The UAE federal government has recently issued a raft of important legislation, addressing and in many ways updating areas of law that are key to businesses in the jurisdiction. Amongst this legislation is Federal Decree-Law 14 of 2018 concerning the central bank and the organisation of financial institutions and activities (the

New Banking Law

) and Federal Decree-Law 20 of 2018 concerning anti-money laundering and anti-terrorism financing (the

New AML Law

). Both the New Banking Law and the New AML Law repeal and replace the previous legislation on their respective subjects.


Importantly, the New Banking Law and the New AML Law have together enhanced the protection afforded to confidential information under UAE law, in particular where financial and legal service providers and their customers and clients are concerned. 

 
Confidentiality under UAE law

While it has long been the case that confidential information was given protection, such protection was spread across various pieces of legislation. For example, it has been generally accepted that UAE law includes an obligation on the part of a bank or a financial institution to hold information concerning its customers as confidential. This was understood to form part of customary banking practice in the UAE and was confirmed through certain guidance issued by the Central Bank. Similarly, obligations of confidentiality were placed on other service providers through sector specific legislation on the matter (see for example, Dubai Law 11 of 2013 concerning obligations of insurance companies in the Emirate of Dubai and Federal Law 23 of 1991 concerning the licensing of advocates). A general obligation of confidentiality was also contained in the UAE Penal Code (being Federal Law 3 of 1987, as amended).

Each of the New Banking Law and the New AML Law improves on this position and places customer confidentiality on statutory footing.

Confidentiality under the New Banking Law

Article 120 of the New Banking Law provides that all data and information concerning accounts, deposits and safe deposit boxes (along with transactions concerning these facilities) of a customer shall be considered confidential and must not be directly or indirectly disclosed to any third party, in each case without the prior written consent of the customer. The obligation to keep such data and information confidential is stated to continue for an indefinite period, notwithstanding the termination of the relationship between the account holder and the bank or financial institution. Importantly, Article 120(4) stipulates that the obligation of confidentiality extends to all “agencies” and “persons” and other entities that by virtue of their profession or employment have access to such information. 


Though the clarity provided by the Banking Law with regards to customer confidentiality is welcome, it remains to be seen how this obligation will affect the exchange of credit information (for example, in the context of disclosure of financial information to a UAE credit rating agency). It also remains to be seen whether there will be clearly prescribed sanctions and/or penalties for breach of such obligations.


The Banking Law provides that the Central Bank will issue further rules on this matter and it is anticipated that these rules will provide the required granularity to the confidentiality obligations set forth in the New Banking Law.

Confidentiality under the New AML Law

Like the New Banking Law, the New AML Law contains guidance with respect to confidentiality. Importantly, Article 15 of the New AML Law contains an exception to the obligation of a bank or financial institution covered by the New Banking Law to hold customer information confidential. In summary, such a bank or financial institution must issue a notification in the prescribed form to the designated unit within the Central Bank, where it has reasonable grounds to suspect a transaction or funds concerns a crime. In such case, the bank or financial institution must inform the designated unit within the Central Bank of its suspicion “without delay” and must include an appropriate level of detail on the account or transaction concerned, and without regard to the confidentiality of such information. It remains to be seen how banks and financial institutions will balance their obligations of confidentiality (as now enshrined within the New Banking Law) against their obligations of disclosure under the New AML Law. The obligation to report suspicious transactions is also imposed on Designated Non-Financial Businesses and Professions, a category that will be detailed in the implementing regulations contemplated by the new AML Law. Importantly, it remains to be seen how banks will determine what constitutes “reasonable” grounds. Is mere suspicion adequate?

Interestingly, the New AML Law provides (albeit indirect) recognition to the fact that lawyers (including those licensed as “legal consultants” in addition to those licensed as “advocates”) owe a duty to their clients to treat information received from such clients as confidential. It was previously the case that the confidentiality obligations of a legal consultant had to be derived by analogy to Federal Law 23 of 1991 concerning the licensing of advocates and, in the Emirate of Dubai, from the provisions of the draft code of conduct issued by the Dubai Legal Affairs Department.

Article 15 of the New AML Law stipulates that lawyers, notaries and other legal professionals are exempt from the requirements of disclosure contained in article 15 of the New AML Law, provided such information is received “subject to professional confidentiality”. This exemption is also extended to independent legal auditors. While the introduction of such exemption is welcome, it remains to be seen how the courts and authorities will interpret the requirement for the relevant information to have been received “subject to professional confidentiality” and whether the implementing regulations contemplated by the New AML Law will place limits on this exemption.

Despite further guidance pending, these legislative developments highlight the importance of confidentiality for businesses that receive and deal with confidential information. It also helps to bring into focus the high level of importance placed by UAE policy makers on matters of confidentiality and privacy. Businesses in the UAE would be well advised to take note of these developments and to stay alert for further developments in this field. ■