A financing facility worth AED 3 million is an ordinary transaction. It funds inventory, supports expansion, bridges working capital. Most of the time it is exactly what it appears to be.
Occasionally it is not, and the way those situations unfold is worth understanding before you are in one.
What follows is a fictional scenario, constructed for illustration. It does not describe any real bank, company, individual, investigation or judgment, and no wrongdoing is alleged against anyone. The purpose is to show where risk actually accumulates in a financing transaction and what controls address it.
Before that, the boundary that governs this piece. Dillon & Bird is a business, technology and risk consultancy, not a law firm. We do not provide legal advice, legal opinions, criminal defence or representation before authorities. Those are regulated services requiring licensed professionals. This is general business education.
The Scenario
Orion Commercial Trading LLC, a fictional UAE trading company, seeks an AED 3 million facility to buy inventory and fulfil new contracts. It is a real business with real employees and real suppliers, but its recent financial performance does not comfortably support the amount requested, and there is a commercial deadline.
An external consultant offers to help, saying he has relationships that can accelerate approval. A fee is agreed. A relationship manager at the bank coordinates the application. The facility is approved.
Several months later the bank's compliance team reviews the file and finds a handful of things that need explaining: revenue figures that do not reconcile to the underlying accounting records, supporting commercial documents that need independent verification, a substantial payment to the intermediary from a company connected to one of the participants, communications suggesting preferential treatment may have been discussed, and exceptions granted during approval without a recorded rationale.
None of that establishes that an offence occurred. All of it justifies looking properly.
Three Numbers That Are Not the Same
This distinction matters more than almost anything else in how these situations get discussed, and it is routinely collapsed.
The facility amount is AED 3 million. That is not an allegation of theft.
Any suspected improper payment is a separate figure, likely far smaller.
Any proven loss is a third figure, which may be nil if the facility performs.
Headlines and internal conversations tend to merge all three into "an AED 3 million fraud". Doing so overstates exposure, prejudices people whose conduct has not been established, and leads to bad decisions about disclosure and response. Keep them separate from the first day.
Where the Risk Actually Accumulated
Reading the scenario backwards, the failure points are ordinary.
Commercial pressure meeting weak governance. The company needed approval before a deadline and its numbers did not comfortably support the request. Pressure alone is not wrongdoing. Pressure combined with controls that can be bypassed is where problems start.
An intermediary selling access rather than expertise. This is the clearest warning sign in the whole scenario. A consultant offering genuine services (preparing the application, building the financial model, managing the process) is normal. A consultant whose value proposition is who they know inside the bank is selling something else. The fee may be identical; what it purchases is not.
Documentation that did not reconcile. Figures in the application that do not match the accounting records are a straightforward control failure, and one that any pre-submission review would catch.
Exceptions without recorded reasons. Approval exceptions are sometimes legitimate. An exception with no documented rationale is indistinguishable, after the fact, from one granted improperly. The record is what protects the person who made an honest decision.
Undisclosed conflicts. Communications suggesting a relationship between parties who should have been at arm's length.
Each of those is a process weakness before it is anything else. That is the useful insight: most financial crime exposure in ordinary businesses is a governance problem that was allowed to mature.
The Legal Framework
Which law applies depends entirely on the facts, the parties, the conduct and the jurisdiction. In outline:
Federal Decree-Law No. 31 of 2021, the Crimes and Penalties Law, contains the provisions addressing bribery, fraud-related conduct and related offences. Whether conduct falls within them depends on the elements being satisfied on the evidence. Not every commission, introduction or breach of internal policy is bribery, and the distinction between a properly disclosed fee for genuine services and a payment intended to improperly influence a decision is exactly what an investigation has to establish.
Anti-money laundering is governed by Federal Decree-Law No. 10 of 2025, which repealed Federal Decree-Law No. 20 of 2018 and came into force on 14 October 2025. Its executive regulation is Cabinet Resolution No. 134 of 2025, effective 14 December 2025, replacing the 2019 implementing rules.
That change matters practically. The new regime is broader: it adds proliferation financing, treats tax evasion as a predicate offence, and expressly covers virtual asset service providers. If your AML policy still cites the 2018 law or the 2019 regulations, it is out of date and should be reviewed.
Obligations where they apply can include customer due diligence, beneficial owner identification, risk assessment, transaction monitoring, record keeping and suspicious transaction reporting. They extend beyond banks to certain designated non-financial businesses and professions.
Banking regulation. Institutions under Central Bank supervision carry their own requirements on risk management, financial crime compliance and fraud prevention. In the scenario, questions would arise about the bank's controls as well as individual conduct: were approval responsibilities separated, were exceptions properly authorised, were records sufficient to reconstruct the transaction.
A control failure does not establish that anyone committed an offence. Equally, internal controls are not a substitute for externally required reporting.
Our overview of criminal and business law for UAE companies covers the wider framework.
Who Gets Examined
Not only whoever received money.
The bank employee, on whether procedures were followed, conflicts disclosed and the application handled properly. Involvement in an approval is not itself evidence of anything.
Company directors, on the accuracy of financial statements, authorisation of payments and governance. A director who knowingly participates in unlawful conduct is in a different position from one who did not know, and the evidence on knowledge and authority is what separates them.
The intermediary, on what services were actually provided, the basis of the fee and where the money went.
The company, on whether it benefited, whether representatives acted within authority, whether false records were created or used, and whether controls existed.
Other staff and third parties, assessed individually rather than by job title or because they handled a document.
The instinct to assume everyone involved is implicated is both unfair and operationally damaging. Investigations that start from a conclusion find what they expect rather than what happened.
Responding Properly
Preserve everything, change nothing. Financing agreements, accounting records, invoices, approvals, communications, payment confirmations, intermediary contracts. Preserve electronic records in a way that protects integrity and allows origin to be assessed. Never instruct anyone to delete communications, alter documents or create retrospective records.
Establish facts before conclusions. Build a timeline. Separate what is verified from what is assumed. Identify the amount approved, the amount disbursed, how funds were used, what the intermediary actually did, and which questions remain open.
Take legal advice early. A UAE-qualified lawyer with financial crime experience can assess obligations, privilege, reporting requirements and conflicts. Your position differs materially depending on whether you are the reporting party, a potential victim, a witness or an entity under examination.
Assess reporting obligations properly. The right route depends on the nature and location of the conduct, and regulated entities carry separate obligations. This is a question for counsel, not for guesswork.
Protect operations lawfully. Review supplier commitments, covenants, payroll and project obligations. Maintain continuity without concealing facts or interfering with any investigation.
Document remediation. Where weaknesses are found, fix the cause rather than the symptom, and record what was done.
The Controls That Would Have Prevented It
Working backwards from the scenario, the preventive measures are unremarkable and effective.
Separation of duties. No single person initiating, approving and reconciling a material payment. Defined approval limits. Exceptions documented, justified and authorised by someone with standing to authorise them.
Third-party due diligence proportionate to risk. Before engaging any intermediary: what specifically are they doing, is the fee rational for that work, who owns the counterparty, and are there conflicts? Treat an intermediary whose pitch is based on relationships rather than capability as a reason to look harder.
Reconciliation that actually happens. Accounting records against bank statements, contracts, invoices and actual delivery. For material financing, management should be able to demonstrate how funds were used against the stated purpose.
Conflict disclosure with teeth. Declarations collected, reviewed, acted on and recorded, rather than filed.
A reporting channel people trust. Employees able to raise concerns about suspicious payments or falsified records, with confidentiality safeguards, assessed fairly. Avoid promising absolute confidentiality where obligations may require disclosure.
Periodic testing. A policy nobody tests is a document, not a control. Check whether approval limits are respected, whether supporting documents are reliable, whether exceptions are justified.
Where Technology Helps
Automated monitoring can surface unusual payment patterns, duplicate invoices, changed payment details and transactions departing from approval rules. Document management preserves versions, records approvals and makes evidence retrievable. Workflow automation can enforce approval sequences and require supporting documents before a payment proceeds.
Two limits worth stating. An alert is a risk indicator, not proof, and must be reviewed by someone competent. And financial data contains confidential and personal information, so privacy, cybersecurity and retention obligations need assessing before deploying monitoring or sharing records.
Technology strengthens governance. It does not substitute for judgement, and it should never be used to treat someone as guilty because a system flagged a transaction.
What the Scenario Teaches
Transaction size does not determine liability. A legitimate business need does not excuse how an application was prepared. An intermediary's fee needs a genuine commercial basis and a record. Documentation is what establishes who decided what. Controls must operate in practice, not just on paper. Early advice beats late reaction. And suspected misconduct deserves an objective investigation rather than a presumption.
Where We Fit
We work on the governance and systems side: reviewing approval and payment processes for weaknesses, designing workflows and escalation procedures, improving digital audit trails, defining monitoring indicators, and supporting policy documentation and staff awareness.
What we do not do: legal advice, criminal defence, representation before authorities, formal legal opinions, or advising on whether and how to report. Those require licensed professionals, and a consultancy that blurs that line is one you cannot rely on to tell you when you need a lawyer.
That work sits with our management consulting and technology consulting teams, with accounting and bookkeeping where the financial records themselves need strengthening.
If you want your approval processes, third-party controls or audit trails reviewed before something tests them, get in touch.
The AED 3 million scenario, the company name, the events and all participants are fictional. Nothing here alleges wrongdoing by any actual bank, company or individual. This article is general educational information as at October 2026, not legal advice, a legal opinion or a finding of liability. UAE law applies according to the facts, the relevant date, the competent jurisdiction and the applicable provisions, and mainland UAE, DIFC, ADGM and other jurisdictions may differ. Verify current legislation and obtain advice from a UAE-qualified professional before acting. Where the Arabic text of UAE legislation prevails over an English translation, the official Arabic text should be consulted.