Civil Law and UAE Regulatory Tort Overlap Systems

1. Introduction

Regulatory tort overlap occurs when the same conduct creates both:

a regulatory violation, and

a civil wrong causing private loss or damage.

For example, a regulated financial institution may violate a regulatory requirement concerning suitability or disclosure. The regulator may have power to investigate or penalise the institution, while an affected customer may separately pursue compensation if the regulatory breach also gives rise to a recognised civil claim.

The UAE system therefore requires a distinction between public regulatory enforcement and private civil liability. The distinction is particularly developed in DIFC jurisprudence, where the former DIFC Regulatory Law expressly permitted civil proceedings for certain regulatory breaches. (DIFC Courts)

For mainland UAE, the current framework must also be read with the Federal Decree by Law No. 25 of 2025 promulgating the Civil Transactions Law, which represents the current civil-law framework from 1 June 2026. (UAE Legislation)

2. Meaning of Regulatory Tort Overlap

A regulatory-tort overlap can be represented as:

Regulatory Duty
↓
Breach of Regulatory Rule
↓
Civilly Recognised Wrong
↓
Damage
↓
Causation
↓
Civil Liability

At the same time:

Same Regulatory Breach
↓
Regulator's Investigation
↓
Administrative/Disciplinary Enforcement

Thus, one factual event may produce two different legal consequences.

Example

A financial adviser:

fails to comply with a regulatory suitability rule;

recommends an unsuitable investment;

the customer relies on the recommendation;

the investment loses value.

There may be:

Regulatory side:
DFSA/regulator → investigation → regulatory sanction.

Civil side:
Customer → civil proceedings → compensation if breach, causation and loss are established.

These two proceedings have different purposes.

3. Regulatory Liability and Tort Liability Are Not Identical

This distinction is fundamental.

Regulatory liability

Regulatory liability arises from breach of:

regulatory rules;

licensing conditions;

statutory requirements;

compliance obligations;

professional standards.

Tort liability

Tort liability generally arises from wrongful conduct causing legally compensable harm.

The current UAE Civil Transactions Law expressly deals with harm, multiple responsible persons, contribution by the injured party and compensation for resulting loss. For example, Article 253 addresses multiple persons responsible for harm and contribution by the injured person, while Article 255 provides that compensation is assessed by reference to loss and lost profit that is a natural consequence of the harmful act. (UAE Legislation)

Regulatory tort overlap

The difficult question is:

When does violation of a regulatory rule also become a basis for civil liability?

The answer depends upon the applicable legislation, the nature of the regulatory obligation, the existence of a protected private interest, causation, damage and the available remedy.

4. The UAE's Dual-Layer Approach

The UAE system can be understood through two layers.

Layer 1 — Public regulation

The regulator may:

investigate;

inspect;

request information;

issue directions;

impose administrative consequences;

suspend or restrict activities;

impose regulatory sanctions;

refer matters for further proceedings where appropriate.

Layer 2 — Private civil law

The injured party may potentially seek:

damages;

compensation;

restitution;

recovery of property;

rescission where available;

specific performance;

injunctions;

declarations;

other civil remedies.

The two layers may overlap factually without becoming legally identical.

5. Article 94 of the Former DIFC Regulatory Law

The clearest UAE example comes from the former DIFC Regulatory Law.

Article 94 provided that a person who intentionally, recklessly or negligently breached a duty, requirement, prohibition, obligation or responsibility imposed by the regulatory legislation could be liable for loss or damage caused by that conduct.

The Court could order:

damages;

compensation;

recovery of property; or

another appropriate order. (DIFC Courts)

This provision is particularly important because it expressly connected regulatory breach with private civil remedies.

The Khorafi litigation became the leading example.

6. Regulatory Tort Overlap Does Not Mean Every Regulatory Breach Is a Tort

This is an important limitation.

A claimant cannot automatically argue:

"The defendant breached a regulation, therefore I have a tort claim."

The claimant may need to establish:

a legally applicable regulatory duty;

breach;

the applicable mental or fault standard;

protected interest or recognised cause of action;

actual damage;

causation;

legally recoverable loss;

appropriate remedy.

Some regulatory provisions exist primarily to protect the market or public administration and may not independently create a private cause of action.

Therefore:

Regulatory breach ≠ automatic tort liability.

7. Regulatory Breach as Evidence of Civil Wrongdoing

A regulatory violation can nevertheless be highly relevant to a civil case.

It may demonstrate:

failure to exercise required care;

breach of professional standards;

failure to disclose material information;

improper conduct;

inadequate compliance;

violation of a statutory obligation;

foreseeability of risk.

But the civil court must still determine the legal significance of the breach.

8. Contract, Regulation and Tort Can Overlap

A single dispute may contain three different causes of action.

Contract

The defendant breached an express or implied contractual obligation.

Regulation

The defendant violated a regulatory requirement.

Tort

The defendant's conduct caused independent civil harm.

For example:

Investment agreement

Regulatory suitability obligation

Negligent advice

=

Potentially overlapping contractual, regulatory and tort issues.

The claimant must nevertheless establish the requirements of each cause of action separately.

9. Causation in Regulatory Tort Cases

Causation is often the most difficult issue.

Suppose:

a bank breached a regulatory disclosure obligation;

the customer invested AED 10 million;

the market subsequently declined;

the customer lost AED 3 million.

The court must determine:

Was the loss caused by the regulatory breach, or by the independent market decline?

A useful structure is:

Regulatory Breach

↓

What would proper compliance have produced?

↓

Would the claimant still have invested?

↓

Would the investment still have suffered the same loss?

↓

What loss was actually caused by the breach?

This is why regulatory civil claims can become technically complex.

10. Multiple Causes of Damage

The current Civil Transactions Law expressly addresses situations where multiple persons are responsible for harm.

Article 253 provides that where several persons are responsible:

liability may be allocated according to their respective shares;

the court may impose equal or joint-and-several liability; and

compensation may be reduced or denied where the injured party contributed to the harm. (UAE Legislation)

This is particularly relevant to regulatory-tort overlap.

Example

A financial loss could result from:

negligent adviser;

inadequate compliance system;

misleading product documentation;

customer's own investment decision;

market movement.

The court may need to determine the causal contribution of each factor.

11. Regulatory Tort and Economic Loss

Regulatory disputes frequently involve pure economic loss, especially in:

banking;

securities;

investment management;

insurance;

financial advice;

digital assets;

corporate transactions.

Therefore, the claimant must carefully identify the legally recoverable loss.

The Khorafi litigation demonstrates that the existence of regulatory liability does not eliminate the need to properly plead and establish the particular heads of damage. (DIFC Courts)

12. At Least 6 Important Case Laws

Case 1 — Khorafi v Bank Sarasin-Alpen

Rafed Abdel Mohsen Bader Al Khorafi & Others v Bank Sarasin-Alpen (ME) Ltd & Another [2009] DIFC CFI 026

This is the leading UAE/DIFC authority on regulatory-civil overlap.

The Court considered Article 94 of the DIFC Regulatory Law and accepted that qualifying regulatory breaches could generate private civil liability.

The Court rejected the argument that regulatory legislation necessarily excluded civil remedies. Article 94 itself supplied a civil remedy mechanism. (DIFC Courts)

Principle

Regulatory breach may constitute an independent basis for civil compensation where the applicable regulatory legislation expressly provides for it.

Case 2 — Khorafi v Bank Sarasin-Alpen [2015]

Khorafi v Bank Sarasin-Alpen (ME) Ltd [2015] DIFC CA 003

The Court of Appeal considered the scope of Article 94 and the regulatory obligations applicable to financial services.

The case demonstrates that regulatory requirements can be directly relevant to civil proceedings and compensation.

The statutory wording covered intentional, reckless and negligent breaches of regulatory duties and provided for damages, compensation and recovery of property. (DIFC Courts)

Principle

Regulatory duties can have direct private-law consequences where the governing legislation provides such a mechanism.

Case 3 — Khorafi v Bank Sarasin-Alpen [2018]

Khorafi v Bank Sarasin-Alpen (ME) Ltd [2018] DIFC CA 010

This later appellate proceeding is particularly important for damages.

The Court emphasised that the claimant's pleaded heads of loss determine the scope of the damages claim. New heads of damage cannot simply be introduced after the liability trial. (DIFC Courts)

Principle

Regulatory liability does not eliminate ordinary civil requirements concerning:

pleadings;

causation;

proof;

quantum.

Case 4 — Gauge Investments Ltd v Ganelle Capital Ltd

Gauge Investments Ltd v Ganelle Capital Ltd [2016] DIFC ARB 003/006

This is one of the most important authorities on the relationship between regulatory enforcement and private civil proceedings.

The Court held that private civil claims founded upon regulatory breaches could be arbitrated and did not necessarily conflict with the DFSA's public regulatory functions.

The claimant could pursue its private civil claim while the DFSA remained capable of investigating and taking disciplinary action. (DIFC Courts)

Principle

Public regulatory enforcement and private civil remedies can coexist.

The Court also recognised that the two proceedings have different legal characters, meaning that res judicata did not automatically prevent separate regulatory enforcement following a private proceeding. (DIFC Courts)

Case 5 — Sanjeev Sawhney v Credit Suisse AG

Sanjeev Sawhney & Alka Sawhney v Credit Suisse AG [2022] DIFC CFI 062

The claim involved alleged failures concerning:

client classification;

suitability;

investment recommendations;

regulatory compliance.

The Court recognised that a breach of the Regulatory Law or DFSA Rules could potentially generate a civil claim under Article 94 where the statutory requirements were satisfied. (DIFC Courts)

Principle

A regulatory civil claim must identify the specific regulatory rule allegedly breached.

The defendant in the case argued that an Article 94 claim required identification of the actual regulatory rule giving rise to the alleged cause of action. (DIFC Courts)

Case 6 — Al Khorafi v Bank Sarasin-Alpen: Jurisdiction

Al Khorafi v Bank Sarasin-Alpen (ME) Ltd [2011] DIFC CA 003

The Court considered the jurisdictional connection between regulatory/tort claims and the DIFC.

The Court explained that an "incident" could encompass essential elements of conduct or loss necessary to establish a tort or breach of statutory duty. It also emphasised the geographical connection required for the DIFC jurisdictional gateway. (DIFC Courts)

Principle

Regulatory-tort overlap does not eliminate the need to establish proper jurisdiction.

A claimant must show the required connection between:

the incident;

transaction;

DIFC activity; and

alleged civil wrong.

Case 7 — Muzoon Holding LLC v Arif Naqvi

Muzoon Holding LLC v Arif Naqvi [2018] DIFC CFI 080

The Court examined the DIFC jurisdictional gateway for civil and commercial claims connected with incidents or transactions occurring within the DIFC.

The Court relied on the Khorafi approach to incidents involving tortious liability and breach of statutory duty. (DIFC Courts)

Principle

A regulatory-tort claim still requires a proper jurisdictional gateway.

Case 8 — Hardt v Sajwani

Dr Lothar Ludwig Hardt & Hardt Trading FZE v Hussain Al Habib Sajwani & Peter Riddoch [2009] DIFC CFI 036

The claim involved alleged representations, loss and an asserted duty of care in tort, together with alleged breaches of DIFC legislation.

The case illustrates the importance of distinguishing contractual, statutory and tortious duties rather than treating every statutory or regulatory violation as automatically creating the same civil cause of action. (DIFC Courts)

Principle

The source and nature of the duty must be identified before determining civil liability.

13. Case Law Comparison

14. Important Difference Between Mainland UAE and DIFC

This distinction is essential for examination and legal research.

Mainland UAE

The principal civil liability framework is based on the federal civil legislation, currently the 2025 Civil Transactions Law, together with sector-specific legislation.

DIFC

DIFC has its own:

regulatory legislation;

Law of Obligations;

contract legislation;

remedies framework;

courts;

regulatory institutions.

The DIFC's former Article 94 mechanism is therefore a particularly clear example of statutory regulatory-civil overlap, but it should not automatically be transplanted into mainland UAE law.

15. Regulatory Tort Overlap in Different Sectors

A. Banking

Potential overlap:

Regulatory duty → improper banking conduct → customer loss → civil claim

Issues include:

disclosure;

suitability;

misrepresentation;

unauthorised activity;

compliance failures.

B. Securities and Investment

Potential claims may involve:

misleading information;

unsuitable investment advice;

unauthorised financial services;

market misconduct;

negligent advice.

C. Consumer Protection

A supplier's regulatory violation may coincide with:

defective product;

misleading advertisement;

failure to warn;

unsafe product;

economic or physical injury.

The consumer's civil claim and governmental enforcement remain conceptually distinct.

D. Data Protection

Unlawful data processing may potentially produce:

Regulatory violation + privacy injury + financial loss

The exact civil remedy depends upon the applicable data-protection and civil-liability provisions.

E. Digital Assets

A digital-asset provider may simultaneously face:

licensing issues;

regulatory compliance issues;

contractual claims;

property claims;

negligence claims;

restitutionary claims.

This makes regulatory-tort overlap particularly important in fintech.

16. Regulatory Breach as a Standard of Care

One of the most useful analytical approaches is to ask:

Does the regulatory requirement help define the standard of care applicable to the defendant?

For example, if a regulated professional is required to undertake specified risk assessments, failure to do so may be evidence relevant to whether the professional acted negligently.

But the analysis must not automatically become:

"Regulation breached = negligence proved."

The court must examine:

wording of the rule;

purpose of the rule;

protected persons;

type of harm;

defendant's conduct;

causation;

damage;

statutory consequences.

17. Regulatory Tort and Private Right of Action

A particularly important question is:

Was the regulation intended to create or support a private remedy?

Three possibilities exist.

Model 1 — Express civil remedy

The statute expressly says that an affected person can sue.

This was the clearest position under former DIFC Article 94.

Model 2 — Civil remedy arises through another cause of action

The regulatory breach may be evidence supporting:

negligence;

contractual breach;

misrepresentation;

restitution;

another civil claim.

Model 3 — Regulatory breach only

The legislation may provide only for regulatory enforcement.

In that situation, the claimant cannot automatically convert the regulatory breach into an independent tort.

18. Regulatory Enforcement Does Not Necessarily Bar Civil Proceedings

A regulator may have already imposed a penalty.

That does not necessarily answer:

"How much money does the injured person receive?"

A regulatory sanction and civil compensation have different objectives.

For example:

Regulator:
Fine or disciplinary action.

Civil court:
Compensation for proven loss.

Therefore:

Penalty ≠ Compensation

and:

Compensation ≠ Regulatory Punishment

19. Civil Court and Regulatory Decision

Where a regulator has already made findings, the civil court may need to consider:

what exactly the regulator decided;

whether the decision is final;

what statutory effect it has;

whether the defendant had procedural rights;

whether the finding establishes the civil issue;

whether independent proof remains necessary.

The legal effect of a regulatory decision therefore depends upon the governing legislation and procedural framework.

20. Parallel Proceedings

A single event can produce:

Regulatory proceeding

Civil lawsuit

Arbitration

Criminal investigation

The existence of multiple proceedings does not automatically mean that one must be stopped.

Gauge Investments is particularly useful because the Court recognised that private arbitration and regulatory enforcement could coexist. (DIFC Courts)

21. Defences in Regulatory-Tort Claims

A defendant may argue:

1. No regulatory breach

The relevant rule was complied with.

2. No private cause of action

The regulatory provision does not create a private remedy.

3. No duty owed to claimant

The rule protects the market generally rather than establishing a private duty to the claimant.

4. No causation

The loss resulted from another cause.

5. Contributory conduct

The claimant contributed to the loss.

The current Civil Transactions Law expressly permits reduction or denial of compensation where the injured party contributed to the harm. (UAE Legislation)

6. No recoverable damage

A regulatory violation occurred but no legally compensable loss was established.

7. Limitation

The civil claim was brought outside the applicable limitation period.

8. Jurisdiction

The chosen court lacks jurisdiction.

22. Regulatory Tort Overlap and Corporate Groups

Complex disputes may involve:

parent company;

subsidiary;

licensed entity;

adviser;

director;

employee;

compliance officer;

service provider.

A regulatory breach by one entity does not automatically establish tort liability against every related entity.

The claimant must establish the relevant legal basis for each defendant.

This is especially important where regulatory permissions are held by one group company but services are actually performed by another.

23. Regulatory Tort Overlap and Directors

A director may potentially face:

corporate liability;

statutory liability;

regulatory consequences;

personal civil liability.

But corporate and personal liability must be separately established.

The court must ask:

What duty existed?

To whom was it owed?

Who breached it?

Was the director personally involved?

Did the breach cause loss?

Does the statute impose personal liability?

24. Practical Example

Suppose a licensed investment firm recommends an unsuitable investment.

Stage 1 — Regulation

The regulator identifies possible non-compliance.

Stage 2 — Civil claim

The customer claims that the firm's conduct caused AED 2 million in loss.

Stage 3 — Civil analysis

The court examines:

applicable regulatory rule;

breach;

contractual obligations;

duty of care;

customer's reliance;

alternative causes;

market conditions;

mitigation;

quantum.

Stage 4 — Remedy

If liability is established, the court determines the appropriate civil remedy.

Stage 5 — Regulatory consequence

Separately, the regulator may impose the regulatory consequence authorised by its legislation.

25. Key Legal Formula

Basic Model

Regulatory Rule
+
Breach
+
Civilly Relevant Duty
+
Damage
+
Causation

Potential Civil Liability

Parallel Enforcement Model

Regulatory Breach

→ Regulatory Investigation

and simultaneously:

Regulatory Breach

→ Private Civil Claim

The two tracks may coexist.

26. Important Exam Points

Regulatory liability and tort liability are conceptually distinct.

A regulatory breach does not automatically create a tort claim.

An express statutory civil remedy greatly strengthens the private claim.

Former DIFC Article 94 is the clearest UAE example of regulatory-civil overlap.

Khorafi is the leading authority.

Gauge confirms that private civil proceedings can coexist with regulatory enforcement.

Sawhney demonstrates the importance of identifying the precise regulatory rule.

Causation and actual loss remain essential.

Multiple causes of damage may require allocation of liability.

Regulatory sanctions and civil compensation serve different purposes.

Jurisdiction must be established independently.

DIFC authorities should not automatically be treated as binding mainland UAE precedent.

27. Short Exam Answer

Regulatory tort overlap in UAE civil law occurs where conduct breaches a regulatory requirement and simultaneously causes legally compensable private harm. Regulatory enforcement primarily protects public and market interests, whereas civil proceedings protect private rights.

The leading DIFC authority is Khorafi v Bank Sarasin-Alpen, where the former DIFC Regulatory Law's Article 94 provided a direct mechanism for compensation following qualifying regulatory breaches. Gauge Investments v Ganelle Capital confirmed that private civil proceedings based upon regulatory breaches could coexist with independent regulatory enforcement. Sawhney v Credit Suisse demonstrates the importance of identifying the precise regulatory rule underlying the civil claim. Other Khorafi decisions establish the importance of jurisdiction, pleading and proof of loss.

Under the current mainland UAE framework, the 2025 Civil Transactions Law provides the general civil-liability framework, including rules concerning harm, multiple wrongdoers, contribution by the injured party and compensation for natural consequences of harmful conduct. (UAE Legislation)

Therefore, the central principle is:

A regulatory breach may become relevant to civil/tort liability, but the claimant must establish the applicable legal duty or cause of action, breach, causation and legally recoverable damage.

28. Conclusion

UAE regulatory tort overlap is best understood as an interaction between public regulatory law and private civil liability.

The most important distinction is:

Regulatory enforcement asks:
"Did the regulated person breach the regulatory framework?"

Civil litigation asks:
"Did that conduct create a legally actionable wrong causing compensable harm to this claimant?"

The answer to the first question does not automatically answer the second.

The Khorafi cases demonstrate how legislation can expressly transform regulatory breaches into civil claims. Gauge Investments demonstrates the coexistence of public regulatory enforcement and private civil proceedings. Sawhney shows the importance of identifying the precise regulatory obligation, while the wider Civil Transactions Law framework makes harm, causation, allocation of responsibility and compensation central to civil liability. (DIFC Courts)

Thus, the core formula is:

Regulatory Duty → Regulatory Breach → Civilly Recognised Wrong → Causation → Damage → Civil Remedy

with the important qualification that not every regulatory violation creates an independent tort or private right of action.