Self-Reporting Under Article 284: Turning a Fraud Discovery Into a Penalty Exemption

What this guide covers

The Statutory Framework: Article 284 and the Penal Code Architecture
Conditions for the Exemption: What Article 284 Actually Requires
The Strategic Decision: When to Report, When to Investigate First, and When Not to Report
Procedure: How a Self-Report Is Made and What It Must Contain
What the Exemption Covers — and What It Does Not
Corporate Governance Implications: Boards, Compliance Functions, and Mandatory Reporting
Practical Timeline and Action Map for the First 72 Hours
Practical checklist
What we'd typically advise
Frequently asked questions

Article 284 of the UAE Penal Code (Federal Decree-Law 31/2021) contains one of the most consequential yet least-understood provisions in UAE criminal law: a mandatory penalty exemption for a bribe-giver who self-reports before authorities discover the offence. Timing, form, and legal preparation determine whether that exemption holds.

The Statutory Framework: Article 284 and the Penal Code Architecture

The governing statute is Federal Decree-Law 31/2021 (the Penal Code), which entered into force on 2 January 2022 and was subsequently amended by Federal Decree-Law 36/2022. Articles 275 to 287 of FDL 31/2021 constitute the core bribery chapter, covering public-sector bribery (Articles 275–280), private-sector bribery (Articles 281–283), and the self-reporting exemption at Article 284. The 2021 Code consolidated and modernised earlier provisions, and practitioners must be careful not to rely on the repealed Penal Code (Federal Law 3/1987) or any predecessor numbering.

Article 284 provides, in substance, that a person who gave or offered a bribe — or acted as an intermediary — is exempted from the penalties prescribed under the bribery chapter if they disclose the offence to the competent authorities before those authorities become aware of it. The exemption is framed as a right, not a discretion: once the statutory conditions are satisfied, the public prosecutor is legally constrained from pursuing a conviction for the bribery offence itself. This is a significant departure from mere mitigation and must be understood as such when advising executives or corporates weighing exposure.

The architecture matters: Articles 275 to 280 address bribery of UAE public officials and persons exercising public authority, with penalties reaching imprisonment and substantial fines. Article 281 extends liability to private-sector bribery, which is increasingly prosecuted in commercial disputes. The intermediary — the person who facilitates a bribe without directly paying it — is explicitly caught by Article 284, meaning that compliance officers, agents, and intermediaries who discover and report conduct before authorities do may also qualify. The amended FDL 36/2022 did not alter the core Article 284 mechanism, but boards and GCs should verify the precise current text against the Official Gazette version rather than relying on unofficial translations.

It is equally important to distinguish the Article 284 exemption from the anti-money laundering regime. Where a bribe payment constitutes a predicate offence generating proceeds, those proceeds may constitute money-laundering under Federal Decree-Law 10/2025 (in force 14 October 2025, replacing FDL 20/2018). FDL 10/2025 carries fines up to AED 100 million, imposes personal manager liability, and contains no statute of limitations for money-laundering. An Article 284 exemption for the underlying bribery offence does not automatically extinguish AML exposure arising from the same transaction; that requires separate analysis and, where a financial institution is involved, engagement with the Central Bank under CBUAE Law No. 6/2025.

Conditions for the Exemption: What Article 284 Actually Requires

The exemption under Article 284 is conditioned on three interlocking elements, each of which must be satisfied for the provision to operate. First, the reporting party must be the bribe-giver, offeror, or intermediary — not the recipient. A public official who accepted a bribe cannot invoke Article 284 to escape liability under Articles 275 to 279; those provisions carry separate and heavier penalties. Second, the disclosure must be made to competent authorities. In practice this means the Public Prosecution (Al-Niyaba Al-Amma) operating under Federal Decree-Law 38/2022 (the Criminal Procedure Law), in force from 1 March 2023, or — depending on subject matter — specialised enforcement bodies such as the Abu Dhabi Accountability Authority, the Dubai Judicial Inspection Department, or relevant free-zone regulators. Third, and most critically, the disclosure must precede any awareness by the authorities of the offence.

The 'before discovery' threshold is where most cases succeed or fail. UAE courts have interpreted 'awareness' broadly: it is not limited to a formal investigation or arrest. If a regulator has received a suspicious transaction report (STR) referencing the transaction, if a whistleblower has already approached the prosecution, or if the matter is under administrative inquiry by a government body, the window for Article 284 may already have closed. Boards and GCs who discover bribery internally must therefore act with genuine urgency — not merely expedience — because every day of deliberation increases the risk that a parallel report has already triggered official awareness. The burden of demonstrating prior ignorance by authorities will, in contested cases, fall on the reporting party.

The exemption covers the bribery offences in the chapter — Articles 275 to 283. It does not, on its face, extend to collateral offences that may have been committed in furtherance of the bribe: forgery of documents (Article 216 et seq., FDL 31/2021), abuse of position (Article 234), or fraud (Article 399). A comprehensive self-report therefore requires separate legal analysis of every collateral exposure before the report is made, because the act of reporting will itself generate an evidentiary record that prosecutors may use to investigate those ancillary matters. The report is not a general amnesty; it is a targeted statutory exemption for a defined category of conduct.

Where a corporate entity is involved, FDL 31/2021 provides for corporate criminal liability. An entity making an Article 284 report through its authorised representative should ensure that the authorisation is documented and that the report is structured to cover both individual and corporate exposure. Under FDL 10/2025, 'managers and persons in charge' face personal liability for AML predicate offences if committed with their knowledge or through their negligence — a point that makes the decision to self-report simultaneously a personal and institutional one for any C-suite executive.

The Strategic Decision: When to Report, When to Investigate First, and When Not to Report

For a board, GC, or HNW individual who has discovered potential bribery, the instinct may be to conduct an internal investigation before approaching authorities. That instinct is understandable but carries legal risk under the UAE framework. An extended internal investigation that delays reporting may inadvertently eliminate the Article 284 window if, during the investigation period, an STR is filed by a bank, a counterparty approaches prosecutors, or a regulatory inquiry commences. The Federal Decree-Law 10/2025 AML regime imposes STR obligations on designated non-financial businesses and professions (DNFBPs) and financial institutions; if the entity's own compliance team has already filed or is obliged to file an STR, that filing may itself constitute 'awareness' by competent authorities for Article 284 purposes.

The correct sequencing is a compressed, privileged preliminary review — not a full investigation — sufficient to (a) confirm that reportable conduct has in fact occurred or is reasonably suspected; (b) identify the individuals involved and their roles as givers, offerors, or intermediaries; (c) assess whether the conduct falls within Articles 275 to 283; (d) identify and ring-fence any collateral offences requiring separate strategy; and (e) verify, through discreet intelligence, that no official inquiry has yet commenced. This review should be conducted under legal professional privilege. Under UAE law, privilege attaches to confidential communications between a lawyer and client for the purposes of legal advice — a principle recognised in the evidentiary framework under Federal Decree-Law 35/2022 (the Evidence Law).

The decision not to report also requires rigorous analysis. Where the bribery was committed under duress — for example, an extortionate demand by a public official — the legal position differs, and Article 284 may not be the only or best avenue. Where the exposure is primarily private-sector under Article 281, the commercial and reputational calculus differs from a public-official bribery scenario. In multi-jurisdictional situations — for instance, a UAE-based company with UK, US, or EU operations — a UAE Article 284 report may trigger disclosure obligations or waiver arguments in other jurisdictions, or conversely, a UK or US deferred prosecution agreement may not satisfy the UAE 'competent authority' requirement. Multi-jurisdictional coordination of self-reports requires specialist counsel in each relevant jurisdiction and should not be sequenced without that coordination.

Financial institutions subject to CBUAE Law No. 6/2025 face an additional layer: the Central Bank may impose administrative fines up to AED 1 billion for compliance failures, independently of any criminal prosecution. A self-report to the Public Prosecution that is not simultaneously coordinated with Central Bank notification where required may result in the criminal exposure being resolved while the regulatory exposure remains open and, arguably, aggravated by the evidence contained in the criminal report itself.

Procedure: How a Self-Report Is Made and What It Must Contain

There is no prescribed form under FDL 31/2021 or the Criminal Procedure Law (FDL 38/2022, as amended by FDL 45/2023) for an Article 284 self-report. In practice, a report is submitted to the relevant Public Prosecution office — which in the UAE operates at the federal level and through emirate-level prosecution departments — or, where the bribery involves a regulated sector, to the sector regulator simultaneously. The report should be submitted in Arabic (the language of judicial proceedings) with a certified translation if originally drafted in English; courts will treat the Arabic text as authoritative.

A well-constructed self-report for Article 284 purposes should contain, at minimum: (a) the identity and legal status of the reporting party (individual or corporate); (b) a clear narrative of the conduct, identifying dates, amounts, payment mechanisms, and parties, with supporting documentary evidence secured prior to submission; (c) explicit invocation of the Article 284 exemption, including a statement that the report is being made before authorities have become aware; (d) identification of any witnesses the reporter is prepared to produce; and (e) a reservation of rights in respect of any collateral issues that require further legal analysis. The reservation at (e) is important: a report that over-discloses may inadvertently waive privilege or create an evidentiary basis for prosecution on ancillary matters.

Under FDL 38/2022, the Public Prosecution has broad powers to summon, detain, and seize assets once a matter is in their hands. A self-reporting party should therefore secure legal representation before the report is submitted, not after, and should be prepared for the possibility that the prosecution will move immediately to verify the report by interviewing other parties, including the bribe recipient — who is not protected by Article 284 and who may themselves become a target. Asset-protection steps (such as reviewing whether civil recovery claims against the bribe recipient are available) should be considered as part of the pre-report preparation.

Where the bribery involves proceeds that have passed through the financial system, the FDL 10/2025 AML regime requires coordination with CBUAE and, if the entity is a reporting institution, a determination of whether an STR has already been filed. Cabinet Resolution 134/2025 (the Executive Regulations to FDL 10/2025) sets out the obligations of compliance officers and the tipping-off prohibition: counsel must ensure that the self-report process does not inadvertently constitute a 'tip-off' to the bribe recipient in violation of those regulations, which carry independent criminal penalties.

What the Exemption Covers — and What It Does Not

The Article 284 exemption, when validly invoked, produces a mandatory exemption from the penalties prescribed under the bribery chapter of FDL 31/2021. In practical terms, this means the Public Prosecution should not proceed with a bribery charge against the reporting party. However, the UAE system does not provide for a formal 'declination letter' equivalent to those issued by the US DOJ or UK SFO; the exemption operates as a legal bar to conviction rather than as a proactive official clearance. Prosecutors retain discretion as to whether to accept the factual basis of the report and whether to investigate the recipient, and the reporting party should be prepared for a period of uncertainty following submission.

The exemption does not cover: (a) money-laundering charges under FDL 10/2025 arising from the same transaction; (b) forgery, fraud, or abuse-of-position offences under FDL 31/2021 that were committed in furtherance of the bribe; (c) tax-related offences, including under Federal Decree-Law 47/2022 (Corporate Tax Law) if bribe payments were improperly deducted — noting that voluntary disclosure under the tax regime carries graduated penalties of 1–4% versus 15% on audit assessment; (d) regulatory sanctions by sector regulators such as the CBUAE (fines up to AED 1 billion under Law No. 6/2025) or, from 1 January 2026, the Capital Markets Authority under FDL 32/2025; or (e) civil liability to any party harmed by the bribery, including the entity on whose behalf the bribe-giver acted.

The civil dimension is frequently underestimated. A company whose employee paid a bribe may face claims from shareholders, joint-venture partners, or counterparties who suffered loss. Self-reporting to the prosecution does not estop those claims and may in fact strengthen them by providing an official record of the admitted conduct. Boards should instruct counsel to conduct a parallel civil-exposure mapping exercise before the criminal report is submitted, identifying potential claimants and the limitation periods applicable under UAE civil law.

On the international dimension, the UAE's extradition framework under Federal Law 39/2006, as amended by FDL 38/2023, means that a UAE-resident individual who has self-reported should assess whether foreign jurisdictions with concurrent jurisdiction — particularly those with long-arm bribery statutes — might seek extradition or mutual legal assistance. The UAE's removal from the FATF grey list in February 2024 and subsequent removal from the EU high-risk list in 2025 has increased the UAE's engagement with international MLA requests, and an Article 284 report may generate documentary evidence that is transmitted to foreign prosecutors under those arrangements.

Corporate Governance Implications: Boards, Compliance Functions, and Mandatory Reporting

For listed companies, financial institutions, and large corporates operating in the UAE, the discovery of bribery triggers obligations that sit alongside — and may conflict with — the Article 284 self-reporting strategy. Under FDL 10/2025, compliance officers at financial institutions and DNFBPs are obliged to file STRs with the Financial Intelligence Unit (FIU) upon suspicion of money-laundering or a predicate offence. Bribery is a predicate offence under FDL 10/2025. An STR filing that precedes the Article 284 report may, as noted above, eliminate the 'before discovery' condition. Compliance officers and boards must therefore understand that the STR obligation and the Article 284 strategy must be sequenced — or, where sequencing is impossible, that the STR should itself be treated as the self-report, with immediate parallel notification to the Public Prosecution.

Board liability under FDL 31/2021 and FDL 10/2025 is direct and personal where directors authorised, facilitated, or negligently failed to prevent bribery. The personal manager liability provisions of FDL 10/2025 — which are broader than those under the repealed FDL 20/2018 — mean that a director who discovers bribery and fails to report it faces independent exposure. The Article 284 exemption does not, on its terms, extend to a director who was merely complicit through negligence rather than active conduct; that exposure must be addressed through the FDL 10/2025 voluntary disclosure framework and through engagement with the relevant regulator.

Whistleblower protection in the UAE is evolving but remains less robust than in comparable common-law jurisdictions. There is no dedicated federal whistleblower protection statute equivalent to the UK's Public Interest Disclosure Act. Internal reporting channels and non-retaliation policies are increasingly required under Central Bank and SCA (now CMA from 1 January 2026 under FDL 32/2025) governance frameworks. Boards that discover bribery through internal whistleblower reports should take care not to allow any adverse employment action against the whistleblower, both as a matter of good governance and because such action could be characterised as obstruction in the context of a subsequent prosecution.

Practical Timeline and Action Map for the First 72 Hours

When credible evidence of bribery surfaces — whether through an internal audit finding, a regulatory inquiry, a counterparty complaint, or an employee disclosure — the first 72 hours are determinative. The following action map reflects the practical steps that experienced UAE criminal counsel would implement in that window. First, immediately convene a privileged crisis session with external legal counsel. Do not circulate findings by email or messaging platforms that may be subject to seizure under FDL 38/2022 search-and-seizure powers; use in-person or legally privileged channels. Second, conduct a rapid document preservation exercise: secure original records, communications, and financial data relevant to the bribery allegation without alteration. Destruction or alteration of evidence is a separate criminal offence under FDL 31/2021.

Third, commission a privileged preliminary assessment — not a full investigation — to confirm: whether the conduct falls within Articles 275 to 283 of FDL 31/2021; whether any STR has been or is imminently required to be filed; whether any regulatory inquiry has already commenced; and whether any collateral offences are present. Fourth, conduct discreet intelligence on official awareness: counsel with established relationships with the prosecution and regulatory community can, without disclosing the client's identity, obtain a reasonable assessment of whether the matter is already on official radar. Fifth, if the preliminary assessment confirms reportable conduct and no official awareness, prepare and submit the Article 284 report in Arabic, through counsel, to the appropriate Public Prosecution office, simultaneously addressing any mandatory STR obligations under FDL 10/2025.

Sixth, prepare key individuals for prosecution interviews. Once a report is submitted, the prosecution will exercise its powers under FDL 38/2022 to summon and question relevant persons. The reporting party and any witnesses they have identified should be prepared for this process. The Article 284 exemption protects the reporting party from bribery conviction; it does not protect them from questioning, and anything said in prosecution interviews may be used in relation to collateral matters. Seventh, map civil and regulatory exposure in parallel: identify potential civil claimants, assess limitation periods, and prepare regulatory notifications to CBUAE, CMA (from 2026), or other sector regulators as required by their governance frameworks. This parallel workstream should run concurrently with, not sequentially after, the criminal self-report process.

Practical checklist

Verify internally that no STR has been filed before initiating Article 284 process.
Instruct external counsel under privilege before any document is circulated internally.
Preserve all original evidence immediately; do not alter, delete, or move records.
Confirm conduct falls within Articles 275–283, FDL 31/2021, before characterising as bribery.
Assess AML exposure under FDL 10/2025 and map it separately from the bribery exemption.
Prepare the self-report in Arabic with certified translation and explicit Article 284 invocation.
Coordinate multi-jurisdictional strategy before submitting if cross-border nexus exists.
Brief board and compliance function on personal manager liability under FDL 10/2025.

What we'd typically advise

In our experience advising on UAE white-collar matters, the single most common error we see is the extended internal investigation conducted without legal oversight before anyone has assessed whether the Article 284 window remains open. By the time a board has received a polished internal report, weeks may have passed and a counterparty's bank may already have filed a suspicious transaction report. The statutory exemption under Article 284 of FDL 31/2021 is powerful but perishable.

We would typically recommend a compressed, legally privileged preliminary review — targeted, not exhaustive — followed by an immediate assessment of official awareness and mandatory STR obligations under FDL 10/2025. If the window is open, the report should be submitted promptly, in Arabic, through counsel, with collateral exposures ring-fenced and addressed through parallel workstreams. Acting quickly and correctly at the outset is materially more valuable than acting thoroughly and late.

Frequently asked questions

Does the Article 284 exemption apply if I was pressured into paying the bribe?

Article 284 of FDL 31/2021 does not distinguish between voluntary and coerced payments for the purpose of the exemption — both the bribe-giver and the offeror are covered. However, duress may also provide a separate defence to the underlying charge and should be assessed independently. The exemption applies where you report before authorities become aware; the duress context does not extend the reporting window but may be relevant to how the prosecution exercises its discretion once a report is received.

If my company already filed an STR with the FIU, can we still use Article 284?

This is a critical threshold question. An STR filed by your compliance function with the Financial Intelligence Unit under FDL 10/2025 may constitute 'awareness by competent authorities' for Article 284 purposes, depending on the content of the STR and whether it identified the specific bribery conduct. Counsel should immediately review the STR content and assess whether it triggered official awareness of the specific offence. If so, the Article 284 window may be closed for the bribery charge, and strategy should shift to mitigation, cooperation, and addressing AML exposure separately.

Does self-reporting protect the company from money-laundering charges under the new AML law?

No. Article 284 of FDL 31/2021 provides an exemption from the bribery penalties under Articles 275–283 only. Federal Decree-Law 10/2025, the current AML statute (in force 14 October 2025), contains independent offences with fines up to AED 100 million and no statute of limitations for money-laundering. Where bribe proceeds have passed through the financial system, AML exposure must be addressed through the separate voluntary disclosure and cooperation framework under FDL 10/2025 and engagement with the CBUAE or FIU as appropriate.

Can an intermediary — such as a consultant or agent who facilitated the bribe — also invoke Article 284?

Yes, explicitly. Article 284 of FDL 31/2021 covers the bribe-giver, the offeror, and the intermediary. A consultant, agent, or facilitator who discovers they were used to channel a bribe, and who reports the matter to competent authorities before those authorities become aware, may qualify for the exemption on the same terms as the primary payer. The intermediary should ensure they have their own independent legal representation, as their interests may diverge from those of the principal who instructed them.

What happens after I submit the report — will I be questioned by prosecutors?

Yes. Under Federal Decree-Law 38/2022 (the Criminal Procedure Law, in force 1 March 2023), the Public Prosecution has broad powers to summon any person for questioning once a matter has been reported. The Article 284 exemption protects you from conviction for the bribery offence itself; it does not exempt you from the investigative process. Statements made in prosecution interviews may be used in relation to collateral matters such as forgery or fraud. You should have counsel present for any interview and prepare thoroughly in advance of submission.

We are a listed company. Does the Capital Markets Authority (CMA) need to be notified separately?

From 1 January 2026, the Capital Markets Authority replaces the SCA under Federal Decree-Law 32/2025. Listed companies are subject to disclosure obligations under the CMA governance framework; a material bribery matter — particularly one affecting financial statements or creating contingent liability — may trigger a disclosure obligation to the CMA in addition to the criminal self-report to the Public Prosecution. These are independent obligations; satisfying one does not discharge the other. Counsel should assess both simultaneously as part of the pre-report preparation.

Could a UAE Article 284 report be used against me in a foreign jurisdiction — for example, the US or UK?

This is a real risk in multi-jurisdictional matters. The documentary record created by an Article 284 report may be transmitted to foreign prosecutors under the UAE's mutual legal assistance framework, Federal Law 39/2006 as amended by FDL 38/2023, in response to MLA requests. The UAE's enhanced international cooperation posture following FATF grey-list removal in February 2024 means MLA requests are processed more efficiently than previously. If the conduct has any US, UK, or EU nexus — through nationality, currency, or business operations — foreign counsel must be instructed before the UAE report is submitted to assess whether the report creates or waives privilege and how it interacts with foreign self-reporting frameworks.

Is there a time limit within which I must report to qualify for the exemption?

Article 284 of FDL 31/2021 does not specify a fixed time limit from the date of the bribery; the operative condition is that the report is made before authorities become aware, not within a defined period after the offence. However, the longer the delay between the occurrence of the bribery and the report, the greater the risk that official awareness has independently arisen — through STRs, regulatory inquiries, whistleblowers, or counterparty complaints. There is no safe harbour period; urgency is determined by the risk of parallel discovery, not by a statutory clock.

Related guides

Published 15 July 2026. General information only — not legal advice. Contact us for matter-specific advice.