For advice on how Safecall can help your organisation meet its DIFC whistleblowing obligations, call us on +44 (0) 191516 7720 or send us an email to [email protected].
Retour à la page d'aperçu de la législation
On 7 April 2022, the Dubai Financial Services Authority (DFSA) introduced a dedicated whistleblowing regime for all entities it regulates, operating in or from the Dubai International Financial Centre (DIFC).
This was the first regulatory whistleblowing framework of its kind to be introduced by a financial services regulator in the UAE, and it represents a significant step towards aligning the DIFC with international standards – particularly those established by the UK’s Financial Conduct Authority (FCA), on which the regime is closely modelled.
Contexte et objectif
Prior to April 2022, whistleblowing protections in the Dubai Financial Services Authority (DFSA) were fragmented across a number of different laws and regulations, with no single coherent framework in place. The DFSA consulted on its proposals in July 2021 before bringing the new regime into force the following April – with no grace period for compliance.
The regime was introduced against a broader backdrop of the UAE’s efforts to combat financial crime and improve its standing with the Financial Action Task Force (FATF). Strengthening whistleblower protections within its major financial centres is a key part of that strategy.
Scope: Who Does It Apply To?
The regime applies to all DFSA-regulated entities operating in or from the DIFC. This includes firms providing asset management, banking, securities, insurance, Islamic finance, crowdfunding, and other financial or ancillary services within the DIFC. The protections cover officers, employees, and agents of regulated entities.
What Constitutes a Qualifying Disclosure?
Protection is available to a whistleblower if two conditions are met. The report must be made in good faith – meaning honestly, and not for a malicious or dishonest purpose. It must also involve a reasonable suspicion that a regulated entity has breached a DFSA law or regulation, or has been involved in money laundering, fraud, or another financial crime. The DFSA defines the reasonable suspicion test as objective in nature, though it acknowledges that the threshold is relatively low.
Qualifying disclosures can be made to any of the following:
- internally within the regulated entity
- to the entity’s auditor
- to the DFSA directly
- to a relevant law enforcement agency
Importantly, whistleblowers may make reports anonymously. The regime explicitly allows for anonymous disclosures, and regulated entities must put in place measures to protect the identity of those who report.
Protections Offered to Whistleblowers
Under Article 68A of the DFSA Regulatory Law 2004, a person making a qualifying disclosure must not:
- be subject to any civil or contractual liability arising from that disclosure
- have any contractual, civil, or other remedy enforced against them by another person
- be dismissed from employment or subjected to any other action reasonably likely to cause them detriment
If a whistleblower suffers any of the above, they may apply to the DIFC Courts for relief. The Courts have broad discretion in granting remedies, which may include compensation for any losses suffered.
An Important Limitation
The DIFC whistleblowing regime does not protect a whistleblower from potential criminal liability for matters such as breach of corporate confidentiality, nor from claims such as defamation brought outside the DIFC in the local Dubai courts. This reflects the ongoing complexity of operating across both freezone and onshore UAE legal frameworks, and is a consideration for any organisation developing its whistleblowing programme in the DIFC.
Obligations on Regulated Entities
Regulated entities are required to put in place effective policies and procedures that:
- establish effective internal arrangements to allow for the disclosure of regulatory concerns
- include procedures to receive, assess, and where appropriate escalate whistleblower reports
- protect the identity of the whistleblower
- protect whistleblowers from any detriment resulting from their report
- maintain a register of all reports received, along with supporting documents, to enable the DFSA to inspect and assess matters reported
There is no grace period for compliance. Regulated entities were required to implement an appropriate whistleblowing programme from the date the regime came into force on 7 April 2022.
Relationship with Wider UAE Law
It is important to note that the UAE as a whole does not have a single, comprehensive federal whistleblowing law. The DIFC regime is specific to entities regulated by the DFSA operating within the freezone. Organisations with operations both inside and outside the DIFC must carefully consider how the regime interacts with onshore UAE law – including the confidentiality obligations imposed by the UAE Labour Law (Federal Decree Law No. 33 of 2021) and the UAE Penal Code (Federal Decree Law No. 31 of 2021).
The DIFC Regime in Context
The DIFC regime was the first of its kind in the UAE and paved the way for the Abu Dhabi Global Market (ADGM) to introduce its own, broader framework in 2024. While the two regimes share many features, the ADGM Whistleblower Protection Regulations 2024 are wider in scope – applying to all ADGM-registered entities rather than just those regulated by a financial services authority – and are supported by more comprehensive published guidance. The DIFC regime nonetheless remains a significant framework for the large financial sector community operating within Dubai’s international financial centre.
Conclusion
The DFSA’s whistleblowing regime marked a pivotal moment for corporate governance standards in the UAE. By introducing clear obligations on regulated entities and meaningful protections for those who speak up, the DIFC has established a framework that aligns closely with the approach taken by the UK’s FCA. For organisations operating in or from the DIFC, having a properly structured, independently managed whistleblowing channel is not merely best practice – it is a regulatory requirement.
Our Recommendation
For DFSA-regulated entities, the case for an independently operated whistleblowing service is clear. Internal reporting channels, while a useful starting point, can create real or perceived barriers to disclosure – particularly in financial services environments where seniority, professional relationships, and concerns about confidentiality all influence whether an individual feels safe enough to speak up. An externally managed service removes those barriers. It also provides the documented, auditable record of disclosures and subsequent actions that the DFSA expects regulated entities to maintain. Safecall’s whistleblowing solutions are used by organisations across multiple jurisdictions and are built around the same principles that underpin the DIFC regime – confidentiality, impartiality, and the protection of those who report.
How Safecall Can Help with DIFC Compliance
Safecall provides anonymous reporting channels – including dedicated telephone hotlines and secure online portals – that allow employees, officers, and agents of DFSA-regulated entities to raise concerns without fear of retaliation. Our call handlers have 25 or more years of interview experience each, and our service operates 24 hours a day, 7 days a week, 365 days a year, with access in over 150 countries and support in more than 175 languages and dialects.
We provide comprehensive case management and reporting tools that generate the auditable records regulated entities need, and our systems are fully GDPR compliant with all whistleblower data held securely in the UK. Partnering with Safecall helps your organisation meet its DIFC obligations while fostering the culture of transparency and accountability that the regime is designed to encourage.
Références
[1] DFSA, 7 April 2022 – DFSA Introduces Whistleblowing Regime: https://dfsaen.thomsonreuters.com/rulebook/7-april-2022-dfsa-introduces-whistleblowing-regime
[2] DIFC Regulatory Law 2004, Article 68A – Whistleblower Protection: https://dfsaen.thomsonreuters.com/rulebook/68a-whistleblower-protection
[3] DFSA Rulebook, GEN 5.4 – Whistleblowing: https://dfsaen.thomsonreuters.com/rulebook/gen-54-whistleblowing
[4] DFSA Whistleblowing Regime Explainer: https://www.dfsa.ae/your-resources/publications-reports/explainers/dfsas-whistleblowing-regime
[5] Herbert Smith Freehills Kramer, Updates to UAE Whistleblowing Protections (October 2025): https://www.hsfkramer.com/notes/middle-east/2025-posts/updates-to-uae-whistleblowing-protections
[6] National Law Review, New Whistleblowing Regime Introduced by The Dubai Financial Services Authority (April 2022): https://natlawreview.com/article/new-whistleblowing-regime-introduced-dubai-financial-services-authority
[7] Global Legal Post, Dubai’s New Whistleblowing Regime: What You Need to Know (May 2022): https://www.globallegalpost.com/news/dubais-new-whistleblowing-regime-what-you-need-to-know-907534576
Les résumés fournis sur ce site Web sont uniquement destinés à titre informatif et à titre indicatif. Demandez toujours l'avis d'un spécialiste juridique compétent avant de prendre des décisions fondées sur la législation relative à la dénonciation. Safecall peut vous recommander des spécialistes juridiques compétents si nécessaire. N'hésitez pas à demander plus de détails.