Whistleblowing Regime introduced by DFSA
“Whistleblowers form a key part of a firm’s ability to detect, identify and escalate issues of misconduct, and the required Whistleblower policies and procedures play an important role in encouraging appropriate disclosures - F. Christopher Calabia, Chief Executive of the DFSA
The Regime defines a whistleblower as any person who in good faith, manifests a reasonable suspicion that a Regulated Entity might have been in violation of a provision of any law, regulation, or other regulation administered by the Dubai Financial Services Authority or involved in money laundering, fraud, or any other financial crime.
On 7 April 2022, amendments to DIFC Regulatory Law 2004 and the Dubai Financial Services Authority Rulebook came into force to implement proposals concerning a whistleblowing regime that was consulted on by the Dubai Financial Services Authority (DFSA) in 2021. The Dubai Financial Services Authority noted that the objectives of the Regime are to provide greater legal protection for individuals who report regulatory concerns, strengthen the Whistleblowing culture in Dubai Financial Services Authority Regulated Entities and increase transparency about how such entities will deal with regulatory matters, encourage greater disclosure of regulatory concerns, discouraging wrongdoing, promoting better compliance and ethical culture, raising awareness that there is a greater likelihood that will be reported.
Dubai Financial Services Authority launched its regulatory regime for whistleblowing. It is the first of its kind to be introduced by a financial service regulator in the UAE. It also applies to all DFSA-regulated entities operating in or from the Dubai International Financial Centre.
What should Regulated Entities Do?
The Regime requires that Regulated Entities to implement effective policies and procedures that:
- establish effective internal arrangements to enable the disclosure of regulatory issues, as well as related procedures to receive, assess and possibly escalate reports within the Regulated Entity, the DFSA or any other relevant authority.
- It includes reasonable measures to
- protect them from the identity and confidentiality of the whistleblower
- protect them from harm because they have raised a concern
- provide feedback to the whistleblower, as appropriate
- include appropriate measures to deal with
- any conflicts of interest
- to ensure the fair treatment of the individuals accused of wrongdoing by the whistleblower.
The regime provides increased legal protection for individuals who report misconduct internally within DFSA regulated entities including a DFSA authorized individual, registered auditor, or a designated non-financial business or profession or external to their auditor, the DFSA, or a law enforcement agency.
The DFSA regime aims to improve the whistleblowing culture between these entities by increasing transparency around how they manage regulatory concerns, assess those concerns, and, if appropriate, escalate them. According to DFSA, the policies and procedures put in place by the regulated entities must be appropriate to the nature, scale, and complexity of that entity’s activities and should be reviewed periodically to ensure that they are adequate, effective, and up to date. The regulated entity should also, as part of the implementation of these new requirements, inform all its officers and employees of the protective measures available to them.
It further stated that a DFSA regulated entity must put in place measures to safeguard the whistleblower’s identity and protect them from harm. Christopher Calabia, CEO of the DFSA, explained Whistleblowers are a fundamental part of a firm’s ability to detect, identify and escalation of misconduct issues, and the required whistleblower policies and procedures play an important role in encouraging proper disclosures. All regulated entities are prepared to discuss and demonstrate the application of their policies and procedures when dealing with the DFSA.
What Protection should be granted to a Whistleblower?
When a whistleblower makes a qualifying disclosure, the DFSA rule Article 68A(4) states that the individual must not:
- will not incur any civil or contractual liability for having made such a communication.
- Assert any contractual, civil or other remedy or right of another person against it.
- Dismiss from their employment or be the subject to any other action reasonably likely to cause him harm.
In the event of an occurrence of one of these events, the whistleblower may seize the DIFC court for compensation for any damage suffered. The DIFC court has wide discretion to decide matters for relief in this regard.
An important caveat here is that the Regime does not protect a whistleblower from possible criminal liability for matters such as violation of business confidentiality, or claims such as defamation, which may be brought before the DIFC in the local courts in Dubai.
Comparison With Financial Conduct Authority (FCA)
The Regime largely mirrors Rule 18 on Senior Management Arrangements, Systems and Controls (SYSC) in the area whistleblowing, as set out in the UK FCA Handbook against FCA authorized firms. It is worth making note that there is two interesting ways in which SYSC goes beyond the Regime.
- The FCA requires that companies nominate a sample of whistleblowers. This individual is responsible for overseeing and maintaining the integrity of a company’s internal whistleblowing provisions. and must be independent and must be sufficiently experienced within the company to fulfill this role effectively.
- SYSC requires companies to include a clause in any settlement agreement that clearly states that nothing in such an agreement prevents a worker from safely disclosing. In addition, companies should not require workers to enter into any warranties which require them to disclose to the company that
- having made a protected disclosure
- not aware of any information that could form the basis of a protected disclosure.
The DFSA is expected to conduct a review of the Regime in mid-2023 which could involve the introduction of new measures, such as those described above. In the meantime, Regulated Entities seeking to implement best practices may consider adopting one or both of these approaches.
The DFSA had signed a Memorandum of Understanding with the Central Bank of the Republic of Mauritius to cooperate on the performance of their respective regulatory functions.
The DFSA introduced a new whistleblowing regime on April 7, 2022. However, the Regime has important parallels with that applied in the UK by the FCA, although some of the more advanced requirements incorporated into the FCA regime have yet to be introduced by the DFSA. The Regime aims to provide better legal protection for those who report concerns within the Dubai International Financial Centre, improve whistleblowing culture in entities regulated by DFSA, encourage greater reporting, and promote an ethical culture within the DIFC by discouraging wrongdoing. It builds on the existing framework governing the DIFC which is under the supervision of the DFSA. The companies regulated by the DFSA must now implement an appropriate whistleblowing program. Focusing on the design and implementation, affected companies would do well to consider best practice approaches already well established within many FCA-regulated institutions.