White-Collar Allegations and Your Reputation: Defamation, Leaks and Media Under UAE Cybercrime Law

A fraud allegation — even an unproven one — can detonate an executive's reputation within hours. Under current UAE law, those who spread, leak or amplify such allegations face serious criminal and civil exposure, and so, critically, do those who respond carelessly.

The Legal Architecture: Defamation, Cybercrime and Privacy in UAE Law

UAE reputation protection rests on three interlocking pillars. First, the Federal Penal Code under Federal Decree-Law 31/2021 (in force 2 January 2022, as amended by FDL 36/2022) criminalises defamation and slander in Articles 425–428. Article 425 imposes imprisonment and/or a fine on anyone who attributes to another person — by any means — a fact that would expose them to punishment or contempt. Article 426 escalates penalties where the defamatory act is committed via a public medium. Critically, truth is a defence under Article 427 only where the statement concerns a public official acting in that capacity; for private individuals and executives, truth alone does not automatically preclude liability if the disclosure was unjustified.

Second, Federal Decree-Law 34/2021 on Combating Rumours and Cybercrime (the Cybercrime Law) is the primary instrument for digital reputation attacks. Article 43 criminalises use of information technology to invade privacy, including recording or broadcasting private communications. Article 44 targets publication of content that violates private or family life. Sentences reach imprisonment of up to two years and fines of AED 500,000, with aggravated penalties where the victim is a public figure or where the content goes viral. Importantly, Article 45 covers re-publication: forwarding a defamatory message, screenshot or voice note incurs the same exposure as the original sender. This is frequently overlooked by journalists, social media influencers and even lawyers communicating on WhatsApp.

Third, the Federal Data Protection Law (Federal Decree-Law 45/2021) creates civil liability for unauthorised processing of personal data, including professional reputation data. While enforcement is still maturing, it provides an independent cause of action before the UAE courts and before the regulator (Department of Economy and Tourism data protection office at federal level) without requiring proof of intent. For HNW individuals and executives, this creates a parallel civil track alongside criminal complaints.

The procedural gateway is Federal Decree-Law 38/2022 (Criminal Procedure Law, in force 1 March 2023, as amended by FDL 45/2023). Article 6 permits an aggrieved party to file a direct complaint to the Public Prosecution. Articles 247–260 govern the personal civil claim alongside criminal proceedings, allowing simultaneous pursuit of compensation and criminal sanction — a strategic option that concentrates pressure on a defendant and is frequently deployed in reputation disputes.

Anatomy of a Reputation Attack: Leaks, Anonymous Posts and Media Strategies

In white-collar proceedings, reputation damage rarely arises from a single source. Practitioners observe four recurring attack vectors. The first is the investigative leak: information from police files, prosecution submissions or regulatory correspondence surfaces in media reports before any charge is laid. Under FDL 38/2022, Article 73 imposes confidentiality obligations on all persons involved in a criminal investigation, including investigators, prosecutors and their staff. A journalist who receives and publishes leaked investigative material may face accessory liability under the Cybercrime Law, and the leaking official faces disciplinary and criminal sanction under the Penal Code (FDL 31/2021, Article 381 — breach of professional secrecy).

The second vector is coordinated social media campaigns. These typically involve anonymous accounts on X (formerly Twitter), LinkedIn or Telegram publishing allegations, purported evidence or reputational commentary. Identifying anonymous actors is now more achievable than many clients expect: under Article 43 of FDL 34/2021, the Public Prosecution may compel telecommunications providers and platform operators to disclose account holder information. UAE courts have issued such disclosure orders against international platforms, and platform compliance has improved materially since the FATF grey-listing period. Preservation requests should be filed within 48 hours of identification, given platform data retention policies.

The third vector is competitor or counterparty instrumentalisation: a civil adversary files a spurious fraud complaint to the Public Prosecution, then ensures the filing is publicised, knowing even an investigation — not a conviction — can destroy banking relationships and investor confidence. This tactic is well-documented in UAE commercial disputes. The correct response is to challenge the complaint's admissibility under FDL 38/2022 (Article 10 — abuse of process) and to simultaneously pursue the complainant for malicious prosecution and defamation.

The fourth vector is the institutional press release. A regulator, exchange or listed company issues a public statement referencing an individual by name in connection with alleged misconduct before any final determination. Under Federal Decree-Law 32/2025 (Capital Markets Law, CMA replacing SCA from 1 January 2026) and FDL 33/2025 (market conduct offences), regulatory bodies retain broad publication powers. However, these powers are not unlimited: procedural fairness obligations apply, and individuals named in regulatory statements retain the right to judicial review of the publication decision before the Federal Court of Appeal.

The White-Collar Intersection: Fraud Allegations and Compounded Exposure

When a fraud, market abuse or money-laundering allegation is made against an executive, two simultaneous legal exposures arise: the underlying substantive allegation, and the reputational attack that accompanies it. Mishandling the second can prejudice the first. Under Federal Decree-Law 10/2025 (AML/CFT/CPF Law, in force 14 October 2025, replacing FDL 20/2018), Article 14 introduces personal criminal liability for senior managers of corporate defendants where a money-laundering offence is attributable to the entity's failure of oversight. The new law carries fines up to AED 100 million and removes any statute of limitations for money-laundering offences. This means that reputation damage from even historic allegations has indefinite legal relevance.

Under FDL 33/2025 (market conduct), insider-dealing and market manipulation offences now carry penalties up to AED 200 million. Where an individual is publicly named — whether by the CMA under FDL 32/2025 or in media — before a final determination, the reputational consequence can itself constitute grounds for civil compensation if the naming was premature or procedurally defective. Practitioners should immediately assess whether the naming authority had a statutory basis, followed its own published procedures and applied proportionality — each a judicially reviewable question.

Bankruptcy proceedings create a distinct reputation nexus. Under Federal Decree-Law 51/2023 (Bankruptcy Law, in force 1 May 2024), the new dedicated Bankruptcy Court has powers to investigate pre-filing conduct for fraudulent or negligent bankruptcy (Articles 228–235). Once a bankruptcy petition is filed, it is a matter of public record. Competitors and media routinely surveil bankruptcy filings. The gap between filing and any finding of misconduct is a high-risk window during which speculative reputational commentary is common and legally actionable. Protective injunctions under the Bankruptcy Court's jurisdiction can be sought to restrain publication of prejudicial commentary pending determination.

For executives in financial institutions, CBUAE Law No. 6/2025 permits administrative fines up to AED 1 billion and empowers the Central Bank to publish enforcement decisions. The publication discretion is subject to internal governance procedures, but there is no general statutory right of pre-publication review for the named individual. This asymmetry makes proactive engagement with the CBUAE during investigation — rather than adversarial resistance — a critical reputation-preservation strategy.

Strategic Media Response: What the Law Permits and What It Prohibits

A common instinct is to respond publicly to false allegations. Under UAE law, this carries significant risk. Any statement made by or on behalf of an executive that is inaccurate — even inadvertently — can be characterised as an attempt to mislead the Public Prosecution under FDL 38/2022, Article 271 (obstruction). More practically, public statements by a suspect or accused during an active investigation are inadmissible as confessions but are fully admissible as contextual evidence and can be deployed by opposing counsel to construct a narrative of consciousness of guilt or pre-emptive damage limitation. The default position should be: no public statement without prosecution approval or legal privilege analysis.

Where a statement is necessary — for example, to protect a listed company's disclosure obligations under FDL 33/2025 or to address material market-moving rumours — it must be drafted with three constraints in mind. First, it must not contain statements that could constitute a sub judice contempt under FDL 38/2022 (Article 244 prohibits publication of material that prejudices pending criminal proceedings). Second, it must comply with the Securities and Commodities Authority's (and from 1 January 2026, the CMA's) disclosure rules on material information. Third, it must avoid any characterisation of the opposing party that could itself constitute a criminal defamation complaint.

The 'no comment' posture, while legally safest in isolation, is commercially dangerous in a relationship-driven market like the UAE. The calibrated alternative is a factual, legally reviewed statement that: confirms the matter is subject to legal process; affirms the individual's or entity's commitment to cooperation with authorities; and reserves full legal rights against those responsible for unlawful leaks or publications. Such a statement, issued through counsel on firm letterhead, signals institutional seriousness without creating evidentiary vulnerability. It should be accompanied by formal legal notices — sent by registered post and electronically with read receipts — to any media outlet or individual who has published actionable content, preserving the limitation period under FDL 38/2022 and establishing the record for any subsequent civil claim.

Enforcement Tools Available to the Targeted Executive

UAE law provides a substantial enforcement toolkit for the wrongly or prematurely accused. The first instrument is the criminal complaint under Article 6 of FDL 38/2022 to the Public Prosecution, supported by a detailed factual memorandum and preserved digital evidence. Complaints under the Cybercrime Law (FDL 34/2021) are handled by the Cybercrime Unit of the Abu Dhabi and Dubai Public Prosecutions, which have specialist investigative capacity. Evidence of a campaign — multiple accounts, coordinated timing, use of VPNs that can nonetheless be penetrated through IP forensics — significantly strengthens the complaint. The Prosecution may apply to courts for interim orders requiring platform takedowns within 24 hours under Article 46 of FDL 34/2021.

The second instrument is a civil claim for damages in parallel with or following criminal proceedings. Under FDL 31/2021 (Penal Code), Article 428, compensation may be claimed for moral injury (reputational harm) and material injury (quantifiable economic loss such as cancelled contracts, withdrawn credit facilities or depressed share value). UAE courts have awarded compensation in defamation cases that reflects actual business loss where the claimant adduces expert evidence of causation — typically a financial expert and a PR/reputation consultant who can speak to market impact. The civil claim can also encompass claims under the Data Protection Law (FDL 45/2021) for unauthorised data processing.

The third instrument is an urgent injunction. The UAE courts — including the DIFC Court under DIFC Court Law 2/2025 — have jurisdiction to grant urgent interim injunctions restraining publication or requiring removal of defamatory content. Following ADGM A17 v B17 [2025], ADGM courts have confirmed jurisdiction to grant worldwide freezing orders in support of foreign proceedings without a local-asset nexus, a development with direct relevance where the perpetrator of a reputational attack holds assets offshore. Where a defamation campaign is funded or directed from abroad, the combination of a UAE criminal complaint and an ADGM or DIFC worldwide freezing order can be a powerful deterrent and enforcement combination.

Cross-border enforcement is increasingly accessible. Under Federal Law 39/2006 as amended by FDL 38/2023 (Extradition and Mutual Legal Assistance), UAE authorities can request foreign states to preserve and disclose digital evidence in defamation and cybercrime matters, not only in fraud cases. The UAE has active MLAs with GCC states, the UK, India, and a growing number of common law jurisdictions. Executives targeted by campaigns operating from outside the UAE should not assume offshore operators are beyond reach.

Board and Institutional Obligations: Disclosure, Internal Investigations and Privilege

For listed entities and regulated institutions, a reputation crisis triggered by white-collar allegations creates immediate board-level governance obligations. Under FDL 33/2025, material information — including the fact that a senior officer is subject to a criminal investigation — must be disclosed to the CMA where it is likely to affect the market price of the entity's securities. The obligation is contemporaneous; there is no grace period pending internal investigation. Boards that delay disclosure pending a 'wait and see' approach face independent regulatory liability. The timing and content of mandatory disclosure must therefore be calibrated against the risk of prejudicing the criminal defence — a tension that requires immediate senior external counsel engagement.

Internal investigations, when properly structured, attract legal professional privilege under UAE law (as confirmed by practice under FDL 38/2022 and the Evidence Law FDL 35/2022). To maintain privilege, the investigation must be commissioned by lawyers rather than compliance officers, directed primarily at obtaining legal advice rather than remediation, and its outputs must not be shared with regulators without explicit privilege waiver analysis. A badly structured internal investigation — increasingly common where compliance teams act without counsel supervision — can generate disclosable material that becomes a primary evidential source against the very individual the board is seeking to protect or distance itself from.

Beneficial ownership obligations under Cabinet Decision 109/2023 (25% threshold) mean that where an executive who is under investigation holds a qualifying beneficial interest in a UAE entity, that interest is on a public or semi-public register accessible to regulators and sophisticated adversaries. Restructuring beneficial ownership mid-investigation carries serious risk of being characterised as asset concealment under FDL 10/2025 (AML Law) or the Penal Code. Boards should take urgent advice before any ownership restructuring during an investigation period.

Practical Response Timeline: The First 72 Hours and Beyond

Reputation management white collar UAE cases are defined by speed of response in the first 72 hours. Hour one to four: retain external criminal and civil counsel simultaneously; instruct a specialist digital forensics provider to capture, hash and preserve all relevant online content, including social media posts, screenshots, archived web pages and messaging application content. This preservation is essential for admissibility before UAE courts, which apply strict authenticity requirements under the Evidence Law (FDL 35/2022, Articles 27–33 on electronic evidence). Evidence not properly preserved at source is routinely challenged and excluded.

Hours four to twenty-four: conduct a privilege-protected audit of all internal communications that could be relevant to the allegations. Under FDL 38/2022, investigators can seek production orders at any stage; documents that exist and are not subject to valid privilege are producible. Identify any communications that are ambiguous or capable of mischaracterisation and obtain immediate legal advice on context. Do not delete — deletion during an active or reasonably foreseeable investigation constitutes a criminal offence under the Penal Code (FDL 31/2021, Article 378 — tampering with evidence).

Hours twenty-four to forty-eight: file urgent cybercrime and defamation complaints with the relevant Public Prosecution (Abu Dhabi, Dubai or applicable emirate) with a detailed factual memorandum and preserved evidence bundle. Simultaneously, send formal legal notices to media outlets, social media accounts and any identified individuals who have published actionable content. Issue a measured, legally reviewed public statement through counsel where commercially necessary. Begin the process of notifying banks, key commercial counterparties and investors in a controlled, legally reviewed communication — this pre-emptive outreach, conducted properly, significantly reduces the risk of unilateral banking restrictions or contract termination.

Beyond 72 hours: engage proactively with any regulatory authority that is likely to be notified of the matter — CBUAE, CMA, or the Financial Intelligence Unit under FDL 10/2025. Regulators who receive a cooperative, well-advised subject are demonstrably more likely to exercise administrative rather than criminal routes and to limit public disclosure. Instruct a reputation management consultant who is experienced in UAE media dynamics and works under a legally privileged retainer, ensuring their work product does not become disclosable in subsequent proceedings. Finally, map the international dimension: where assets, witnesses or perpetrators are cross-border, initiate preservation and MLA strategy under FDL 39/2006 as amended.

Practical checklist

• Preserve all digital evidence within 4 hours using forensic hashing compliant with FDL 35/2022
• File cybercrime complaint with Public Prosecution under FDL 34/2021 within 24–48 hours
• Send formal legal notice to media and social media accounts before limitation period runs
• Issue no public statement without privilege review and prosecution-risk analysis under FDL 38/2022
• Audit internal communications for ambiguity before any investigative authority requests production
• Assess mandatory disclosure obligations under FDL 33/2025 if the entity is listed or regulated
• Engage CBUAE, CMA or FIU proactively where regulatory notification is probable or imminent
• Map cross-border asset and witness locations early for MLA strategy under FDL 39/2006

Frequently asked questions

Related guides

• Personally Named in a UAE Financial-Crime Investigation? A Director and CFO Survival Guide
• Off-Plan Property and Escrow Fraud in Dubai: Recovering Your Money
• Letter of Credit and Bank Guarantee Fraud: When Can You Injunct Payment in the UAE?
• White-Collar & Financial Crime — full guide

Published 15 July 2026. General information only — not legal advice. Contact us for matter-specific advice.