In brief: 

· On 7 April 2022, the Dubai Financial Services Authority (DFSA) introduced a new whistleblowing regime (the Regime).

· The Regime has significant parallels with that enforced in the United Kingdom by the Financial Conduct Authority (FCA), although some of the more advanced requirements incorporated into the FCA’s regime are yet to be introduced by the DFSA.

· The Regime aims to provide better legal protection for those who report concerns within the Dubai International Financial Centre (DIFC), improve whistleblowing culture in DFSA regulated entities, encourage greater reporting (both internally and to the DFSA) and promote an ethical culture within the DIFC by deterring wrongdoing.

· DFSA regulated firms must immediately implement an appropriate whistleblowing programme (no grace period for implementation is provided by the Regime).

On 7 April 2022, changes to DIFC Regulatory Law 2004 and the DFSA Rulebook came into force, to implement proposals consulted on by the DFSA in 2021 concerning a whistleblowing regime. The Regime applies to all entities regulated by the DFSA (Regulated Entities), which must now introduce appropriate measures.

Who is a whistleblower?

The Regime defines a whistleblower as any person who, in good faith, discloses a reasonable suspicion that a Regulated Entity (including its officers or employees) is, has or might have been:

· in contravention of a provision of the law, rules or other any other legislation administered by the DFSA; or

· engaged in money laundering, fraud, or any other financial crime.

A report is made in good faith if it is made “honestly rather than for a dishonest or malicious purpose”. What constitutes a reasonable suspicion is dependent on the circumstances.

For the protection of the Regime to apply, the report must be made within the Regulated Entity or externally to its auditor, the DFSA or a law enforcement agency.

What protection must a whistleblower be given? 

Where a whistleblower makes a qualifying disclosure, Article 68A(4) of the DFSA Rulebook provides that the individual (who, importantly, can remain anonymous) must not:

· be subject to any civil or contractual liability for having made that disclosure;

· have any contractual, civil or other remedy or right enforced against them by another person; or

· be dismissed from their employment or be subject to any other action reasonably likely to cause detriment to them.

What must Regulated Entities do?

The Regime requires that Regulated Entities must put in place “effective policies and procedures” that:

· establish effective internal arrangements to allow for the disclosure of regulatory concerns, along with associated procedures to receive, assess and possibly escalate whistleblower reports within the Regulated Entity, the DFSA or any other relevant authority;

· include reasonable measures to (i) protect the identity and confidentiality of the whistleblower; and (ii) protect them from suffering “detriment” because they raised a concern; and

· provide feedback to the whistleblower, where appropriate.

Comparison with the FCA

The Regime largely mirrors Rule 18 of the FCA’s Senior Management Arrangements, Systems and Controls (SYSC), as set out in the FCA Handbook in respect of FCA authorised firms (Firms). It is worth noting two interesting ways in which SYSC goes beyond the Regime.

· Firms must appoint a “whistleblowers’ champion”. This individual is responsible for overseeing and maintaining the integrity of a Firm’s internal arrangements concerning whistleblowing and must be both sufficiently independent and senior within the firm to carry out this role effectively.

· Firms must include a term in any settlement agreements with employees which makes clear that nothing in such an agreement prevents a worker from making a protected disclosure (as defined by the UK Employment Rights Act 1996).

The DFSA is due to conduct a review of the Regime in mid-2023 which may result in further measures being introduced, such as those described above.

Along with the recent establishment of a specialist court in Dubai to hear cases relating to money laundering and financial crime, the introduction of the Regime is a further example of ongoing efforts to promote Dubai as a leading jurisdiction in which to do business, by encouraging sophisticated governance and compliance processes amongst businesses in Dubai, tackling financial crime and enhancing the integrity generally of the UAE’s financial system.

In seeking to comply with the new rules, care should be taken to design a whistleblowing system that is both effective and proportionate, while at the same time avoiding the pitfalls often associated with ‘off the shelf’ solutions or those that are poorly implemented.

Simon Airey and Hamid Yunis are partners at McDermott Will & Emery and Joshua Domb is an associate at the firm. All three are based in London.