A trading company based in Dubai routes a payment to a long-standing European supplier. The compliance officer flags the counterparty during routine screening. The payment is paused. Legal wants to know whether a formal authorisation is required, who issues it, and how long the process takes. The business wants to know whether the deal survives. These questions sit at the intersection of the UAE's domestic sanctions architecture and the extraterritorial reach of the US and EU regimes.
The UAE operates an autonomous sanctions regime administered primarily through the Executive Office for Control and Non-Proliferation (EOCN, the UAE authority responsible for implementing UN Security Council decisions and autonomous UAE designations). Where a payment touches a designated person or entity, a specific authorisation from the competent authority is required before the funds may move. The procedure is distinct from – and runs parallel to – OFAC licensing and EU derogation processes, and a business subject to multiple regimes must satisfy each one independently.
This guide walks through the UAE payment-authorisation process step by step, identifies the most consequential divergences from the OFAC and EU approaches, and flags where compliance counsel should be involved before a payment is made.
Step 1 – What triggers a payment-authorisation requirement under the UAE regime?
A payment-authorisation requirement is triggered when a transaction involves a person, entity, or asset that appears on the UAE Unified List – the national consolidated list that incorporates UN Security Council designations and autonomous UAE designations. The EOCN maintains this list and publishes updates when the Security Council amends the UN Consolidated List or when the UAE Council of Ministers approves a new autonomous designation. Any payment routed through the UAE financial system that has a nexus to a listed party falls within scope.
The nexus test is broader than many businesses assume. It is not limited to payments made directly to a listed person. It extends to payments where a listed person is the beneficial owner of the receiving account, a substantial shareholder in the receiving entity, or a party through whom the funds will pass. In our experience, the first practical question is not "is the named payee listed?" but "who ultimately receives value, and is any part of that ownership chain listed?" Financial institutions licensed in the UAE apply this logic under Central Bank of the UAE supervisory guidance on anti-money-laundering and sanctions compliance.
Secondary-sanctions exposure compounds the picture. A UAE-licensed entity processing a payment that also touches a US-designated person risks OFAC exposure under secondary sanctions (measures that can affect non-US persons dealing with certain designated parties), even where the UAE-side authorisation is secured. The two analyses must run simultaneously.
Step 2 – Identify the correct competent authority and the applicable authorisation route
The correct authority depends on the legal basis for the designation. For UN Security Council designations adopted under Chapter VII of the UN Charter – which the UAE implements through Cabinet resolution – the EOCN is the primary point of contact. For autonomous UAE designations, the path runs through the same body, but the procedural rules and review standards differ from the UN track.
Understanding which track applies is not always straightforward. A single counterparty can appear on both the UN Consolidated List and the UAE autonomous list. The authorisation routes may overlap or be processed together, but the documentary requirements differ. Counsel familiar with EOCN practice can identify which track controls and whether a joint application is procedurally possible.
A further distinction matters for financial institutions. The Central Bank of the UAE issues its own supervisory directions on how licensed banks should handle frozen funds and restricted payments. Those directions set out internal escalation and reporting obligations that sit alongside the EOCN authorisation process. A bank processing a customer's authorisation request must comply with both layers. Businesses submitting payment-authorisation requests through their bank should be aware that the bank's internal procedures may impose a shorter practical deadline than the EOCN process itself.
For businesses that also hold accounts or conduct transactions in the United Kingdom, the parallel competent authority is the Office of Financial Sanctions Implementation (OFSI), which administers UK financial sanctions under the Sanctions and Anti-Money Laundering Act. OFSI issues specific licences (case-by-case authorisations for otherwise prohibited transactions) on licensing grounds set out in the relevant thematic sanctions regulations. A payment that is simultaneously a UAE-restricted payment and a UK-restricted payment requires both authorisations; OFSI and the EOCN do not recognise each other's licences.
The position above covers the standard case. Your specific facts – the nature of the goods, the route of the funds, the regime under which the counterparty is listed, and the jurisdictions of the banks involved – will change the analysis materially.
For an initial assessment of the authorisation route that applies to your transaction, contact Calder & Vance at info@caldervance.com.
Step 3 – Assemble the documentation before you apply
A payment-authorisation application under the UAE regime is a formal submission to a government authority; it is not an informal query. The quality and completeness of the documentation submitted at the outset determines whether the application proceeds or is returned for further information, which can extend the process significantly.
The standard documentary package for a UAE payment-authorisation request includes:
- A clear written explanation of the nature and purpose of the payment, identifying the parties, the amounts, and the account details.
- Evidence of the legal and commercial relationship underlying the payment (contract, invoice, or equivalent instrument).
- Corporate ownership documentation for all entities in the payment chain, sufficient to address any beneficial-ownership questions.
- Where the payee or the recipient of value is connected to a listed person, a clear account of the ownership or control relationship and the basis on which the authorisation is sought.
- A statement addressing how the authorised payment will not benefit the designated party beyond what is permitted.
In our experience, applications that fail to address the beneficial-ownership question clearly are the ones most likely to be returned without decision. Preparing the ownership analysis upfront – using corporate registry documents, shareholder agreements, and, where necessary, legal opinions from counsel in the relevant jurisdiction – is worth the time investment before filing.
Practitioners advising on OFAC licensing matters note that OFAC's specific-licence applications follow a parallel logic: the applicant must identify the transaction, the sanctioned nexus, the legal ground for relief, and the safeguards that will prevent prohibited benefit flowing to the designated party. The documentary discipline required for an OFAC application translates well to the UAE process, and businesses that have been through an OFAC licence round are often better prepared for an EOCN submission than those approaching a payment-authorisation process for the first time.
Step 4 – How long does the UAE payment-authorisation process take, and what happens in the interim?
The UAE regime does not publish a fixed statutory decision period for payment-authorisation applications in the way that some other regimes do. Processing time depends on the complexity of the transaction, the completeness of the file, and whether the designation in question has an international dimension requiring coordination with the UN Security Council committee. In our practice, straightforward applications with complete documentation resolve within weeks; those involving complex ownership structures or coordination requirements take longer.
During the period between application and decision, the funds remain frozen. The legal position is that no payment may be made until the authorisation is granted. This has operational consequences for businesses: the supplier is not paid, the contract timeline slips, and – depending on the commercial terms – penalty clauses or termination rights may be triggered on the counterparty's side. Planning the application timeline around the commercial deadline, and communicating clearly with the counterparty about the regulatory position, is a practical step that experienced counsel can support.
For comparison, OFSI in the UK targets decisions within a defined period (verify the current position before relying on it), and OFAC does not commit to a published turnaround time for specific-licence applications, though the average processing period varies considerably by programme and complexity. The EU derogation process under the relevant Council Regulation typically requires a referral to the competent national authority and, for certain designations, a notification or non-objection step at the EU level. None of these timelines are fixed by statute in a way that guarantees a decision by a specific date.
If a transaction has already been flagged, or a payment has been blocked by your bank pending authorisation, an early review of the position can preserve options that may narrow as time passes.
To discuss an urgent payment-authorisation matter, write to info@caldervance.com.
Where does the UAE regime diverge from OFAC and EU approaches?
Three divergences matter most for a business operating across the UAE, the United States, and the EU simultaneously.
First, the ownership and control test. Under OFAC, the test is the 50 percent rule: any entity owned 50 percent or more in the aggregate by one or more blocked persons is itself treated as blocked, regardless of whether it appears on the SDN List by name. The test is mechanical and turns on ownership percentage alone. Under the EU and UK regimes, the test includes a control limb: an entity can be caught even where the listed person holds less than 50 percent, if the listed person exercises control through other means – voting arrangements, board composition, contractual rights. The UAE regime, following the UN framework, applies the designation to the listed person directly; whether a non-listed entity is also caught depends on the factual relationship to the designated party and the interpretation applied by the EOCN. Where doubt exists, practitioners treat the strictest applicable standard as the working assumption.
Second, the authorisation grounds differ by regime. OFAC's licensing grounds under the relevant programme regulations include categories such as personal remittances, legal fees, and humanitarian transactions, each with defined conditions. OFSI's licensing grounds under the relevant UK thematic regulations include grounds for legal expenses, personal maintenance, and certain business transactions, subject to case-by-case scrutiny. The UAE authorisation process does not publish a comparable published list of pre-defined grounds; the assessment is more discretionary, which means the quality of the narrative in the application carries greater weight.
Third, reporting obligations diverge. OFSI requires a person who knows or suspects that they hold frozen assets, or have information that would help OFSI enforce a prohibition, to report that information to OFSI. The UAE imposes its own reporting obligations on financial institutions through Central Bank supervisory requirements. OFAC's reporting framework requires, among other things, the submission of a report when blocked property is held. A business operating in all three jurisdictions must track which reporting obligation has been triggered, by whom, and to which authority, as the same transaction can trigger three concurrent reporting duties. Failure to report in any one jurisdiction remains a violation even where the others have been satisfied.
Common pitfalls and risk flags in UAE payment authorisations
The most common pitfall is treating the UAE authorisation as a single-regime problem. Businesses focus on the EOCN process and overlook the concurrent OFAC or EU exposure. The result is a situation where the UAE authorisation is pending but the business has already violated a US or EU prohibition by allowing value to move – or, conversely, where the UAE authorisation is granted but the OFAC licence is never applied for because the team assumed the UAE clearance resolved everything.
A second pitfall is incomplete ownership mapping. The UAE regime, like all major regimes, is concerned with who ultimately receives value. An application that addresses only the named payee without examining the ownership structure behind it will not satisfy the EOCN, and it will not satisfy a bank's compliance function either. Banks operating in the UAE apply their own sanctions-screening policies, and a bank may decline to process a payment even where an EOCN authorisation has been granted, if the bank's internal risk assessment produces a different conclusion. In a recent matter, a commodities trading business obtained the necessary regulatory authorisation for a payment but found that its correspondent bank applied a stricter internal standard. Resolving the bank's concern required a separate engagement that the business had not anticipated when it planned the timeline.
A third risk area is record-keeping. Sanctions and export-control regimes generally require businesses to maintain records of authorisations obtained, transactions conducted, and the due-diligence steps taken. The period for which records must be kept varies by regime; five years is a common benchmark across several regimes, verify the current position for the UAE and for each applicable regime before relying on it. Poor record-keeping is a consistent theme in enforcement actions: it transforms what might have been a defensible decision into an evidential gap.
Have you considered whether your compliance programme covers the full scope of documentation that would be needed if an enforcement authority reviewed this transaction in three years?
Related practices
- Frozen account management under BIS and EAR – navigating blocked-property obligations and release procedures under US export-control rules.
- Payment authorisations under UAE – advanced issues – deeper treatment of complex ownership structures and multi-bank clearing chains.
When to involve sanctions counsel – and the myth that applications are straightforward
A persistent view in corporate compliance teams is that payment-authorisation applications are administrative rather than legal matters – that it is enough to complete the form and submit the documents. This view underestimates the process. The EOCN application requires a considered legal analysis of the nexus between the payment and the listed party, the basis on which authorisation is sought, and the safeguards that will prevent prohibited benefit. An application that gets these elements wrong is not merely delayed; it can alert the authority to the transaction in a way that triggers enhanced scrutiny of the wider relationship.
Counsel should be involved from the point at which a potential designation nexus is identified – before the decision is made to proceed with the payment, before the application is filed, and certainly before any funds move. The decision tree looks like this:
- Potential nexus identified at screening: pause the payment, map the ownership chain, identify the applicable regime or regimes, and assess whether an authorisation or a licence is required in each.
- Authorisation required in the UAE: prepare the documentary package, draft the application narrative, and coordinate with the relevant bank on its internal processing requirements.
- Concurrent OFAC or EU exposure: file parallel applications under the applicable regimes; do not assume that any one authorisation covers the position under another.
- Bank declines to process despite authorisation: engage the bank's compliance function directly, with supporting legal analysis, to address the residual concern.
- Decision takes longer than the commercial timeline: advise the counterparty of the regulatory position, review the force-majeure or regulatory-compliance clauses in the contract, and assess whether the delay constitutes a breach.
We regularly advise businesses at each of these stages. The earlier counsel is engaged, the more options are available and the lower the cost of resolution.
For a confidential review of a payment that has been flagged or blocked, contact Calder & Vance at info@caldervance.com.