The Auditor Signed Off and the Company Collapsed: Can Shareholders Sue the Auditor in the DIFC Courts?

Possibly, but four questions can decide the claim before anyone tests the audits: whose loss it is, which law governs, whether time has run and whether the DIFC Courts can hear it. The only published DIFC claim against an auditor for shareholder loss located in the court's published decisions ended on limitation. Shareholders holding about 24 percent of a bank incorporated in Lebanon sued a firm registered as an auditor in the DIFC, which they said was responsible for the bank's audits, for about USD 128 million. They said proper audits would have exposed money laundering in time to prevent the bank's sale and liquidation. In March 2019 the DIFC Court of Appeal let them add the partner responsible for the audits as a defendant. In February 2023 it dismissed their appeal: under Lebanese law, which governed, five years ran from the general assembly that received each audit report, the last on 26 May 2010, and the claim form was issued on 19 July 2016.

Those were findings of Lebanese law on expert evidence, not rules of DIFC law. What carries across is the order of the questions and the DIFC procedure, now read with Dubai Law No. 2 of 2025, which superseded the Judicial Authority Law under which both appeals were decided.

The checklist sets each question against what the appeals decided or only recorded.

Can a DIFC claim against an auditor recover a shareholder's loss?

It can be claimed, but a loss that mirrors the company's is the auditor's first target. The shareholders claimed the difference between what they received and stood to receive from the liquidation and what their shareholding, and the sums they would otherwise have received, were worth, as the Court of Appeal's judgment of 9 February 2023 in CA 012/2021 and CA 014/2021 records. The trial judge identified Lebanese-law rules barring a shareholder's individual claim for a fall in share value connected to the company's loss through management default or audit fault. He held that they did not apply where there was no risk of double recovery, found none, and held the loss recoverable. The auditors' challenge to that was fully argued on appeal and left undecided as moot.

The nearest DIFC ruling found comes from a different kind of case. In December 2021 a DIFC judge declared a claimant barred from claiming losses suffered as a shareholder of holding companies, after argument on the rule against reflective loss as the UK Supreme Court's majority stated it in 2020. That declaration was not appealed, and in July 2022 the Court of Appeal, in CA 003/2022, refused the claimant's amendments and gave immediate judgment against the claimant on the whole claim. No published decision found applies that bar to a shareholder suing an auditor.

Key takeaway. A fall in share value that mirrors the company's loss is the part of the claim most exposed to challenge. Separate any loss that is yours alone before you price a claim against the auditor.

Which law governs a shareholder's claim against the auditor?

Not necessarily DIFC law, even when the firm is registered in the DIFC and sued there. Article 8 of the Law on the Application of Civil and Commercial Laws in the DIFC picks the first applicable law from a list: DIFC law so far as there is regulatory content, a law chosen by a DIFC Law, a law agreed by all concerned, the law most closely related to the facts and persons, and English law. Article 23 of the 2025 law applies DIFC Laws except where they provide otherwise, and on a reading Article 8 is such a provision. The shareholders first pleaded deceit, negligence and the Regulatory Law, with Lebanese law as the alternative, as the Court of Appeal's judgment of 13 March 2019 in CA 011/2018 records. By the trial of preliminary issues their claims rested only on Lebanese law, it was agreed they had no contract with either defendant, and the trial judge held that Lebanese law also decided limitation.

Three points a claim plan has to start from.

Can the DIFC Courts hear a claim against a DIFC-registered audit firm?

Yes, on the reasoning of the 2019 appeal, now read with the 2025 law. The Court of Appeal recorded that the firm, a general partnership registered in Cyprus, was a registered auditor in the DIFC, which gave jurisdiction against it under Article 5(A)(1)(a) of the Judicial Authority Law, and stated that jurisdiction existed because the firm was a DIFC Establishment and a Licensed DIFC Establishment under the supervisory control of the DFSA. Under that gateway, it said, the DIFC party's role, as claimant, defendant or third party, does not matter.

Article 43 of Dubai Law No. 2 of 2025 superseded that law. Article 14(A)(1) now gives exclusive jurisdiction over civil or commercial claims to which a DIFC Establishment is party, and Article 2 defines one to include any entity or business registered to carry on any activity in or through the DIFC under DIFC Laws and DIFC Regulations. On a reading, a registered audit firm stays inside that gateway, though no published decision applying Article 14(A)(1) to an audit firm was found. A defendant disputing jurisdiction must apply within 14 days after filing its acknowledgment of service under RDC Part 12, and our guide to suing a Dubai bank in the DIFC Courts compares the other gateways.

Can the audit partner be sued alongside the firm?

Yes, but here only through the joinder rule, and only after an appeal. The partner, who also managed a Lebanese accounting company and was the individual responsible for the audits, was named in the claim form, but in August 2017 the Court held it had no jurisdiction over him: the claim against him passed no gateway, and the Law of Obligations and the Regulatory Law supplied none. In February 2018 the judge refused the firm's application to strike out the claim or give immediate judgment, but held that RDC 20.7(2) could not add a party over whom there was no independent jurisdiction. The Court of Appeal disagreed: the court rules are DIFC Regulations, RDC 20.7 confers a discretionary jurisdiction where its criteria are met, and the original claim must still pass a gateway. It added him as the central figure in the case against the firm, to avoid duplicated cost and inconsistent judgments, though the firm could be liable without him.

The equivalent gateway now is Article 14(A)(7), for claims within the DIFC Courts' jurisdiction under DIFC Laws and DIFC Regulations. In an order of 30 April 2025 in CFI 079/2023, the Court of First Instance held it relevantly the same as the old provision and, applying the 2019 appeal, that RDC 20.7 can still found jurisdiction to add a party. That is a first-instance decision, and no appeal from it was found.

When does the limitation clock start on an auditor claim?

It depends on the governing law, and in the 2023 appeal a foreign rule decided it. The trial judge preferred the defendants' expert: Article 178 of the Lebanese Code of Commerce, which subjects auditors' liability for supervisory faults to a five-year limit, covered every fault committed in carrying out the audit, and time ran from the general assembly that received the report complained of. The shareholders had argued for ten years for some breaches. The last report was presented on 26 May 2010, time expired on 26 May 2015, and the claim form came on 19 July 2016. Their primary case, six years under DIFC law as the law of the forum from the shareholders' approval of the bank's sale on 28 July 2011, failed because the Lebanese rule was substantive.

If DIFC law governs, Article 28 of the 2025 law bars proceedings begun more than six years after the events giving rise to them unless DIFC Laws provide otherwise, and the Law of Obligations has its own rules. For negligence, Article 9(2) starts time when the claimant knows or ought reasonably to know about the loss, within fifteen years of when the cause of action in fact arose, and Article 9(1) removes the time limit where the cause of action arises from the defendant's fraud. Article 9(1) still refers to Article 38 of the superseded DIFC Court Law, so how Article 9 fits with Article 28 is a reading. Our guide to older DIFC claims and limitation covers contract periods.

Deadline warning. A claim is brought for limitation purposes on the date the Registry receives the claim form, if that is earlier than issue, and RDC 7.8 tells claimants near the deadline to record that date themselves. In the 2023 appeal the claim form was issued more than a year after time had run.

What did the two appeals decide, and what happened afterwards?

The 2019 appeal decided jurisdiction over the partner and the 2023 appeal decided limitation, tried as a preliminary issue, a step RDC 26.35(7) lets the Court consider at case management. Neither decided whether the audits were negligent or dishonest, whether any duty was owed to the shareholders, or whether their loss was recoverable. On 9 February 2023 the Court dismissed the appeal on both permitted grounds, reasoning that findings on an unfamiliar foreign law made after hearing the experts are reviewed with a light touch, and that unsettled foreign-law questions are matters of evaluation a foreign court might decide differently. The shareholders were ordered to pay the costs of the appeal, except on recoverability.

October 2026 searches of the DIFC Courts' orders, the Court of Appeal listings and the 84 decisions listed by the Conflicts of Jurisdiction Tribunal found nothing after the judgment except consent orders of 8 May 2023 and 8 June 2023 extending the time to start assessing those costs, and Article 18 of the 2025 law makes Court of Appeal judgments final. My reading is that the claim was lost on dates and the choice of law, not on the audits, which no court examined. A shareholder who leaves limitation to the defence is working in the wrong order.

What do DIFC statutes require of auditors, and what can the DFSA do?

They regulate the audit closely and say little about shareholders' claims. For a DIFC company other than an Authorised Person, Publicly Listed Company or Recognised Person, which Article 120(1) excludes, Part 10 of the Companies Law applies: the auditor must be registered under the Operating Law (Article 127), report to the shareholders on whether the accounts were properly prepared and give a true and fair view (Article 128), and investigate enough to form an opinion on the records, returns and accounting standards (Article 129). For a bank authorised by the DFSA, Part 8 of the Regulatory Law, consolidated to its October 2025 amendment, sets parallel duties in Article 101 and, in Article 104, obliges the Auditor to tell the DFSA of matters tending to show breaches of DFSA-administered legislation, and protects good-faith disclosure. The DFSA registers audit firms and their Audit Principals, may suspend or withdraw registration, and under Article 90 may fine, censure or direct compensation for a contravention, as its own decision.

Closest to a shareholder's own claim is Article 94. A person who intentionally, recklessly or negligently breaches a duty imposed under DFSA-administered legislation is liable to compensate any other person for loss caused as a result, and the Court may order damages on the application of the person who suffered it, unless that liability is excluded under that legislation. The 2019 appeal treated Article 94(2) as conferring jurisdiction, with limits of its own. No published decision applying it to an auditor at a shareholder's suit was found.

The statutory duties in three cards.

Reliance, exclusion clauses and the liquidator: what else can defeat the claim?

Three obstacles turn on texts no published auditor decision found has applied, so each is a reading. Reliance: for pure economic loss, Article 20 of the Law of Obligations requires that the auditor assumed responsibility to the claimant and that the claimant relied on it reasonably. Under Article 20(2), a person making a statement assumes responsibility to recipients, individually or as an ascertainable class, if he knows or ought to know it will reach them and is likely to be acted on for its purpose, and intends, or is reasonably believed to intend, that they act on it. Causation then needs a but-for and substantial cause under Article 10, and Article 27(2) of the Law of Damages and Remedies values a lost opportunity by its probability. Exclusions: Article 59 lets a person exclude or limit that liability unless otherwise provided, subject to the Implied Terms in Contracts and Unfair Terms Law, and no Companies Law provision invalidating an auditor's exclusion was found. The liquidator: Schedule 3 to the Insolvency Law lets a DIFC liquidator bring and compromise the company's claims, including any against its auditor.

The order of work follows those obstacles.

1. Fix the governing law under Article 8, with foreign-law advice, before relying on any limitation date.
2. Diary the earliest possible start date, which in the 2023 appeal was the meeting that received each audit report.
3. Separate loss that is yours alone from loss mirroring the company's, and ask whether the liquidator is claiming.
4. Confirm the firm's DIFC registration and a jurisdiction basis for every defendant, including the partner.
5. Read the articles, engagement letters and audit report for jurisdiction clauses, addressees and exclusions.
6. Start a Part 7 claim in the Court of First Instance against the firm, in its partnership name where RDC 7.11 requires it, and the partner, recording when the Registry receives it.

Frequently Asked Questions

Can shareholders sue the auditor if the bank was not a DIFC company? Yes, if a gateway reaches the auditor. In the auditor case the bank was incorporated in Lebanon, and jurisdiction over the audit firm came from its own registration as an auditor in the DIFC. Article 14(A)(1) of Dubai Law No. 2 of 2025 now covers civil or commercial claims to which a DIFC Establishment is party, but foreign law may still govern the claim, as Lebanese law did there.

Does the auditor owe me, as a shareholder, a duty of care? No published DIFC decision found has decided that it does. Neither appeal reached the question of duty, and by the trial of preliminary issues the claims rested only on Lebanese law. If DIFC law governs, Article 20 of the Law of Obligations allows a duty for pure economic loss only where the auditor assumed responsibility to you and you relied on it reasonably.

What is reflective loss, and will it stop my claim? It is loss a shareholder suffers only because the company was harmed, such as a fall in the value of the shares. In the auditor case the trial judge held the loss recoverable under Lebanese law and the Court of Appeal left the point undecided. In a separate DIFC case a claimant was barred from claiming losses suffered as a shareholder, a ruling that was not appealed.

How long do I have to sue an auditor in the DIFC Courts? It depends on the governing law. Under the Lebanese law applied in 2023, five years ran from the general assembly that received the audit report. If DIFC law governs, Article 28 of Dubai Law No. 2 of 2025 sets six years from the events unless a DIFC Law provides otherwise, and Article 9 of the Law of Obligations has its own rules for negligence and for fraud.

Can I add the audit partner to the claim later? The 2019 appeal added the partner under RDC 20.7(2), and a 2025 first-instance order applied that route under Article 14(A)(7) of the 2025 law. If a DIFC limitation period has expired by then, RDC 20.28 allows a new party only if the period was current when the proceedings started and the addition is necessary within RDC 20.29. Separately, Article 127(5) of the Companies Law treats a firm's appointment as auditor of a DIFC company as the appointment of each partner.

Will the DFSA get my money back? Not as of right. Article 90 of the Regulatory Law lets the DFSA fine or censure a person who contravened its legislation and direct that person to compensate others, but that is the DFSA's decision. A person who suffered loss can apply to the Court under Article 94, which no published decision found has applied to an auditor at a shareholder's suit.

What if the engagement letter or the audit report excludes liability? Under Article 59 of the Law of Obligations a person can exclude or limit liability arising under its Part 3 unless otherwise provided, subject to the Implied Terms in Contracts and Unfair Terms Law, and no provision of the Companies Law invalidating an auditor's exclusion was found. Where a foreign law governs the claim, its own rules decide the point.

Can the auditor have the claim sent to another court? It can try, for example under Article 14(C)(1) of Dubai Law No. 2 of 2025, which lets the DIFC Courts decline jurisdiction where the parties agreed in writing to another court. In the auditor case the first-instance judge held that neither the bank's articles nor the engagement letters bound the firm and the shareholders as between themselves, as the 2019 appeal records.

This article is for general informational purposes only and does not constitute legal advice. Consult a qualified advocate for advice on your specific situation.

Related Guides

Our business and governance page covers entity choice, directors' duties, shareholder arrangements and corporate records.

• Excluded From Your DIFC Company: Records and Shareholder Remedies
• Your DIFC Expert Report Sounds Like Advocacy: What Needs to Change?
• Was my DIFC investment mis-sold, or did the market fall?