A trading house based in a Gulf free zone receives an order for controlled electronic components. The end customer is a commercial enterprise in a third country. Everything looks routine – until the compliance team realises that neither the UAE's export licensing rules nor the end-use obligation attached to those goods has been properly mapped. The shipment is ready to move. What must happen before it does?
End-use and end-user controls under the UAE regime require exporters and re-exporters to verify how controlled goods will be used and by whom, to obtain and retain documentary evidence of that use, and to refuse or halt a transaction where a prohibited application is apparent. As of April 2026, the UAE administers these obligations through its Strategic Goods Regulation, enforced by the Competent National Authority, with growing alignment to multilateral export-control regimes. Failure to apply the controls correctly exposes a business to licence revocation, administrative penalties, and reputational harm across every jurisdiction in which it operates.
This guide walks through the governing authority and legal basis, the step-by-step procedure for applying end-use and end-user controls, the cross-regime comparison a business with US, EU, or UK exposure must consider, the risk flags that most frequently produce enforcement referrals, and the point at which specialist counsel adds measurable value.
Who administers end-use controls under the UAE regime, and what is the legal basis?
End-use and end-user obligations in the UAE sit within the Strategic Goods Regulation, administered by the UAE's Competent National Authority for strategic goods and dual-use items. The regime covers military goods, dual-use goods listed on the UAE's control lists, and certain civil nuclear or chemical-precursor items. The legal basis traces to federal legislation on the control of strategic goods, which empowers the authority to require end-use certificates, to impose conditions on licences, and to investigate breaches.
The UAE is a member of several multilateral export-control arrangements and has incorporated their control lists as the technical basis for determining what is subject to licensing. This means the classification methodology familiar to exporters using the US Commerce Control List or the EU's dual-use regulation is broadly recognisable, though not identical. Items controlled under the US Export Administration Regulations or the EU dual-use rules may or may not align precisely with UAE list entries: always verify the UAE-specific classification before assuming equivalence.
In our cross-border practice, the most frequent gap we identify is an exporter who holds a US re-export authorisation but has not separately verified UAE domestic obligations. The two regimes operate in parallel. Holding one set of permissions does not satisfy the other.
Step 1 – Classify the goods and determine whether an end-use obligation applies
Classification is the entry point. Before any end-use or end-user check is possible, the exporter must determine whether the goods in question appear on the UAE's strategic goods list. Classification turns on technical parameters – the item's function, performance thresholds, and any controlled characteristics – mapped against the applicable list entry.
Where the item is not on the list, it may still attract a licence requirement through a catch-all provision. The UAE regime, like those of the US, EU, and UK, operates a catch-all that can require a licence where the exporter has reason to believe the goods – regardless of their listing status – will be used in a weapons-of-mass-destruction programme or in a prohibited military application. Recognition of the catch-all trigger is therefore part of every classification exercise, not an afterthought.
Practical step: produce a written classification record for each product or product family, including the list entry relied on, the technical basis for the classification, and the date of the review. Re-run classification whenever the product specification changes or the control list is updated.
Step 2 – Identify the end user and assess the end-use statement requirement
Once a controlled item is identified, the exporter must establish who will ultimately use the goods and for what purpose. This is the end-user due diligence exercise. It is not a screening exercise in the narrow sense of checking a name against a sanctions list, though that screening must also happen. It is a substantive inquiry into the customer's business, the stated application of the goods, and any indicators that the stated end use is not the real one.
The UAE regime requires an end-user certificate (a document signed by the ultimate consignee confirming the identity of the end user, the stated end use, and the undertaking not to re-export without consent) for controlled goods. The certificate must be obtained before the licence is issued and must be retained for a specified period. Where the goods involve a government-to-government procurement, the form of the certificate and the authority accepting it may differ.
What do you do when the stated end use sounds plausible but the customer's profile raises questions? The answer is not to accept the certificate at face value and move on. A certificate that is internally inconsistent, that names an end user whose business does not match the goods, or that is submitted by an entity with connections to higher-risk jurisdictions calls for additional due diligence – site visits, references, third-party verification, or escalation to the authority before the licence is sought.
In our experience, the end-user certificate is treated by some exporters as an administrative form rather than a substantive risk-management document. That misunderstanding is one of the most common reasons enforcement inquiries escalate.
Step 3 – Apply for the export licence and embed end-use conditions
An export licence application under the UAE regime is submitted to the Competent National Authority with the following supporting documents as a minimum: the end-user certificate, a description of the goods with technical specifications, the classification basis, the transaction documents (commercial invoice, purchase order), and, where relevant, any import licence or authorisation issued by the receiving country's authority.
The authority may impose conditions on the licence. Common conditions include: a prohibition on re-export without prior written consent; a requirement to notify the authority if the end user changes; and, for particularly sensitive items, a post-shipment verification right. These conditions are not formalities. Breach of a licence condition is itself a regulatory violation, separate from the underlying export offence.
A cross-border consideration arises here. If the goods originated in the United States and carry US-content above the applicable de minimis threshold, a US re-export licence or licence exception may also be required under the EAR. The UAE licence does not substitute for that requirement. Equally, if the transaction involves a party subject to EU financial sanctions, the EU's export prohibitions may apply in parallel to any EU-nexus actor in the supply chain. The position above covers the standard UAE domestic procedure. Your specific transaction – the goods, the route, the parties, the origin of the technology – may engage additional regimes simultaneously.
Step 4 – Screen parties and apply post-shipment obligations
Screening the end user, intermediate parties, freight forwarders, and financial institutions against the UAE's own restricted-party and sanctions lists is mandatory before each transaction. The UAE maintains its own list of designated parties and also gives effect to United Nations Security Council designations, which carry binding force on all UN member states. Screening must therefore cover both the domestic UAE list and the UN Consolidated List.
Post-shipment obligations add a further layer. Where the licence included a post-shipment verification condition, the exporter must cooperate with any inspection or documentary request from the authority after delivery. Some UAE licences also require an end-use verification report to be filed within a specified period after the goods are delivered – confirming that the goods arrived at the stated destination and are in use for the stated purpose.
Record-keeping runs through both phases. All transaction documents, screening records, end-user certificates, and communications with the authority must be retained. The retention period under the applicable regime should be confirmed at the time of the transaction and records kept accordingly. In our experience, gaps in the documentary record are the primary reason a business that was technically compliant at the point of export is unable to demonstrate that compliance when an inquiry arrives years later.
How does the UAE regime compare with the US, EU, and UK approaches?
The UAE regime shares the structural logic of other major export-control regimes – classification, licensing, end-user verification, catch-all – but diverges on several operational points that matter to cross-border businesses.
Under the EAR, BIS maintains the Entity List (a list of parties to which exports, re-exports, or in-country transfers require a licence regardless of the item's classification). The UAE regime does not operate an equivalent published entity-level control list in the same form, though the authority can impose conditions that have a similar effect for specific transactions. An exporter who has checked a party against the Entity List has not thereby satisfied the UAE end-user assessment obligation.
The EU's dual-use regulation operates a catch-all with broadly comparable scope to the UAE's, but the EU adds layers of mandatory denial reporting and information sharing between member states that have no direct UAE counterpart. A denial issued by one EU member state is not automatically communicated to UAE authorities, and vice versa. This means a party that has been denied a controlled-goods licence in an EU jurisdiction may not appear on any UAE restricted-party list. The obligation on the UAE exporter to conduct substantive end-user due diligence – rather than relying on list-screening alone – is therefore more acute, not less.
Under OFSI and the UK's Export Control Order, the UK maintains its own control list, which since the UK's departure from the EU has diverged incrementally from the EU list. UK-origin components in a UAE-destined shipment may carry different classification codes and different licence requirements from their EU equivalents. Where a transaction involves goods with both UK and US content, the more restrictive regime governs.
Risk flags: what triggers enforcement attention?
Enforcement referrals under export-control regimes – including the UAE's – tend to cluster around a consistent set of fact patterns. Recognising these patterns in advance is the purpose of a well-designed compliance programme.
The most common risk flags are:
- An end-user certificate signed by an entity that is not the ultimate consignee, or that names a consignee in a jurisdiction different from the stated delivery destination.
- A customer who is unwilling to identify the final application of the goods, or who requests removal of technical markings or serial numbers from controlled items.
- A transaction priced significantly below market rate, or structured with unusual payment routing that obscures the beneficial flow of funds.
- Goods ordered in quantities that do not match the stated end use – for example, a civil engineering business ordering military-specification electronic components at scale.
- A freight route that transits a jurisdiction subject to comprehensive controls, with a vague explanation for the routing.
- A repeat customer who changes their stated end use between transactions without explanation.
- A request for goods that were previously refused a licence, submitted through a newly incorporated entity with overlapping beneficial ownership.
None of these flags is conclusive alone. Together, or where a single flag is particularly pronounced, they require the transaction to be escalated, verified, or declined. A compliance programme that documents this decision-making – including the reasons for proceeding where flags were identified and assessed – is materially stronger in enforcement than one that leaves no record of the analysis.
Common myths and when to involve counsel
One persistent misconception is that compliance with the UAE's strategic goods rules is sufficient to address all export-control exposure for a UAE-based transaction. It is not. If any party in the supply chain has a US nexus, if the goods contain US-origin technology above the applicable threshold, or if the transaction passes through a jurisdiction with its own controls, additional regime obligations apply simultaneously. The UAE licence does not displace them.
A related misconception is that free-zone operations sit outside the UAE's domestic export-control regime. This is incorrect. The UAE's strategic goods rules apply to exports and re-exports from free zones. The free-zone status of the exporter affects certain customs procedures but does not create an exemption from licensing or end-user obligations.
We regularly advise businesses on the intersection of these obligations. The practical question – which regime takes precedence when obligations conflict? – has a settled answer: where two regimes both prohibit a transaction, both prohibitions must be complied with; where one regime prohibits and another permits, the prohibition governs. This is the "stricter prohibition governs" principle, applied consistently across the regimes we cover.
Counsel adds measurable value at three points: first, at transaction design, where classification and end-user structure can be set correctly from the outset; second, at the licence application stage, where a poorly drafted application or incomplete end-user certificate can stall or lose a transaction; and third, at the enforcement stage, where a voluntary self-disclosure prepared with legal advice typically results in a more predictable outcome than one filed without it.
If a shipment has already moved without the necessary controls in place, or if an inquiry has been received from the authority, the window for managing the outcome is open – but it narrows. Early involvement preserves options. For a confidential review of a potential gap or exposure, contact Calder & Vance at info@caldervance.com.
Related practices
- Deemed-export and technology controls under BIS and the EAR – licensing, classification, and end-use compliance for US-origin technology transfers.
- End-use and end-user controls under the UN regime – Security Council restrictions, the Consolidated List, and their interaction with national controls.