In the (free) zone

As part of its strategy to become a global business location, the United Arab Emirates (UAE) has created a range of special economic zones, including the Dubai International Financial Centre (DIFC). An independent, common‑law jurisdiction under the UAE Constitution, the DIFC has its own civil and commercial laws, courts and financial services regulator (the Dubai Financial Services Authority, DFSA).

Especially over the last two decades, the international community has made noteworthy efforts in terms of anti‑money laundering and combatting the financing of terrorism (AML/CFT). Largely driven by intergovernmental organisations, such as the Financial Action Task Force (FATF), these efforts have given rise to standards that are now widely accepted. By way of consequence, today, the success of financial free zones like the DIFC also depends on the existence of robust AML rules, as well as on their effective enforcement.

Two distinct and complementary sets of rules govern the AML system in the DIFC (both of which are administered by the DFSA):

• Federal Law No. 20 of 2018 on Anti‑Money Laundering and Combating the Financing of Terrorism and Illegal Organisations, Federal Law No. 7 of 2014 on Combating Terrorism Offences, and the implementing regulations under those laws (the Federal Legislation); and
• Part 4, Chapter 2 of the Regulatory Law, and the DFSA Rulebook – Anti‑Money Laundering, Counter‑Terrorist Financing and Sanctions Module (the Free Zone’s Regime).

In 2020, following the overhaul of the UAE laws, the DIFC updated the relevant provisions of the DFSA Rulebook.

Personal scope of application

The DFSA Rulebook applies to any ‘relevant person’ in the free zone’s territory. The notion of ‘relevant person’ comprises the following categories:

• authorised firms (i.e., entities that offer financial services);
• authorised market institutions (i.e., entities operating an exchange or clearing house or an alternative trading system);
• designated non‑financial businesses or professions (e.g., real estate developers or agents, law firms, accounting firms, audit firms, precious metal dealers, company service providers, single family offices); and
• registered auditors.

Criminal offences

The Federal Legislation defines four AML offences. First, ‘money laundering’ is defined as:

• converting or transferring the proceeds of crime to conceal an illegal source or the source of the proceeds of crime;
• acquiring, using or possessing the proceeds of crime; or
• helping the perpetrator of a money laundering or predicate offence escape punishment.

In all three forms of money laundering, the person must act intentionally and be aware that the property at issue is the proceeds of crime.

Second, ‘financing terrorism’ is defined as using the proceeds of crime to fund terrorist organisations, terrorists or acts of terrorism. Third, ‘financing illegal organisations’ is defined as carrying out money laundering while being aware that the proceeds are owned by, or intended to finance, a terrorist or illegal organisation or person. Fourth, ‘tipping off’ is defined as disclosing the fact that certain persons are under review in relation to suspicious transactions or are being investigated by the competent UAE authorities.

Any of the aforementioned money laundering acts constitutes an aggravated offence if the suspected individual is aware that the proceeds are partially or wholly owned by a terrorist organisation, or they had the intention of financing a terrorist organisation. The offence is aggravated even in the absence of an intention to provide, collect, prepare or obtain (or facilitate obtaining) the proceeds of crime, directly or indirectly, as long as the potential perpetrator knows that such proceeds will be used, in whole or in part, to commit a terrorist offence, or to intentionally commit such acts on behalf of a terrorist organisation/person while being aware of their true background or purpose.

The Federal Legislation also covers activities that DIFC‑registered entities undertake outside the UAE, in particular if:

• any part of the money laundering process involved the DIFC entity and occurred in or through the UAE (such as a money transaction);
• the ‘end point’ of the money laundering process or the benefit of a money laundering transaction is realised or was intended to be realised in the UAE wholly or partially for the benefit of the DIFC entity (or its officers or employees); or
• the DIFC entity itself or its officers or employees assists a money laundering crime that occurs wholly or partly in the UAE.

Obligations of DIFC entities

Pursuant to the Federal Legislation and Free Zone’s Regime, DIFC‑registered entities must ensure that they do not knowingly engage in any of the aforementioned offences. Therefore, in line with a risk‑based approach, any relevant person must evaluate the AML risks in a manner that is proportionate to them. Moreover, such assessments need to be conducted at appropriate intervals, based on reasonable grounds and proper documentation. The responsibility for the relevant person’s compliance resides with every member of its senior management. Further, DIFC financial institutions and designated non‑financial businesses or professions are required to identify crime risks, have in place the necessary due‑diligence measures and procedures, refrain from opening or conducting financial/commercial transactions with anonymous/fictitious names, and develop internal policies and controls to manage identified risks and mitigate them.

To ensure the implementation and oversight of its compliance with the AML rules, a relevant person must appoint a money laundering reporting officer with an appropriate level of seniority and independence to act in the role. What is more, financial institutions and designated non‑financial businesses or professions need to report suspicious money laundering or terrorist financing transactions to the UAE Financial Intelligence Unit (FIU), while refraining from tipping off the reported person. Irrespective of the Free Zone’s Regime, under the UAE Penal Code, all persons have a general duty to report crimes of which such persons have knowledge.

Sanctions in case of AML violations

Non‑compliance with the Free Zone’s Regime may result in imprisonment or a fine ranging from AED10,000 to AED100,000. A failure to report suspicious activity to the FIU may entail imprisonment and/or a fine of between AED100,000 and AED1 million. Persons that have committed a criminal offence under the Federal Legislation face fines ranging from AED100,000 to AED50 million, or a prison term ranging from six months to ten years and the removal or suspension of their business licences. Pursuant to the Federal Legislation, other possible consequences include the confiscation of assets, travel bans and, if the perpetrator is a foreigner, deportation or restriction of freedom. What is more, directors and managers of companies can be subject to criminal, civil and regulatory actions, while companies can face criminal fines as well as civil and regulatory actions.

Compliance reviews

In the DIFC, all financial service providers are subject to compliance reviews. These either take the form of a general evaluation or an evaluation targeting a particular risk element. All compliance reviews comprise both a desk‑based review and an on‑site review. The desk‑based review comprises an assessment of the AML policies and procedures (e.g., general policy and risk statement, client on‑boarding templates, know‑your‑client procedures, sanctions screening and transaction monitoring). The on‑site review involves a sample review of client files (including the clients’ source of wealth and funds), a sample transaction review, a review of sanctions screening documentation, as well as AML training materials. It also comprises interviews with staff (e.g., client on‑boarding team, client‑facing staff, audit personnel, senior management, etc.). Although most of the compliance reviews are general evaluations, the DFSA also undertakes AML assessments upon certain triggers (e.g., change in business activities, increase in number of clients).

Overall progress and challenges

In 2019, the EU removed the UAE from the list of jurisdictions that have failed to cooperate with Brussels on tax matters, citing the adoption of new rules on offshore structures, including the introduction of economic substance rules to fight economic crime, as a reason for its decision.[1] According to the FATF’s 2020 Mutual Evaluation Report,[2] the UAE, including the DIFC, has made considerable improvements as regards its AML system over the past few years. The report noted that the jurisdiction has achieved positive results in investigating and prosecuting the financing of terrorism. At the same time, it considered the limited number of money laundering prosecutions and convictions, especially in Dubai, as a source of concern given the country’s risk profile.