Ever felt like your company needs its own Sherlock Holmes? Well, welcome to the United Arab Emirates, where corporate investigations are the new mystery novels, and every firm needs a detective hat. As of 2023, the UAE is witnessing a surge in the frequency of these investigations, driven by the introduction of comprehensive financial regulations and the impending implementation of federal corporate tax. This article aims to conduct internal investigations in the UAE, exploring the legal framework, and the critical steps involved.
1. Understanding Whistle-Blower Protection:
One of the fundamental aspects of internal investigations in the UAE revolves around whistle-blower protection. Although federal law does not explicitly define whistle-blowers, various protections exist at both emirate and free-zone levels. Notably, the Dubai International Financial Centre (DIFC) has implemented a Whistleblowing Regime, aligning with global best practices. This regime ensures the availability of internal reporting channels, protects whistle-blowers from retaliation, and imposes penalties for non-compliance. Additionally, the Central Bank of the UAE has established an anonymous whistle-blowing portal, encouraging incident reporting without fear of reprisal. As companies gear up to face an increase in whistle-blower reports, establishing online reporting platforms and training employees becomes crucial to maintaining control over the investigative process.
2. Initiating and Scoping an Investigation:
Deciding when and how to initiate an internal investigation in the UAE involves careful consideration of various factors. While there is no specific law governing the requirements for commencing an investigation, existing legislation outlines offenses that can be committed by corporate organizations or their employees. For instance, Federal Law No. 19 of 2016 addresses corporate fraud, and Federal Decree-Law No. 31 of 2021 imposes a duty on individuals to report crimes to competent authorities. The concept of corporate criminal liability, under article 66 of the Penal Code, emphasizes the importance of appropriately dealing with reports of serious employee misconduct.
Scoping an investigation requires a clear strategy, often developed in consultation with legal counsel. Identifying the investigation team, outlining the scope, detailing plans for evidence gathering, and establishing a flexible timeline are crucial steps. In this phase, companies must also address potential conflicts of interest, ensuring objectivity and credibility. Retaining external counsel adds credibility to the investigation, especially when reviewing directors’ conduct. Consultants, including e-discovery vendors and forensic accountants, may be engaged to facilitate a thorough and impartial fact-finding process.
3. Protecting Confidentiality and Data Privacy:
The UAE’s legal landscape mandates companies to navigate carefully through issues of confidentiality and data privacy during internal investigations. The Data Protection Law (Federal Decree-Law No. 45 of 2021) defines controls for processing personal data and obliges companies to secure and maintain the confidentiality of such data. While there is no explicit provision for cases where processing is necessary for a legitimate interest pursued by the controller, companies must ensure compliance with these regulations.
Confidentiality extends to preventing the disclosure of trade secrets and private information, with criminal sanctions under the Cybercrimes Law. In the context of internal investigations, companies must strike a balance between uncovering the truth and safeguarding individuals’ rights. Employee consent and adherence to legal justifications for data processing become pivotal elements in this process. Consulting with experienced Dubai lawyers ensures that companies interpret and apply the laws effectively, safeguarding their interests throughout the investigative process.
4. Responding to Investigation Outcomes:
Upon uncovering misconduct, companies face critical decisions on whether, when, and how to report to regulatory authorities or law enforcement agencies. Article 323 of the Penal Code establishes a general obligation to report crimes, and specific reporting obligations may apply to certain sectors. Companies that choose to self-report often receive favorable considerations from regulators. Engaging external counsel in this decision-making process ensures objectivity and expertise, helping companies demonstrate the integrity of their reporting decisions. Subsequently, taking corrective action becomes paramount, including disciplinary measures, policy revisions, and internal controls enhancements. Demonstrating commitment to remediation and preventive measures not only aids in regulatory compliance but also contributes to safeguarding the company’s reputation.
Conclusion:
As internal investigations become increasingly prevalent in the UAE, companies must embrace a proactive approach to compliance. From establishing robust whistle-blower protection mechanisms to scoping investigations strategically and safeguarding data privacy, adherence to the legal framework is paramount.