Client Update: Federal Decree-Law No. 41/2023

The UAE has issued a new law regulating the auditing and accounting professions, aimed at improving audit standards in the UAE, and to enhance business confidence in the standard of auditing and accounting services provided. This is a key development in the UAE’s regulatory framework which follows several high-profile corporate governance scandals in recent years (both in the region and globally) and reflects the UAE’s commitment to improving corporate governance standards and AML compliance in response to its listing on the FATF Grey List in 2022.

On 28 March 2024, the new Federal Decree-Law No. 41/2023 on the Regulation of the Accounting and Auditing Profession (the New Auditors Law) will come into force, repealing Federal Law No. 12/2014 on the Regulation of the Auditing Profession (the Old Law) in its entirety.  All accounting and audit firms and professionals operating in the UAE should ensure that they are aware of and comply with their new obligations.

Our comments on the New Auditors Law, including on the key changes which have been introduced, are set out below.

Application of the Law

The New Auditors Law applies to:

1. Chartered Accountants and accounting firms located “onshore” in the UAE, which are licenced by the Ministry of Economy (the Ministry) to practice and to provide auditing and related professional services; and
2. Chartered accountants and accounting firms located in the financial free zones (namely the DIFC and the ADGM) which intend to practice and to provide auditing and related professional services “onshore”.

Firms located in the financial freezones and which use joint teams working in the freezone and onshore, or which may provide auditing and accounting services onshore, will therefore be subject to both onshore and freezone laws and regulations. The potential challenges of complying with both regimes will need to be carefully considered.  

Crucially, the New Auditors Law provides clarity as to the other professional services which accountants and accountancy firms may be licenced to perform. These include internal audit services, consultancy work relating to financial monitoring, approval of electronic information systems, assessment of financial risks, “and other services that fall within the scope of professional standards approved by the Ministry.”  

We note that the term “Chartered Accountants” is protected under the New Auditors Law – only individuals who are licensed by the Ministry to practice the accounting and auditing profession in the UAE are entitled to describe themselves as “Chartered Accountants”.  It is prohibited for an individual to act in their capacity as a Chartered Accountant when conducting professional activities that fall outside the accounting and auditing profession.

Ownership of Accounting and Audit Firms

Where the Old Law expressly required accountancy firms in the UAE to be at least 25% owned by a UAE national, the New Auditors Law is silent. It therefore appears that accounting and audit firms may now be fully foreign owned.

Pursuant to the New Auditors Law, accounting and audit firms may be established in any of the following legal forms:

1. A professional company consisting of two or more Chartered Accountants;
2. A professional corporation between one of more Chartered Accountants and an international accounting and audit firm;
3. A branch of an international accounting and audit firm; and
4. Any other form as may be set out in the Implementing Regulations.

Where an accounting and audit firm seeks to merge with, or acquire, another firm, this can only be done after obtaining approval from the Ministry.

A key question for firms currently operating in the UAE will therefore be whether there is any desire to consider restructuring, given these changes to the ownership requirements. It may also attract new foreign firms into the market.

Internal Procedures

The New Auditors Law introduces a requirement for accounting and audit firms to establish and maintain specific internal procedures, including having regulations and procedures in place to ensure:

1. compliance with approved professional ethics and standards;
2. continuing professional development of staff;
3. compliance with UAE anti-money laundering laws; and
4. protection of customer data and information.

AML Reporting Obligations

In line with the UAE’s wider efforts to strengthen its anti-money laundering regulations and protections, the New Auditors Law includes an express reporting obligation on accountancy firms to inform the Ministry and competent authorities if any fraud or money laundering is detected or suspected in the course of providing their services.  There is no express time frame within which such reports must be made to the Ministry.

We note that professionals such as lawyers and accountants are increasingly seen as the gatekeepers of AML compliance, both globally and in the UAE, given the nature of the information which they may be privy to in the course of their work. This update therefore reflects the reporting obligations already in place under other regulatory regimes, and is a clear response to the ever-present risk of money laundering.

Audit Reports – Updated Signing Requirements

As was the case under the Old Law, audit reports must be signed by the auditor who completed the audit or, where the work was carried out by a firm, by a manager or partner of that firm who is a licensed auditor. In addition to this requirement, audit reports must now also include the auditor’s licence number, and the name and licence number of the firm issuing the report.

Further Clarity on Related Parties and Conflicts  

Under the Old Law, auditors were prohibited from having “any transaction or interest with the customer for whom he is auditing the accounts or any of the related parties.” The scope of this prohibition, and the meaning of a “related party”, has been developed in the New Auditors Law. Accounting and audit professionals are expressly prohibited from having any transaction or interest with the customer or any related party including, but not limited to, “the chairman and members of the board of directors as well as the members of the supreme executive management of private and public joint stock companies and institutions, as well as the companies where any of the aforementioned contributes with not less than (30%) of the capital, in addition to subsidiary, sister or allied companies thereof.” Firms should therefore ensure that they have measures in place to identify any such related parties.

The New Auditors Law also provides further clarity on the circumstances in which an auditor would be prohibited from carrying out work for certain clients on the basis of conflicts. 

Previously, auditors were prohibited from participating in the establishment of companies, or participating or managing companies, if within the previous two years they had worked at that company or been a consultant. This is further clarified under the New Law, to state that auditors are prohibited from participating in the establishment or management of a company “to which he already provided his services or for which he worked permanently or temporarily” in the last two years. The language of this prohibition has therefore been updated to clarify that the provision of services (such as audit services) to a company in the prior two years would prohibit an auditor from moving to work at that company.

Treatment of Confidential Information

It is prohibited for accounting and audit firms and Chartered Accounts to disclose “secrets” obtained in the course of their professional work, except in certain cases:

1. where requested or approved by the relevant client;
2. where required by a judicial authority or “official investigation authority” (for example, a regulator);
3. where requested by the Ministry;
4. where the purpose of disclosure is to prevent or to report an offence, as long as that disclosure is only to the competent authority; and
5. where the purpose of disclosure is to provide a defence before an “investigation authority” or judicial body, and is deemed necessary for such a defence.

We note that this broadens the express circumstances in which a client’s “secrets” may be lawfully disclosed, in comparison to the equivalent provisions of the Old Law. However, the extent to which the definitions of “judicial authority” and “official investigation authority” would include financial freezone and overseas authorities and regulators remains to be seen.

Extended Document Retention Period

The New Auditors Law imposes a new retention period of ten years for all documents, data and papers collected and prepared in the course of a firm’s work, compared to the five years previously required. The ten-year period begins from the issuance of the “report” to the relevant customer. Although the provision does not specify this, it may be assumed that the “report” would be an audit report, or other work product prepared (for example, an advisory opinion).  Where data and documents relate to legal proceedings, the retention period only begins from the date of the final judgment.

Importantly, if a firm’s licence is cancelled or removed by the Ministry, the firm’s partners are responsible for ensuring that the ten-year retention period is complied with.

Civil Liability to Third Parties

Auditors and accountancy firms are liable to “whoever is damaged due to [their] activities and services”, and anyone who is “damaged” is entitled to seek civil compensation. In our view, this provision is more limited than the equivalent provision under the Old Law, and therefore provides greater clarity on the circumstances in which an auditor may be held liable.

The Old Law expressly referred to damage arising from “professional error or negligence,” but provided no clarity as to whether this constituted a separate cause of action to those available under other UAE laws. This resulted in third-party claims being made against auditors with no clear basis under the UAE Civil Code, and in claimants seeking to argue that the Old Law imposed a broader duty of care.

In contrast, the New Auditors Law specifies that a person who is “damaged” by an auditor’s activities and services has “the right to claim a civil compensation for any damages, according to the rules and procedures in force by virtue of the legislation in force in the State.” It therefore appears that, under the New Auditors Law, anyone seeking to commence a civil claim against an auditor may only do so where they have a contractual and/or tortious cause of action under UAE law.  We expect that this will restrict the ability of claimants to make broad arguments as to “negligence”, and to argue that a wider duty of care applies as against auditors than a usual defendant.

We also note that, under the Old Law, liability was automatically on a joint and several basis where there were (1) joint audit mandates, and (2) where the work was completed by a firm. There is no equivalent provision in the New Auditors Law. One possible result of this, for example where there are joint audit mandates, is that auditors may only be liable for their own errors.

In addition to the above, any legal or physical person which is aware of a breach of the New Auditors Law is obliged to inform the Ministry or the Public Prosecution of that breach. This may increase the risk of malicious reports being made, or of parties combining a civil claim with a formal report to the Ministry and/or the Public Prosecution.

Disciplinary and Penal Sanctions

A breach of any of the provisions of the New Auditors Law, and any violation of the “duties, standards or rules of conducts and ethics of the Profession”, shall result in disciplinary measures being taken by the Professional Compliance Committee. One or more of the following disciplinary sanctions may be imposed for a breach:

1. Written warning;
2. Administrative fine of AED 10,000 – AED 1,000,000;
3. Licence suspension of 1 month – three years; or
4. Licence cancellation.

In addition to this, certain breaches attract criminal sanctions.

Any of the following breaches will attract a prison sentence of at least three months, and a fine of AED 100,000 – AED 2,000,000:

1. Provision of incorrect statements or false statements for the purpose of obtaining a professional licence;
2. Practicing the auditing and accountancy profession without being licenced;
3. Practicing the auditing and accountancy profession while suspended; and
4. Signing a report which has not been prepared by the signatory, or by persons working under his supervision.

Any of the following breaches will attract a prison sentence of at least one year, and a fine of AED 300,000 – AED 5,000,000:

1. Signing a false report, in the knowledge that it is false;
2. Disclosing secrets obtained in the course of the provision of services, or while practicing as an auditor or accountancy professional; and
3. Facilitating the commission of financial offences related to public finance or the seizure of funds from third parties, hiding the offender, or failing to inform the competent authorities of such offences.

In addition to the penalties above, the criminal court may also order cancellation of licences, or the closure of the accounting firm / office.

Professional Indemnity Insurance

As under the Old Law, auditing and accounting firms are required to hold professional indemnity insurance. However, the New Auditors Law does not specify a minimum level of cover, or mandatory policy wording. It therefore does not go as far as the mandatory insurance requirements of other regulators in the region and globally – for example, the Saudi Central Bank (SAMA) has issued a standard professional indemnity insurance policy for auditors of entities supervised by the Saudi Capital Market Authority.

Publication of Decisions

The Ministry is expressly entitled to publish the outcome of its investigations and any decisions of the Professional Compliance Committee, as well as final court judgments issued against Chartered Accountants and accounting and audit firms.

This is a positive development which may result in greater clarity as to the Ministry’s approach to violations of the New Auditors Law and applicable accounting standards.  It brings the Ministry in line with the DIFC and ADGM regulators’ approach to the publication of regulatory decisions, and is clearly aimed at increasing transparency within the onshore regulatory framework.

Notification of Legal Proceedings

The UAE judicial authorities shall inform the Ministry of any civil and criminal judgments issued against auditors and accountancy professionals. Previously, only criminal judgments were required to be reported to the Ministry by the Public Prosecution.

Conclusion

As highlighted in the introduction to this note, the introduction of the New Auditors Law appears to be part of the UAE’s wider effort to more closely regulate financial services, particularly in relation to the risk of money laundering and fraud and the UAE’s listing on the FATF Grey List, and to align the UAE’s accounting and audit profession more closely with international best practice.  It includes a number of new obligations for firms and individuals, and clarifies the potential consequences of any breaches.

In view of the disciplinary and criminal sanctions for non-compliance, we recommend that any audit firm and Chartered Accountant within the UAE (including in the freezones, if they conduct work “onshore”) takes steps to ensure compliance before the New Auditors Law takes effect on 28 March 2023, such as:

1. ensuring you are aware of your obligations, as a firm and as an individual, under the New Auditors Law;
2. reviewing and updating existing processes, such as internal audit procedures, professional development programmes, document retention procedures, and internal measures to report suspected fraud or money laundering to the Ministry and to gather sufficient information to identify related parties; and
3. reviewing and updating client engagement terms where needed to ensure compliance with the New Auditors Law, including as to the permitted uses of confidential client information, and the extended document retention period.

For further information, please contact Rebecca Kelly, Mark Beswetherick or Caitlin Coady.