A trading company operating out of a DMCC free zone brings on a new finance manager. The owner knows the candidate from a mutual contact, the CV looks solid, the interview goes well. Within fourteen months, AED 1.3 million has been diverted through a combination of fictitious vendor invoices and unauthorised transfers to a personal account.
The Hire That Nobody Vetted
A trading company operating out of a DMCC free zone brings on a new finance manager. The owner knows the candidate from a mutual contact, the CV looks solid, the interview goes well. Within fourteen months, AED 1.3 million has been diverted through a combination of fictitious vendor invoices and unauthorised transfers to a personal account. A basic employment history check would have revealed that the candidate had been dismissed from two previous roles under circumstances the former employers declined to discuss in any reference call. No check was ever done. The fraud ran for twelve months before an external accountant noticed the pattern.
This is not an anomaly. It is a structural feature of how small and medium businesses in the UAE hire people, and the consequences are quantifiable and preventable.
The argument of this paper is direct: SMBs in the UAE consistently face a higher concentration of insider fraud risk than larger regulated entities, and they are simultaneously the least likely to deploy the pre-employment verification controls that would reduce that exposure. The gap between the risk they carry and the scrutiny they apply is the problem. The regulatory environment has not closed it. Market practice has not closed it. And the costs, when they materialise, are disproportionate.
The Scale of the Problem in the UAE Context
SMBs represent more than 94% of all businesses operating in the UAE and employ approximately 86% of the private sector workforce. That is not a segment of the economy. That is the economy. The approximately 350,000 SMBs active in the country range from single-owner consultancies and DMCC commodity trading entities to mid-sized professional services firms and family-owned light manufacturing operations. What they share, almost universally, is a hiring process that prioritises speed and personal referral over documented verification.
Federal Decree-Law No. 33 of 2021 on the Regulation of Employment Relationships, which replaced Federal Law No. 8 of 1980 and has been in force since 2 February 2022, does not mandate pre-employment background checks. The law provides that an employer may dismiss an employee without notice if it is proven that the employee submitted forged certificates or documents, but it places no affirmative obligation on the employer to verify credentials before an offer is made. The practical consequence is that approximately 20% of UAE employers conduct no background verification at all, and among SMBs the proportion is materially higher once resource and awareness constraints are factored in.
The regulatory frameworks that do impose screening obligations, including FATF Recommendation 18's requirement for adequate employee screening procedures within AML/CFT programmes and the fit and proper person requirements applied by the ADGM FSRA and DFSA to approved persons in regulated entities, apply to licensed financial institutions and designated non-financial businesses or professions. Most UAE SMBs do not fall within those categories, and even many that do treat the regulatory requirement as applying to senior appointments only, rather than as a standard applicable across their hiring pipeline.
Why Small Businesses Are the Primary Target and the Softest Victim
The Association of Certified Fraud Examiners' 2024 "Occupational Fraud: A Report to the Nations", based on analysis of more than 1,900 fraud cases across 138 countries, provides the foundational data point: organisations with fewer than 100 employees suffered a median fraud loss of USD 141,000 per incident. The same report found that fraud losses as a percentage of annual revenue tend to be higher for smaller organisations than for large ones, and that the typical fraud scheme ran for twelve months before detection, with an average monthly loss of USD 9,900. The ACFE further found that more than half of all fraud cases were correlated with either an absence of internal controls or management override of existing controls, and that small organisations are significantly less likely than larger counterparts to have anti-fraud controls in place.
The UAE context amplifies these figures in three ways.
First: the expatriate workforce verification challenge. The workforce is overwhelmingly expatriate and geographically dispersed in its origins. Candidates arrive from jurisdictions with minimal or no background screening infrastructure, where employment history verification requires direct calls to foreign HR departments that often do not respond, where academic certificates are not attested to a common standard, and where criminal record checks require navigating foreign government channels that vary enormously in accessibility and reliability. A hiring manager at a DIFC-adjacent advisory firm or an Abu Dhabi light manufacturing company faces a genuine operational burden in verifying a candidate from rural South Asia or West Africa. Most SMB owners solve this problem by not attempting it.
Second: the referral economy as a substitute for verification.
Wasta, and its commercial equivalent across the expatriate professional community, creates informal trust networks that carry real social weight. An introduction from a shared contact is treated as implicit endorsement. The problem is that social endorsement and professional integrity are not the same thing, and in a transient workforce where career paths span multiple countries, a trusted contact in Dubai may have met the candidate once at a conference in Nairobi. The ACFE data is instructive: most perpetrators of occupational fraud had no prior criminal record at the time of the offence, meaning that even a UAE police Good Conduct certificate would not have flagged them. The meaningful signal lies in employment history, the circumstances under which previous roles ended, and what former managers are willing to say when asked directly.
Third: SMB internal structures create optimal conditions for fraud. Segregation of duties, the single most effective structural control against asset misappropriation, is difficult to implement when a finance function consists of two people. A single employee who handles both payment approval and bank reconciliation has operational access to the full fraud cycle. In an SMB context, the owner often trusts that employee precisely because they are the only person who understands the books. The ACFE found that weak controls provide the opportunity for fraud, and that management override, common in owner-managed businesses where the finance manager is given broad authority to keep things running, accounts for a substantial proportion of cases.
The Specific Risks Being Underestimated
Credential Fraud and the Unlicensed Degree Problem
Federal Law No. 9 of 2021 on the Prohibition of the Use of Academic Degrees Issued by Non-Licensed Entities prohibits the use of certificates from unlicensed educational institutions for employment purposes in the UAE. The penalties are significant: intentional submission of a forged degree carries imprisonment of up to one year and fines of up to AED 500,000, and employers who knowingly accept forged degrees face imprisonment of up to two years and fines up to AED 1,000,000. There were 143 recorded attempts to pass forged certificates for employment in the UAE in 2018 alone.
Despite this legislative framework, the verification burden sits with the employer and most SMBs do not exercise it. The MOFA attestation process for foreign qualifications exists and is accessible. Third-party verification services offer comprehensive checks, including employment history, education, criminal record and reference interviews, for AED 1,000 to 3,000 per candidate. For an SMB hiring a finance manager or operations director on a package of AED 15,000 to 25,000 per month, spending AED 2,000 on pre-employment verification is a fraction of one month's salary. The argument against doing it is not cost. It is habit.
The Undisclosed Prior Employment History
The more operationally significant risk is not the forged degree but the falsified or omitted employment history. A candidate who was dismissed from a previous role for financial misconduct, but whose departure was handled quietly by a former employer reluctant to pursue legal action, will present a CV that either omits the role entirely or characterises the departure as voluntary. In a market where many employers receive references that amount to nothing more than confirmation of employment dates, this gap is rarely closed. Candidates from jurisdictions where legal constraints make adverse reference disclosure difficult, or where cultural norms discourage it, are particularly difficult to vet through database methods alone.
Reference interviews conducted by trained investigators, not HR administrators, consistently surface material that formal checks miss. A former manager who will not comment officially on a dismissal for financial irregularity will often, in a structured telephone conversation conducted under the right framing, communicate the substance of that information without ever stating it as a formal adverse reference.
The AML and Regulatory Exposure Dimension
For UAE SMBs that fall within the scope of AML/CFT obligations, whether as DNFBPs under Federal Decree-Law No. 20 of 2018, as entities registered under ADGM, DIFC or DMCC frameworks, or as participants in the virtual asset sector regulated by VARA, the hiring risk carries a regulatory dimension that most boards have not adequately priced.
FATF Recommendation 18 requires that financial institutions and other obliged entities implement adequate procedures to ensure high ethical standards in recruitment as part of their internal AML/CFT programme. The ADGM FSRA and DFSA both apply fit and proper person criteria to individuals performing controlled functions, requiring assessment of probity, competence and financial soundness. What these requirements mean in practice, but rarely what regulated SMBs deliver, is that hiring someone into a role with access to client funds, transaction approval, compliance function or senior management without conducting meaningful personal background verification is an internal controls failure. It is the kind of failure that, in the context of the UAE's forthcoming FATF 5th Round Mutual Evaluation scheduled for mid-2026, supervisors will be actively looking for evidence of.
The UAE's National Risk Assessment 2024 identified fraud as one of the two highest-rated predicate offences for money laundering risk in the country. An SMB that places an unvetted individual with a history of financial misconduct into a role with payment access is not simply taking an operational HR risk. It is potentially creating a conduit for proceeds of fraud to move through its financial activity, with all the AML reporting and liability consequences that flow from that.
What the Appropriate Response Looks Like
Compliance officers, general counsel and operations directors at UAE SMBs should treat the following as minimum standard practice, not optional enhancement: Pre-employment screening for any role with financial, compliance or data access. This means employment history verification with direct contact to former employers, not reliance on candidate-supplied reference names alone. The HireRight 2024 Global Benchmark Report found that 36% of EMEA background checks surfaced discrepancies between candidate claims and verified records. One in three checks at the basic level. A rate that justifies the investment in every case.
Degree attestation aligned with Federal Law No. 9 of 2021. Verify that educational qualifications were issued by licensed institutions and have been attested through MOFA or the appropriate UAE Embassy channel before the candidate is offered or commences the role.
UAE Good Conduct Certificate and, where relevant, international criminal record checks. As a minimum, require a UAE police Good Conduct Certificate as a condition of offer. For roles with significant financial responsibility, extend this to the candidate's country of origin and any other jurisdiction where they have resided for two or more years.
Structured reference interviews for senior appointments. A phone call to a former manager is not a box-ticking exercise. It is an intelligence collection activity. The questions asked, the framing, and the interpretation of what is said and not said require skill. HR administrators conducting perfunctory reference checks are not equipped to conduct this work to the standard required.
Document the process. For DNFBP-regulated entities and those within ADGM, DIFC or DMCC frameworks, the absence of documented pre-employment screening for key roles is a demonstrable gap in internal controls. Under the CBUAE AML/CFT guidelines and the requirements flowing from the 2024 National Risk Assessment, documented evidence of screening decisions and outcomes will be requested by supervisors during inspections.
The Assumption That Needs Challenging
The received wisdom in UAE SMB hiring is that due diligence is something you apply to your clients and counterparties, not to your own people. That assumption reflects how most commercial due diligence frameworks were designed, with their focus on external parties, KYC and sanctions screening. It does not reflect where the material losses actually occur.
The person sitting three desks away with access to the payment system is a more immediate financial risk than most of the counterparties your compliance function is screening. The controls applied to the former are, in most UAE SMBs, a fraction of those applied to the latter. Closing that gap does not require a legal mandate. It requires a decision to treat internal hiring with the same rigour that commercial due diligence receives.