Corporate criminal exposure in the UAE is no longer theoretical; it is a live risk.

Federal Decree-Law No. 31 of 2021, known as the Crimes and Penalties Law, reshaped how companies are charged, fined, and sanctioned when crimes are committed by people acting for them.

This guide breaks down what actually triggers liability, the penalties a company can face, how investigators build cases, and what practical controls reduce heat in 2025.

It is written in plain language, you can brief a board or a GM, without losing legal precision.

The new Penal Code took effect on 2 January 2022 and continues to anchor corporate liability today.

What Law Are We Talking About, Exactly

Federal Decree-Law No. 31 of 2021 is the UAE’s current Penal Code.

It includes a dedicated chapter on the liability of legal persons.

Under Article 66, a “legal person” can be criminally liable for crimes committed by its representatives, directors, or agents acting in its favor or on its behalf.

Government agencies and certain public bodies are excluded.

The Core Rule: When Companies Are Liable

Under Article 66, your company can be prosecuted if a representative, director, or agent commits an offense while acting for the company or on its behalf.

The test is about the link to the company’s interests or mandate, not just where the person sat when they did it.

This captures classic scenarios like bribery in sales pipelines, falsified invoices by finance staff, fraud by branch managers, and data crimes by IT administrators working “for the company.”

Who Counts As “Representative, Director, or Agent”

Think broadly. “Representative” includes anyone authorized to act for the company in a defined scope.

“Director” includes board members and those with equivalent decision power.

“Agent” covers individuals or entities empowered to act on the company’s behalf.

Courts look at substance over job titles, so de facto decision-makers and contracted intermediaries can fall inside the net when they execute company business. Commentary from leading firms confirms this expansive read.

Do Government Bodies Get Caught

No. Article 66 carves out government agencies, their official departments, and public entities and corporations.

Private and most quasi-private companies remain in scope.

What Penalties Can a Company Receive

For legal persons, the Penal Code limits criminal penalties primarily to fines, confiscation, and other criminal measures set by law.

Where an offense carries a principal penalty other than a fine, the legal person’s penalty is converted to a fine up to AED 5,000,000, unless another statute sets a different cap.

Individuals involved can still be punished personally.

What About The Individuals

Company liability does not shield the human beings.

Article 66 expressly allows prosecutors to pursue the individual perpetrator with the full penalties in the underlying offense.

General guidance and practitioner commentary emphasize parallel individual exposure for directors, managers, and staff.

A Quick Timeline Check

The current Penal Code replaced the 1987 code.

Many practitioners used to cite Article 65 for corporate liability.

With Federal Decree-Law 31 of 2021, that provision is now in Article 66, effective from 2 January 2022.

If you find older references to Article 65, they are likely pointing to the previous framework.

Offense Types That Commonly Create Corporate Exposure

  • Bribery and corruption in procurement or sales

  • Fraud, breach of trust, and forgery in finance processes

  • Cyber offenses and data crimes committed using company systems

  • Obstruction, false reporting, or evidence tampering

  • Public order or safety violations tied to operations
    Underlying offense elements still need proof, but if the actor was serving the company’s interests or acting on its behalf, the company may be charged alongside them. The Penal Code sets out many of these offenses with specific penalties. UAE Legislation+1

How Prosecutors Build Corporate Cases

  • Attribution theory: Was the actor a representative, director, or agent, and acting in favor of or on behalf of the company

  • Benefit and control: Did the company benefit, direct, or tolerate the conduct

  • Policy and culture evidence: What policies existed, how they were enforced, and whether red flags were ignored

  • Records and comms: Emails, chat logs, approvals, and power-of-attorney trails

  • Third-party chains: Distributor, consultant, and introducer agreements, scopes, and payments
    These are common patterns reported in UAE practitioner analyses and align with Article 66’s focus on agency and representation. Afridi & Angell+1

Fines, Confiscation, And “Other Measures” Explained

  • Fines: Up to AED 5,000,000 unless another law specifies a different cap for that offense.

  • Confiscation: Seizure of proceeds or instrumentalities of the crime.

  • Other criminal measures: Measures the law allows on top, such as publication of judgments or operational restrictions where provided by sectoral laws.
    Courts retain latitude to match penalties to the offense, while individuals face their own sanctions under the underlying offense. UAE Legislation

Boards, GMs, And Compliance Officers, Take Note

The Penal Code sits alongside sector laws. Boards and GMs should treat Article 66 as the umbrella that engages when someone acting for the company crosses a criminal line.

The most effective protection is credible prevention and fast escalation paths.

Leading UAE commentary underscores that strong governance can limit exposure and demonstrate that the act was rogue, not cultural.

2025 Compliance Checklist That Actually Helps

  1. Tone from the top that is specific, repeated, and measured, not just a poster.

  2. Written policies for anti-bribery, conflicts, gifts, data handling, investigations, and record keeping.

  3. Third-party diligence with risk-based screening, payment controls, and contract clauses that allow audits and termination.

  4. Delegation and approvals mapped, with dual controls on spend, onboarding, and data access.

  5. Training that lands by role and by risk, refreshed annually, with testing and records.

  6. Speak-up channels that are confidential and credible, with tracked remediation.

  7. Forensics-ready IT logging, retention, and legal hold playbooks.

  8. Incident response matrix that links legal, HR, IT, security, and PR, with timetables and ownership.

  9. Board reporting on incidents, near misses, and remediation.

  10. Continuous monitoring of high-risk payments and data movements.

Internal Investigations, UAE Style

  • Scoping: Define issues, custodians, and time windows early.

  • Preservation: Lock email, chat, and device data immediately.

  • Interviews: Start with fact holders, then move to decision makers, then implicated persons.

  • Privilege and confidentiality: Route legal strategy through counsel.

  • Regulatory touchpoints: If sector rules require notifications, align timing with counsel.

  • Outcome: Document findings, discipline fairly, and fix the root cause.

Contracting And Third-Party Risk

Most corporate cases start with third parties. Build in:

  • Representations and warranties on legality and anti-corruption,

  • Audit rights and document retention periods,

  • Right to suspend or terminate on credible breach,

  • Payment discipline using verified milestones and approved channels.
    This positions the company to argue that a third party acted outside authority, breaking the chain that Article 66 requires.

Data, Cyber, And Digital Evidence

Digital trails are decisive. Courts look at logs, device activity, admin rights, and how data was handled.

If a company maintains proper access controls and monitoring, it is easier to prove an employee went rogue.

The Penal Code includes data-related offenses and evidence obstruction provisions that prosecutors regularly rely on. UAE Legislation

Boardroom FAQs, Answered Fast

  • Can a company be jailed
    No. Legal persons face fines, confiscation, and other measures the law allows. Humans face custodial penalties.

  • Is AED 5,000,000 the hard cap
    It is the default cap for converted penalties, unless another law sets a different limit. UAE Legislation

  • Are government entities liable
    They are excluded under Article 66. UAE Legislation

  • Is Article 65 still relevant
    Older references point to the previous code. In the current code, corporate liability sits in Article 66. CRS

  • When did the new code start
    2 January 2022.

Case Posture And Defenses That Work

  • Lack of attribution: The actor was not a representative, director, or agent, or acted outside any authority and against company interests.

  • Effective compliance: Real controls, training, and enforcement that the actor bypassed.

  • No company benefit: The conduct harmed, rather than served, the company’s interests.

  • Prompt remediation: Investigated, reported where needed, disciplined, and fixed controls.
    These defenses turn on facts. Document them early.

Sector Overlays You Should Not Ignore

Your exposure may be higher under specialized regimes, for example, anti-bribery and procurement controls, AML rules in regulated sectors, and safety or environmental duties in industrial operations.

Federal Decree-Law 31 supplies the liability engine. Sector laws supply the accelerators and brakes.

Practitioner updates through 2025 keep pointing to cross-over risk.

What To Do Tomorrow Morning

  1. Map your risk owners across sales, procurement, finance, operations, and IT.

  2. Pull your top ten third parties by spend, influence, or access. Re-paper where needed.

  3. Run a 60-minute tabletop on a realistic bribery or data-misuse scenario.

  4. Set a quarterly board KPI for investigations closed, actions taken, and training completion.

  5. Close one gap this month that matters, not five that do not.

Conclusion

Corporate criminal liability in the UAE is now a structured pathway under Article 66 of Federal Decree-Law 31.

If someone empowered by your company commits a crime in the company’s favor or on its behalf, the company can face fines up to AED 5,000,000, confiscation, and other legal measures, while individuals remain fully exposed to personal penalties.

The smartest move in 2025 is simple, build an evidence-ready culture with clear authority lines, disciplined third-party management, and fast incident response.

That is how you reduce risk and prove you took the law seriously before anyone asked.

FAQs

1) Does a compliance program really help in court
Yes, credible policies, training, and enforcement can show the act was rogue and not the company’s way of doing business, which helps defeat attribution or mitigate penalties. CRS

2) Can the court ban a company from operating
The Penal Code mentions fines, confiscation, and other measures permitted by law. Sector laws may add operational measures in certain cases. Check the regime that governs your activity. UAE Legislation

3) If a consultant pays a bribe, is the company liable
If they acted as your agent or representative and in your favor or on your behalf, liability risk is real. Strong third-party controls are essential. UAE Legislation+1

4) Are there situations where only the individual is charged
Yes, where attribution to the company fails, or the conduct clearly fell outside authority and against company interests. Individuals still face personal exposure.

5) Where can I read the exact legal text
The English text of the Crimes and Penalties Law, including Article 66 on liability of legal persons, is available on the UAE legislation portal.