Family-Office Fraud: Asset Tracing When the Threat Is Inside the Structure

When the threat to a family office originates inside the structure — a trusted manager, a co-trustee, a nominee director — speed, legal precision and jurisdictional coordination determine whether assets are recovered or permanently lost. This guide addresses the full UAE legal toolkit.

Anatomy of Family-Office Insider Fraud in the UAE

Family offices operating in the UAE span multiple legal regimes simultaneously: an onshore holding company under the UAE Companies Law, a DIFC trust or foundation, an ADGM limited partnership, and offshore subsidiaries in the BVI or Cayman Islands. This layered architecture, designed for succession and tax efficiency, also creates multiple attack surfaces. The most damaging frauds are perpetrated by insiders with legitimate access — the family office CEO who authorises wire transfers, the investment manager who routes co-investments through personal vehicles, the trustee who exercises discretionary distributions in breach of the trust deed, or the nominee director who encumbers assets without board authority.

Under Federal Decree-Law 31/2021 (the UAE Penal Code, in force 2 January 2022, amended by FDL 36/2022), the core criminal exposure for such conduct falls across several provisions: Article 399 (breach of trust — khiyanat al-amana), which criminalises misappropriation of movable property entrusted to the accused by reason of agency, employment or fiduciary appointment; Article 451 (forgery of commercial documents); and Articles 400-402 (fraud and deceptive acts). Critically, Article 399 does not require proof of an external deception — the betrayal of a pre-existing trust relationship is itself the actus reus. This makes it the natural charge against a rogue family office manager who causes the office to transfer assets to his own account or to a related party under the guise of authorised investment activity.

On the civil side, the DIFC Courts apply the DIFC Trust Law (DIFC Law No. 4 of 2018) and the DIFC Contract Law, both of which impose fiduciary duties on trustees and investment managers respectively. A trustee who makes unauthorised distributions or self-deals commits a breach of express trust and is liable to restore the trust fund with compound interest. ADGM applies English common law directly by virtue of the ADGM Application of English Law Regulations 2015, meaning the full body of English fiduciary law — including the rule in Keech v Sandford and the no-profit rule — applies without modification. For onshore entities, Federal Decree-Law 32/2021 (Companies Law) Articles 84-86 impose fiduciary duties on directors of LLCs and joint-stock companies, and Article 165 creates personal liability for managers who cause loss through abuse of authority.

In practice, insider frauds at UAE family offices frequently combine multiple offences: the trust relationship is exploited (Article 399 Penal Code), forged board resolutions or powers of attorney are used to effect transfers (Article 451), and the proceeds are layered through crypto wallets or offshore accounts — triggering the money-laundering provisions of Federal Decree-Law 10/2025 (the AML/CFT/CPF Law, in force 14 October 2025), which adds tax evasion and proliferation financing as predicate offences and removes any statute of limitations for money-laundering prosecutions entirely.

The First 72 Hours: Freezing Assets Before They Disappear

The most critical window in any insider-fraud case is the period between discovery and the moment the fraudster or their associates are alerted. Any application for emergency relief must be filed before the respondent has opportunity to dissipate assets across borders. In the UAE, three distinct judicial systems offer freezing mechanisms with materially different reach and speed.

DIFC Courts offer the most powerful immediate tool. Under DIFC Court Law No. 2/2025 and the DIFC Courts Rules (Part 25), the DIFC Court of First Instance can grant a worldwide freezing order (WFO) on a without-notice basis within hours of filing. Crucially, following the authority established in A17 v B17 [2025] DIFC, a WFO in support of foreign proceedings is available even where the respondent holds no assets within the DIFC — the absence of a local-asset nexus is no longer a jurisdictional bar. This is transformative for family offices whose assets are held in BVI, Cayman or Luxembourg structures but whose managers operate from Dubai. The application must demonstrate: (i) a good arguable case on the merits; (ii) a real risk of dissipation; and (iii) that it is just and convenient to grant the order. Evidence of recent unexplained transfers, one-way airline bookings, or sudden resignation by the suspected insider will typically satisfy the dissipation risk limb.

For onshore assets, the UAE Courts of Execution (Mahkama al-Tanfidh) can issue precautionary attachment orders (Hajz Tahtiyati) under Federal Decree-Law 42/2022 (Civil Procedure Law) Articles 252-262. These freeze bank accounts, real estate registered with the land department, and shares in onshore LLCs. The applicant must provide a security deposit (typically 25-30% of the claimed amount) and demonstrate the urgency of the situation. Speed here is slower than DIFC — first-instance attachment orders typically take 2-5 business days — but the mechanism reaches assets that DIFC orders cannot directly enforce against without a recognition step. ADGM Courts similarly have jurisdiction to grant precautionary orders under the ADGM Court Procedure Rules 2016 (Rule 91 et seq.), and their recognition of DIFC judgments via the 2018 Memorandum of Guidance provides a fast-track enforcement path.

Simultaneously with court applications, a criminal complaint (Balaagh) should be filed with the Public Prosecution under Federal Decree-Law 38/2022 (Criminal Procedure Law, in force 1 March 2023, amended by FDL 45/2023). Under Articles 61-65 of that Law, the Public Prosecution has authority to issue asset-freezing orders as part of the investigation, including freezing orders over bank accounts and real property, without requiring a civil court application. This parallel track creates prosecutorial pressure that civil proceedings alone cannot replicate — it also generates investigative powers (search warrants, witness summonses, bank-record seizure) that are unavailable in civil litigation. For a family office holding assets across both DIFC and onshore structures, running civil and criminal tracks simultaneously is almost always the correct approach.

Asset Tracing: Following the Money Through UAE and Offshore Structures

Effective asset tracing in a UAE family-office fraud requires the systematic dismantling of the structures through which proceeds have been moved. Insiders typically layer funds through two or three transfer steps: funds leave the family office account to a seemingly legitimate recipient (an investment vehicle, a law firm client account, a management fee payee), are then moved to a personal account or company controlled by the fraudster, and finally converted into hard assets — real property, crypto, gold, or transferred offshore. Each layer requires a different legal instrument to pierce.

UAE bank records can be obtained through two routes. In civil proceedings in the DIFC or ADGM Courts, a Norwich Pharmacal order (or its DIFC equivalent) compels a bank to disclose account information and transaction records relating to a respondent, even if the bank is not itself a wrongdoer. In onshore proceedings or via the criminal track, the Public Prosecution can issue production orders to CBUAE-supervised banks under Articles 70-73 of Federal Decree-Law 38/2022. The CBUAE, operating under Law No. 6/2025, also maintains supervisory authority over all licensed financial institutions and can share information with law enforcement under the AML framework in Federal Decree-Law 10/2025, Article 22 (obligation to respond to competent authority requests). Where the fraud has generated Suspicious Transaction Reports (STRs) filed by the bank, these can — with prosecutorial cooperation — be factored into the investigation timeline.

Real property is a common parking mechanism. UAE land department records are not publicly searchable in the way that English Land Registry entries are, but through the criminal track the Public Prosecution can compel disclosure from the Abu Dhabi, Dubai, Sharjah or Ras Al Khaimah land departments. In civil proceedings, a court-appointed expert (khabeer) or a disclosure order against the relevant emirate's land authority can achieve the same result, albeit more slowly. Beneficial ownership registers maintained under Cabinet Decision 109/2023 (the 25% UBO test) apply to onshore and free zone companies and require disclosure of ultimate beneficial owners — these registers, held by the relevant licensing authority or free zone authority, are accessible to law enforcement and, in some circumstances, to courts in contested proceedings.

Cryptocurrency tracing has become a significant sub-discipline in UAE family-office fraud. Where a rogue manager has moved funds into crypto, the VARA Rulebooks 2.0 (May 2025) and the Travel Rule obligations under Cabinet Resolution 134/2025 (which set the AED 3,500 threshold for virtual asset transfer reporting) create a regulatory paper trail. VARA-licensed exchanges operating in Dubai are obliged to maintain KYC records and transaction histories, and these records are compellable by UAE law enforcement. Offshore exchanges present a harder problem — but blockchain analytics (using tools such as Chainalysis or Elliptic, deployed by specialised forensic firms) can trace wallets across chains, and the resulting chain-of-custody evidence is increasingly accepted by UAE courts. In the DIFC, the DIFC Digital Assets Law No. 2/2024 confirms that crypto assets constitute property capable of being subject to proprietary injunctions and tracing remedies — a critical legal foundation for any DIFC-based recovery action.

Criminal and Regulatory Exposure of the Fraudulent Insider

Prosecuting a rogue family-office insider through the UAE criminal justice system creates both direct enforcement pressure and parallel civil remedies. The key charges under Federal Decree-Law 31/2021 are: breach of trust (Article 399, imprisonment of up to 3 years and/or a fine for basic misappropriation, rising to 7 years where the perpetrator is a public servant or the sum is substantial); fraud (Article 451, up to 5 years); and forgery of official or commercial documents (Articles 251-258, up to 10 years where the forged document is a power of attorney or commercial instrument). If the proceeds were then concealed or transferred — as they almost invariably are — Federal Decree-Law 10/2025 (AML/CFT/CPF Law) applies, with criminal penalties of imprisonment from 1 to 10 years and fines of AED 300,000 to AED 5,000,000 for individuals under Articles 17-19. Under Article 20, senior managers and compliance officers of entities involved in laundering face personal liability, and under Article 36, confiscation of proceeds and instrumentalities is mandatory. Critically, Article 12 of FDL 10/2025 removes any statute of limitations for money-laundering offences, meaning historical transfers remain actionable regardless of when they occurred.

Where the family office holds a DIFC or ADGM licence, or where the fraudster was acting as an authorised individual under a DFSA or FSRA authorisation, regulatory consequences layer on top of criminal ones. The DFSA can withdraw authorisation, impose unlimited financial penalties (subject to the principles of proportionality in the DFSA Rulebook), and publish enforcement notices. The FSRA in ADGM has equivalent powers. For any investment manager who engaged in market manipulation or insider dealing — for example, trading in listed securities on the basis of the family office's positions — Federal Decree-Law 33/2025 creates codified offences with penalties up to AED 200 million and imprisonment, enforceable from 1 January 2026 by the new Capital Markets Authority established under Federal Decree-Law 32/2025. These regulatory exposures are distinct from and additional to criminal prosecution.

For dishonoured cheques — a common instrument in family-office fraud, where a manager issues cheques drawn on the family office account that are subsequently dishonoured — Federal Decree-Law 50/2022 (Commercial Transactions Law) applies. Under Article 635 bis, a returned cheque is now an executive instrument, allowing the payee to proceed directly to execution without a judgment. Criminal exposure for NSF cheques is reserved for bad-faith conduct, which in a fraud context is readily established. This provides a rapid enforcement pathway against misappropriated liquid instruments.

Cross-Border Recovery: Enforcing UAE Orders and Seeking Assistance Abroad

Family-office fraud rarely stays within a single jurisdiction. A manager who has misappropriated AED 50 million from a Dubai family office will typically move funds through a BVI company to a Swiss bank account, acquire real property in London or Monaco, and maintain personal residency in a third state. Recovery requires simultaneous pursuit in multiple jurisdictions, with UAE orders underpinning the strategy.

The UAE's Mutual Legal Assistance framework is governed by Federal Law 39/2006 as amended by Federal Decree-Law 38/2023. Under this framework, the UAE Public Prosecution can issue Letters Rogatory to foreign counterpart authorities requesting the freezing of foreign assets, production of bank records, and extradition of fugitive suspects. The UAE has bilateral MLA treaties with over 40 states, including the UK, France, Switzerland, India, Pakistan and most Arab League states. Where no bilateral treaty exists, MLA can still be requested on a reciprocity basis. For extradition specifically, the amended FDL 38/2023 streamlines the process and confirms that UAE courts can issue international arrest warrants through INTERPOL channels for suspects who have fled the jurisdiction.

On the civil enforcement side, the DIFC Courts' enforcement regime is among the most internationally connected in the region. The DIFC Courts have memoranda of guidance on enforcement with the English courts, the Singapore International Commercial Court, the New York courts and others, allowing DIFC judgments to be registered and enforced in those jurisdictions with minimal procedural friction. A family office that obtains a DIFC worldwide freezing order can — through the appropriate recognition process — enforce that order against assets in England and Wales, and use the DIFC judgment as the foundation for English High Court enforcement proceedings. ADGM judgments similarly benefit from recognition pathways in common law jurisdictions. For onshore UAE judgments, enforcement in GCC states is governed by the 1996 Riyadh Arab Agreement on Judicial Cooperation, providing relatively efficient enforcement across Saudi Arabia, Kuwait, Bahrain, Oman and Qatar.

Where assets are held in offshore structures — BVI, Cayman, Jersey — the family office will need to instruct local counsel to bring parallel proceedings. In the BVI and Cayman Islands, a DIFC or ADGM judgment is persuasive authority and can support an application for a local freezing order. The key is to move in coordinated waves: file in Dubai, file in the offshore domicile of the holding company, and file in the jurisdiction where the fraudster is physically located, all within a compressed timeframe that denies the respondent the opportunity to restructure or transfer assets between steps.

AML Obligations, STRs and the Compliance Dimension of Insider Fraud

A family office that discovers insider fraud faces an immediate compliance question: does the discovery trigger a Suspicious Transaction Report obligation? Under Federal Decree-Law 10/2025, Article 15, Designated Non-Financial Businesses and Professions (DNFBPs) — which include family offices that manage assets on behalf of clients if they qualify as such under the Executive Regulations in Cabinet Resolution 134/2025 — are obliged to file STRs with the Financial Intelligence Unit (FIU) at CBUAE without delay upon identifying a transaction or attempted transaction suspected to be related to money laundering, terrorist financing or proliferation financing. The obligation arises on suspicion, not proof. Failure to file is itself a criminal offence under Article 26 of FDL 10/2025, with fines up to AED 1 million for the entity and personal liability for the MLRO and senior management.

However, the tipping-off prohibition in Article 16 of FDL 10/2025 creates a tension: filing an STR and simultaneously pursuing civil proceedings carries a risk that the respondent, through their own legal proceedings or bank contact, becomes aware of the STR and uses that knowledge to accelerate dissipation. Experienced counsel navigate this by timing the STR filing to coincide with or immediately follow the without-notice freezing application, so that by the time the respondent could act on any information, their assets are already frozen. The CBUAE's FIU is also empowered under Article 22 of FDL 10/2025 to share STR information with foreign FIUs through the Egmont Group, which can accelerate parallel freezing actions in jurisdictions where the UAE maintains FIU cooperation arrangements.

For family offices that are DIFC or ADGM entities, additional AML obligations arise under the DFSA's AML Module and the FSRA's AML/CFT Rulebook respectively. Both regulators expect prompt escalation to senior management and the board when insider fraud is suspected, maintenance of contemporaneous records of the investigation, and notification to the regulator in appropriate cases under the relevant 'significant regulatory matter' notification obligations. Post-fraud, regulators will scrutinise whether the family office's AML controls were adequate — inadequate controls can result in regulatory fines and reputational consequences separate from the underlying fraud. The CBUAE's maximum administrative fine of AED 1 billion under Law No. 6/2025, Article 137, while calibrated to systemic financial institutions, illustrates the regulatory severity of AML failures in the UAE financial sector more broadly.

Governance, Structural Safeguards and Post-Recovery Remediation

Effective litigation and recovery are essential responses to insider fraud, but they are responses to a governance failure. Family offices that are structurally vulnerable to insider fraud typically share common characteristics: investment authority concentrated in a single individual without co-signatory requirements; limited segregation of duties between the person authorising transactions and the person reconciling accounts; inadequate board or protector oversight of trustee discretions; and no independent audit function with direct reporting lines to the principal family.

Under the DIFC Trust Law (DIFC Law No. 4 of 2018), Articles 22-24, a trust deed may provide for a Protector with veto rights over trustee decisions, including distributions, investments and changes of trustee. Properly structured, a Protector appointed by the family (rather than the trustee) provides a structural check on trustee conduct that is enforceable under the trust deed itself. Similarly, in ADGM foundations, the Foundation Charter and By-Laws can require Guardian approval for significant asset disposals — and the Guardian's fiduciary duties to the beneficiaries are enforceable in the ADGM Courts. For onshore LLCs, Federal Decree-Law 32/2021 (Companies Law) permits the appointment of a supervisory board (Majlis al-Muraqaba) for larger companies, and Articles 101-108 allow the General Assembly to appoint an audit committee with investigative powers.

Post-fraud remediation must address both the structural gaps that enabled the fraud and the evidentiary record needed for litigation. Preserving digital evidence — email servers, Slack channels, SharePoint records, WhatsApp communications — is critical from day one, given that deletion of evidence is an independent criminal offence under Federal Decree-Law 31/2021, Article 379 (obstruction of justice) and under Federal Decree-Law 38/2022, Article 72 (tampering with evidence). A litigation hold notice must be issued internally on discovery, and forensic imaging of relevant devices and servers should be conducted by a qualified forensic firm under a proper chain-of-custody protocol. This evidence will be required in both civil and criminal proceedings, and its admissibility may depend on compliance with the requirements of the UAE Evidence Law (Federal Decree-Law 35/2022), particularly as to electronic records and digital signatures.

Finally, family offices that have suffered insider fraud should consider whether their professional advisers — the external auditor, the compliance consultant, the law firm that advised on the structure — bear any concurrent liability. If professional negligence contributed to the fraud going undetected, concurrent claims against those advisers may increase the overall recovery pool and provide insurance-backed defendants who are more easily enforced against than an individual fraudster who has dissipated assets offshore.

Practical checklist

• File for a DIFC worldwide freezing order without notice within 24 hours of confirmed discovery.
• Simultaneously lodge a criminal complaint with the Public Prosecution to trigger prosecutorial asset-freezing powers.
• Issue an internal litigation hold notice and instruct forensic imaging of all relevant devices immediately.
• File an STR with the CBUAE FIU contemporaneously with or immediately after the freezing application.
• Identify all offshore holding companies and instruct local counsel in BVI, Cayman or relevant jurisdiction for parallel proceedings.
• Search DIFC, ADGM, Dubai and Abu Dhabi land department records for real-property holdings by the suspected insider.
• Engage blockchain analytics specialists if crypto wallets are identified as part of the misappropriation chain.
• Review trust deeds and corporate constitutions to identify Protector or supervisory board remedies available without court involvement.

Frequently asked questions

Related guides

• Extradition To and From the UAE After the 2023 Reforms
• INTERPOL Red Notices and the UAE: Removal, Provisional Arrest and Defence
• Tried in Your Absence: In-Absentia Convictions in the UAE and How to Reopen Them
• White-Collar & Financial Crime — full guide

Published 15 July 2026. General information only — not legal advice. Contact us for matter-specific advice.