A regional bank in the Gulf processes an incoming transfer. The compliance system flags the beneficiary account against the UAE Executive Office for Control and Non-Proliferation – known as EOCN – screening lists. The funds are frozen pending investigation. The account-holder is not a designated person, but a related party is. What does the bank do next? Who must be notified, within what window, and on what legal basis? These questions are not hypothetical. They arise in practice every week, and the answers are not always intuitive.
Frozen-account management under the UAE regime requires immediate notification to the competent authority – the EOCN – followed by ongoing compliance with the relevant Cabinet Decision and its implementing rules. The UAE operates a dual-track system: UN Security Council designations are implemented directly as a matter of treaty obligation, while autonomous UAE designations follow a separate domestic track. As of June 2026, firms operating across the UAE, UK, EU, and US regimes face divergent obligations on reporting timelines, authorisation requirements, and record-keeping – and the strictest applicable prohibition governs each transaction.
This guide works through the frozen-account management process step by step – from the initial freeze trigger through notification, authorisation, and ongoing administration – with a cross-regime comparison at each stage and practical guidance on when to involve sanctions counsel.
Step 1: Understanding the UAE Legal Basis for Account Freezes
A freeze under the UAE regime is triggered by the relevant Cabinet Decision implementing the UN Security Council Consolidated List and the UAE's own autonomous designation list administered by the EOCN. The UAE's legal basis for financial sanctions sits in its national anti-money-laundering and counter-terrorism-financing architecture, reinforced by the country's obligations under UN Charter Chapter VII. Two distinct legal sources can trigger a freeze, and they carry different procedural consequences.
Where the freeze derives from a UN Security Council designation, the obligation is automatic and does not require a separate domestic implementing act. The relevant Security Council committee maintains the Consolidated List, and UAE-licensed institutions must screen against it continuously. Where the designation is autonomous – that is, imposed by the UAE Cabinet independently of a UN listing – the implementing authority is the EOCN, and firms must monitor the EOCN list in addition to the UN Consolidated List.
In our practice, firms new to the UAE regime often conflate these two tracks, screening only the UN list and missing autonomous UAE designations. That gap alone creates a reportable compliance failure. A UAE-licensed firm must screen both sources simultaneously, and its screening policy must document how it does so. The EOCN publishes updates to the autonomous list, and firms are expected to implement those updates promptly – not at the next scheduled screening cycle.
Cross-regime note: under OFAC, the equivalent trigger is appearance on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) or on a sectoral sanctions identification list. Under OFSI, the trigger is designation under the relevant thematic UK sanctions regulations made under SAMLA. Under the EU, the trigger is listing in the relevant Council Regulation. All four regimes can apply concurrently to the same account if the account-holder or a related party is listed across more than one regime. Where they do, the strictest prohibition governs.
Step 2: Confirming the Freeze Obligation – the Ownership and Control Question
Before treating an account as frozen, the compliance team must confirm that the relevant person or entity meets the designation criteria under the applicable UAE rule – and, critically, must assess whether the ownership and control test (the UAE test for whether a non-listed entity is caught through a listed person's interest in it) captures the account-holder.
The UAE regime follows a test broadly analogous to the approach taken by OFSI and the EU. Where a listed person owns or controls a UAE-regulated entity, that entity may be subject to the same prohibitions as the listed person – even if the entity itself is not named. The exact threshold and the definition of "control" are set by the applicable Cabinet Decision and EOCN guidance. Firms must apply this test to every account that flags a designated person in the ownership chain, not only to accounts held directly in a designated person's name.
How does this differ from the US? Under OFAC, the equivalent rule is the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked). The OFAC test is mechanical and ownership-based; control is not determinative. The UAE, OFSI, and EU tests go further by also capturing entities subject to the direction or control of a listed person, even below a strict ownership threshold. That broader scope means a firm advising a UAE-licensed client with US operations must apply the stricter of the two tests to each fact pattern.
In a recent matter, a financial-services business operating in the UAE identified a corporate account whose ultimate beneficial owner held a minority stake in a separately designated holding company. The ownership percentage fell below the OFAC mechanical threshold. However, because the designated person also exercised board-level control over the account-holder, the UAE control limb of the test was engaged. We advised on the freeze obligation, prepared the notification to the EOCN, and supported the application for a specific authorisation to permit continued account maintenance. The matter resolved without enforcement action.
Step 3: Notification to the EOCN – Timing and Content
Once the freeze obligation is confirmed, the UAE-licensed firm must notify the EOCN – and, where applicable, the relevant UAE supervisory authority – within the statutory reporting window. The notification obligation is not optional and does not depend on whether the firm considers the freeze commercially inconvenient.
The required content of a notification is not prescribed verbatim by the Cabinet Decision, but EOCN guidance makes clear that the notification must include the full identity of the account-holder, the basis for the freeze (UN list, autonomous list, or both), the value and type of assets frozen, and any relevant ownership or control analysis that caused a non-listed entity to be caught. Firms that file a bare notification without the supporting ownership analysis risk a follow-up request from the EOCN and a determination that their initial notification was deficient.
Timing is the area where firms most frequently fail. The UAE does not publish a single fixed statutory number of days that applies across all notification scenarios – the obligation is to act "immediately" or "without delay" under the applicable rules, consistent with the language used in the relevant UN Security Council resolutions. In practice, competent UAE counsel will advise that a notification should be filed the same business day a confirmed freeze determination is made, or at the latest on the following business day. Delay creates a compliance gap. It may also be treated as a separate breach by the EOCN.
How does this compare with other regimes? OFSI in the UK requires that a person who knows or has reasonable cause to suspect that a person is a designated person, and holds information about that person's funds or economic resources, must report that information to OFSI. The UK window under the relevant thematic regulations is a short statutory period – verify the current position before relying on it. The EU equivalent is governed by the relevant Council Regulation and national implementing rules, which vary by member state. Under OFAC, there is no general obligation to report a blocked account within a specific number of days, but blocked property must be reported annually. Each regime has a different rhythm; a firm with multi-jurisdiction exposure must manage all notification tracks simultaneously.
Step 4: Ongoing Account Administration – Permitted and Prohibited Transactions
Freezing an account does not mean the account ceases to exist or that all activity on it is automatically prohibited. The UAE regime, in line with most major sanctions regimes, distinguishes between prohibited transactions – those that release, transfer, or make available frozen funds – and permitted maintenance activities.
Permitted activity generally includes crediting interest or dividends to the frozen account, provided that the incoming amounts themselves are frozen on arrival. Permitted activity also typically includes administrative charges levied by the institution holding the frozen funds, again provided the effect is to reduce the frozen balance rather than to transfer funds away. What is prohibited is any transaction that transfers frozen funds out of the frozen account, makes them available to or for the benefit of the designated person, or reduces the account balance in a way that benefits the designated person.
Is a payment into a frozen account always permitted? Not necessarily. Where incoming funds originate from a third party that is itself designated, or where the incoming payment is structured in a way that would constitute a prohibited service to the designated person, the incoming transfer may itself be prohibited. This is one of the subtler compliance questions in frozen-account management, and it arises more often than firms expect.
Record-keeping during this administration period is also a legal obligation, not merely good practice. Under the UAE regime and its analogues – OFSI in the UK, OFAC, and the EU – firms must maintain contemporaneous records of every decision made about the frozen account, every transaction credited or debited, and every communication with the EOCN or the relevant authority. Record-keeping periods across major regimes typically run to five years, though the precise period under the applicable UAE rule should be verified before reliance. In our experience, the quality of an institution's records determines whether a regulatory review becomes a brief inquiry or a full investigation.
Related practices
- Licensing & Authorizations – BIS/EAR frozen-account management – authorisation strategy for US export-control account freezes
- Frozen-account management under the UN regime – step-by-step guide to the UN Consolidated List obligations
- Frozen-account management under the UN regime: advanced guide – delisting routes and Focal Point procedures
If a transaction on a frozen account has already been processed in error, an early review by sanctions counsel can preserve options that narrow quickly. Contact Calder & Vance at info@caldervance.com to discuss a confidential review.
Step 5: Applying for a Specific Authorisation to Access Frozen Funds
A specific licence (a case-by-case authorisation to conduct an otherwise prohibited transaction) is available under the UAE regime in defined circumstances. The EOCN is the licensing authority for autonomous UAE designations; for UN-listed persons, the licensing route runs through the relevant Security Council committee. These are distinct applications with distinct procedural requirements.
For autonomous UAE designations, the EOCN's approach to licensing is analogous to the approach taken by OFSI and the EU: the applicant must demonstrate a legitimate purpose, identify the specific transaction or category of transactions for which authorisation is sought, and satisfy the EOCN that the authorisation does not undermine the policy objective of the designation. Common licensing grounds include the release of funds for basic expenses (food, housing, medical care), legal fees, and, in some cases, ordinary commercial maintenance of assets pending delisting proceedings.
For UN-listed persons, the Security Council committee process is distinct. The relevant committee, applying the criteria established in the applicable resolution, may grant a humanitarian exemption or a delisting. The Ombudsperson mechanism – which exists for the ISIL/Al-Qaida list – provides a structured review route that is not available for all Security Council lists. Firms advising account-holders who are UN-listed should take care to identify which list applies before advising on the available route.
How do OFAC and OFSI compare? OFAC grants specific licences for case-by-case authorisations, and also publishes general licences (standing authorisations permitting a defined category of transactions without a separate application). OFSI in the UK similarly operates specific and general licences under the relevant thematic regulations; an OFSI general licence may permit certain payments – for example, legal fees or basic living expenses – without a separate application. The EU operates a parallel system, with the relevant Council Regulation setting out licensing criteria and the relevant national competent authority determining applications. The UAE does not publish general licences in the same codified way as OFAC or OFSI; each authorisation request is treated as a specific application.
The position above covers the standard case. Your facts – the nature of the designation, the account type, the purpose of the requested release, and which regimes apply – change the analysis. For an assessment of your authorisation options under the UAE regime, contact Calder & Vance at info@caldervance.com.
Step 6: Contesting a Designation – the Delisting Route Under UAE
Where an account-holder believes that a UAE designation was made in error – or that the grounds for designation no longer exist – a petition to the EOCN for review is available. This is a distinct route from the licensing process and is pursued separately from any application for a specific authorisation.
The UAE delisting process for autonomous designations involves submitting a written petition to the EOCN, supported by evidence addressing the grounds for designation. The EOCN reviews the petition and may request additional information. The process does not have a fixed published timeline, though firms advising designated persons should plan for a review period measured in months rather than days.
For UN-listed persons, the delisting route runs through the relevant Security Council committee. The Focal Point for de-listing – maintained by the UN Secretariat – provides a mechanism for individuals and entities to submit delisting petitions directly to the committee, without requiring state sponsorship. For the ISIL/Al-Qaida list, the Ombudsperson mechanism provides a more structured adversarial review. In our experience, the evidence package required for a credible UN delisting petition is extensive; firms that underestimate this requirement tend to receive a summary rejection without meaningful engagement from the committee.
What is the most common mistake at the delisting stage? Many applicants focus exclusively on disproving the designation grounds and fail to address the procedural legitimacy of the listing process. A strong petition addresses both the substantive evidence and any procedural irregularity in how the designation was made. Under the EU regime, the EU General Court has annulled designations on procedural grounds where the Council failed to provide adequate reasons. The UAE domestic review process does not follow the same judicial route, but a well-evidenced procedural challenge can still be persuasive before the EOCN.
Risk Flags and When to Involve Sanctions Counsel
Several risk patterns recur in frozen-account management under the UAE regime, and identifying them early is the difference between a manageable compliance event and an enforcement referral.
The first risk flag is delayed notification. As discussed in Step 3, the obligation to notify the EOCN arises immediately on confirmation of the freeze. Firms that delay notification while internally debating whether the ownership test is met are already in breach. Involve counsel as soon as the question arises – before the notification window closes.
The second is incomplete ownership analysis. Screening the account-holder's name against the list is necessary but not sufficient. The control limb of the UAE test can catch entities that are not directly listed. An entity that a designated person directs – even without majority ownership – may be caught. Firms that rely on automated screening without a manual ownership-chain analysis routinely miss this.
The third risk is processing credit transactions to a frozen account without checking the source. Interest and dividends from unlisted counterparties are generally permissible; transfers from designated counterparties are not. Every incoming transaction to a frozen account requires a fresh screening check on the originator.
A common myth in this area is that a frozen account creates no ongoing compliance obligation once the initial notification is made. That is incorrect. The EOCN expects firms to maintain active oversight of frozen accounts, to report any material change in the account's position, and to notify the authority if new information about the account-holder or related parties becomes available. Passive maintenance is not enough.
We regularly advise financial institutions across the UAE, UK, EU, and US regimes on exactly these scenarios. Our approach in a frozen-account matter is to scope the freeze obligation across all applicable regimes on day one, prepare a defensible notification to each relevant authority, and build a record that supports either an authorisation application or a delisting petition, depending on the client's position.
If a transaction has already been flagged or a filing has been refused, an early review by sanctions counsel can preserve options that narrow with time. For a confidential assessment of your exposure under the UAE regime, contact Calder & Vance at info@caldervance.com.