Saturday to Thursday, 9:00 am – 6:00 pm

Legal Insights

Reporting Corporate Misconduct and Preserving Evidence and Documents

Financial Corruption and Economic Crimes

Early reporting of financial and commercial irregularities is one means of protecting companies, but it cannot achieve its purpose unless reporting channels are accompanied by impartial verification procedures and lawful evidence preservation. Confidentiality of a whistleblower’s identity is not an absolute guarantee; a digital image is not conclusive evidence in itself; and an internal policy does not replace specific statutory obligations to report to official authorities. This guide provides a practical framework for companies operating in Egypt to manage reports and preserve paper and digital evidence, distinguishing the evidential weight of electronic documents and signatures from the requirements governing criminal evidence.

I. Scope of Internal and External Reporting

Internal reporting involves submitting information about a potential violation through a company-approved channel, such as a compliance officer, audit committee or complaints platform. External reporting takes place before the competent official authority according to the nature of the matter, such as the Public Prosecution, regulators or authorities responsible for receiving suspicious-transaction reports under the anti-money laundering regime. A company’s policy must not prohibit lawful reporting to authorities or require exhaustion of internal procedures where the law provides otherwise.

A report differs from witness testimony, a disciplinary complaint and a judicial claim. A company must verify the substance of a report without presuming its accuracy or describing a whistleblower as having made a false report merely because the allegations were not substantiated. Criminal liability for false reporting requires the elements prescribed by the Penal Code; a good-faith suspicion alone does not constitute the offence.

II. The Egyptian Legal Framework

  • Evidence Law No. 25 of 1968: Governs the evidential value of official and private documents, the rules for producing them and challenges to their authenticity. Articles 20 and 21 permit an application to compel an opposing party to produce a relevant document in their possession in the circumstances and subject to the conditions specified therein; they do not confer an unrestricted right on a company to search another person’s documents.
  • Electronic Signature Law No. 15 of 2004: Articles 14 and 15 accord electronic signatures, writing and documents evidential value in civil, commercial and administrative transactions where the requirements of the Law and its technical regulations are met. Not every WhatsApp message automatically has the same evidential status as a compliant electronic signature.
  • Information Technology Crimes Law No. 175 of 2018: Article 11 provides for the evidential value of digital evidence in criminal proceedings where the technical requirements of its Implementing Regulations, issued by Decision No. 1699 of 2020, are met. The provisions on offences involving unauthorised access or alteration should be considered according to the act involved.
  • Personal Data Protection Law No. 151 of 2020 and its Implementing Regulations issued by Decision No. 816 of 2025: Govern the collection, processing, retention, security and cross-border transfer of personal data, subject to statutory requirements and exceptions.
  • Labour Law No. 14 of 2025: Article 141 governs the safeguards applicable to investigations of employees, while Articles 145–147 regulate temporary suspension, grievances and extensions, subject to the deadlines governing disciplinary accountability.
  • Anti-Money Laundering Law No. 80 of 2002, as amended: Imposes specific reporting duties on institutions and other entities within its scope; it does not subject every commercial company or employee to the same notification procedure.

III. Establishing a Secure and Effective Reporting Channel

It is preferable to provide more than one reporting channel, such as a digital platform with restricted permissions, a dedicated compliance email address and an independent mechanism for reports concerning senior management. The persons authorised to access a report should be identified, and its receipt date, specific allegations, available evidence and the body tasked with assessment recorded. Information should be shared only to the extent necessary for the investigation.

  • Enable a whistleblower to provide the facts, dates, persons involved and any documents lawfully available to them, without requiring full proof of a criminal offence before accepting the report.
  • Accept anonymous reports for preliminary assessment, without imposing a penalty on anyone merely because an anonymous allegation has been received.
  • Provide an independent escalation route where a report concerns the chief executive officer or head of compliance, and document any conflict of interest.
  • Adopt an internal policy prohibiting retaliation against good-faith whistleblowers, while distinguishing internal confidentiality from legally binding requests for disclosure to the authorities.
  • Set appropriate retention periods for reporting records and investigation reports according to the nature of the data and applicable obligations, with access and deletion controls.

IV. From Receipt of a Report to the Decision to Open an Investigation

The competent body conducts a preliminary assessment to determine whether the report concerns an ongoing threat to funds, evidence or safety, or involves a specific statutory reporting obligation. A brief record should distinguish substantiated from unsubstantiated facts, followed by a decision to open an internal investigation, refer the matter to a competent authority or close the report with reasons. An internal investigation must not be used as a pretext to delay an external report required by law or to destroy documents.

Preserving Evidence Before Confronting the Suspect

Where there is a credible risk of data deletion or document destruction, the company should issue an internal Legal Hold identifying the relevant information systems, files and persons, and suspend routine deletion within a scope proportionate to the incident. This does not authorise the seizure of personal devices, searches of private communications without a legal basis, or the freezing of bank accounts over which the company has no authority.

V. Preserving Paper Evidence and Maintaining the Chain of Custody

The chain of custody begins when a document is identified as potential evidence. Its source, condition, date and time of receipt, the name of the recipient, place of storage and every subsequent transfer should be recorded. Originals should be stored in protective envelopes without writing on them, applying new stamps over signatures or ink, or making any other alteration that could affect technical examination. Separate working copies should be prepared for administrative review, and circulation of the original limited to cases of necessity.

If the original cannot be obtained, it does not automatically follow that every other means of proof is unavailable. Copies, correspondence, witness testimony and other circumstantial evidence may be useful depending on the rules of evidence and the nature of the dispute. Nevertheless, the absence of an original may restrict technical comparison and examination of ink, writing pressure and paper. The reasons for its absence and attempts to obtain it should therefore be documented, and a judicial application for its production under Articles 20 and 21 of the Evidence Law considered where their conditions apply.

VI. Digital Evidence: Collection, Documentation and Analysis

Digital evidence may include business emails, accounting-system (ERP) logs, server files, copies of conversations, and access and modification logs. The technical team should receive a defined scope and method for extraction. A forensic image or verifiable identical copy should be preserved according to the type of device and the incident, with a record of the tool and version used, the extraction time, the person conducting the extraction and digital file hashes where appropriate.

  • Document the device or system, the user and their permissions, the source of the data and the times of creation, modification and extraction, distinguishing server time from device time.
  • Preserve the original or forensic image and protect it from writing. Use separate working copies for examination and document every transfer and analytical step.
  • Collect audit logs, backups and earlier versions where the suspicion concerns modification of invoices, minutes or transactions.
  • Document circumstances in which full extraction is impossible, and distinguish data directly observed by the expert from information supplied by management.
  • Do not treat screenshots alone as conclusive proof attributing a message to a particular person or establishing the integrity of an entire conversation; assess source authenticity, context and the remaining evidence.

The Distinction Between Preservation Integrity and Evidential Value

An electronic message may be preserved without alteration while insufficient information remains to attribute it to a particular sender. Conversely, attribution may be established while the lawfulness of the method used to obtain the message remains disputed. The integrity of evidence, the legality of extraction and its evidential weight must therefore be distinguished. An internal examination does not replace an expert report that an investigating authority or court may require, and merely documenting the chain of custody does not guarantee automatic admission of the evidence.

VII. Can Email and WhatsApp Messages Be Used as Evidence?

Electronic correspondence may be relied upon as an element of proof according to the type of dispute, the means by which it was obtained and the parties’ ability to verify its source and integrity. However, the evidential value of electronic signatures, writing and documents under Articles 14 and 15 of Law No. 15 of 2004 depends on statutory and technical requirements, whereas the value of digital evidence in criminal proceedings is governed by Article 11 of Law No. 175 of 2018 and its Implementing Regulations. It is therefore incorrect to assert that every printed WhatsApp conversation is invariably equivalent to a signed private document or that a transcript prepared by the company is sufficient on its own.

VIII. Employee Privacy and Personal Data Protection

Company policies should define in advance the scope of business email and corporate-device use and lawful access to them, while observing personal data protection requirements, confidentiality of correspondence and proportionality of processing to the investigation’s purpose. Ownership of a computer or telephone does not confer absolute authority over personal accounts stored on it. Access to data concerning the whistleblower, witnesses and persons complained against should be restricted, and access, deletion and sharing operations documented.

If an investigation requires copies of communications or employee reports to be sent to a parent company outside Egypt, Personal Data Protection Law No. 151 of 2020 and its Implementing Regulations, Decision No. 816 of 2025, must be examined in relation to cross-border transfers, exceptions and any licence or permit required in the circumstances, together with the possible application of foreign legislation such as the European General Data Protection Regulation (GDPR). A confidentiality agreement within the group does not, on its own, establish the lawfulness of a data transfer.

IX. Disciplinary Investigation and Official Reporting

Where a preliminary investigation identifies suspected misconduct by an employee subject to Labour Law No. 14 of 2025, Article 141 requires written notification of the allegations, hearing the employee’s statements, investigating their defence and recording the proceedings in minutes, in compliance with statutory deadlines. Any temporary suspension under Article 145 and its conditions must be assessed without treating it as a penalty imposed before the facts have been established. Filing a complaint with the Public Prosecution should be considered according to the nature of the incident, available evidence, standing and jurisdiction, distinguishing proven facts from technical assessments or suspicions.

X. Errors That Undermine the Evidential Value of Evidence

  • Excessive circulation of an original document, writing on it, or collecting evidence without a record of transfers of custody.
  • Extracting data from a device or account without a legal basis, or opening and modifying original files during examination without documentation.
  • Failing to preserve backups or system logs that might establish data modification or deletion, or exonerate the suspect.
  • Disclosing a whistleblower’s identity widely before it is necessary, or promising absolute confidentiality that cannot be maintained under applicable legal procedures.
  • Making a criminal accusation based on an anonymous report or an isolated screenshot without an impartial investigation or supporting evidence.

XI. A Simplified Model for Managing Evidence Within the Company

Each item of evidence should have a register entry containing a reference number, brief description, lawful source, receipt date, the name of its initial custodian, storage location, working copy used, subsequent transfers and the reason for each transfer. For digital evidence, add the device or system details, extraction method and digital hash where appropriate, together with any necessary alteration or technical obstacle. The register should be linked to the investigation record and supporting documents for the report, without making it accessible to all employees.

Special Considerations for International Companies

Multinational groups need to harmonise evidence-preservation standards while adapting them to Egyptian legislation. Local regulatory obligations should be assessed before referring an investigation to headquarters, and the collection and overseas transfer of employees’ communications and data must remain compliant with Egyptian law. Separating the technical team, legal counsel and audit committee helps manage conflicts of interest and maintain a clear decision-making record.

When Is Specialist Legal Counsel or Local Counsel in Egypt Necessary?

Legal intervention becomes particularly important where a report concerns senior management, forgery or embezzlement is suspected, a statutory regulatory notification duty may arise, highly sensitive digital evidence must be extracted, or a decision on dismissal or litigation is contemplated. Counsel defines the scope of the investigation, the powers to collect documents and appropriate escalation to official authorities without infringing the parties’ rights.

How Can Specialist Legal Support Help?

El Rouby Law Firm provides services in drafting reporting, compliance and internal investigation policies; legal oversight of document and electronic-evidence preservation in coordination with technical experts; assessment of criminal, employment and civil liability; preparation of appropriate complaints and claims; pursuit of recovery of rights; and Local Counsel services for international companies and investors in Egypt.

Frequently Asked Questions

Can a Company Guarantee Absolute Confidentiality of a Whistleblower’s Identity?

It can take effective measures to minimise disclosure and prohibit retaliation, but it must not promise absolute confidentiality if judicial proceedings or specific statutory provisions require disclosure of particular information in accordance with the law.

Do WhatsApp Messages Have Conclusive Evidential Value Before the Courts?

No. They may be submitted as evidence depending on the circumstances of the dispute, subject to examination of their source, the integrity of extraction, the ability to attribute messages to their senders and the applicable statutory and technical requirements.

Must the Original Paper Document Be Produced to Prove Forgery?

The original is important for physical examination and comparison, but its unavailability does not automatically exclude every other form of proof. Its effect is assessed according to the type of dispute and the evidence available.

May a Criminal Complaint Be Filed on the Basis of an Anonymous Internal Report?

An anonymous report may justify preliminary examination. Whether an official complaint should subsequently be filed depends on the facts, available supporting evidence and legal obligations, not merely on the anonymity of the source or the existence of an accusation.

May a Company Copy Its Entire Server Upon Discovering an Irregularity?

Forensic imaging may be appropriate where there is adequate authority, legality, necessity and proportionality, taking account of business continuity and individuals’ rights and data unrelated to the incident. It should not automatically be undertaken in every case.

Legal and Official References

Back to all insights Contact Our Team