In October 2023, WTW in collaboration with Clyde & Co launched the Global Directors’ and Officers’ Survey. This article will focus on the top Middle Eastern exposures as highlighted in the survey report.
The report identifies the top seven risks to directors and officers (D&Os) in the Middle East. In this article we explore the risks that we consider to be most key and emerging.
Health and safety tops the survey results across all regions, including the Middle East. As a result of ongoing construction activity in the Middle East, health and safety protection is recognised as a high risk for businesses and also for individuals, as, depending on the circumstances, the liability for any employee accident in the workplace can rest with the individual who ‘caused’ the accident. This liability can sometimes attach to the injured employee for their failures to follow safety instructions and may also extend to the injured employee’s direct supervisor or health, safety and environment (HSE) officer (which can often be a director or officer of the organisation) for failure to implement safe work processes. As there is no concept of corporate liability prosecution for health and safety breaches, this can lead to both financial penalties and/or criminal prosecution for D&Os. Given the significant volume of construction work being carried out across the region, this is a key risk for D&Os.
Cyber-attacks and data loss are listed as the second and fifth top risks respectively by respondents in the Middle East. The region is a ripe target for cybercriminals to exploit due to a combination of factors, including the significant wealth in the region, high-profile businesses and individuals, rapid digitisation across sectors, the influx of start-ups and new business, the perceived lower standards of cybersecurity defences within individual businesses and geopolitical tensions. Cyber-attacks, data breaches and cyber extortion are an increasingly significant risk for businesses. Up until recently, data protection and privacy rights were fairly limited and there was little regulation and enforcement.
Jurisdictions in the Middle East are currently at various stages of implementing standalone personal data protection laws for the first time to bring them in line with international standards, such as the EU’s General Data Protection Regulation (GDPR). These new laws will introduce multiple requirements with which organisations must comply from a data protection perspective, failing which organisations and their D&Os could face civil and criminal liability. It remains to be seen how the regulators will approach enforcement, in particular against individual D&Os, or how individual data subjects may seek to frame any claims against D&Os, but it is certainly an area to watch.
Criminal liability continues to be a significant risk for general managers and senior managers as the prosecution authorities generally look to hold individuals responsible for corporate failures. As well as the underlying liability associated with criminal exposures, D&Os and their insurers can face high costs in defending criminal investigations, which can drag on for some time and can be unpredictable in terms of both the process and the outcome. Criminal investigations can also result in ancillary risks such as suspensions and travel bans. In some jurisdictions there have been an increasing number of travel bans imposed on executive members during regulatory investigations. Furthermore, the overarching threat of deportation is ever-present which adds to the risks faced by D&Os.
It is perhaps surprising that regulatory risk was not in the top seven risks for the Middle East, in contrast to many other regions. Overall, there is an upwards trajectory of regulatory investigations and related claims across the region. The offshore regulators in the financial free zones (Dubai International Financial Centre and Abu Dhabi Global Market), whose investigations are public, are focusing on enforcing compliance with anti-money laundering (AML) laws and other compliance issues, as well as ensuring that organisations are not misleading the regulator and/or their customers. The Dubai Financial Services Authority doubled its enforcement actions last year from the previous year, issuing fines and restrictions against individuals in doing so.
Whilst the offshore regulators have historically been, and remain to be, much more active than the onshore regulators, there appears to have been a recent shift in the approach of the onshore regulators who are starting to take a more proactive role in enforcement. There are recent examples of the onshore regulators starting to enforce AML laws more vigorously and it is expected that this trend will move into other areas throughout 2024.
The change in attitude of the regulators is coupled with a developing framework of laws and regulations. Recent key examples in Saudi Arabia are the codification for the first time of the Saudi Arabian law governing contracts (which was previously governed by Islamic Law or Sharia) and the relatively recent changes to the Saudi Arabian Companies Law which introduced detailed directors’ duties. We are also starting to see an increasing number of claims filed under the Saudi Arabian class action regime which is available to shareholders of government-owned entities.
In the United Arab Emirates (UAE), lawyers and accountants are increasingly being seen as gatekeepers for AML prevention and their actions will continue to come under scrutiny from the regulators. A good example of this is the passing of the new Accountancy and Auditors Law in the UAE which will come into effect in March 2024 and, amongst other things, requires accountancy firms in the UAE to implement stringent internal controls and training to help enforce AML requirements and notify breaches they become aware of.
Key risks that are emerging as areas of potential increased liability for D&Os in the Middle East are sanctions, AI, and supplier business practices.
Whilst breach of sanctions did not make it into the top seven risks for the Middle East, it is in the top seven risks globally. It is almost inevitable, given the current conflicts, that sanctions regimes will impact within the region, and this is a risk to watch for D&Os operating in the region. The UAE has been the focus of the financial press in recent years in relation to intimations by the United States that it is facilitating Russian sanctions evasion. The UAE was removed from the Financial Action Task Force’s (FATF) grey list on 23 February 2024, having been on it since March 2022, in recognition of its progress in combatting money laundering and the financing of terrorism.
Most Middle Eastern countries have largely remained politically neutral on sanctions issues, but as this develops, the ability to remain on the fence will come under more pressure, in particular, as United States authorities step up enforcement actions against regional businesses.
Artificial intelligence (AI) appears as third on the list of top risks for the Middle East, in contrast to the other jurisdictions involved in the survey for whom it does not appear in the top seven risks. At a governmental level, in Qatar, Saudi Arabia and the UAE in particular, there is significant investment being made into AI which is filtering down to organisations at a rapid pace. Although at an early stage, regulatory frameworks are being developed for AI. For example in Saudi Arabia, the Saudi Data and Artificial Intelligence Authority issued regulatory arrangements for AI and in the UAE, a new AI Council was set up in Abu Dhabi in January 2024.
Although we have not seen any D&O liability specifically arising out of the use of AI yet, the inclusion of AI in the top seven risks in the Middle East is likely to be connected to the apprehension about the rate of digitisation in the region in the context of legal and regulatory frameworks which are not currently equipped to deal with the consequences.
Supplier business practices feature as the seventh top risk identified by respondents in the Middle East. This is likely to reflect the significant supply chain disrupting events that have been experienced in recent years (including COVID-19) and are perhaps felt most acutely in the Middle East, given the historic problems with supplier business practices and vulnerabilities in supply chain risk management in the region. Organisations in the Middle East are currently grappling with the disruption of the Red Sea shipping crisis and ongoing geopolitical tensions. There is an undeniable increase in customer demand across the region in all sectors, as the Middle East continues to raise its global profile and attract foreign investment. Whilst this is obviously a positive development for the region, it brings with it a need for businesses to improve their supply chain resilience which is likely to be a key concern for D&Os.
The report and this article demonstrate that the risk landscape for D&Os in the Middle East is evolving quickly and there are significant potential exposures of which to be aware. In this region, it is particularly difficult to stay abreast of risks as they develop due to the speed with which changes are introduced to laws and regulations and the lack of clarity around the status of various laws and regulations, how they interact with one another and the practicalities of compliance and enforceability.
