Whistle While You Work: Are You Ready for the ADGM’s New Protection Regulations?

What you Need to Know

The Protection Regulations seek to protect all “protected disclosures”. This means they protect individuals making disclosures in good faith regarding their knowledge or reasonable suspicion about potential legal contraventions or financial crimes such as money laundering or fraud. The individual is protected against civil and contractual liability, and any form of detriment including employment termination. 

What you Need to Do

By 31 May 2025, Global Market employers are required to: 

• Implement and maintain arrangements to facilitate “protected disclosures”, assess and escalate any concerns arising from the disclosure, and protect the identity of the whistleblower;
• Periodically review the arrangements to ensure that they are appropriate, proportionate, effective and up to date; and 
• Maintain records of each protected disclosure and any supporting documents, as well as information (including internal findings and analysis) relating to the investigation, assessment and determination of matters relating to the protected disclosures for six years from the closing of the issue. 

All Global Market employers with a turnover of more than US$13.5 million or which hold, administer or control assets over that value, and which have more than 35 employees all within the same financial year must set out the above arrangements in written policies and procedures. 

The Protection Regulations make it clear that these arrangements will be judged in light of the size and complexity of the business and its operations. This means that more sophisticated businesses will be held to a higher standard than smaller businesses. 

Penalties for non-compliance will include sanctions, including financial penalties, public censure, or a suspension or even withdrawal of commercial licenses.

How to Do it 

1. Implement a clear and concise whistleblowing policy, which emphasises confidentiality for reporters and non-retaliation for reporting. In most cases, a written policy is appropriate.
2. Ensure that the policy is well-communicated throughout the business. Employees need to be aware of the mechanisms and their rights under the policy. For larger businesses, training on whistleblowing policies is most effective. In some instances, it will be appropriate to involve outside legal counsel in running this training, drawing on their experiences and encouraging interaction and discussion in bringing this policy and scenarios ‘alive’. 
3. Review any confidentiality agreements in place to make sure they contain the requisite carve outs allowing employees to report, both internally and to various regulatory or law enforcement agencies (as referenced in the Protection Regulations). 
4. Make sure that you have well-defined processes for handling whistleblowing reports quickly and effectively. Where applicable, this will include having an independent team investigating the reports with sufficient expertise in the issues which might arise within the business.
5. Ensure the identity of whistleblowers is strictly confidential. This will include only sharing complaints amongst a small group of people, strictly on a need-to-know basis.
6. Consider making policies and reporting available in local languages (possibly even beyond Arabic and English).
7. For larger businesses, consider the use of digital platforms to facilitate anonymous whistleblowing and follow-up communications. 

We have designed and implemented whistleblowing solutions alongside our in-house technology operations, Eltemate. Policies do not need to be lengthy, and a lack of reports does not automatically mean that the business or culture is functioning without issue.

Why does it matter? 

Aside from the potential sanctions for non-compliance with the Protection Regulations, having robust whistleblowing measures is key. This is because such measures are instrumental in uncovering misconduct within a business, in particular for multinational entities operating across different legal and regulatory landscapes. The earlier misconduct is identified, the better the business can deal with the issue. Whistleblowing encourages reporting within the business, rather than to outside channels, as well as cultivating a culture that will create sustainable revenue

A lack of these compliance processes – beyond regulatory requirements – can also stifle investment as outside investors should be examining the risk awareness at a target entity, and they will expect that fundamental compliance measures exist to detect and mitigate risk so financial reporting is accurate.

Further, we expect a rise in whistleblowing reports across the region, as protections for whistleblowers increase across jurisdictions. Globally, regulators are increasingly encouraging employees to report directly to them, for instance offering financial rewards to individuals who report financial crimes they discover. We also increasingly see whistleblowers represented by counsel, equipped to advocate for their clients in front of regulators and drawing on counsel’s credibility in highlighting patterns of improper behaviour. 

The time is ticking down to implement these whistleblowing processes and to avoid the cost, disruption and commercial and reputational ramifications of regulator involvement. 

Authored by Sophia Kinally, Randall Walker, Khushaal Ved, and Jessica Quinlan.