UAE whistleblowing: The biggest programs are being built where no law requires them

When we started selling in the UAE, we expected the financial free zones to be our market. ADGM and DIFC are where the whistleblowing rules sit, and in this category the rules usually create the buyer.

We've spent two years selling here, and our pipeline looks nothing like that.

Most of the organisations that approach us are on the mainland, where no federal law obliges them to run a whistleblowing channel. They're building speak-up programs anyway, and at full scale. These are employers with tens of thousands of people on the payroll.

In our conversations, a regulator rarely comes up. What we hear about instead is an investor, a lender, a joint venture partner, a certification body, or what it takes to hold onto people who could work anywhere. For them, the channel is one visible piece of something larger they want to prove about themselves.

So regulation may be the lagging indicator in this market rather than the leading one. That's our read after two years, and it's worth testing if you're sizing the region or building a program inside it.

Where UAE whistleblowing rules apply: ADGM, DIFC and the mainland

The compliance map of the UAE doesn't line up with the economic one.

ADGM introduced its Whistleblower Protection Regulations in 2024, with a deadline of 31 May 2025. Every registered entity needs arrangements to receive and handle protected disclosures, and must keep related records for at least six years. FSRA-regulated firms, DNFBPs, DLT Foundations and Large Establishments (those above USD 13.5 million in turnover or assets with more than 35 employees) also need a written policy. ADGM's authorities can censure a firm, fine it or suspend its licence.

Dubai got there first. The DFSA's whistleblowing regime came into force in April 2022 and covers regulated firms in the DIFC, alongside the disclosure duties in the DIFC Operating Law. It's narrower than ADGM's, with the same underlying idea: a firm should hear about a problem before its regulator does.

Both zones are small on a map and heavy in the economy, because most international financial institutions operating in the country are registered inside them. ADGM closed H1 2026 with close to 14,000 active licences.

Cross the boundary and the obligation stops. There's no general federal law requiring mainland private companies to run an internal whistleblowing channel. Dubai Law No. 4 of 2016 protects people who report economic security threats to the Dubai Centre for Economic Security, and the Penal Code covers crimes, but neither says a company has to build anything. A mainland group with 30,000 employees can legally offer none of them a formal route to raise a concern.

Why mainland UAE companies build speak-up channels anyway

Inside the free zones, adoption looks how you'd expect when there's a deadline. Regulated entities do what the rulebook asks, at the pace the rulebook sets.

The mainland conversations are different. National oil companies, telecoms operators, state-linked contractors, universities, government-owned investment authorities: nobody sent them a deadline. Most are long-established, with workforces in the thousands or tens of thousands, and many have relied on an email address and a phone number until now.

The reasons they give us tend to fall into three groups.

The first is a governance agenda they've already committed to publicly. Every Gulf state has a national vision, and each treats institutional quality as part of the promise. Companies take that as a mandate to modernise how they're run, not only what they produce. Giving employees a structured way to raise concerns fits naturally inside that.

The organisations moving first are the ones you'd expect to set the standard. Among our customers in the region are the Presidential Court, Emirates, Etisalat, Sharjah National Oil Corporation, the Government of Sharjah and Zain. Several built a channel before anyone required them to.

The second is an external standard. Workplace certifications, ESG reporting, corporate governance codes for companies listed on ADX or Tadawul, and due diligence from international partners and lenders all ask a version of the same question: can your people raise a concern, and can you show what happened next?

The third is the least dramatic and the most common. A new chief compliance officer arrives, a board committee is formed, or something happens that shows the limits of the current setup.

Why the UAE's largest employers are moving first

In the US, compliance is pulled up from the bottom. A two-person startup will chase a SOC 2 report before it has a product, because a customer asked for one. Maturity there runs well ahead of size.

In the UAE, it's being pushed down from the top. The largest employers have the most at stake: many are state-linked and tied to national vision commitments, they work with international partners and lenders, and their reputation reflects on the country itself. A smaller company feels far less of that pressure. So the organisations with the most to prove are the ones building first, and smaller firms tend to follow once a large customer or partner starts asking.

Saudi Arabia shows the same pattern at greater scale, and the Nazaha framework has raised expectations around reporting and protection a long way. Some of the Kingdom's biggest employers are standing up a structured channel for the first time.

When an organisation that size moves, it doesn't pilot in one department. Everyone gets the channel at once, which means it has to work for a site engineer, a contractor, and a board member from the first day. That's where the real work starts.

Building a speak-up channel people trust

Reaching everyone is one thing. Getting them to trust the channel is harder. Much of the Gulf workforce is expatriate, and for many people their job is closely linked to their visa and residency. That shapes the decision to raise a concern in a way it wouldn't in Berlin or Chicago. Where ownership and leadership are close-knit, the question an employee asks isn't whether a channel exists. It's whether it's safe to use.

How the channel feels matters too. Most organisations we work with here don't call it "whistleblowing." Regulators use the word, but internally it's Speak Up, the Ethics Line, or the Integrity Line. "Whistleblowing" can sound like informing on a colleague, and the programs people use are framed around raising a concern, not reporting a person.

Trust then comes from what people see. They need to know they can stay anonymous and still be heard, that a report about a manager won't reach that manager, and that something happens after they speak up. Without that, a channel produces silence, and silence is easy to mistake for good news.

Where FaceUp fits

FaceUp is an ethics and compliance platform used by organisations in more than 70 countries. The Gulf is where we've had to think hardest about the trust problem above. Six things come up in nearly every conversation here.

1. Reporters stay anonymous if they choose. Someone can report without giving a name and keep talking to the case handler through anonymous two-way communication. That second part is what makes anonymity usable: an investigator can ask follow-up questions, and the reporter can answer, with no trace of who they are.

2. Reports reach the right people and nobody else. You choose who can see each case, so a concern about a senior leader doesn't land in that leader's queue. Organisations here often send sensitive categories to a board committee or an external party, and the setup follows whatever governance structure you already have.

3. Reachable without a laptop. Much of the workforce in construction, oil and gas, and facilities management has no corporate email address. Reports can come in through a mobile app, a QR code on a site poster or a web link, in any of 113 languages, including Arabic, Urdu, Hindi, Bengali, and Filipino. Hotlines are available as add-ons if you want a voice option.

4. Data stored in the UAE. PDPL comes up early in Gulf security reviews, and where case data physically sits comes up in nearly all of them. FaceUp can store your data in the UAE. We're ISO 27001:2022 certified, and our controls are aligned to the SOC 2 Trust Services Criteria.

5. Declarations on the same platform. Conflict of interest and related-party declarations come up in Gulf conversations more than anywhere else we operate, usually in the same meeting as the reporting channel. Groups with dense ownership and supplier relationships want both on the same platform, not in a separate spreadsheet.

6. A record of what happened next. Every report becomes a case with an owner, a status and a documented history. Reporters can follow progress, and compliance teams can show a board or a regulator what was done and when.

Most organisations here start with one channel and one category, then widen the scope once employees can see that reports go somewhere.

What this means if you're building a program in the Gulf

The free zones wrote the rules, and the rules matter. But the organisations setting the standard here are mostly outside them, building programs they could legally skip, because the people they answer to are investors, partners, boards, and their own staff.

That changes what good looks like. The law gives you a floor, and nobody in this market is judged against the floor. In our experience, the programs that work here:

• launch across the whole organisation from day one, in the languages people actually speak
• are named and framed around raising a concern, not reporting a colleague
• let reporters stay anonymous and still take part in follow-up
• run declarations on the same platform as the reporting channel
• give the board a clear record of what happened next

Book a demo and we'll walk you through anonymous intake, how a case moves from report to resolution, and what setup looks like for a workforce spread across sites.