How a Financial-Crime Investigation Begins in the UAE

In the UAE, a financial crime investigation can be triggered within hours by a bank SAR, a regulator referral, or a private complaint. Understanding the anatomy of the first 30 days — and the precise procedural rights under Federal Decree-Law 38/2022 — is the difference between controlling the narrative and losing it.

The Legislative Architecture: What Laws Actually Govern

A financial crime investigation UAE-side draws on an interlocking web of legislation that was substantially modernised between 2021 and 2025. The primary criminal code is Federal Decree-Law 31/2021 (the Penal Code, in force 2 January 2022, amended by FDL 36/2022), which consolidated and restated fraud, embezzlement, breach of trust and related offences. Procedure is governed exclusively by Federal Decree-Law 38/2022 (the Criminal Procedure Law, CPL, in force 1 March 2023, amended by FDL 45/2023) — not by the older Code of Criminal Procedure or the frequently mis-cited 'Federal Law 35/1992'. Any adviser still referencing the former procedure code is working from repealed law.

The anti-money laundering regime underwent its most significant overhaul in a generation when Federal Decree-Law 10/2025 (AML/CFT/CPF Law, in force 14 October 2025) came into force, implementing Cabinet Resolution 134/2025 as its Executive Regulations (14 December 2025) and repealing Federal Decree-Law 20/2018 in its entirety. FDL 10/2025 is structurally important: it adds proliferation financing and tax evasion as standalone predicate offences, introduces personal criminal liability for senior managers of reporting entities who fail to act, raises administrative fines to AED 100 million per violation, and — critically — eliminates any statute of limitations for money laundering offences. There is no time-bar defence available in an AML prosecution under current UAE law.

Capital markets enforcement has been restructured by Federal Decree-Law 32/2025 (which replaced the Securities and Commodities Authority with the Capital Markets Authority from 1 January 2026) and Federal Decree-Law 33/2025, which codified insider dealing and market manipulation as distinct criminal offences carrying penalties up to AED 200 million, repealing Federal Law 4/2000. The Central Bank's supervisory enforcement arm operates under CBUAE Law No. 6/2025, which authorises administrative fines of up to AED 1 billion. For corporate insolvency-related financial crime, Federal Decree-Law 51/2023 (Bankruptcy Law, in force 1 May 2024) creates a dedicated Bankruptcy Court and codifies fraudulent and negligent bankruptcy as criminal offences in their own right.

Understanding which statute governs which conduct — and which enforcement authority holds primary jurisdiction — is the first task for any defence team. A single transaction can simultaneously engage the Penal Code, FDL 10/2025, FDL 33/2025, and a CBUAE supervisory action, each with independent evidentiary thresholds and sanction regimes. Mapping that exposure before engagement with any authority is non-negotiable.

Day Zero: How a Financial Crime Investigation Actually Starts

Investigations are initiated through four principal channels, and each has a different trajectory. The most common is a Suspicious Transaction Report (STR) filed by a reporting entity — a bank, exchange house, financial institution, or designated non-financial business or profession (DNFBP) — with the UAE Financial Intelligence Unit (UAEFIU) under Article 18 of FDL 10/2025. An STR does not require the reporting entity to have proof of criminality; reasonable grounds for suspicion are sufficient. The FIU analyses the report and, where it determines that further investigation is warranted, disseminates the intelligence to the relevant law enforcement authority — typically the Public Prosecution or an economic crimes unit. The subject of the STR has no right to notice at this stage, and tipping-off prohibitions under Article 23 of FDL 10/2025 mean the filing institution is legally barred from informing the client.

The second channel is a regulator referral. The CBUAE, the Capital Markets Authority (from 1 January 2026 under FDL 32/2025, previously the SCA), VARA, and ADGM/DIFC regulators all have statutory powers to refer matters to the Public Prosecution. A CMA referral for suspected insider dealing or market manipulation under FDL 33/2025, or a CBUAE referral following an examination finding under CBUAE Law 6/2025, triggers an independent prosecutorial assessment. In practice, regulator referrals tend to be better documented and more likely to result in formal charges than FIU disseminations alone.

The third channel is a private criminal complaint lodged directly with the Public Prosecution or police by an aggrieved counterparty — a defrauded investor, a bank holding a bounced cheque, or a business partner alleging embezzlement. Under FDL 31/2021, the Public Prosecution retains the discretion to proceed regardless of whether the complainant subsequently withdraws. Notably, following Federal Decree-Law 50/2022 (Commercial Transactions Law), dishonoured cheques are no longer automatically criminal: an NSF cheque is treated as an executive instrument enforceable directly through the courts under Article 635 bis, and criminal exposure arises only where bad faith is affirmatively demonstrated. This is a material change that many private complainants — and their advisers — fail to appreciate.

The fourth, less common channel is a mutual legal assistance (MLA) request from a foreign jurisdiction, processed under Federal Law 39/2006 as amended by FDL 38/2023. Where a foreign authority alleges that assets or suspects are located in the UAE, an incoming MLA request can trigger asset-freezing orders and investigative steps without any prior domestic complaint. DIFC Court Law 2/2025 and the precedent set in ADGM A17 v B17 [2025] have extended the reach of worldwide freezing orders in support of foreign proceedings, even without a UAE asset nexus, materially expanding the risk profile for internationally-mobile clients.

Who Investigates: Economic Crime Units, Public Prosecution and Regulators

The UAE does not have a single unified financial crime investigative body. Jurisdiction is distributed across several authorities, and understanding which unit has carriage of a particular matter is essential for calibrating the defence response. At the federal level, the Public Prosecution has supervisory authority over all criminal investigations under Article 18 of CPL 38/2022 and may direct police investigations, request expert reports, and order precautionary measures including asset freezes and travel bans. Each Emirate maintains dedicated Economic Crime Departments within the police — Abu Dhabi's General Directorate, Dubai Police's Anti-Economic Crime Department, and equivalent units in Sharjah and the northern Emirates — which conduct field investigations, execute search warrants, and take witness statements under prosecutorial supervision.

In parallel, the UAEFIU (housed within the CBUAE) operates as the UAE's financial intelligence hub, receiving STRs, conducting financial analysis, and disseminating intelligence. It does not itself charge or prosecute. The National Anti-Money Laundering and Combating Financing of Terrorism Committee (NAMLCFTC) sets the strategic policy framework, including the UAE's National Risk Assessment, but has no direct investigative role. For regulated financial institutions, the CBUAE's Consumer Protection and Market Conduct Department and its Supervision function can simultaneously pursue administrative enforcement and refer matters for prosecution — creating a risk of parallel proceedings that must be managed carefully.

In the financial free zones, the DFSA (DIFC) and the FSRA (ADGM) exercise their own enforcement jurisdiction under their enabling laws, with power to investigate, fine, and ban individuals and entities operating in their respective perimeters. VARA regulates virtual asset activities in Dubai (outside DIFC) under its Rulebooks 2.0 (May 2025), and any financial crime involving virtual assets will typically engage VARA at the supervisory level before or alongside a Public Prosecution referral. The Travel Rule, now embedded in Cabinet Resolution 134/2025 with an AED 3,500 threshold, applies to all virtual asset service providers, and compliance failures are a frequent trigger for VARA referrals.

One of the most consequential practical issues during the first 30 days is determining whether regulatory and criminal investigations are running concurrently. A company under CBUAE examination and simultaneously subject to a police investigation faces distinct — and potentially conflicting — disclosure obligations. Documents produced voluntarily to a regulator may not be shielded from use in a criminal proceeding. Defence counsel must map all active or potential proceedings from the outset and advise on the sequencing of any voluntary engagement.

Inside the First 30 Days: Procedural Steps and What Clients Experience

The early procedural sequence under CPL 38/2022 is more compressed than many clients expect. Once a complaint or referral is received, the Public Prosecution can direct police to investigate and to take urgent precautionary measures — including travel bans, asset freezes, and account blocks — before the subject is notified or interviewed. Article 97 of CPL 38/2022 empowers the Public Prosecution to issue asset-preservation orders where there is reasonable cause to believe that assets may be dissipated. These orders can be communicated directly to banks and financial institutions without prior judicial approval in urgent circumstances, though they are subject to later judicial confirmation.

Within the first 72 hours of a formal investigation being opened, the subject may receive: a summons to appear before the Public Prosecution for questioning; a notice from their bank that accounts have been blocked; or, in more serious cases, an arrest followed by detention. Under Article 42 of CPL 38/2022, a suspect held in custody must be brought before a prosecutor within 48 hours. The prosecutor may then release the suspect, impose bail conditions, or seek a remand order from the court. Remand periods in financial crime cases can extend — with judicial approval — to significant periods where the investigation is complex, and the defence should apply immediately for any available bail or release mechanism.

The right to legal representation is guaranteed from the moment of arrest or summons under Article 53 of CPL 38/2022. Critically, a suspect is not required to answer questions in the absence of counsel, and any statement made without counsel being given a reasonable opportunity to be present carries risks that skilled counsel will identify and argue at the admissibility stage. In practice, Public Prosecutors will often proceed with questioning even if counsel arrives late; the defence record of requests for delay should be meticulously documented from the first contact. Advisers should ensure that the client's first written submission — if any is made voluntarily — accurately and consistently reflects the facts, because inconsistencies between early statements and later evidence are a primary tool of prosecution in financial crime cases.

Asset-freezing orders affecting DIFC or ADGM-sited assets, or assets held by entities registered in those zones, may additionally engage the civil courts of those centres. Following DIFC Court Law 2/2025 and the ADGM A17 v B17 [2025] decision, worldwide freezing orders can be granted by DIFC and ADGM courts in support of foreign proceedings without any requirement that UAE assets be identified. This means that a client subject to proceedings in London, Singapore, or New York may simultaneously face a DIFC-registered freezing order — a dual-front that requires coordinated cross-border defence strategy from day one.

Earliest Defence Intervention: Rights, Strategy and CPL 38/2022

The window for effective defence intervention is widest in the first 30 days, before the Public Prosecution has filed charges, before asset-freeze orders have been judicially confirmed, and before witness statements have been locked into the record. Article 53 of CPL 38/2022 provides that every accused has the right to seek the assistance of a lawyer at all stages of investigation and trial. Counsel may attend any questioning session and may review the file — subject to prosecutorial restrictions on sensitive materials — to the extent disclosed prior to charge. The defence should request access to the investigation file under Article 57 of CPL 38/2022 at the earliest opportunity; this provides visibility on the evidence that the prosecution intends to rely upon and identifies any procedural irregularities that could be challenged.

One of the most strategically important early actions is a voluntary disclosure or proactive engagement with the relevant authority — but only where the factual and legal analysis supports it. In the tax context, Federal Decree-Law 47/2022 (Corporate Tax Law) and Cabinet Decision 129/2025 provide that a taxpayer who makes voluntary disclosure before an audit is initiated faces a penalty of 1–4% of the underpaid tax, compared to 15% on audit discovery. The equivalent principle in an AML context is more complex: FDL 10/2025 does not provide a formal voluntary disclosure regime equivalent to some common law jurisdictions, but cooperation is a statutory mitigating factor in sentencing under FDL 31/2021, and early engagement can influence the Public Prosecution's decision on whether to proceed to charge.

Where beneficial ownership is in issue — as it frequently is in fraud, embezzlement, and AML cases involving corporate structures — counsel must immediately audit the client's ownership registers against the requirements of Cabinet Decision 109/2023, which applies a 25% ultimate beneficial ownership threshold. Discrepancies between declared UBO registers and actual economic ownership are regularly relied upon by the prosecution as evidence of intentional concealment, even where the underlying conduct may have an innocent explanation. Correcting any filing deficiencies before they become a prosecution exhibit requires urgent attention.

For clients with crypto asset exposure, the VARA Rulebooks 2.0 (May 2025) and the Travel Rule under Cabinet Resolution 134/2025 create specific compliance obligations, breaches of which are increasingly being used as predicate violations to support broader AML allegations. The DIFC Digital Assets Law 2/2024 confirms that digital assets are property under UAE law, meaning they are subject to freezing, confiscation, and tracing in the same way as traditional financial assets. Defence teams must ensure they have the technical capacity — or access to qualified forensic partners — to analyse blockchain records and respond to VARA or prosecutorial enquiries on transaction flows.

Exposure and Consequences: Criminal, Administrative and Reputational

The sentencing exposure in a UAE financial crime prosecution is substantial and has increased materially under the 2021–2025 legislative cycle. Under FDL 31/2021, fraud, embezzlement, and breach of trust carry custodial sentences ranging from one year to life imprisonment depending on the quantum involved, the degree of premeditation, and aggravating factors such as the use of a corporate vehicle or abuse of a position of trust. Where the conduct also constitutes money laundering under FDL 10/2025, a separate — and consecutive — custodial term is available, along with asset confiscation extending to all proceeds of the predicate offence. The elimination of any statute of limitations for ML under FDL 10/2025 means that historical transactions, including those pre-dating the current AML Law, can form the basis of a money laundering charge where the concealment or conversion occurred within the limitation-free window.

For market-related offences, FDL 33/2025 imposes criminal penalties of up to AED 200 million and imprisonment, with the CMA empowered to seek disgorgement of all profits derived from insider dealing or market manipulation in addition to punitive fines. At the supervisory level, the CBUAE's power under CBUAE Law 6/2025 to impose fines of up to AED 1 billion creates an administrative exposure that can be existential for financial institutions and highly damaging for individuals holding regulated roles. Personal manager liability — now expressly codified in FDL 10/2025 — means that a Compliance Officer, MLRO, or senior executive who knew or should have known of AML violations can face personal criminal prosecution, separate from any action against the institution.

Reputational consequences in the UAE financial market are compounded by the country's post-FATF grey-listing trajectory. Having been removed from the FATF grey list in February 2024 and from the EU high-risk jurisdiction list in 2025, UAE authorities are acutely sensitive to enforcement credibility ahead of the mutual evaluation scheduled for 2026. This creates a prosecutorial environment that is more robust and less amenable to quiet resolution than it may have been in prior years. Public prosecutions, particularly in high-value financial crime cases, are increasingly pursued to completion regardless of civil settlement or restitution offers. A client who believes that repaying the alleged loss will end a criminal investigation is operating on an outdated assumption.

Confiscation orders present a distinct and serious exposure. UAE courts may order confiscation of both direct proceeds and assets of equivalent value where the original proceeds cannot be traced. Where assets are held through corporate structures, the prosecution may seek to pierce the corporate veil — particularly where the beneficial ownership chain was not properly disclosed under Cabinet Decision 109/2023 — and pursue confiscation against the underlying natural person. Counsel should conduct an early forensic mapping of all potentially confiscatable assets and consider whether any are susceptible to legitimate third-party claims that could shield them from confiscation.

Cross-Border Dimensions: MLA, Extradition and Multi-Jurisdictional Risk

Financial crime cases in the UAE rarely exist in a single jurisdictional silo. The UAE has extradition treaties and MLA agreements with a significant number of states, administered under Federal Law 39/2006 as amended by FDL 38/2023. An incoming MLA request from a treaty partner — including France, India, China, and a growing number of GCC states — can result in asset freezing, document production orders, and witness summons being executed on UAE soil in support of foreign proceedings. Conversely, the UAE Public Prosecution can and does issue outgoing MLA requests to recover evidence or assets held abroad, including bank records, company registers, and real estate title documents.

The cross-border freezing landscape has been substantially widened by DIFC Court Law 2/2025 and the ADGM's decision in A17 v B17 [2025]. Both courts have confirmed their jurisdiction to grant worldwide freezing orders in support of foreign civil proceedings without requiring the applicant to identify UAE-sited assets. For a client who holds assets through a DIFC or ADGM entity — or who has merely submitted to the jurisdiction of those courts by contract — a foreign judgment creditor or foreign authority may be able to obtain and enforce a freezing order through those centres with relative procedural ease. Defence teams must assess this risk proactively and not simply assume that assets outside the UAE are outside the reach of UAE judicial assistance.

For clients facing parallel proceedings in multiple jurisdictions — a common scenario in trade finance fraud, crypto asset fraud, or investment scheme cases — the sequencing of which jurisdiction to engage first, and in what order to make disclosure or settlement approaches, is a critical strategic decision. Statements made to one authority can be disclosed to another under MLA channels. Voluntary production of documents in a civil case can be obtained and used in a criminal case in a different jurisdiction. Clients and their advisers must approach multi-jurisdictional exposure with a unified strategy, not a jurisdiction-by-jurisdiction reaction. Engagement of coordinating counsel with genuine UAE criminal procedure expertise — not merely corporate or civil practitioners — is essential from the outset of any cross-border financial crime matter.

Practical checklist

• Instruct UAE criminal defence counsel before making any statement to police or prosecution
• Request immediate access to the investigation file under Article 57, CPL 38/2022
• Audit all UBO registers for compliance with Cabinet Decision 109/2023 (25% threshold)
• Identify all active regulatory and criminal proceedings and map potential conflicts of interest between them
• Assess asset-freeze risk across UAE mainland, DIFC, and ADGM-held assets immediately
• Review voluntary disclosure options under FDL 47/2022 if corporate tax exposure is implicated
• Preserve and legally segregate all potentially relevant electronic and documentary records
• Obtain specialist advice on any virtual asset exposure against VARA Rulebooks 2.0 and Cabinet Resolution 134/2025 Travel Rule

Frequently asked questions

Related guides

• Dawn Raids and Digital Evidence Seizure in the UAE: The First Hour
• UAE Travel Bans in Criminal Cases: Imposed, Challenged and Lifted
• Asset Freezing and Precautionary Attachment in UAE Economic-Crime Cases
• White-Collar & Financial Crime — full guide

Published 15 July 2026. General information only — not legal advice. Contact us for matter-specific advice.