A founder called us about a customer who had stopped paying. Straightforward debt recovery, he assumed. Partway through the conversation it emerged that the customer was alleging the invoices had been altered.
That changes what kind of problem it is, and it changes what should happen next.
The boundary between a commercial dispute and a potential criminal matter is one of the more consequential things a business operating here can misjudge, in either direction. This guide covers where ordinary business activity can create criminal exposure in the UAE, how that differs from a contractual disagreement, and the broader legal framework a company in Dubai should understand.
One thing first, because it governs everything below. Dillon & Bird is a business and technology consultancy, not a law firm. We do not provide legal advice, legal opinions, criminal defence or court representation, and we do not hold ourselves out as able to. Those are regulated services belonging with licensed advocates and legal consultants. What follows is general business awareness, not legal advice.
Criminal Law Is Not Only About Traditional Crime
The common assumption is that criminal law concerns violence, theft and offences remote from ordinary commerce. In practice, business activity intersects with it more often than most owners expect.
The principal federal framework is Federal Decree-Law No. 31 of 2021 promulgating the Crimes and Penalties Law, generally called the Penal Code. It sits alongside the Criminal Procedures Law, which governs how complaints, investigations and proceedings run, and specialised legislation addressing particular categories of conduct.
Areas where business operations can create exposure include fraud and deception, misappropriation of funds, breach of trust, forged or false documents, unauthorised access to computer systems, misuse of information, money laundering, certain financial and regulatory violations, and intellectual property infringement.
The point is not that businesses are routinely committing offences. It is that a director should not conclude a dispute is "only commercial" before the facts have been examined.
Commercial Dispute or Criminal Matter
The distinction matters because the response differs entirely.
A commercial dispute arises where a customer has not paid, a supplier has not delivered, scope is contested, or shareholders disagree. These run through negotiation, mediation, arbitration or civil proceedings, depending on the contract and jurisdiction.
A criminal matter arises where the alleged conduct falls within an offence recognised by criminal legislation: fraud, forgery, theft, breach of trust, unauthorised system access, certain financial misconduct, money laundering.
The same business relationship can produce both. An unpaid invoice is commercial. An unpaid invoice where one party alleges the supporting documents were fabricated is potentially something else.
Two errors are common and both are expensive. Treating a genuine criminal exposure as a billing disagreement means losing time and evidence. Treating an ordinary commercial disagreement as a criminal matter, and threatening accordingly, damages relationships and can create problems of its own. Establish the facts before deciding which you have.
The Risk Areas Worth Knowing
Documentation and False Records
Businesses run on documents: contracts, invoices, purchase orders, certificates, licences, bank documents, corporate records, government submissions.
Creating, altering, using or submitting a document alleged to be false carries serious consequences. The practical control is unglamorous: proper document creation and approval procedures, version control, authorisation matrices, record retention, and verification of third-party documents.
The specific thing to guard against is the retrospective fix. An employee correcting a document after the fact to make it match what should have happened, without an audit trail, creates risk disproportionate to whatever they were trying to tidy up. Make it clear this is never acceptable.
Cybercrime and Systems
Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes addresses conduct involving information technology systems, with penalties reported in the range of AED 100,000 to AED 4 million depending on the offence.
Any business running systems, holding data or using digital communications is within scope. Relevant areas include unauthorised access, alteration or deletion of data, misuse of information systems, online fraud, and improper disclosure or use of electronic information.
Which makes cybersecurity a legal risk function rather than purely an IT one. Role-based access control, strong authentication, access logs, privileged account management, prompt offboarding when employees leave, data classification, backups and incident response are all legal controls as much as technical ones.
One specific instruction: once a dispute or complaint arises, do not delete, modify or overwrite potentially relevant digital evidence. Preservation should be coordinated with your legal and technical advisers. We cover this in detail in our guide to organising evidence before briefing a lawyer.
Anti-Money Laundering
The governing law changed recently, and a great deal of published guidance has not caught up. Federal Decree-Law No. 10 of 2025 repealed Federal Decree-Law No. 20 of 2018 and took effect on 14 October 2025, with Cabinet Resolution No. 134 of 2025 as its executive regulation from 14 December 2025. The new regime broadens scope, adding proliferation financing, treating tax evasion as a predicate offence and expressly covering virtual asset service providers.
It is not confined to banks.
Certain designated non-financial businesses and professions fall within it. Where obligations apply they can include customer due diligence, beneficial owner identification, risk assessment, transaction monitoring, record keeping, suspicious transaction reporting, internal controls and staff training.
The error we see is assuming AML is somebody else's problem. Establish whether your activity falls within a regulated category. That assessment is quick, and the consequence of getting it wrong is not.
The Business Law Framework Around It
Criminal exposure is one part of a wider picture. The laws shaping day-to-day operations matter more often.
Corporate. Federal Decree-Law No. 32 of 2021 on Commercial Companies governs legal form, shareholding, management authority, directors and managers, shareholder rights, resolutions and corporate records. The questions worth answering in writing: who owns the company, who can sign contracts, who can operate bank accounts, who approves major transactions, and what happens if a shareholder exits or dies.
Contracts. Scope, deliverables, payment terms, liability, indemnities, confidentiality, intellectual property, termination, governing law and dispute resolution. The test we apply before signing anything significant is one question: what happens if the other party does not do what it promised? That usually exposes weaknesses invisible during the sales conversation.
Employment. Federal Decree-Law No. 33 of 2021 regulates labour relations, covering contracts, working arrangements, termination, notice, disciplinary process, end-of-service obligations and records. Employers should distinguish carefully between misconduct, performance issues, contractual disputes and potential criminal conduct. They are not the same and should not be handled as though they were.
Intellectual property. Federal Decree-Law No. 36 of 2021 covers trademarks, which can include distinctive words, names, symbols, images and packaging used to distinguish goods or services. Register what matters, run clearance checks before adopting a brand, and define IP ownership explicitly in employment and contractor agreements. Most disputes over ownership trace back to an agreement that never addressed it.
Data protection. The UAE has a federal personal data protection framework, with sector-specific and free zone requirements that may also apply. The practical questions: what personal data do you collect, why, where is it stored, who can access it, how long is it kept, and what happens if there is an incident. For businesses using AI, add training data, confidential information, automated decision-making and third-party platform exposure.
Tax. VAT at 5% with mandatory registration above AED 375,000 in taxable supplies, and corporate tax at 0% up to AED 375,000 of taxable income and 9% above it, subject to the applicable rules and reliefs. Our bookkeeping, tax and audit calendar covers the deadlines.
Jurisdiction Is the First Question
"UAE law" is not one uniform body of rules applying identically everywhere.
The framework depends on the emirate, whether the entity is mainland or free zone, the sector and its regulator, and whether it sits within a specialised jurisdiction. DIFC and ADGM operate their own legal and regulatory regimes in significant areas, administered through their own courts.
So before any assessment: where is the business incorporated, where is it licensed, and where is it actually conducting the relevant activity? Advice built on the wrong jurisdiction is worse than no advice, and a great deal of general content online makes exactly that mistake.
When Something Goes Wrong
A disciplined sequence, rather than the instinct to retaliate or publish a response.
Identify what kind of issue it is. Commercial, contractual, employment, regulatory, civil, criminal, or a combination.
Preserve evidence. Emails, contracts, messages, financial records, system logs, CCTV, internal approvals. Change nothing.
Establish the facts. Build a timeline. Keep verified facts separate from assumptions.
Confirm jurisdiction. Emirate, mainland or free zone, DIFC or ADGM, contractual jurisdiction, relevant regulator.
Engage licensed counsel. Where the matter involves legal advice, representation, criminal defence or proceedings, that is a licensed advocate or legal consultant's work.
Then build a response strategy protecting your legal position, evidence, reputation and business continuity.
Where We Fit, and Where We Do Not
Our role is the business, process and technology layer around legal risk. Reviewing processes to identify where exposure sits. Organising contracts, policies, approval workflows and compliance records. Access control and identity management reviews, audit trails, cloud security and data governance. AI governance covering usage policies, data flows, vendor risk and human oversight. Building continuity procedures so a dispute or investigation does not stop normal operations.
What we do not do, and will not represent ourselves as doing: formal legal advice, criminal defence, representation before prosecutors or courts, pleadings, or legal opinions. When a matter needs those, it needs a licensed legal professional, and we work alongside them.
The reason this distinction matters to you rather than just to us: a consultancy that blurs it is one you cannot rely on to tell you when you actually need a lawyer.
That work runs through our technology consulting, AI and cloud services and management consulting teams.
The Takeaway
Understanding criminal law is not about treating every dispute as a potential prosecution. It is about knowing where the boundaries are, keeping records that stand up, distinguishing a commercial disagreement from something else, and recognising the point at which a licensed professional needs to be involved.
For companies in Dubai and the wider UAE, that awareness is part of ordinary good governance. It is considerably cheaper as prevention than as reconstruction.
If you want your processes, documentation and systems reviewed from a risk perspective, get in touch.
General educational information as at October 2026. Not legal advice, a legal opinion, criminal defence advice or tax advice, and not a substitute for advice from a professional authorised to practise in the relevant UAE jurisdiction. Legislation is amended over time, and different rules apply depending on emirate, activity, licensing authority, free zone, sector and the facts of a matter. Verify current legislation on the UAE Legislation Portal and obtain professional advice before acting.