Blowing the Whistle: The DFSA’s Whistleblower Protection Reform – The First of Its Kind in the UAE

Whistleblowers play a crucial role in detecting and escalating issues of regulatory and financial misconduct. Yet individual whistleblowers endure risks of retaliation or even dismissal when they blow the whistle on corporate misconduct. For expatriates, dismissal can also mean the risk of being forced to leave the country and having their home and family lives uprooted. The risk therefore is that whistleblowers – a crucial source of misconduct reporting – are silenced.

In response, regulators around the world are focused on strengthening the legal protection offered to whistleblowers, increasing transparency and providing clear and unambiguous guidance on reporting procedures. The Dubai Financial Services Authority (DFSA) is demonstrating regulatory leadership in this area, and in 2022, the DFSA launched a first of its kind regulatory regime in the UAE for whistleblowing, applicable to all DFSA Regulated Entities operating in or from the Dubai International Financial Center (DIFC). The regime brings the DIFC position closer to the UK’s regulatory landscape, provides a more consistent approach to reporting and recording misconduct, and is a positive step in transforming business cultural attitudes towards whistleblowing in the region.

What has changed in the DIFC?

Until the implementation of the DIFC’s new whistleblowing regime, which took effect on 7 April 2022 (with no grace period for compliance), whistleblowing protections in the DIFC were fragmented across various DIFC laws and regulations. The term ‘whistleblower’ had no established definition and the protections offered to whistleblowers were limited, forging an environment where reports were not commonplace. The new regime aims to change this.

The new regime is centred on two key principles. First, it provides enhanced legal protection to whistleblowers who report suspected misconduct internally and externally to the DFSA. Second, it obliges Regulated Entities to implement appropriate internal policies and procedures to facilitate such reporting, fostering effective compliance. In this blog, we consider each of these principles, the scope of the regime, and how it compares to the UK regime, which it largely mirrors.

What are the key changes for whistleblowers?

Protection under the regime is made available to whistleblowers if the report is made in ‘good faith’ (that is, not for a detrimental or malicious purpose) and there is a ‘reasonable suspicion’ of a breach of a DFSA law or regulation or that money laundering, fraud or any other financial crime has been committed. The reasonableness test here has a relatively low threshold but requires the application of an objective test. The regime extends beyond the protection previously provided by allowing reports to be made anonymously and protecting whistleblowers making a qualifying report from any detrimental impact. Employees cannot be terminated for complying with their legal reporting obligations, and, under Regulatory Law DIFC Law No. 1 of 2004 (Regulatory Law), can approach a court for relief against loss of employment or other detriment for making a report. These are significant changes to enhance whistleblower protections and promote internal reporting, as employees have historically been reticent to blow the whistle, often fearing retaliation. Whistleblower protections are only provided if the report is made to the categories of persons listed in the Regulatory Law, which includes the DFSA. Protections will not be afforded if the report is made to, for example, the media.

However, whilst the new regime protects whistleblowers from any civil or contractual liability, it remains unclear how this regime will operate in conjunction with criminal remedies such as for breach of confidence or defamation, as disclosures may potentially give rise to criminal liability under the UAE Penal Code.

What are the key changes for Regulated Entities?

A DFSA Regulated Entity is now required to put in place ‘appropriate and effective policies’ to facilitate reporting of regulatory concerns. The DFSA has published detailed guidance that speaks to its expectations of an appropriate whistleblowing regime, and a high-level roadmap on safeguards to be built into any compliance program, including arrangements for reporting concerns, methods for escalating regulatory concerns both internally and externally, and measures to adequately protect the whistleblower and their identity. The safeguards must be appropriate to the nature, scale, and complexity of the business, providing sufficient flexibility. For some organisations, a dedicated email address or a telephone number may be appropriate for reporting conduct, however, this may not be practical for others.

Regulated Entities must take steps to create awareness among employees and officers of the protections available to them and are required to maintain a written record of each report made, including details of the concern and outcome of its assessment. This aims to change the culture and perception of whistleblowing from within and creates a sense of accountability, providing an avenue for the DFSA to revisit decisions made. 

How does the new regime compare?

The new regime largely mirrors the whistleblower rules enforced in the UK by the Financial Conduct Authority. However, certain advanced protections under the UK regime are yet to be introduced by the DFSA. The DFSA intends to conduct a review of the implementation of the regime among Regulated Entities in mid-2023 and further measures may be introduced. The DFSA will likely review compliance with the whistleblower requirements through its supervisory function.

The DFSA’s regime has spurred positive change across the UAE in line with a global drive towards corporate accountability. In December 2022, the Abu Dhabi Global Market (ADGM), which previously afforded no formal protections to whistleblowers, published guiding principles on whistleblowing, reflecting the ADGM's emphasis on transparency, accountability, and market integrity.

What should companies be thinking about now?

Opportunities for companies to reassess their compliance frameworks – review codes of conduct and align them with compliant speak up programs and a company’s other internal policies and, as applicable, international obligations – are all positive outcomes resulting from the new whistleblower protections.

Effective speak up programs can play an important role in helping companies deter and otherwise detect misconduct and, thereby, manage risks. It is equally important that speak up programs are tested to ensure that they are being used (and being used effectively) and that recipients of reports are independent and know how to handle reports.

Conclusion 

The new whistleblowing regime brings about significant and welcome change, especially in light of the UAE’s increased focus on anti-money laundering and anti-terrorist financing enforcement. The new regime of bolstered protections, with requirements of effective internal policies and procedures is expected to encourage employees to speak up about misconduct and thereby encourage a culture where wrongdoing is deterred.  

The authors would like to thank Shagun Jaggi for her invaluable contribution to this blog.