and to the DFSA itself) and promote an ethical culture within the DIFC by deterring wrongdoing. It builds upon the existing framework which governs those businesses in the DIFC which fall under the supervision of the DFSA.
  • DFSA regulated firms now need to implement an appropriate whistleblowing programme (no grace period for implementation is provided by the Regime).  In focusing on the design and implementation, relevant firms would do well to consider the best practice approaches already well established within many FCA regulated institutions in the UK.



On 7 April 2022, changes to DIFC Regulatory Law 2004 and the DFSA Rulebook came into force, to implement proposals concerning a whistleblowing regime that were consulted on by the DFSA in 2021. The Regime applies to all entities regulated by the DFSA (Regulated Entities), which must now introduce appropriate measures.

In an accompanying press release (the Release), the DFSA noted that the aims of the Regime are to:

"a) provide better legal protection for persons who report regulatory concerns; 

b) improve the Whistleblowing culture in DFSA Regulated Entities and increase transparency around how those Entities will handle regulatory concerns; 

c) encourage more disclosures of regulatory concerns; and 

d) deter wrongdoing, promote better compliance and an ethical culture, by increasing awareness that there is a higher likelihood that wrongdoing will be reported." 

Who Is a Whistleblower?

The Regime defines a whistleblower as any person who, in good faith, discloses a reasonable suspicion that a Regulated Entity (including its officers or employees) is, has or might have been:

  • in contravention of a provision of the law, rules or other any other legislation administered by the DFSA; or
  • engaged in money laundering, fraud, or any other financial crime.

Under the Regime, a report is made in good faith if it is made "honestly rather than for a dishonest or malicious purpose." This would naturally exclude from the definition an individual who submits a false report, intending that, for example, it would harm a colleague with whom they had a disagreement or against whom they were competing for a promotion.

What constitutes a reasonable suspicion is dependent on the particular circumstances. However, by way of guidance, the Release notes that "while "suspicion" is a relatively low threshold, the notion of reasonableness brings an objective test to the suspicion".  As such, a genuine and honestly held concern supported by some objective fact or evidence is likely to qualify as being reasonable, even if the suspicion is ultimately found not to be born out following investigation.

Importantly, it is for the person making the disclosure to establish that both of these tests are met to qualify for the protections offered.

Finally, for the protection of the Regime to apply, the report must be made within the Regulated Entity or externally to its auditor, the DFSA or a law enforcement agency.

What Protection Must a Whistleblower Be Given?

Where a whistleblower makes a qualifying disclosure, Article 68A(4) of the DFSA Rulebook provides that the individual (who, importantly, can remain anonymous) must not:

  • be subject to any civil or contractual liability for having made that disclosure;
  • have any contractual, civil or other remedy or right enforced against them by another person; or
  • be dismissed from their employment or be subject to any other action reasonably likely to cause detriment to them.

Should any of these events happen, the whistleblower may apply to the DIFC court for relief for any loss suffered. The DIFC court has broad discretion to make orders for relief in this regard.

One important caveat here is that the Regime does not protect a whistleblower from possible criminal liability for matters such as breach of corporate confidentiality, or from claims such as defamation, which might be brought outside of the DIFC in the local Dubai courts.

What Must Regulated Entities Do? 

The Regime requires that Regulated Entities must put in place "effective policies and procedures" that:

  • establish effective internal arrangements to allow for the disclosure of regulatory concerns, along with associated procedures to receive, assess and possibly escalate whistleblower reports within the Regulated Entity, the DFSA or any other relevant authority;
  • include reasonable measures to (i) protect the identity and confidentiality of the whistleblower; and (ii) protect them from suffering "detriment" because they raised a concern;
  • provide feedback to the whistleblower, where appropriate; and
  • include appropriate measures to deal with (i) any conflicts of interest; and (ii) to ensure the fair treatment of an individual (or individuals) accused of wrongdoing by the whistleblower.

Comparison With The FCA

The Regime largely mirrors the Senior Management Arrangements, Systems and Controls (SYSC) Rule 18 on whistleblowing, as set out in the UK FCA Handbook in respect of FCA authorised firms (Firms). It is worth noting two interesting ways in which SYSC goes beyond the Regime.

  • The FCA requires that Firms appoint a "whistleblowers' champion". This individual is responsible for overseeing and maintaining the integrity of a Firm's internal arrangements concerning whistleblowing and must be both sufficiently independent and senior within the firm to carry out this role effectively.
  • SYSC provides that Firms must include a term in any settlement agreements with employees which makes clear that nothing in such an agreement prevents a worker from making a protected disclosure (as defined by the UK Employment Rights Act 1996). In addition, Firms must not request that workers enter into warranties which require them to disclose to the firm that (a) they have made a protected disclosure; or (b) they know of no information which could form the basis of a protected disclosure.

The DFSA is due to conduct a review of the Regime in mid-2023 which may result in further measures being introduced, such as those described above. In the meantime, Regulated Entities who are seeking to implement best practice might consider adopting one, or both, of these approaches.

Brief Comment

Given the complexity of certain aspects of the Regime (e.g. whether a disclosure will qualify as being made in good faith and based upon a reasonable suspicion, whether the whistleblower might risk criminal or other proceedings, notwithstanding the protection offered by the Regime, etc), Regulated Entities might consider making free, independent legal advice available to their staff, as part of their whistleblowing policies.  Consideration should also be given to setting up dedicated hotlines, staffed by properly trained and sufficiently senior internal staff, who speak multiple languages, or utilising the services of an external provider (subject again to other relevant laws in Dubai and the DIFC).

For Regulated Entities with a nexus to the UK (and which are therefore likely to be within the reach of the UK Bribery Act 2010), a comprehensive whistleblowing programme is a key part of a control framework designed to ensure that an organisation has in place ‘adequate procedures' designed to prevent bribery.  The introduction of the Regime therefore offers a useful occasion on which such entities might review and refresh their broader anti-bribery control framework more generally.

The Chief Executive of the DFSA noted in a statement that: "[the DFSA] expect all Regulated Entities to be ready to discuss and demonstrate the application of their policies and procedures when engaging with the DFSA."  As with all compliance processes, proper documentation and record keeping, training to help new policies and procedures embed within an organisation and evidence of ongoing monitoring and review are key to satisfying a regulator of genuine and proactive compliance.

The Release notes that the procedures established by Regulated Entities should be "appropriate to the nature, scale and complexity of that Entity's business and must be reviewed periodically to ensure they are adequate, effective and up to date."  This is important, as it permits an approach proportionate to the size and complexity of the business.  As such, whilst well established international financial institutions will be expected to have comprehensive and sophisticated processes in place, smaller or more recently established companies could justifiably take a less comprehensive approach.

Along with the recent establishment of a specialist court in Dubai to hear cases relating to money laundering and financial crime, the introduction of the Regime is a further example of ongoing efforts to promote Dubai as a leading jurisdiction in which to do business, by encouraging sophisticated governance and compliance processes amongst businesses in Dubai, tackling financial crime and enhancing the integrity generally of the UAE's financial system.

ALM expressly disclaims any express or implied warranty regarding the OnPractice Content, including any implied warranty that the OnPractice Content is accurate, has been corrected or is otherwise free from errors.

More From McDermott Will & Emery

New York City's Wage Transparency Law to Take Effect November 1, 2022

By Christina S. Dumitrescu McDermott Will & Emery May 06 , 2022

On January 15, 2022, the New York City Council enacted Local Law 32 of 2022 (Wage Transparency Law or Law) to amend the New York City Human Rights Law (NYCHRL) to require that most employers include compensation data in their job advertisements. The Law was supposed to take effect on May 15, 2022, however, it faced criticism over a number of ambiguities, including undefined penalties. In response, on April 28, 2022, the New York City Council passed an amendment to the Wage Transparency Law. Among the biggest changes is that employers now have until November 1, 2022—more than six months—to ensure compliance with the Law’s requirements. If Mayor Eric Adams signs the Law, which he is expected to do, New York City will become the second jurisdiction in the country (the first being Colorado) to require employers to include minimum and maximum potential salary amounts for open positions in job postings.

NAIC Continues to Refine Multiyear Work Plan to Expand Scrutiny of Holding Company Act Filings

By Andrea T. Best McDermott Will & Emery May 05 , 2022

In our report published on April 26, 2022, we discussed the New York Department of Financial Services’ (NYDFS) Circular Letter No. 5 in which it reminded the industry that acquiring less than 10% of an insurer’s voting securities does not necessarily mean that the acquirer (1) is not a “controller” and (2) does not have to submit a Form A application to the insurer’s home state or domestic regulator seeking approval for the change of control. This topic is one of several related matters that various committees, task forces and working groups of the National Association of Insurance Commissioners (NAIC) are studying and will continue to study over a multiyear period (the Project).

European Union, United Kingdom Propose New Sanctions Against Russia, Including Ban on Certain Services

By Raminta Dereskeviciute McDermott Will & Emery May 04 , 2022

As Russia continues to escalate its military operations in Ukraine, the European Union (EU) and the United Kingdom (UK) unveiled details of new sanctions against Russia. This alert summarises the proposed restrictions.

More From Litigation

New CFPB Interpretive Rule Outlines Broad State CFPA Enforcement Authority

By Michael Gordon Ballard Spahr May 23 , 2022

The CFPB has issued a new interpretive rule regarding the authority of state attorneys general and state regulators (State Officials) to enforce the Consumer Financial Protection Act (CFPA).

Fifth Circuit Decision Could Undermine Constitutionality of HHS Civil Money Penalty Laws

By Robert P. Charrow Greenberg Traurig May 20 , 2022

On May 18, 2022, the U.S. Court of Appeals for the Fifth Circuit issued its decision in Jarkesy v. Securities and Exchange Comm’n, in which it examined the constitutionality of an agency civil money penalty enforcement proceeding.

CFPB Arbitration Study Would Not Support a New Regulation

By Alan S. Kaplinsky Ballard Spahr May 20 , 2022

Recently, Professor Jeff Sovern and I exchanged views on whether the CFPB could (or should) add arbitration rulemaking to its regulatory agenda. Professor Sovern has now suggested that the CFPB’s 2015 Study of consumer arbitration would support a new regulation. It would not.

Featured Stories