The Privilege Trap: Why Your UAE Internal Investigation May Not Be Protected

An internal investigation conducted without proper privilege architecture can hand regulators a roadmap into your organisation's most sensitive findings. In the UAE, the rules differ sharply between onshore and financial free zone jurisdictions — and the gap is far wider than most boards appreciate.

The Legal Framework: What Privilege Actually Means Under UAE Law

Legal professional privilege in the UAE is not a single, codified doctrine. It is assembled from a patchwork of provisions across the UAE Penal Code (Federal Decree-Law 31/2021, as amended by FDL 36/2022), the Criminal Procedure Law (Federal Decree-Law 38/2022, in force 1 March 2023, as amended by FDL 45/2023), the UAE Evidence Law (Federal Decree-Law 35/2022), and the separate legal frameworks governing the DIFC and ADGM. Understanding which instrument applies to your investigation is the threshold question — and getting it wrong can be catastrophic.

Under the onshore UAE framework, the closest analogue to legal professional privilege is the confidentiality obligation imposed on legal professionals by the UAE Advocates Law (Federal Law 23/1991 as amended). This obligation protects communications between a client and a licensed UAE advocate — i.e., a lawyer holding a UAE Ministry of Justice or emirate-level Bar licence to practise onshore. Critically, it does not extend to in-house counsel, however senior, and does not extend to foreign-qualified lawyers practising through an onshore law firm licence, unless they are acting under the direct supervision of a licensed advocate. The Criminal Procedure Law FDL 38/2022 reinforces this by permitting investigators to compel testimony from any person who is not a licensed advocate in respect of client matters.

The practical consequence is stark: memoranda prepared by your General Counsel, notes taken by compliance officers, interview records compiled by an in-house legal team, and reports produced by a foreign law firm not operating through a licensed advocate — all of these are potentially compellable by a public prosecutor conducting a criminal investigation under FDL 38/2022. There is no implied privilege, no work-product doctrine equivalent, and no automatic protection for documents that are merely marked 'confidential' or 'legally privileged.'

The position is materially different in the DIFC and ADGM. Both financial free zones have adopted English common law as the applicable law for civil matters, and both expressly recognise legal professional privilege — including both legal advice privilege and litigation privilege — as a substantive right. DIFC Law No. 7/2004 (as amended) and the ADGM Courts, Civil Evidence, Judgments, Executions and Judicial Appointments Regulations 2015 each give effect to privilege principles broadly consistent with English law. This means that, within those jurisdictions, properly structured investigation advice from a qualified lawyer — including, in some circumstances, in-house counsel advising in a legal rather than a business capacity — may be protected from compelled disclosure before DIFC or ADGM tribunals.

The In-House Counsel Gap: A Risk That Most Organisations Underestimate

The single most dangerous misconception among UAE-based executives and General Counsels is the belief that communications with in-house legal teams are privileged in the same way as those with external counsel. Onshore UAE law does not recognise this. An in-house lawyer — whatever their qualification, seniority, or title — is an employee. Their communications with management do not attract advocate-client privilege under Federal Law 23/1991, because they do not hold a personal licence to practise as an advocate on behalf of third parties. They are providing legal services to their employer, not acting as independent legal advisers in the recognised professional sense.

This gap has immediate and serious consequences for internal investigations. When a board commissions an internal investigation into suspected fraud, bribery, AML violations, or market abuse, the instinctive response is to involve the in-house legal team at every stage — directing interviews, reviewing documents, preparing findings. Under onshore UAE law, every document produced in that process, every interview note taken by in-house counsel, and every draft report reviewed by the GC is potentially accessible to a public prosecutor under FDL 38/2022 if the investigation later intersects with a criminal inquiry. Federal Decree-Law 10/2025 (the new AML/CFT/CPF law, in force 14 October 2025) also grants the UAE Financial Intelligence Unit and supervisory authorities broad powers to compel the production of records from regulated entities — and an internal investigation report sitting in the in-house legal team's file is precisely the kind of document that falls within those powers.

The risk is compounded by the personal liability provisions introduced under FDL 10/2025. Senior managers and compliance officers can now face personal criminal liability for failures in AML/CFT/CPF systems, with fines up to AED 100 million at the entity level and individual custodial exposure. In that environment, an investigation report that has not been properly privilege-protected becomes a liability document as much as an investigative tool — capable of being used to establish that management knew of the relevant conduct and either acted or failed to act upon it.

For financial institutions regulated by the Central Bank of the UAE under CBUAE Law No. 6/2025 — which carries maximum administrative fines of AED 1 billion — the stakes of an unprotected investigation report are existential. Boards and audit committees must treat the privilege architecture of any investigation as a foundational governance decision, not an afterthought.

Structuring the Investigation: Onshore, DIFC, and ADGM Compared

The decision of where and how to structure a UAE internal investigation is not merely procedural — it directly determines whether your findings are protected. The following framework reflects the material differences between the three principal jurisdictions available to most UAE corporates and financial institutions.

Onshore (mainland UAE): Any investigation that is instructed directly by the board or management and conducted by in-house counsel, compliance teams, or foreign law firms without a licensed advocate in the chain of instruction will not be privilege-protected. To achieve the closest available protection onshore, the investigation must be instructed by and conducted under the direction of a licensed UAE advocate (holding a Ministry of Justice or emirate Bar licence), and all advice, interview notes, and draft reports must flow through that advocate. Even then, the privilege is personal to the advocate-client relationship and does not cover every document in the investigation file — documents that would exist independently of the legal advice (underlying transactional records, email chains, financial data) remain compellable. There is no work-product doctrine that independently protects the investigative materials prepared in anticipation of litigation.

DIFC: Where the entity under investigation is incorporated in or operates through the DIFC, or where it is possible to instruct DIFC-registered external counsel to lead the investigation, a significantly more robust privilege architecture is available. Under DIFC Law No. 7/2004 and the DIFC Courts' case law, legal advice privilege protects confidential communications between a lawyer and client made for the purpose of giving or receiving legal advice; litigation privilege extends to documents prepared with the dominant purpose of use in reasonably anticipated adversarial proceedings. Both heads of privilege apply to properly structured investigations. The engagement letter should be with DIFC-registered external counsel, who should direct and control the investigation — not merely review its output.

ADGM: The ADGM framework mirrors the English common law position most closely. The ADGM Courts, Civil Evidence, Judgments, Executions and Judicial Appointments Regulations 2015 apply English privilege principles directly. For regulated entities under FSRA supervision — particularly those facing potential enforcement action — instructing ADGM-registered external counsel to lead an investigation and treating the resulting advice as both legal advice privilege and (where proceedings are reasonably anticipated) litigation privilege provides the strongest available protection in the UAE market. The recent ADGM decision in A17 v B17 [2025] also confirms the willingness of ADGM courts to take a sophisticated, common-law approach to evidence and privilege questions.

A critical structuring point applies in all three jurisdictions: the investigation must be genuinely directed by external legal counsel, not merely reviewed by them at the end. Courts and regulators will look through arrangements where in-house teams conduct the investigation and external counsel simply 'endorses' the output. The instruction must flow from the board or audit committee directly to external counsel, and external counsel must control the methodology, the interview process, and the preparation of the final report.

When Investigations Meet Criminal and Regulatory Proceedings

The intersection between an internal investigation and a parallel criminal or regulatory process is where privilege failures become most acutely dangerous. Under the Criminal Procedure Law FDL 38/2022, the Public Prosecutor has broad powers of search, seizure, and compelled testimony. Article 57 of FDL 38/2022 permits the prosecutor to order the production of documents held by any person or entity where there is reasonable cause to believe those documents are relevant to a criminal inquiry. There is no blanket exception for documents held by corporate legal departments. The only documents that a prosecutor is expressly prohibited from seizing are those in the possession of a licensed advocate that are covered by the advocate's professional secrecy obligation under Federal Law 23/1991.

This matters acutely in the context of the new AML/CFT/CPF law. Federal Decree-Law 10/2025 (in force 14 October 2025), which repeals FDL 20/2018, adds proliferation financing and tax evasion as predicate offences, removes any statute of limitations for money laundering offences, and introduces personal manager liability. An internal investigation triggered by a suspicious transaction report or a regulatory inquiry from the UAE Financial Intelligence Unit operates in an environment where the investigators themselves — and their documents — may be drawn into a criminal process at any point. Without a properly structured privilege architecture from day one, documents that were intended to assist in remediation can become exhibits in a prosecution.

Capital markets investigations add a further layer of complexity following the enactment of Federal Decree-Law 32/2025 (establishing the Capital Markets Authority, replacing the SCA from 1 January 2026) and Federal Decree-Law 33/2025 (codifying insider dealing and market manipulation offences with penalties up to AED 200 million). The CMA has inherited and expanded the SCA's enforcement powers, including the power to compel production of investigation reports from regulated entities. Where an entity conducts an internal investigation into potential market abuse and that investigation report is unprotected, the CMA can compel its production — and use it as the foundation for its own enforcement case.

For entities facing potential bankruptcy-related offences under Federal Decree-Law 51/2023 (in force 1 May 2024), which created a dedicated Bankruptcy Court and codified fraudulent and negligent bankruptcy offences, the same risk applies. An internal review of the company's financial position that was commissioned to assess restructuring options but conducted without privilege protection can be compelled by the Bankruptcy Court or by creditors seeking to establish director liability.

Waiver, Voluntary Disclosure, and the Risk of Selective Production

Even where privilege has been properly established over an investigation report, it can be lost — entirely or partially — through waiver. Waiver of privilege in the DIFC and ADGM follows English common law principles: it can be express (deliberate disclosure to a third party outside the privileged relationship) or implied (conduct inconsistent with maintaining confidentiality, such as relying on the report's conclusions in regulatory submissions while withholding the underlying analysis). Onshore, the concept of waiver is less developed in the case law, but the principle that producing part of a privileged document may require production of the whole is recognised.

The voluntary disclosure regime under corporate tax law illustrates the tension precisely. Under Federal Decree-Law 47/2022 and Cabinet Decision 129/2025, a voluntary disclosure made proactively to the Federal Tax Authority attracts penalties of 1–4% of the tax shortfall, compared with 15% on audit discovery. A company conducting an internal tax investigation may wish to use its findings to support a voluntary disclosure. But if the investigation report is shared with the FTA, privilege over that report — and potentially over related legal advice — is waived. External counsel must carefully structure what is disclosed and in what form: a summary of conclusions, a remediation plan, or a factual appendix may be shareable without waiving privilege over the full investigative file, provided the disclosure is managed with precision.

The same tension arises in AML/CFT contexts. Under FDL 10/2025 and Cabinet Resolution 134/2025 (the Executive Regulations), regulated entities have ongoing obligations to file suspicious transaction reports and to cooperate with AMLSCU and the UAEFIU. Sharing findings from an internal investigation with regulators in the course of that cooperation is often prudent — but it must be done under a framework that preserves the distinction between what is being disclosed voluntarily and what remains protected by legal advice privilege. Blanket disclosure of investigation reports to regulators as a goodwill gesture is a privilege trap of the first order.

Financial institutions regulated under CBUAE Law No. 6/2025 face additional complexity: the Central Bank's examination powers are broad and include the right to inspect all records of a licensed entity. Boards should take specific advice on whether investigation reports constitute 'records' subject to Central Bank inspection rights and what, if any, privilege claim can be maintained in that context. The answer will depend on the nature of the investigation, the identity of the instructing party, and whether external counsel properly directed the work.

Practical Structuring: How to Build a Privilege-Protected Investigation from Day One

The architecture of a privilege-protected investigation must be established before any investigative work begins. Retrofitting privilege after the fact is not possible — a court or regulator will look at the actual structure of the investigation, not the label applied to it. The following steps reflect the approach that practitioner-grade UAE investigations should follow.

Step 1 — Board or Audit Committee instruction: The investigation must be commissioned by the board, audit committee, or a specially constituted investigation committee — not by management. This is critical because it establishes that the purpose of the investigation is to obtain legal advice for the company (through its governing body), not to conduct a management review. The board resolution commissioning the investigation should expressly state that it is being conducted for the purpose of obtaining legal advice and, where proceedings are reasonably anticipated, in contemplation of those proceedings.

Step 2 — Engage external counsel with the correct qualification and jurisdiction: For onshore matters, engage a licensed UAE advocate. For DIFC or ADGM matters, engage counsel registered with the relevant free zone authority. The engagement letter should be with the board or audit committee directly. It should specify that all work product, interview notes, and draft and final reports are prepared for the purpose of legal advice and are to be treated as privileged. In-house counsel should be kept informed but should not direct the investigation or prepare the primary investigation documents.

Step 3 — Establish a document-handling protocol from the outset: All investigation documents — interview memoranda, document review notes, chronologies, draft reports — should be created and held within external counsel's systems, not on the company's own servers or in-house counsel's files. A document labelling protocol (marking documents with the privilege basis) should be implemented from day one, with the understanding that labels alone do not create privilege but are important evidence of intention.

Step 4 — Separate factual compilation from legal analysis: Underlying factual documents (transactional records, emails, financial data) are not themselves privileged merely because they are collected in the course of an investigation. The privilege attaches to the legal analysis, interview memoranda prepared by counsel, and the final report — not to the underlying source documents. External counsel should clearly separate factual appendices (which may need to be shared with regulators) from privileged analysis (which should not be disclosed without careful advice on waiver consequences).

Step 5 — Consider cross-border privilege issues: Where the investigation involves entities or individuals in multiple jurisdictions, privilege must be assessed jurisdiction by jurisdiction. A document that is privileged in the DIFC may not be privileged in onshore UAE proceedings, and vice versa. Extradition and mutual legal assistance requests under Federal Law 39/2006 as amended by FDL 38/2023 can result in foreign authorities seeking production of UAE-held documents; the privilege analysis in those scenarios requires specific advice on the applicable treaty framework and the requesting state's laws.

Consequences of Getting It Wrong: Enforcement, Liability, and Reputational Exposure

The consequences of an unprotected internal investigation are not theoretical. When a regulator or public prosecutor obtains an investigation report that was intended to be internal, the document typically contains precisely the analysis that is most damaging: a candid assessment of what went wrong, who was responsible, what the company knew and when, and what remediation was or was not taken. In well-conducted investigations, external counsel will have identified the most serious conduct precisely because that is their mandate. Without privilege protection, that honest assessment becomes exhibit one in a regulatory or criminal case.

Under FDL 10/2025, where a money laundering or proliferation financing investigation is involved, there is no statute of limitations — meaning that an unprotected investigation report can resurface years after it was prepared. The personal liability provisions for senior managers mean that individuals named in an investigation report face direct criminal exposure, not merely reputational risk. Fines at the entity level reach AED 100 million; at the individual level, custodial sentences are available for wilful failures.

In capital markets matters, the newly constituted Capital Markets Authority under FDL 32/2025 has inherited a remit that is explicitly more enforcement-oriented than its predecessor. The codified insider dealing and market manipulation offences under FDL 33/2025 carry penalties up to AED 200 million. An investigation report that identifies potential market abuse conduct but was not properly privilege-protected will be compellable by the CMA. The individuals identified in that report will have no basis to resist its use as evidence in subsequent proceedings.

For beneficial ownership compliance, Cabinet Decision 109/2023 (applying the 25% ownership threshold) requires entities to maintain accurate registers. An internal investigation into beneficial ownership failures that is later compelled by regulators will reveal not only the underlying failure but also the company's internal assessment of how serious that failure was — a fact that will directly influence penalty calculations. Boards should ensure that any such review is structured as privileged legal advice from the outset, not as a compliance team exercise.

The reputational dimension is equally serious for high-net-worth individuals and executives. In a jurisdiction where criminal and regulatory proceedings are public, an unprotected investigation report that finds its way into the record of proceedings becomes a permanent public document. The privilege architecture of an investigation is, ultimately, a form of risk management for individuals as much as for institutions.

Practical checklist

• Commission the investigation at board or audit committee level, not management level.
• Instruct a licensed UAE advocate (onshore) or free zone-registered external counsel (DIFC/ADGM) before any investigative work begins.
• Confirm in the engagement letter that work product is created for legal advice purposes and is intended to be privileged.
• Keep all investigation documents within external counsel's systems, not on company servers or in-house counsel files.
• Separate compellable underlying source documents from privileged legal analysis in the investigation file architecture.
• Take specific advice before voluntarily disclosing any part of an investigation report to regulators, to manage waiver risk.
• Assess privilege jurisdiction-by-jurisdiction where the investigation involves cross-border entities or potential MLA requests under FDL 38/2023.
• Review personal liability exposure of senior managers under FDL 10/2025 before finalising the investigation scope and report.

Frequently asked questions

Related guides

• Can a Company Itself Be Prosecuted? Corporate Criminal Liability (Article 66)
• From SCA to CMA: The UAE's New Market Abuse and Insider Trading Regime
• Whistleblowing in the UAE: One Programme for Onshore, DIFC and ADGM
• White-Collar & Financial Crime — full guide

Published 15 July 2026. General information only — not legal advice. Contact us for matter-specific advice.