What this guide covers
- The Legal Framework: Article 66 of the UAE Penal Code
- Sanctions: The AED 5 Million Fine Ceiling and Beyond
- Personal Liability of Managers, Directors, and Officers
- How Corporate Prosecutions Proceed: Procedure Under FDL 38/2022
- Sector-Specific Overlays: AML, Capital Markets, Crypto, and Tax
- Defences, Mitigation, and the Compliance Architecture Defence
- Cross-Border Dimensions: Freezing Orders, MLA, and Extradition
- Practical checklist
- What we'd typically advise
- Frequently asked questions
Under Article 66 of Federal Decree-Law 31/2021, a UAE company is not a mere bystander when its employees commit crimes in its name. The company itself can be prosecuted, fined up to AED 5 million, and its responsible managers can face imprisonment alongside it.
The Legal Framework: Article 66 of the UAE Penal Code
Corporate criminal liability in the UAE is primarily governed by Article 66 of Federal Decree-Law No. 31 of 2021 (the Penal Code, in force 2 January 2022, as amended by Federal Decree-Law No. 36 of 2022). Article 66 establishes a dual-track liability model: a legal person — meaning any company, establishment, or other incorporated entity with legal personality — may be held criminally liable for offences committed by its representatives, directors, or employees acting in its name or on its behalf, provided the offence was committed for the company's benefit. This is a significant departure from the older conception that only natural persons could bear criminal culpability under UAE law.
The mechanics of Article 66 are precise. The company's criminal liability is not independent of individual liability; it is derivative and concurrent. The prosecution must establish that: (i) a natural person committed the predicate offence; (ii) that person was acting as a representative, director, manager, or employee of the legal person; (iii) the act was done in the name of the legal person or for its benefit; and (iv) the offence is one that the law has specifically made applicable to legal persons. Not every Penal Code offence triggers corporate liability — the law must either explicitly extend liability to legal persons or the nature of the offence must admit of it. Courts have read this criterion broadly in practice, applying it across fraud, forgery, bribery, and commercial offences.
Critically, Article 66 does not require the company to have directed, authorised, or even known about the offending conduct. If a branch manager defrauds a client while purportedly acting for the company, the company itself can be charged. This creates a vicarious liability framework that places extraordinary importance on internal compliance architecture. The company's only meaningful defence lies in demonstrating that it had robust, genuinely operative controls in place and that the employee acted entirely outside any mandate — a high bar to clear in adversarial proceedings before the UAE Public Prosecution.
The amended text under Federal Decree-Law No. 36 of 2022 clarified procedural aspects of how legal persons are summoned and represented in criminal proceedings, addressing a practical gap in the original 2021 text. Under Federal Decree-Law No. 38 of 2022 (the Criminal Procedure Law, in force 1 March 2023, as amended by Federal Decree-Law No. 45 of 2023), a legal person is represented before the court and prosecution by its legal representative or a duly authorised attorney. Failure to appear or respond to summons does not halt proceedings; the case may proceed in the company's absence.
Sanctions: The AED 5 Million Fine Ceiling and Beyond
The primary sanction available against a convicted legal person under Article 66 of FDL 31/2021 is a fine. The Penal Code caps the corporate fine at AED 5,000,000 (five million dirhams). Where the law prescribes a fine for a natural person, the court imposes that fine on the legal person, subject to the AED 5 million ceiling. This ceiling applies to the general Penal Code; specialised regulatory statutes frequently displace it with far higher maxima, and practitioners must always check the lex specialis.
Beyond the fine, Article 66 authorises courts to impose ancillary measures against convicted legal persons. These include: dissolution of the legal person where it was established to facilitate the commission of crimes or where its continued existence poses a threat to public order or morals; closure of the establishment or branch, either permanently or for a specified period; prohibition from engaging in the relevant activity for a defined period; confiscation of the tools, proceeds, and assets used in or derived from the offence; and publication of the conviction judgment in the official gazette or in two local newspapers at the legal person's expense. Publication is routinely ordered in corporate fraud and bribery cases and carries severe reputational consequences disproportionate even to the fine itself.
The AED 5 million ceiling under the Penal Code is, in practice, frequently overshadowed by sector-specific liability regimes operating in parallel. Under Federal Decree-Law No. 10 of 2025 (the AML/CFT/CPF Law, in force 14 October 2025, which repealed FDL 20/2018), fines for legal persons convicted of money laundering offences can reach AED 100,000,000. Under Federal Decree-Law No. 33 of 2025 (market abuse and capital markets offences, effective 1 January 2026), corporate penalties for insider dealing and market manipulation reach AED 200,000,000. The Central Bank of the UAE Law No. 6 of 2025 empowers the CBUAE to impose administrative fines on licensed financial institutions of up to AED 1,000,000,000. Boards and GCs must assess exposure under all applicable instruments simultaneously — the Penal Code ceiling is the floor, not the ceiling, of corporate risk.
Confiscation orders deserve particular attention. UAE courts apply confiscation broadly under both Article 66 and the AML framework. Under FDL 10/2025, assets subject to confiscation include not only direct proceeds but any property into which proceeds have been converted or with which they have been intermingled, to the extent of the laundered value. This can reach balance-sheet assets far removed from the original offence.
Personal Liability of Managers, Directors, and Officers
Article 66 of FDL 31/2021 expressly preserves individual criminal liability alongside corporate liability. The conviction of the legal person does not discharge the natural persons who committed the act or who, by virtue of their position, are held responsible for it. In UAE criminal practice, the Public Prosecution routinely charges both the company and its responsible managers, directors, or officers in the same indictment. The individual faces the full penalty prescribed by the relevant offence — including imprisonment — while the company faces the fine and ancillary orders. There is no election between the two; both can and frequently do proceed together.
The concept of 'responsible manager' liability is particularly acute in the context of regulatory offences. Under FDL 10/2025 (AML), senior management and compliance officers can be personally liable where they knew of, or should have known of, the conduct and failed to act. The new law introduces explicit personal manager liability provisions that go further than the repealed FDL 20/2018, aligning with the FATF standards that contributed to UAE's grey-listing in 2022 and informed the reforms that secured its removal in February 2024. Under Federal Decree-Law No. 47 of 2022 (Corporate Tax), responsible officers of a taxpaying entity face personal penalties for deliberate evasion and for failures to maintain records or file correctly, with penalty rates under Cabinet Decision 129/2025 ranging from 1–4% for voluntary disclosure to 15% upon audit assessment — a differential that creates strong incentives for proactive self-reporting.
Directors and officers of financial institutions face additional exposure under the CBUAE Law No. 6 of 2025, which empowers the Central Bank to disqualify individuals from holding management positions in licensed entities and to impose personal fines in addition to institutional sanctions. Under FDL 33/2025, individuals convicted of insider dealing or market manipulation face personal fines up to AED 10 million and imprisonment of up to ten years, with disgorgement of profits ordered separately. The cumulation of corporate and personal sanctions in a single set of proceedings is the defining feature of UAE corporate criminal exposure.
A frequently underappreciated risk is the liability of nominee directors and individuals who hold directorships as a matter of form without active management. UAE courts assess actual knowledge and constructive knowledge; a director who signed board resolutions approving a transaction later found to be fraudulent will face difficulty establishing that they had no responsibility. The Cabinet Decision No. 109 of 2023 on beneficial ownership (25% test) adds a further dimension: ultimate beneficial owners recorded in the register may be examined as to their role in governance, even if they hold no formal title.
How Corporate Prosecutions Proceed: Procedure Under FDL 38/2022
The procedural architecture for corporate criminal prosecutions is set out in Federal Decree-Law No. 38 of 2022 (Criminal Procedure Law, in force 1 March 2023, as amended by FDL 45/2023). The Public Prosecution initiates proceedings through a complaint, referral from a regulatory authority, or of its own motion following investigation. A legal person is treated as a party to the proceedings and must be formally notified. Notification is effected at the company's registered address as recorded with the relevant licensing authority; this underscores the importance of maintaining accurate registered address information, as failure of service does not prevent the case from proceeding.
The legal person appears through its legal representative — typically the general manager, CEO, or a court-authorised attorney. Where the legal representative is also charged as an individual (which is common), the company must appoint a separate representative to avoid conflicts of interest. Failure to appoint a representative does not stay proceedings; the court may proceed to judgment in the company's absence. Once a judgment is rendered against the legal person, enforcement of the fine and ancillary orders proceeds against the company's assets. The Public Prosecution can apply for precautionary attachment of the company's assets at investigation stage under the CPL, and frequently does so in fraud and money-laundering cases to preserve the confiscation order.
Parallel regulatory and criminal proceedings are the norm in UAE practice, not the exception. A matter may simultaneously involve: a Public Prosecution investigation under the Penal Code; a Financial Intelligence Unit (FIU) referral under FDL 10/2025; a Central Bank supervisory action under CBUAE Law 6/2025; and civil claims by injured counterparties. There is no codified stay mechanism that automatically suspends one proceeding pending another. Practitioners must therefore actively manage the sequencing and coordinate disclosure strategy across all forums, bearing in mind that admissions made in regulatory correspondence can be deployed in criminal proceedings.
The statute of limitations for criminal offences under FDL 38/2022 generally ranges from one year (contraventions) to twenty years (felonies carrying life imprisonment). However, under FDL 10/2025, there is no statute of limitations for money laundering offences — a provision introduced in the 2025 reform that represents a material hardening of the AML enforcement environment. Companies and individuals involved in historic transactions cannot assume that the passage of time provides a defence.
Sector-Specific Overlays: AML, Capital Markets, Crypto, and Tax
Anti-Money Laundering: Federal Decree-Law No. 10 of 2025 and its Executive Regulations under Cabinet Resolution 134 of 2025 (in force 14 December 2025) represent the most significant recent expansion of corporate criminal exposure in the UAE. The law adds proliferation financing and tax evasion as predicate offences for money laundering, materially widening the predicate catalogue. Designated Non-Financial Businesses and Professions (DNFBPs) — including real estate brokers, lawyers, accountants, and corporate service providers — face the same customer due diligence, suspicious transaction reporting, and record-keeping obligations as financial institutions. Corporate fines reach AED 100 million. The law's personal manager liability provisions mean that a compliance failure at the operational level can translate directly into a board-level prosecution. Critically, Cabinet Resolution 134/2025 introduces a Travel Rule threshold of AED 3,500 for virtual asset transfers, integrating the crypto sector fully into the AML framework alongside VARA Rulebooks 2.0 (May 2025).
Capital Markets and Market Abuse: Federal Decree-Law No. 32 of 2025 replaces the Securities and Commodities Authority (SCA) with the Capital Markets Authority (CMA) from 1 January 2026, and Federal Decree-Law No. 33 of 2025 codifies insider dealing, market manipulation, and related offences with penalties for legal persons reaching AED 200 million. These provisions repeal the longstanding Federal Law No. 4 of 2000 framework. Companies listed on the ADX or DFM, and their advisers, should treat the transition period as a compliance audit trigger: the new law's definitions of inside information and market manipulation are broader and more precise than the repealed statute.
Virtual Assets: Companies operating in the virtual asset space face a layered regime. In Dubai, VARA Rulebooks 2.0 (May 2025) and the Issuance Rulebook (June 2025) impose licensing, conduct, and capital requirements. In the DIFC, the Digital Assets Law No. 2 of 2024 establishes that crypto assets constitute property, with direct implications for tracing, freezing, and confiscation in criminal proceedings. The Travel Rule under Cabinet Resolution 134/2025 applies at AED 3,500, meaning that virtually all commercial crypto transactions trigger KYC/KYB obligations whose breach can constitute a predicate offence under FDL 10/2025.
Bankruptcy-Related Offences: Federal Decree-Law No. 51 of 2023 (Bankruptcy Law, in force 1 May 2024) establishes a dedicated Bankruptcy Court and codifies criminal offences of fraudulent bankruptcy and negligent bankruptcy. Directors and officers who dissipate assets, falsify records, or prefer creditors in contemplation of insolvency face personal criminal liability. The new Bankruptcy Court has demonstrated active engagement with asset-recovery and officer-disqualification applications, making this a live risk for any company in financial difficulty.
Defences, Mitigation, and the Compliance Architecture Defence
The UAE Penal Code does not codify an explicit 'adequate procedures' defence of the kind found in section 7 of the UK Bribery Act 2010. However, Article 66 of FDL 31/2021 requires the prosecution to establish that the employee acted in the name of or for the benefit of the company. A company that can demonstrate that the offending employee acted in direct contravention of company policy, outside any actual or apparent authority, and against the company's interests, can contest the foundational elements of Article 66 liability. This is not a formal defence but a challenge to the prosecution's case on the merits.
In practice, the existence of a robust, documented, and genuinely operative compliance programme serves multiple strategic functions: it strengthens the factual argument that the employee acted outside mandate; it may persuade the Public Prosecution to exercise its discretion not to charge the corporate entity (focusing charges on individuals); and it is a significant mitigating factor at sentencing. UAE courts have discretion in setting fines within the statutory range, and the presence of compliance infrastructure is routinely cited in mitigation submissions. Post-offence remediation — the adoption of enhanced controls following discovery — carries additional weight.
Voluntary disclosure is particularly significant in the corporate tax context. Under Federal Decree-Law No. 47 of 2022 and Cabinet Decision 129/2025, a company that voluntarily discloses an error or underpayment before audit assessment faces a penalty of 1–4% of the unpaid tax, compared to 15% if the error is identified on audit. This differential creates a material financial incentive for proactive engagement with the Federal Tax Authority. Similar logic applies in the AML context: FDL 10/2025 and Cabinet Resolution 134/2025 contemplate cooperation credit in enforcement outcomes, consistent with UAE's post-grey-listing commitment to effective enforcement under FATF standards.
Privilege and legal professional privilege are matters of considerable practical importance in UAE criminal investigations. Correspondence with UAE-licensed lawyers attracts legal professional privilege under general principles, but the precise scope in digital communications and in the context of regulatory (as opposed to criminal) investigations remains a developing area of practice. Companies under investigation should channel all sensitive communications through counsel from the earliest possible stage, and should be cautious about the voluntary production of internal investigation reports, which can constitute admissions in subsequent criminal proceedings. Cross-border privilege considerations arise frequently given the international character of UAE-headquartered groups; advice from DIFC-based counsel and offshore counsel may be subject to different privilege treatment.
Cross-Border Dimensions: Freezing Orders, MLA, and Extradition
Corporate criminal liability in the UAE rarely sits within national borders alone. When a company is under investigation, or is itself the victim of corporate fraud, cross-border asset recovery and mutual legal assistance are central tools. Federal Law No. 39 of 2006, as amended by Federal Decree-Law No. 38 of 2023, governs extradition and mutual legal assistance. The UAE has bilateral extradition treaties with over forty states and is a party to the Arab League Extradition Agreement. Requests for MLA — including requests for financial records, account information, and witness testimony — are processed through the Ministry of Justice. Response times vary significantly; practitioners should not assume that an MLA request provides a reliable mechanism for urgent asset preservation.
For urgent cross-border freezing, the DIFC Court Law No. 2 of 2025 is a transformative development. It expressly empowers the DIFC Courts to grant worldwide freezing orders in support of foreign proceedings, without requiring the respondent to hold assets within the DIFC or the UAE. The ADGM decision in A17 v B17 [2025] confirms a parallel jurisdiction in the Abu Dhabi Global Market courts. Together, these developments make the UAE financial courts a credible platform for international asset-freezing strategy, particularly where respondents or their assets have any connection to the Gulf region. Companies that are victims of employee fraud with an international dimension should consider DIFC or ADGM proceedings as part of a parallel-track strategy alongside Public Prosecution complaint.
The beneficial ownership register under Cabinet Decision No. 109 of 2023 (25% threshold) is increasingly used by the Public Prosecution and by civil litigants seeking to identify and trace assets held through UAE structures. In a corporate criminal investigation, the prosecution will routinely obtain the beneficial ownership register as an early investigative step. Companies should ensure that their register is accurate and current; discrepancies between the register and actual ownership can themselves constitute administrative and, in egregious cases, criminal offences. The FATF mutual evaluation scheduled for 2026 is expected to scrutinise the effectiveness of beneficial ownership transparency measures, which will likely drive further enforcement in this area in the near term.
Practical checklist
- Audit whether all employee conduct policies explicitly state personal and corporate liability consequences under Article 66 FDL 31/2021.
- Confirm the company's AML programme complies with FDL 10/2025 and Cabinet Resolution 134/2025, including the AED 3,500 Travel Rule threshold.
- Verify beneficial ownership register accuracy under Cabinet Decision 109/2023 before any regulatory interaction.
- Identify all individuals who could be charged as 'responsible managers' and ensure each has independent legal counsel on retainer.
- Assess whether sector-specific fine ceilings (AED 100m AML, AED 200m capital markets, AED 1bn CBUAE) dwarf the Penal Code AED 5m cap for your business.
- Channel all communications with regulators and prosecution through UAE-licensed counsel to preserve privilege from the outset.
- Evaluate voluntary disclosure options under Corporate Tax (1–4% vs 15%) and AML cooperation credit before any audit or investigation commences.
- Map parallel proceedings risk: a single incident may trigger Penal Code, AML, regulatory, and civil claims simultaneously with no automatic stay.
What we'd typically advise
When a corporate criminal investigation commences — whether by way of a Public Prosecution summons, a Central Bank inspection, or a regulatory referral — the first forty-eight hours are disproportionately consequential. Our typical advice is to appoint separate UAE-licensed criminal counsel for the company and for each implicated individual immediately, before any voluntary engagement with investigators. Statements made informally to regulators have been deployed in criminal proceedings. Second, conduct a rapid internal review to identify what the Public Prosecution already has and what it is likely to obtain through mandatory disclosure or MLA. Third, assess whether voluntary disclosure, cooperation credit, or remediation measures are available and advisable under the applicable lex specialis — the differential between proactive disclosure and reactive defence is measured in penalties and, more critically, in custodial risk for individuals. The Article 66 framework means the company and its managers stand or fall together; strategy must account for both simultaneously.
Frequently asked questions
Can our company be prosecuted even if the board had no knowledge of what the employee did?
Yes. Under Article 66 of Federal Decree-Law No. 31 of 2021, the company's criminal liability does not require proof that the board directed or authorised the conduct. It is sufficient that the employee acted in the company's name or for its benefit. Ignorance at board level is not a defence, though it may be relevant to mitigation and to arguments that the employee acted outside any mandate. This makes proactive compliance architecture — and documented oversight — the primary protective mechanism.
What is the maximum fine a company can receive under the UAE Penal Code?
The general ceiling under Article 66 of FDL 31/2021 is AED 5,000,000. However, this is displaced by sector-specific statutes: AML offences under FDL 10/2025 carry fines to AED 100 million; market abuse under FDL 33/2025 reaches AED 200 million; and the CBUAE under Law No. 6 of 2025 can impose administrative fines to AED 1 billion on licensed institutions. In most regulated sectors, the Penal Code ceiling is not the operative maximum.
Can the company be dissolved as part of a criminal conviction?
Yes. Article 66 of FDL 31/2021 expressly authorises a court to order the dissolution of a legal person where it was established to facilitate crime or where its continuation threatens public order. Courts may also order closure of premises, prohibition from specific activities, confiscation of assets, and publication of the conviction. Dissolution is an available — not merely theoretical — sanction in serious cases.
If the company is convicted, does that automatically mean the directors are also convicted?
Not automatically — each individual's liability is assessed separately. However, Article 66 preserves concurrent personal liability, and the Public Prosecution routinely charges both the company and responsible managers in the same proceedings. A director is at greatest risk where they signed off on transactions, had supervisory responsibility for the offending employee, or where the prosecution can establish constructive knowledge. Individual managers face imprisonment; the company faces fines and ancillary sanctions.
Is there a statute of limitations on corporate criminal liability in the UAE?
Generally yes: Federal Decree-Law No. 38 of 2022 (Criminal Procedure Law) sets limitation periods ranging from one year for contraventions to twenty years for the most serious felonies. However, under Federal Decree-Law No. 10 of 2025 (AML/CFT/CPF), there is no statute of limitations for money laundering offences. Historic transactions that generate criminal proceeds remain actionable indefinitely, making this a live risk for companies in sectors with legacy compliance gaps.
What happens if the company is under investigation in both the UAE and a foreign jurisdiction simultaneously?
There is no automatic coordination mechanism. The UAE will process its own investigation and any incoming mutual legal assistance request under Federal Law No. 39 of 2006 as amended by FDL 38 of 2023, independently of foreign proceedings. Statements, documents, and admissions produced in one jurisdiction can be transmitted to the other. The DIFC Court Law No. 2 of 2025 and ADGM A17 v B17 [2025] mean worldwide freezing orders can now be obtained from UAE financial courts in support of foreign proceedings without a local-asset nexus. Companies must manage parallel disclosure strategy across all jurisdictions from day one.
Does having a compliance programme protect the company from prosecution under Article 66?
There is no formal 'adequate procedures' defence under UAE law equivalent to the UK Bribery Act. However, a demonstrably robust compliance programme serves three practical functions: it supports an argument that the employee acted outside mandate (challenging a foundational element of Article 66 liability); it may influence the Public Prosecution's charging discretion; and it is a significant mitigating factor at sentencing within the available fine range. Post-discovery remediation also carries mitigation weight. The programme must be genuine, documented, and actively operative — paper policies that are not implemented carry little weight before the UAE courts.
Our company received a cheque from a client that bounced. Do we have criminal exposure?
Under Federal Decree-Law No. 50 of 2022 (Commercial Transactions Law), a dishonoured cheque is now an executive instrument under Article 635 bis, directly enforceable without criminal proceedings. Criminal liability for the drawer arises only where bad faith is established — for example, where the account was deliberately closed or funds were deliberately withdrawn to prevent payment. As the payee, your company has no criminal exposure; you hold an executive title and may proceed directly to enforcement. The era of routine criminal cheque complaints as a debt-collection mechanism is over under the 2022 reform.
Related guides
Published 15 July 2026. General information only — not legal advice. Contact us for matter-specific advice.