Whistleblower Policy (UAE)

A Whistleblower Policy (UAE) is a corporate governance document that establishes a confidential, protected mechanism for employees, directors, contractors, and other persons associated with a UAE company to report genuine concerns about suspected wrongdoing, without fear of retaliation. The policy defines what types of concerns qualify for reporting, how reports should be made, how they will be investigated, and how the reporter will be protected.

Whistleblower policies sit at the intersection of corporate governance, anti-corruption compliance, and employment law. In the United Arab Emirates, the legal framework relevant to whistleblowing includes the Anti-Money Laundering and Combating the Financing of Terrorism Law, Federal Decree-Law No. 20 of 2018, which provides specific protections for persons who in good faith report suspected money laundering or terrorist financing to the Financial Intelligence Unit; the UAE Penal Code, Federal Decree-Law No. 31 of 2021, which criminalises bribery, corruption, and fraud and requires those with knowledge of certain offences to cooperate with investigation; the UAE Labour Law, Federal Decree-Law No. 33 of 2021, which protects employees from unlawful dismissal and retaliatory treatment; and the Corporate Governance Code issued by the Securities and Commodities Authority, which requires listed companies to establish internal reporting channels for compliance concerns.

For companies regulated by the Central Bank of the UAE, the Securities and Commodities Authority, the Dubai Financial Services Authority, or the Abu Dhabi Global Market Financial Services Regulatory Authority, a functioning whistleblower mechanism is part of the required governance infrastructure. For unlisted and unregulated companies, it represents best practice governance that protects the company by enabling early identification of problems before they escalate to regulatory action or criminal liability.

Corporate integrity depends on the willingness of individuals to speak up. Research consistently shows that organisations with effective internal reporting channels identify fraud, corruption, and compliance violations earlier, limit losses, and recover faster from governance failures than those that rely solely on external oversight. The forms-legal.com Whistleblower Policy (UAE) template provides a complete, well-structured policy designed for UAE limited liability companies and other entities, available in PDF and Word formats.

A Whistleblower Policy is needed in the United Arab Emirates in multiple contexts.

Listed companies on the Abu Dhabi Securities Exchange and Dubai Financial Market are subject to the Securities and Commodities Authority's corporate governance code, which requires the audit committee to oversee a mechanism for employees to raise concerns about governance, financial reporting, and compliance, free from retaliation. A written whistleblower policy formalises this mechanism.

Financial institutions regulated by the Central Bank of the UAE — including banks, exchange houses, finance companies, and insurance companies — are required to have internal reporting mechanisms for AML and compliance concerns under the Central Bank's governance regulations. These institutions must demonstrate to Central Bank supervisors that their internal controls include a functioning whistleblower channel.

Designated Non-Financial Businesses and Professions regulated under the Anti-Money Laundering Law, Federal Decree-Law No. 20 of 2018, must have internal reporting procedures for suspicious activity reports, which are functionally similar to a whistleblower mechanism. The Ministry of Economy's AML supervision programme reviews the adequacy of these procedures.

Companies operating in the Dubai International Financial Centre are subject to the DIFC Employment Law, which provides specific whistleblower protections, and the DFSA's governance expectations, which include internal reporting mechanisms. Companies in the Abu Dhabi Global Market face similar requirements under the ADGM Employment Regulations.

Even for companies not in regulated sectors, a whistleblower policy is appropriate whenever a company has employees at multiple levels who may observe misconduct that a manager or director might not. Any company that has adopted an anti-bribery policy or a conflict of interest policy should also have a whistleblower policy as the reporting mechanism that makes those other policies effective in practice.

A UAE Whistleblower Policy must contain specific key elements to be effective and meet governance expectations.

Scope of coverage: A clear statement of who may use the policy — employees, directors, contractors, and other persons associated with the company. Extending coverage to contractors and agents is good practice because they may observe misconduct in the course of their work for the company.

Definition of qualifying concerns: A specific and complete list of the types of wrongdoing that qualify for reporting under the policy — bribery, fraud, financial misreporting, health and safety violations, regulatory breaches, and material policy violations. The policy should also clarify that personal employment grievances are handled through the grievance procedure, not the whistleblower policy.

Reporting channels: At least one accessible, confidential reporting channel — typically a dedicated email address or confidential hotline — and an alternative channel for reports concerning senior management. For larger organisations, an anonymous reporting option increases the volume and quality of reports received.

Acknowledgement and investigation: A commitment to acknowledge receipt of reports within a specified timeframe, to investigate qualifying concerns impartially, and to take appropriate action based on the findings. The process for notifying the subject of the concern and for communicating the outcome to the reporter should be described.

Non-retaliation protection: An explicit, enforceable guarantee that reporters who raise concerns in good faith will not suffer retaliation in any form. This is the most critical element — without credible protection, employees will not use the policy.

Confidentiality: A commitment to protect the identity of the reporter to the greatest extent practicable, with an explanation of the limited circumstances in which disclosure may be necessary.

False reports: A clear statement that the policy protects good-faith reporters, but that knowingly false reports constitute misconduct. The forms-legal.com Whistleblower Policy (UAE) template addresses all these elements in a structure suitable for UAE companies.

Completing the Whistleblower Policy for a UAE company begins with entering the company's full registered name, the emirate or jurisdiction of registration, and the policy effective date. These details appear in the policy header and should match the company's trade licence details.

Enter the primary reporting channel — the specific email address, hotline number, or other confidential mechanism that employees will use to report concerns. The channel should be easy to access and accessible outside the company's normal reporting lines. Consider a dedicated email address such as whistleblower@[company].ae, or a hotline managed by an independent third party for larger organisations.

Enter the alternative reporting channel — used when the concern relates to the conduct of the person who would normally receive reports, such as the general manager or compliance officer. The alternative channel should be genuinely independent — typically the chairperson of the board or an audit committee member.

Indicate whether anonymous reporting is permitted. Allowing anonymous reports encourages more disclosures, particularly in organisations where employees are concerned about identification. If anonymous reporting is permitted, the policy should acknowledge that investigations of anonymous reports may be limited.

Enter the name and title of the investigations officer — the person responsible for receiving, logging, investigating, and managing whistleblower reports. For smaller companies, this is typically the general manager or the most senior compliance-responsible person. For regulated companies, this may be the audit committee or an independent compliance officer.

Select the acknowledgement timeframe — the period within which the company will acknowledge receipt of a report. Five working days is a standard commitment that is responsive without creating unworkable obligations. Select the review period — annually is recommended. Enter who approved the policy and arrange for signature by the general manager and a director.

Legal requirements relevant to a UAE Whistleblower Policy arise from several sources.

The Anti-Money Laundering and Combating the Financing of Terrorism Law, Federal Decree-Law No. 20 of 2018, is the most directly relevant statute. It provides that any person who in good faith and without ill-intent reports a suspicion of money laundering or terrorist financing to the Financial Intelligence Unit — or who provides information, evidence, or documents in connection with such an investigation — shall not be held liable under any UAE law for that report or disclosure, even if the suspicion subsequently proves unfounded. This protection is codified in Article 19 of Federal Decree-Law No. 20 of 2018. For companies subject to AML obligations, creating a documented internal reporting channel is part of the required compliance programme.

UAE Labour Law, Federal Decree-Law No. 33 of 2021, protects employees from arbitrary dismissal. An employee dismissed in retaliation for making a good-faith complaint about illegal conduct — particularly a complaint that led to an investigation — would have a strong claim for unlawful termination under Article 47 of the Labour Law, which specifies the grounds for dismissal without notice, and Article 49, which addresses arbitrary dismissal. The Ministry of Human Resources and Emiratisation (MOHRE) is the primary forum for employment disputes.

The Commercial Companies Law, Federal Decree-Law No. 32 of 2021, imposes duties on directors, managers, and officers to act in the interests of the company. A whistleblower policy supports the exercise of those duties by providing a channel through which violations are identified and addressed before they cause harm to the company.

For companies in the DIFC, the DIFC Employment Law provides specific protections for employees who make a protected disclosure — defined as a good-faith report of a legal violation or a danger to health or safety — and prohibits detriment as a result. These protections are more explicit and detailed than those available under federal UAE law.

Common mistakes in a UAE Whistleblower Policy begin with failing to provide a genuinely confidential and accessible reporting channel. A reporting channel that routes to the person whose conduct is being questioned — or that requires employees to report to their direct line manager — defeats the purpose of the policy. The primary channel must be separate from the normal management structure, and an alternative channel must exist for reports about senior management.

A policy that lacks a genuine, enforced non-retaliation guarantee is the most damaging shortcoming. If employees observe that colleagues who raised concerns were subsequently disadvantaged — demoted, excluded, or dismissed — the policy becomes meaningless and the company loses the early-warning benefit that whistleblowing provides. The non-retaliation commitment must be genuine, communicated, and enforced through actual disciplinary action against those who retaliate.

Failing to distinguish between qualifying concerns and personal grievances is a structural flaw. Treating a disagreement about a performance rating or a personal conflict with a colleague as a whistleblower matter wastes investigative resources and dilutes the seriousness associated with the policy. The policy must clearly define qualifying concerns — serious regulatory, criminal, and compliance violations — and direct personal grievances to the separate grievance procedure.

Inadequate investigation procedures undermine the policy's effectiveness. A report that is not investigated promptly and impartially, or where the outcome is never communicated to the reporter, discourages future reporting. The policy must set out a clear, practical investigation process with defined timeframes.

Failing to communicate the policy's existence to all covered persons is a governance failure. A policy that sits in a document repository but is never read provides no protection and no deterrence. Annual communication, training, and a signed acknowledgement from all covered persons ensure that everyone knows the channel exists and how to use it.