KPMG Gulf Expansion Faces Staff Safety Fears Amid Regional Strikes

Black smoke rising above the Innovation One tower in Dubai's financial district was one of the more visceral signals that professional services firms had miscalculated their Gulf risk exposure. The tower, which houses Morningstar's Middle East operations, stood as a visual marker of exactly the kind of concentration that has made the Big Four accountancy firms suddenly vulnerable: thousands of staff, years of expansion, and no straightforward plan for what comes next.

Iranian drone attacks targeted Dubai's International Financial Centre in at least three separate incidents since March 12. The DIFC, which has seen regional hubs for Goldman Sachs, Citi and Standard Chartered order their staff to work from home, had been one of the region's most coveted business addresses, pitching itself as a rival to the City of London. When the attack on Innovation One hit, Morningstar's staff had been working remotely, sparing casualties but underscoring the shift from business-as-usual to active contingency planning.

For KPMG and its Big Four peers, the security picture compounds what was already a complicated presence in the Gulf. KPMG and Deloitte each employ approximately 7,000 people across the region, with offices in Dubai, Doha and Kuwait City. EY has about 8,000 Gulf staff and is also led from Riyadh. PwC, the largest of the four in the region, runs roughly 12,000 employees from a regional headquarters in Riyadh. Some expats have attempted to flee the country out of safety concerns, while companies have also attempted to evacuate employees. That exodus carries a direct cost for firms like KPMG, robbing them of the experienced audit and advisory talent that took years to recruit and embed in local markets.

Civilians in Gulf Cooperation Council countries are at grave risk from ongoing Iranian strikes, with many attacks hitting civilian residential buildings, hotels, civilian airports, and financial centers, Human Rights Watch noted in a March 17 assessment. On March 14, an IRGC-affiliated media outlet explicitly identified US companies in the region as legitimate targets, publishing a graphic that listed firms including Boston Consulting Group and Bain & Company, all with Dubai office addresses in the DIFC district. None of the Big Four were named, but the targeting logic, which centers on economic hubs hosting Western firms, makes the concentration of professional services staff in DIFC a material concern.

The security crisis arrives on top of pre-existing pressures. A series of accounting scandals in recent years had already caused financial and reputational damage across the Big Four, and Gulf economies have historically delivered feast-or-famine revenue cycles tied to oil price swings. Deloitte, EY, KPMG and PwC had scaled up significantly in the early 2000s to capitalize on sovereign wealth fund mandates in Saudi Arabia and Abu Dhabi, building out practices in audit, tax and advisory that now employ tens of thousands across the region. The bet looked stable for two decades. It looks considerably less certain now.

As of March 24, airspace across large parts of the region remained intermittently restricted or temporarily closed in response to missile and drone activity, with short-notice closures continuing as a precautionary measure. For KPMG staff on secondment, mid-engagement with Gulf sovereign clients, or simply trying to get home at the end of a long quarter, the logistics of working in the region have shifted entirely. The talent pipeline that feeds Gulf offices through international secondments relies on professionals willing to relocate; that calculus looks different when the building down the road is on fire.

Whether firms move toward reducing headcount in exposed hubs, consolidating regional operations to lower-risk cities, or simply continuing to wait it out remains the central operational question. What the Innovation One incident confirmed is that the DIFC's "rival to London" pitch now comes with a threat profile that London's Canary Wharf does not.