Personally Named in a UAE Financial-Crime Investigation? A Director and CFO Survival Guide

Named in a UAE financial-crime investigation as a director or CFO, your personal freedom, assets and professional licence are all at stake simultaneously. This guide maps the precise statutory exposure under the 2025 AML regime, capital-markets law, criminal procedure and bankruptcy framework — and the steps that determine outcomes.

The 2025 Legal Framework: What Has Actually Changed

The most consequential shift for executives is the replacement of Federal Law 20/2018 with Federal Decree-Law 10/2025 on Anti-Money Laundering, Combating the Financing of Terrorism and Financing of Illegal Organisations, which entered force on 14 October 2025. Its Executive Regulations follow under Cabinet Resolution 134/2025 (14 December 2025). Practitioners who rely on FDL 20/2018 case templates or compliance matrices are now citing repealed law — a critical error in any advisory context. The new statute is structurally different: it codifies personal manager liability explicitly, raises individual criminal fines, removes any statute of limitations for money-laundering offences, and adds tax evasion and proliferation financing as standalone predicate offences for the first time.

The criminal law seat is Federal Decree-Law 31/2021 (Penal Code), in force 2 January 2022, amended by FDL 36/2022. Procedure is governed by Federal Decree-Law 38/2022 (Criminal Procedure Law), in force 1 March 2023, amended by FDL 45/2023 — notably, FDL 35/2022 is the Evidence Law and governs a different domain. Capital-markets enforcement has migrated to Federal Decree-Law 32/2025, which reconstitutes the SCA as the Capital Markets Authority (CMA) from 1 January 2026, with substantive insider-dealing and market-manipulation offences codified in Federal Decree-Law 33/2025. Executives in listed entities or investment firms face a dual track: CMA administrative action and Public Prosecution referral simultaneously.

The Central Bank of the UAE operates under CBUAE Law No. 6/2025, which raises its maximum individual administrative fine to AED 1 billion — not a typographical error — and preserves the Central Bank's power to impose industry bans on natural persons including senior managers and beneficial owners. When a financial institution is the subject, its compliance officer, MLRO, CEO and board members face personal exposure in parallel with the entity. The combined statutory arsenal available to investigators in 2025 is materially broader and more punitive than anything applied before FATF grey-listing, and the 2026 mutual evaluation creates sustained enforcement pressure that will not diminish.

Beneficial ownership obligations under Cabinet Decision 109/2023 (25% threshold) mean that executives who are themselves beneficial owners, or who control entities that appear in transaction flows, carry a doubled exposure: failure to register is itself an administrative offence, and a false or incomplete beneficial-ownership register is now a live prosecution pathway in AML investigations. Directors of UAE mainland companies must assume that their UBO status has been screened before any investigation is opened.

Personal Criminal Liability Under FDL 10/2025: Directors, MLROs and CFOs

Federal Decree-Law 10/2025 establishes individual criminal liability for natural persons in two distinct modes. First, direct commission: any person who conducts, facilitates, acquires, conceals or converts proceeds knowing or having reasonable grounds to know they derive from a predicate offence commits money laundering. The standard is deliberately broad — 'reasonable grounds to know' means wilful blindness is not a defence. A CFO who approves treasury transactions through shell counterparties, or a director who signs off on real-estate acquisitions funded by opaque offshore loans, is within the scope of direct commission. Second, and most significant for non-executive directors and supervisory board members, the statute imposes personal manager liability: a senior manager is criminally liable if an AML offence is committed by a person under their supervision and the manager knew, or should have known, of the conduct and failed to take reasonable preventative steps. This is a strict supervisory standard, not a knowing-participation test.

Criminal penalties under FDL 10/2025 for natural persons include imprisonment of not less than one year (with enhanced minima for aggravated conduct), and fines that now reach AED 100 million for individuals — a fivefold increase over the FDL 20/2018 ceiling. Courts may impose both imprisonment and fine cumulatively. Crucially, there is no statute of limitations for money-laundering offences under the new law, meaning historical transactions cannot be insulated by the passage of time. For directors who served in prior years and have since left the UAE or changed roles, this is the most important structural change in the 2025 statute.

Tax evasion is now explicitly listed as a predicate offence. Under Federal Decree-Law 47/2022 (Corporate Tax Law) and Cabinet Decision 129/2025, a director who engineers artificial loss recognition, transfer-pricing manipulation or undisclosed related-party transactions may face not only a corporate-tax penalty of 15% on audit (versus 1–4% on voluntary disclosure) but also an AML predicate offence referral if the conduct involves concealment of proceeds. The convergence of tax and AML enforcement is now operational, not theoretical. Proliferation financing — financing the development or proliferation of weapons of mass destruction — is an equally new predicate, relevant to any executive in dual-use goods, maritime logistics or financial intermediation.

Under Cabinet Resolution 134/2025, the Executive Regulations impose specific obligations on Designated Non-Financial Businesses and Professions (DNFBPs) and their managers. Real-estate brokers, legal professionals holding client money, gold traders, trust service providers and virtual-asset service providers all fall within scope. A director of a DNFBP who fails to implement a risk-based AML programme, fails to file Suspicious Transaction Reports or fails to maintain records for at least five years faces personal administrative fines from the relevant supervisory authority, plus criminal referral for egregious failures. The VARA Rulebooks 2.0 (May 2025) and the Travel Rule threshold of AED 3,500 under Cabinet Resolution 134/2025 impose additional compliance obligations on virtual-asset firm directors, with VARA empowered to revoke licences and ban individuals from the sector.

Market Abuse, Insider Dealing and the New CMA Enforcement Regime

Federal Decree-Law 33/2025 codifies insider-dealing and market-manipulation offences in standalone provisions for the first time in UAE capital-markets history, replacing the patchwork of SCA decisions under the now-repealed Federal Law 4/2000. The CMA, established under Federal Decree-Law 32/2025 from 1 January 2026, inherits and expands the SCA's enforcement powers with materially higher penalty ceilings. Individual penalties for market-abuse offences reach AED 200 million — the highest in the GCC — and the CMA has explicit authority to seek criminal referral to the Public Prosecution for custodial sentences in parallel.

Directors and CFOs of listed companies face enhanced exposure under FDL 33/2025 on three fronts. Insider dealing arises where an individual in possession of material non-public information — including earnings data, M&A terms, regulatory decisions or significant contract awards — trades in securities, or tips others who trade. The information source is irrelevant: a CFO who learns of a material contract through their role and trades before announcement is liable regardless of whether they initiated the position. Market manipulation includes price-fixing through wash trades, spoofing, rumour dissemination and artificially maintaining share price — conduct that treasury teams and investor-relations officers have historically treated as grey-area is now expressly offence-specified. Misleading disclosure — material misstatement in prospectuses, periodic reports or ad hoc announcements — creates direct personal liability for the authorising director or CFO, not merely the issuer entity.

The intersection with AML is direct: proceeds derived from market-abuse offences are themselves the proceeds of a predicate offence under FDL 10/2025, meaning a director who profits from insider trading faces simultaneous AML exposure for any steps taken to handle, transfer or invest those profits. The CMA and Financial Intelligence Unit operate with information-sharing protocols; an investigation opened by one authority routinely triggers a screening by the other. Executives in dual-regulated firms — licensed by both CBUAE and CMA — face concurrent enforcement streams with no formal coordination mechanism that benefits the individual.

How UAE Investigations Unfold: Arrest, Asset Freezing and Travel Restrictions

Under Federal Decree-Law 38/2022 (Criminal Procedure Law), as amended by FDL 45/2023, the Public Prosecution has broad powers to order pre-trial detention, travel bans and asset freezes without a court hearing at the initial stage. Travel bans in financial-crime cases are typically applied within hours of a formal complaint or referral; the individual may not be informed until they attempt to exit the UAE. Directors who receive any informal signal — a call from a regulator, a bank account freeze, a request for documents — should treat this as a possible precursor to a formal investigation and seek legal advice immediately, before any voluntary engagement with authorities.

Asset freezing operates through two channels. Domestically, the Public Prosecution may freeze personal and corporate assets of any individual under investigation for AML offences without court order at the investigative stage, pending referral to trial. The quantum frozen routinely exceeds the alleged offence value to account for potential confiscation. Internationally, the DIFC Court Law 2/2025 and the ADGM precedent in A17 v B17 [2025] confirm that DIFC and ADGM courts will grant worldwide freezing orders in support of foreign proceedings without requiring that the respondent hold assets in the UAE or the financial free zones. This means UAE-based directors with assets overseas — property, investment portfolios, held through offshore structures — are exposed to freezing by foreign courts acting in coordination with UAE authorities, and vice versa.

The extradition and Mutual Legal Assistance framework under Federal Law 39/2006 as amended by FDL 38/2023 operationalises cross-border enforcement. The UAE has bilateral MLA treaties with over 40 jurisdictions and has materially expanded cooperation since FATF removal in February 2024. Evidence gathered in UAE proceedings — bank records, STR filings, regulatory reports — is transmitted to foreign authorities and vice versa. A director who relocates overseas after becoming aware of a UAE investigation should not assume physical absence provides protection; arrest on an Interpol Red Notice or extradition request is a realistic risk.

At the investigative stage, the right to silence is recognised but practically complex under UAE criminal procedure. The Public Prosecution may summon an individual for questioning as a witness — a status that can convert to suspect without prior notice during the interview. There is no formal caution-equivalent requirement before this conversion occurs. Attending a Public Prosecution interview without UAE-qualified criminal counsel is a material risk that practitioners uniformly advise against. Statements made during investigative interviews are admissible and form part of the prosecution file. For foreign executives unfamiliar with UAE procedure, the absence of the common-law distinction between police and prosecution functions is a source of serious procedural error.

Bankruptcy, Dishonoured Cheques and Corporate Tax: Converging Personal Exposures

Federal Decree-Law 51/2023 (Bankruptcy Law), in force from 1 May 2024, creates a dedicated Bankruptcy Court and codifies distinct offences of fraudulent bankruptcy and negligent bankruptcy. A director who, in the period leading to insolvency, withdraws company funds to personal accounts, preferentially repays connected creditors, destroys or falsifies accounting records, or conceals assets commits fraudulent bankruptcy — a criminal offence carrying imprisonment and personal liability for company debts. Negligent bankruptcy — failure to maintain adequate books, gross mismanagement contributing to insolvency — is a lower-threshold offence with civil consequences including disqualification. The Bankruptcy Court has investigative jurisdiction to examine director conduct retrospectively; liquidators are obligated to report identified misconduct to the Public Prosecution.

Critically, the Bankruptcy Law's definition of fraudulent conduct overlaps with the AML predicate list under FDL 10/2025. A director who conceals company assets on the eve of insolvency may simultaneously face a fraudulent bankruptcy charge and an AML charge for the concealment act. This double-exposure is not theoretical — enforcement practice in 2024 and 2025 shows Public Prosecution offices running parallel referrals from bankruptcy proceedings and AML investigations arising from the same factual matrix. Directors in financially distressed companies must obtain both insolvency and criminal counsel simultaneously, not sequentially.

On dishonoured cheques, Federal Decree-Law 50/2022 (Commercial Transactions Law), Article 635 bis, makes NSF cheques directly enforceable as executive instruments — equivalent to a judgment debt — without a full trial. The decriminalisation reform means that bounced cheques no longer automatically carry criminal exposure; however, criminal liability survives where the drawer issued the cheque in bad faith, knew the account lacked funds, acted fraudulently, or issued the cheque as part of a scheme. Directors who issue corporate cheques on accounts they know to be insolvent, or who instruct banks to block payment after delivery, remain criminally exposed. The practical significance: CFOs managing corporate liquidity crises must document their good-faith basis for each cheque issued.

Corporate-tax penalties under FDL 47/2022 and Cabinet Decision 129/2025 create personal exposure indirectly. While the corporate-tax regime imposes penalties on the taxable entity, a director who knowingly approves a false tax return, structures transactions to understate taxable income, or suppresses transfer-pricing documentation is personally exposed to the criminal provisions of the Penal Code (FDL 31/2021) and, where the conduct involves proceeds, to AML predicate liability under FDL 10/2025. The voluntary disclosure mechanism — penalties of 1–4% versus 15% on audit — is available only before an audit opens. Directors who identify tax errors should treat voluntary disclosure as a matter of urgency, not an option to defer.

Defences, Mitigation and Strategic Considerations

The primary defences available to a director or CFO facing personal liability under FDL 10/2025 are: absence of knowledge or reasonable grounds to know; reasonable reliance on professional advice; effective delegation with adequate oversight; and, where applicable, prior reporting through proper channels. None of these defences is self-executing — each requires contemporaneous documentation. A director who instructed legal or compliance counsel and received a written opinion that the transaction was compliant is in a materially better position than one who relied on verbal assurances. Board minutes, compliance sign-offs, risk-committee records and audit trails are the evidentiary foundation of any defence. Recreating these documents after an investigation opens is not only ineffective — it may constitute a separate offence of evidence tampering under FDL 31/2021.

For supervisory liability under FDL 10/2025 — where liability arises from failure to prevent a subordinate's offence — the defence requires proof of a functioning compliance framework: a documented risk-based AML programme, regular training records, escalation procedures actually followed, and evidence that the manager acted on red flags when they appeared. A nominal compliance policy that was never implemented provides no protection. Regulators and prosecutors assess whether the framework was operative, not whether it was formally adopted. The CBUAE's supervisory practice under Law No. 6/2025 includes thematic reviews of compliance culture, and findings feed directly into enforcement referrals.

Cooperation with investigators — providing documents, attending voluntarily, making early admissions on peripheral matters — is a recognised mitigating factor in UAE sentencing practice under FDL 38/2022. However, cooperation strategy must be managed carefully: early voluntary disclosure of conduct that investigators have not yet identified can expand the investigation's scope. Counsel should conduct an internal investigation before any engagement with authorities, so that cooperation is calibrated to known exposure rather than inadvertently creating new lines of inquiry. The decision to cooperate, at what stage and to what extent, is among the most consequential strategic choices in any UAE financial-crime matter.

Settlement mechanisms exist at both the administrative and prosecutorial level. CMA enforcement under FDL 32/2025 and FDL 33/2025 includes a formal settlement pathway with disgorgement and penalty. CBUAE administrative proceedings under Law No. 6/2025 may be resolved by consent order with a defined fine and remediation plan. At the Public Prosecution level, there is no formal plea-bargain mechanism equivalent to common-law systems, but prosecutors exercise discretion on charge framing and sentencing recommendations, and cooperation-based resolution is achievable in practice, particularly for regulatory rather than fraud-based conduct. Each pathway has different consequences for professional reputation, regulatory standing and international travel, and must be evaluated holistically.

The First 72 Hours: What Directors and CFOs Must Do

When a director or CFO learns they are named in or likely to be named in a UAE financial-crime investigation, the first 72 hours are disproportionately consequential. The immediate priority is to retain UAE-qualified criminal and regulatory counsel before making any statement, providing any document or taking any action in relation to the subject matter. This includes declining to respond to informal regulator inquiries or 'clarification requests' from compliance teams acting on behalf of the institution — these interactions are not protected and may be used adversarially. Privilege over communications with UAE-licensed legal counsel in criminal and regulatory matters is recognised under FDL 38/2022 and the relevant professional regulations; privilege over in-house counsel communications is narrower and should not be relied on for strategy discussions.

Simultaneously, the director should take steps to preserve personal documents within their own possession — emails, board papers, approval records, external counsel opinions — without altering, deleting or concealing any document related to the investigation subject matter. Destruction of documents after learning of an investigation is a criminal offence under FDL 31/2021. At the same time, no voluntary disclosure of documents to the institution, regulators or any third party should occur before counsel has reviewed and catalogued what exists. This is the window in which the evidentiary foundation of any future defence is either secured or lost.

Travel position must be assessed immediately. UAE travel bans are imposed without judicial hearing at the investigative stage and are not publicly notified; the first indication is typically at the departure gate. If there is any realistic possibility of a travel ban, counsel should seek urgent clarification through formal channels. Passport surrender is sometimes volunteered as a goodwill gesture in lieu of detention; this decision should only be made on legal advice with a clear understanding of the resulting procedural constraints. For dual-national directors, engagement with the relevant consulate is a separate step that counsel can advise on in the context of UAE's MLA obligations under FDL 38/2023.

Finally, directors should separately retain personal financial advisers to obtain a snapshot of their personal asset position — UAE and overseas — before any freeze order is applied. This enables an accurate accounting if a freezing application is contested. Under UAE procedure, challenging an asset freeze requires prompt action after it is imposed; delay is treated as acceptance. Personal assets held through offshore structures, family trusts or nominee arrangements that have not been registered in beneficial ownership registers under Cabinet Decision 109/2023 create additional legal risk and should be reviewed for compliance status as part of the immediate response, not deferred to the merits phase of any prosecution.

Practical checklist

• Retain UAE-qualified criminal counsel before responding to any regulatory contact or inquiry.
• Preserve all personal documents — emails, approvals, board minutes — without alteration or deletion.
• Do not make voluntary statements to the institution, regulators or prosecutors without counsel present.
• Assess travel-ban risk immediately; do not attempt departure without legal confirmation of status.
• Audit beneficial-ownership register compliance under Cabinet Decision 109/2023 for all held entities.
• Identify all voluntary-disclosure windows (tax, AML, regulatory) before audits or investigations open.
• Obtain a personal asset snapshot before any freeze order; prepare to contest freezing orders promptly.
• Commission an internal investigation before any cooperation engagement to calibrate disclosure scope.

Frequently asked questions

Related guides

• Off-Plan Property and Escrow Fraud in Dubai: Recovering Your Money
• Letter of Credit and Bank Guarantee Fraud: When Can You Injunct Payment in the UAE?
• Procurement, Tender Fraud and Kickbacks in the UAE: Corporate Exposure
• White-Collar & Financial Crime — full guide

Published 15 July 2026. General information only — not legal advice. Contact us for matter-specific advice.