The UAE has strengthened anti-money laundering (AML) laws in recent years: the federal laws were overhauled as recently as 2018 and 2019, while the Dubai International Finance Centre (DIFC) updated its AML rules in April 2020 to reflect the federal-level changes.
In addition to strengthening laws, regulators have focused more on enforcement. In November 2020, an Abu Dhabi court fined nine individuals and nine firms for money laundering offences in relation to funds of over AED300m. The UAE Central Bank reported suspicious banking transactions involving two companies which led to the Abu Dhabi Public Prosecution investigating the money laundering trail. The court fined each individual AED5m and each firm AED50m. The convicted individuals were sentenced to imprisonment terms ranging from seven to 10 years. In addition, the convicted firms’ illegally obtained proceeds (including cash, tangible or intangible assets) were confiscated by court order. In 2018, the Dubai Financial Services Authority (DFSA) started reviewing applicable DIFC entities’ anti-money laundering and counterterrorism compliance programs.
In this blog, we look at the federal and DIFC AML regimes, and what entities operating in the DIFC and regulated by the DIFC’s financial services regulator (the Dubai Financial Services Authority (DFSA)) must do to comply. Even if a DIFC-registered entity is not regulated by the DFSA, it should not ignore money laundering risks in its business.
The DIFC’s AML framework
There are two separate but complementary AML regimes in the DIFC:
- the UAE’s federal AML and anti-terrorist financing laws; and
- the DIFC’s own AML rules as set out in the DFSA’s rulebook.
The DFSA oversees compliance with both these regimes in the DIFC.
The DIFC AML rules apply to any ‘relevant person’ in the DIFC. A ‘relevant person’ means:
- an ‘authorised person’, which can be either:
- an ‘authorised firm’, ie an entity that offers financial services; or
- an ‘authorised market institution’, ie an entity operating an exchange or clearing house, or an alternative trading system;
- a ‘designated non-financial business or profession’, such as a real estate developer or agency, law firm, accounting firm, audit firm, insolvency firm, precious metal/stones dealer, company service provider or single family office; or
- a ‘registered auditor’.
What offences are covered by the law?
The following activities are offences in the DIFC:
- money laundering – to intentionally and with knowledge that the relevant property is the proceeds of crime:
- convert or transfer the proceeds of crime with the purpose of concealing or disguising their illegal source, or conceal or disguise the source of the proceeds of crime;
- acquire, use or possess the proceeds of crime; or
- help the perpetrator of a money-laundering or predicate offence escape punishment;
- financing terrorism (using the proceeds of crime to fund terrorist activities or acts of terrorism themselves);
- financing illegal organisations (carrying out money laundering while being aware that the proceeds are owned by, or intended to finance, a terrorist or illegal organisation or person); and
- ‘tipping off’ persons under review in relation to suspicious transactions or persons being investigated by the relevant UAE authorities.
A person commits an aggravated money laundering offence if they:
- commit any money-laundering act as set out above, while aware that the proceeds are partially or wholly owned by a terrorist organisation/person or with the intention to finance a terrorist organisation/person, even without an intention to conceal or disguise the funds; and
- provide, collect, prepare or obtain (or facilitate obtaining) the proceeds of crime, directly or indirectly, while knowing that such proceeds will be used, in whole or in part, to commit a terrorist offence, or to intentionally commit such acts on behalf of a terrorist organisation/person while being aware of their true background or purpose.
Activities which occur outside the UAE can also be a concern for DIFC-registered entities. Such entities may be liable for extraterritorial activities if:
- any part of the money ‘laundering’ or ‘layering’ process involved the DIFC entity and occurred in or through the UAE (such as a money transaction);
- the “end point” of the money-laundering process or the benefit of a money-laundering transaction is realised or was intended to be realised in the UAE wholly or partially for benefit of the DIFC entity (or its officers or employees); or
- a perpetrator (the DIFC entity itself or its officers or employees) aids or assists a money-laundering crime that occurs entirely or partly in the UAE.
What obligations do DIFC companies have?
DIFC-registered entities must abide by the federal AML laws and, where applicable, DIFC AML rules. This means that DIFC-registered entities are required to ensure that they do not:
- knowingly engage in any money-laundering or terrorist-financing transactions;
- deal with anyone on the UAE anti-terrorist list; or
- knowingly tip off any person who is either under review or subject to any money-laundering investigation.
Under the federal and DIFC AML regimes, DIFC financial institutions and designated non-financial businesses or professions are required to:
- identify crime risks;
- have in place the necessary due diligence measures and procedures;
- refrain from opening or conducting financial/commercial transactions with anonymous/fictitious names; and
- develop internal policies and controls to manage identified risks and mitigate them.
Failure to do so may result in imprisonment (duration unspecified) or a fine between AED10,000 and AED100,000.
Financial institutions and designated non-financial businesses or professions must also:
- report suspicious money-laundering or terrorist-financing transactions to the Financial Intelligence Unit; and
- refrain from tipping off the reported person.
A failure to report suspicious activity to the Financial Intelligence Unit can result in imprisonment (duration unspecified) and/or a fine of between AED100,000 and AED1m.
Separately, under the UAE criminal code, all persons have a general duty to report crimes of which such persons have knowledge.
General sanctions for criminal breaches of AML laws
Persons found to have committed a criminal offence under the federal and DIFC AML laws may:
- be fined between AED100,000 and AED50m, depending on whether an aggravating factor applies or if the offence is carried out by an individual or corporate;
- be imprisoned for between six months and 10 years, or even receive a life sentence, depending on any aggravating factors; and
- have their business licence(s) suspended or removed.
Federal AML law also allows for the confiscation of assets, travel bans and, in the case of crimes committed by a foreigner, deportation/restriction of freedom.
Under the federal AML laws, directors and managers of companies can face criminal, civil and regulatory actions, while companies can face criminal fines, and civil and regulatory actions.
Takeaways
In recent years, the UAE and DIFC have enhanced the AML rules and the respective authorities have increased their investigation and enforcement activity around AML issues.
With further regulatory activity expected in the future, DIFC-registered entities should manage money-laundering risks by:
- familiarising themselves with, and understanding their obligations under, the AML rules;
- implementing due diligence procedures, policies and controls to identify and manage money-laundering and terrorist-financing risks;
- conducting periodic AML risk assessments and audits; and
- providing AML training at all appropriate levels in the organisation.
