Updates to UAE whistleblowing protections, with a spotlight on developments in the ADGM

Whistleblowing protections aim to encourage individuals who have witnessed misconduct to report it, without the fear of retaliation. Such safeguards promote a culture of transparency and accountability which is essential to a progressive business environment.

Historically, the protections offered to whistleblowers in the UAE have been limited, with no single, comprehensive federal law safeguarding whistleblowers in place (as remains the case). However, the Dubai International Financial Centre (the "DIFC") and, more recently, the Abu Dhabi Global Market (the "ADGM") – the country's two financial freezones – have now developed their own whistleblower regimes.

Strengthening these protections is a crucial component of the UAE's broader efforts to combat financial crime and we anticipate that, when the Financial Action Task Force (the "FATF") conducts its mutual evaluation of the UAE in June 2026, it will likely recognise these recent developments as further evidence of the country's commitment to tackling financial crime.

Whistleblowing protections broadly refer to legal safeguards afforded to individuals – typically employees – who report misconduct such as fraud, conflicts of interest, money laundering, regulatory breaches, or other serious wrongdoing. These protections aim to ensure that disclosures made in good faith are treated confidentially, that the whistleblower’s identity remains anonymous, and that they are shielded from workplace retaliation, discrimination, or legal liability.

 

Onshore UAE

The UAE still lacks a comprehensive whistleblowing framework. In onshore UAE, challenges persist in balancing the confidentiality obligations that individuals are subject to under Federal Decree Law No. 33 of 2021 (the "UAE Labour Law") and Federal Decree Law No. 31 of 2021 (the "UAE Penal Code"), against the positive obligation to report criminal conduct under Article 323 of the UAE Penal Code. While individuals (and employees) should report criminal conduct, this obligation is also difficult to enforce and does not extend to unethical or non-criminal misconduct.

However, there are several sector-specific developments aimed at encouraging the reporting of misconduct:

1. Dubai Resolution No. (2) of 2025 Concerning Employment Protection of Public Sector Whistleblowers provides formal whistleblower protections for public sector employees working in entities under the Financial Audit Authority's jurisdiction;
2. the UAE Central Bank launched a whistleblowing policy enabling employees to report concerns anonymously via a secure online portal;
3. the UAE Ministry of Finance developed a platform called "Wajib", a mobile app-based platform that allows individuals to confidentially report financial or administrative misconduct within UAE government entities; and
4. under Article 47, the UAE Labour Law introduced quasi-whistleblower protections prohibiting the termination of an employee or legal action against them for filing a serious and truthful complaint with the Ministry of Human Resources and Emiratisation.

Unlike jurisdictions such as the United States and Saudi Arabia, where whistleblowers may be eligible for financial rewards or a share in recovered assets following successful enforcement actions, the UAE – including the DIFC and ADGM – does not currently offer such incentives. The focus of the UAE's whistleblower frameworks remains on protection from retaliation and safeguarding confidentiality, rather than monetary compensation for disclosures.

 

DIFC

The DIFC developed its own whistleblower regime in 2022 when the Dubai Financial Services Authority (the "DFSA"), the financial regulator of the DIFC, introduced dedicated whistleblowing amendments to the DIFC Regulatory Law 2004 and the DFSA Rulebook (the regulatory framework governing financial activities in the DIFC). The DIFC's regime is supported by a short guidance document published by the DFSA (the "DFSA Guidance"). The protections offered by the DIFC's regime largely mirror those introduced by the United Kingdom's Financial Conduct Authority (the "FCA"), although some of the more advanced protections introduced by the FCA were not included. We address the key features of the DIFC whistleblowing regime further below.

 

ADGM

In 2024, the ADGM introduced a comprehensive whistleblowing regime through the ADGM Whistleblower Protection Regulations 2024 (the "ADGM Regulations") and amendments to the Employment Regulations 2019. Although these Regulations were enacted in July 2024, the compliance deadline for ADGM entities was 31 May 2025. Following this deadline, supplementary guidance was issued in July 2025to assist entities with ongoing implementation and compliance requirements (the "ADGM Guidance"). However, the ADGM Guidance is purely indicative and does not bind the Financial Services Regulatory Authority and the ADGM Registrar (although the extent to which an ADGM entity complies with it will be taken into account during enforcement actions).

The framework provides robust protections for individuals making a 'Protected Disclosure' in good faith that is based on knowledge or reasonable suspicion of breaches of ADGM laws and regulations, or money laundering, fraud or other financial crimes. The ADGM Guidance stresses that the ADGM Regulations are not intended to protect disclosures outside the jurisdiction of the ADGM, and in those cases may have limited applicability as conflict of laws and jurisdictional issues may prevent the Courts from affording the relevant protection.

These are the key features of the ADGM Regulations:

Protected Disclosure

• Only disclosures which meet the requirement of a 'Protected Disclosure' will be offered the protections as set out in the ADGM Regulations. It must be (a) information related to knowledge or reasonable suspicion, (b) that a contravention of ADGM rules or regulations, or money laundering, fraud or any other financial crime occurred, (c) made in good faith, and (d) through an internal or external reporting channel.
• Protected Disclosures can be made anonymously; however, the ADGM Guidance cautions that doing so can present challenges, as it may hinder the effectiveness of any subsequent investigation. The ADGM Guidance also states that the ADGM Regulations will not protect deliberate false disclosures, and it may be appropriate to discipline staff making any such report.
• Although ADGM entities are encouraged to use a broad definition of the kinds of suspected misconduct that qualify, the ADGM Guidance specifies that whistleblowing is distinct from raising an employee grievance or a customer complaint. However, it emphasises that the ADGM Regulations are aimed at protecting disclosures in connection with financial crime and that general crimes should still be reported to the police.

Whistleblower Protection

• A person making a Protected Disclosure will be protected from retaliation such as (a) civil or contractual liability related to the Protected Disclosure; and (b) protection against termination or adverse employment actions by employers or affiliated parties.
• A whistleblower may seek relief through the ADGM Courts in the event of retaliation. Retaliation can include various forms of detriment or disadvantage such as withholding of promotion or even changes to hours of work.

Policies and Procedures

• As of 31 May 2025, ADGM entities must have implemented and maintained appropriate and effective arrangements to facilitate disclosures, assess and escalate concerns, protect confidentiality and prevent retaliation. These arrangements must be proportionate to the size and complexity of its business and operations – for instance, for SPVs, given that they do not have employees, it may be appropriate for the Board Secretary to merely provide a briefing on the ADGM Regulations to the Board.
• In some cases, these arrangements must be reflected in written policies – for instance, where the ADGM entity qualifies as a 'Large Establishment' (e.g., with a turnover or assets under control/administration of more than USD 13 million and has more than 35 employees) or is a Designated Non-Financial Business or Profession (e.g., real estate agents).
• Whilst ADGM entities have to meet the minimum requirements set out in the ADGM Regulations, they can provide broader protection through their own whistleblowing programs. ADGM entities should communicate to officers and employees, in a clear and easily comprehensible format, the protections and reporting channels available under the ADGM Regulations. The arrangements/policies should be regularly reviewed for appropriateness.
• Entities must also maintain written records of disclosures and investigations during and for a minimum of six years after the matter has closed.

Sanctions

• The ADGM Registrar has the power to impose sanctions on ADGM entities which have contravened the ADGM Regulations. These sanctions include a private or public censure, a financial penalty or even the suspension or withdrawal of the ADGM entity's commercial license.

Notably, the ADGM Guidance also stresses that a whistleblowing program can only be effective if ADGM entities have a culture which supports speaking up. ADGM entities are encouraged to communicate clearly "a tone from the top" and should consider training and communication initiatives, as well as easy access to policies, procedures and disclosure channels.

With the compliance deadline having only recently passed, it remains to be seen how effectively ADGM entities will comply with the Regulations and whether the Financial Services Regulatory Authority (the "FSRA") or Registrar, who will be carefully monitoring compliance with the new regime, will take a tough stance in dealing with non-compliance.

 

DIFC vs ADGM

While both the DIFC and ADGM whistleblower protection frameworks are broadly similar, the ADGM regime is broader in scope and supported by comprehensive guidance. We compare the two below.

Issue	DIFC	ADGM
Guidance	See DFSA Guidance here	See ADGM Guidance here
Scope of Application	DFSA-regulated entities	All ADGM-registered entities, with enhanced duties for certain sectors
Types of Misconduct Covered	Breaches of DFSA law/regulations, money laundering, fraud, financial crime	Breaches of ADGM law/regulations, money laundering, fraud, financial crime
Reporting Channels	Internal, auditor, DFSA, other UAE authorities	Internal, FSRA, Registrar, other UAE authorities
Good Faith	The DFSA Guidance defines this as a disclosure made honestly rather than for a dishonest or malicious purpose	The ADGM Guidance defines this as a disclosure made honestly, properly, and generally in the public interest instead of solely serving a personal interest
Reasonable Suspicion	The DFSA Guidance clarifies that an objective test must be applied to the suspicion	The ADGM Guidance clarifies that this does not require 'reasonable belief'; grounds to 'suspect' is sufficient
Anonymity	Permitted	Permitted
Legal Protections	Against dismissal, detriment, or liability	Against dismissal, detriment or liability
Entity Obligations	'Effective and appropriate' written policies; inform staff; maintain written records of disclosures	'Effective and appropriate' arrangements and for qualifying entities; written policies; inform staff; maintain written records of disclosures for at least 6 years following completion
Legal Recourse	Relief through DIFC Courts	Relief through ADGM Courts
Non-Compliance Consequences	Not explicitly stated in whistleblower protection laws or guidance; implied under the wider sanctions section of the DIFC Regulatory Law	Explicit mention in both regulations and guidance; censure, financial penalties, suspension/revocation of licence

Reflections

The developing regimes in the financial freezones signal the UAE's growing alignment with international standards, particularly the position in the UK where the FCA recently published its 2024/2025 annual report which underscored its commitment to protecting whistleblowing and highlighted the key role of whistleblower reports in shining light on wrongdoing in the financial sector. Although questions remain about how these frameworks will operate against broader UAE laws, such as confidentiality obligations in the UAE Penal Code, or defamation risks, they mark a meaningful step towards greater transparency, accountability and market integrity.