Sanctions Compliance in UAE: 2026 Update

Sanctions compliance in the UAE is a mandatory legal obligation for every company operating in or through the Emirates, not an optional risk-management exercise. The UAE maintains its own domestic sanctions framework, enforces United Nations Security Council resolutions, and is subject to extraterritorial pressure from US, EU and UK sanctions regimes. Businesses that ignore this layered structure face asset freezes, licence revocations, correspondent banking cutoffs and criminal liability. This guide explains the UAE';s current legal framework, the authorities that enforce it, the obligations businesses must meet, and the practical steps required to build a defensible compliance programme.

The UAE';s domestic sanctions architecture rests on Cabinet Decision No. 74 of 2020 Regarding the Implementing Regulation of Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations. That decree-law, commonly called the AML-CFT Law, criminalises dealings with designated persons and entities and requires financial institutions and designated non-financial businesses and professions (DNFBPs) to screen counterparties against official lists.

The Executive Office for Control and Non-Proliferation (EOCN), operating under the Supreme Council for National Security, is the primary authority responsible for implementing targeted financial sanctions in the UAE. The EOCN maintains the Local Terrorist List and oversees compliance with UN Security Council consolidated lists, including those issued under UNSCR 1267 (Al-Qaida and associated individuals) and UNSCR 1373 (general terrorism financing).

The Central Bank of the UAE issues binding circulars to licensed financial institutions and payment service providers. Its Consumer Protection and Supervision Bureau conducts on-site inspections and issues administrative sanctions for failures in screening, reporting and record-keeping. The Securities and Commodities Authority (SCA) applies parallel obligations to capital market participants.

A non-obvious requirement is that free zone entities - including those in the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) - are subject to their own regulators but must simultaneously comply with federal sanctions obligations. The DIFC';s Dubai Financial Services Authority (DFSA) and the ADGM';s Financial Services Regulatory Authority (FSRA) each publish their own sanctions rules, which largely mirror federal requirements but contain additional procedural obligations specific to those jurisdictions.

The UAE was placed on the Financial Action Task Force (FATF) grey list in 2022 and removed from it in early 2024 following a sustained reform programme. That removal marked a significant milestone, but the compliance obligations introduced during the reform period remain fully in force. Businesses should not interpret the delisting as a relaxation of requirements.

Key legislative and regulatory changes introduced during and after the reform period include:

• Amendments to Cabinet Decision No. 74 of 2020 tightening the definition of beneficial ownership and requiring more granular customer due diligence (CDD) for high-risk counterparties.
• Central Bank Notice No. 2023/1 requiring all licensed financial institutions to implement automated sanctions screening with real-time list updates, replacing manual or periodic batch-screening processes.
• Ministerial Decision No. 532 of 2023 expanding the list of DNFBPs subject to AML-CFT supervision to include virtual asset service providers (VASPs), real estate brokers, dealers in precious metals and stones, and corporate service providers.
• The Virtual Assets Regulatory Authority (VARA) in Dubai and the ADGM';s FSRA have each issued detailed rulebooks for VASPs that include specific sanctions screening and transaction monitoring obligations.

In practice, the post-grey-list environment means that regulators are conducting more frequent and more detailed inspections. A common mistake is assuming that a company that passed a Central Bank inspection in a prior period is safe from scrutiny now. Regulators are revisiting previously inspected entities with updated benchmarks.

The UAE does not formally adopt US Office of Foreign Assets Control (OFAC) sanctions, EU sanctions or UK Office of Financial Sanctions Implementation (OFSI) regulations as a matter of domestic law. However, the practical effect of these regimes on UAE-based businesses is substantial and cannot be ignored.

US secondary sanctions create risk for any UAE entity that conducts significant transactions with persons or jurisdictions targeted by OFAC. A UAE bank or trading company that processes payments involving sanctioned parties risks being cut off from the US financial system, losing access to USD correspondent banking and facing civil or criminal penalties in the United States. OFAC';s 50 Percent Rule means that any entity owned 50 percent or more by a designated person is itself treated as sanctioned, even if not explicitly listed.

EU sanctions apply directly to EU-incorporated entities and their subsidiaries, and indirectly to any UAE counterparty dealing with EU persons or using EU infrastructure. Recent EU sanctions packages have included asset freeze provisions and transaction prohibitions that affect trade finance, shipping and professional services routed through the UAE.

UK sanctions under the Sanctions and Anti-Money Laundering Act 2018 operate on a similar extraterritorial basis. UK-connected persons, including UK nationals and entities incorporated in the UK, must comply with OFSI requirements regardless of where they are physically located, including in the UAE.

A practical scenario: a UAE trading company with a UK-incorporated parent entity that sources goods from a third country must screen its supply chain against both UAE federal lists and UK sanctions lists. Failure to do so exposes the parent to OFSI enforcement and the UAE subsidiary to reputational and banking consequences.

We can help structure your compliance programme to address both domestic and extraterritorial obligations correctly from the outset. Contact us at info@vlolawfirm.com.

Every business operating in the UAE that falls within the scope of the AML-CFT Law or a sectoral regulator';s rules must maintain a documented compliance framework. The following obligations apply across most regulated categories.

Customer and counterparty screening. Businesses must screen all customers, beneficial owners, suppliers and transaction counterparties against the EOCN';s Local Terrorist List, UN Security Council consolidated lists, and any additional lists required by their sectoral regulator. Screening must occur at onboarding, at periodic review intervals and on a triggered basis when list updates are published. The Central Bank requires financial institutions to process list updates within 24 hours.

Suspicious transaction reporting. Regulated entities must file Suspicious Transaction Reports (STRs) with the UAE Financial Intelligence Unit (UAEFIU), which operates under the Central Bank. The obligation to report arises when a business has reasonable grounds to suspect that a transaction involves proceeds of crime or is connected to a designated person. There is no minimum transaction threshold. Tipping off a customer that a report has been filed is a criminal offence.

Record-keeping. All CDD records, transaction records and screening logs must be retained for a minimum of five years from the end of the business relationship or the date of the transaction, whichever is later. Records must be available to regulators on request within a reasonable timeframe, generally interpreted as within five business days.

Beneficial ownership registers. The UAE requires companies to maintain accurate beneficial ownership registers and to file information with the relevant authority - the Ministry of Economy for mainland companies and the relevant free zone authority for free zone entities. Failure to maintain accurate registers is an independent offence under Cabinet Decision No. 58 of 2020.

Compliance officer appointment. Financial institutions and most DNFBPs must appoint a dedicated Money Laundering Reporting Officer (MLRO) who is a senior employee with direct access to the board or senior management. The MLRO must be registered with the relevant regulator and must complete approved training. Many underestimate the personal liability that attaches to an MLRO who fails to file required reports or who approves a transaction involving a designated party.

Training and awareness. Staff must receive regular AML-CFT and sanctions training. Regulators assess the quality and frequency of training during inspections. Generic online modules are generally insufficient for high-risk roles such as relationship managers, compliance officers and senior management.

The UAE operates a strategic goods control regime under Federal Law No. 13 of 2007 on Commodities Subject to Import and Export Control, as amended, and its implementing regulations. The Ministry of Economy';s Export Control Department administers licences for the export, re-export, transit and transhipment of controlled goods, including dual-use items, military goods and items on international control lists such as the Wassenaar Arrangement and the Nuclear Suppliers Group.

The UAE';s geographic position as a major re-export hub makes export control compliance particularly important. Goods entering the UAE from the US, EU or UK and then re-exported to third countries may require an export licence from both the UAE and the originating country. A common mistake made by foreign founders is assuming that once goods clear UAE customs, the originating country';s export control obligations no longer apply. This is incorrect. US Export Administration Regulations (EAR) and EU dual-use regulations follow the goods, not the geography.

The Abu Dhabi Customs and the Federal Authority for Identity, Citizenship, Customs and Port Security (ICP) are the primary enforcement bodies for physical goods movements. The Ministry of Economy coordinates with international partners on end-user verification and post-shipment checks.

A practical scenario: a European technology company establishes a UAE free zone entity to distribute software and hardware components across the Middle East and Africa. If any of those components are subject to US EAR controls - for example because they contain US-origin technology above the de minimis threshold - the UAE entity must obtain the necessary licences before re-exporting to certain destinations. Failure to do so creates liability for the UAE entity and potentially for the European parent under US law.

A defensible compliance programme is one that a regulator, a correspondent bank or a counterparty due diligence team would assess as adequate. The bar has risen significantly in recent years, and a programme that was considered sufficient three years ago may no longer meet current expectations.

The core elements of an adequate programme include:

• A written sanctions and AML-CFT policy approved by the board or senior management, reviewed at least annually.
• A risk assessment that identifies the entity';s specific exposure by customer type, geography, product and channel.
• Automated screening tools connected to regularly updated list feeds, with documented escalation and decision-making procedures for matches.
• A transaction monitoring system calibrated to the entity';s risk profile, with documented rationale for alert thresholds.
• An independent audit or review of the compliance function at least annually, conducted by a party with no operational responsibility for compliance.
• A documented training programme with records of completion by role.

In practice, founders and senior managers should consider that regulators in the UAE now assess the substance of compliance programmes, not merely their existence. A policy document filed in a drawer with no evidence of implementation will not satisfy an inspection. Regulators look for evidence of actual screening, actual escalations, actual training and actual board engagement.

A non-obvious requirement is that correspondent banks - particularly US and European banks that process USD or EUR payments for UAE entities - conduct their own due diligence on UAE counterparties. A UAE business that cannot demonstrate an adequate compliance programme may find its correspondent banking relationships terminated, regardless of whether it has violated any UAE law. This de-risking phenomenon is a significant practical risk for UAE-based businesses engaged in international trade or financial services.

If your business needs a compliance programme review or assistance responding to a regulatory inquiry, contact us at info@vlolawfirm.com. We can assist with gap analysis, policy drafting and regulator engagement.

The AML-CFT Law and its implementing regulations provide for a range of administrative and criminal penalties. Administrative penalties include fines, licence suspensions and licence revocations. Criminal penalties include imprisonment for individuals found guilty of money laundering or terrorist financing offences.

The Central Bank has the authority to impose administrative fines on licensed financial institutions for failures in screening, reporting or record-keeping. Fines can be substantial and are published on the Central Bank';s website, creating reputational consequences in addition to financial ones. The Central Bank has demonstrated willingness to impose significant penalties on both large and small institutions.

For DNFBPs, the Ministry of Economy and sectoral supervisors have parallel enforcement powers. Failure to register with the relevant supervisory authority is itself an offence. Failure to file STRs, maintain records or appoint a qualified MLRO each carry independent penalties.

Criminal liability for individuals is a serious risk. Senior managers, compliance officers and beneficial owners can face personal prosecution if they are found to have knowingly facilitated transactions involving designated parties or to have failed to report suspicious activity. The tipping-off prohibition means that once a report is filed, the business and its staff must not alert the customer, even indirectly.

---

Does a UAE free zone company need to comply with federal sanctions obligations?

Yes. Free zone entities are subject to UAE federal law, including the AML-CFT Law and Cabinet Decision No. 74 of 2020, in addition to the rules of their specific free zone regulator. The DIFC and ADGM have their own regulatory frameworks that largely mirror federal requirements but add procedural layers. A free zone company cannot rely on its free zone licence as a substitute for federal compliance. In practice, free zone entities engaged in financial services, trade finance or virtual assets face the highest scrutiny from both federal and free zone regulators simultaneously.

How long does it take to build a compliant sanctions programme, and what does it cost?

The timeline depends on the size and complexity of the business. A small trading company with a straightforward customer base can implement a basic compliant framework - policy, screening tool, training and MLRO appointment - within four to eight weeks. A financial institution or VASP with a complex product range and international customer base may require three to six months to implement a programme that meets regulatory expectations. Professional fees for legal and compliance advisory work vary widely. Screening tool subscriptions, training platforms and independent audit fees add to the overall cost. Many underestimate the ongoing cost of maintaining and updating the programme as lists change and regulations evolve.

What should a business do if it discovers it has transacted with a sanctioned party?

The business should immediately cease all further dealings with the counterparty and preserve all relevant records. It should seek legal advice before taking any further action, including before filing any report, to ensure that the response is structured correctly and does not inadvertently create additional liability. Depending on the nature of the transaction and the applicable regimes, voluntary disclosure to the UAEFIU, the Central Bank or a foreign authority such as OFAC may be appropriate or required. Voluntary disclosure, when made promptly and in good faith, is generally treated as a mitigating factor by regulators. Delay or concealment significantly worsens the outcome.

---

Sanctions compliance in the UAE is a multi-layered obligation that combines domestic law, UN Security Council requirements and extraterritorial pressure from US, EU and UK regimes. The regulatory environment has tightened materially in recent years and continues to evolve. Businesses that treat compliance as a one-time exercise rather than an ongoing programme face significant legal, financial and reputational risk.

VLO Law Firms advises international clients on sanctions compliance in the UAE. We can assist with compliance programme design, gap analysis, MLRO support, regulatory correspondence and transaction screening reviews. To request a consultation, contact: info@vlolawfirm.com