A technology exporter operating from Dubai receives a formal written request from the UAE's Executive Office for Control and Non-Proliferation (the central authority administering the UAE's autonomous sanctions and strategic goods controls). The request asks for documentation on a recent shipment, counterparty due diligence records, and a timeline of internal approvals. The company has ten days to respond. What must it produce? What should it withhold? And what happens if it misses the deadline?
Responding to a regulator information request under the UAE regime requires a structured, legally supervised approach. The UAE operates a dual-layer enforcement architecture: financial sanctions administered through the UAE Cabinet framework and the Executive Office, and strategic goods controls under the national export-control rules. Both can generate formal information requests carrying real legal consequences. As of April 2026, the UAE has materially strengthened its enforcement posture, aligning its procedures more closely with international standards following its removal from the FATF grey list.
This guide walks through each stage of the response process, from first receipt to final submission, and flags where cross-border exposure – particularly under US, EU, and UK regimes – complicates the picture.
Step 1: Understand the legal basis and the issuing authority
Before drafting a single line of response, identify which UAE authority issued the request and under which legal instrument. The answer determines your obligations, your timeline, and the standard of proof the authority is applying.
The UAE's sanctions enforcement sits primarily with the Executive Office for Control and Non-Proliferation and the National Anti-Money Laundering and Combating Financing of Terrorism and Financing of Illegal Organisations Committee (NAMLCFTC). The UAE Cabinet issues the list of designated persons and entities aligned with UN Security Council resolutions and autonomous UAE designations. Financial institutions and designated non-financial businesses and professions (DNFBPs) face additional supervisory information requests from the Central Bank of the UAE and the relevant financial-services regulator.
Strategic goods and dual-use items fall under the remit of the Strategic Goods Authority (formerly within the customs administration and now consolidated under the national export-control apparatus). A request from that body carries different obligations from one issued by the Executive Office. Confusing the two leads to incomplete responses – and that omission can itself become the focus of further scrutiny.
In our experience, the first and most common mistake firms make is treating a UAE information request as a purely administrative formality. It is not. Each request is a data-collection exercise that the authority may use to determine whether an apparent violation exists, whether a referral to the public prosecutor is appropriate, or whether enhanced supervisory measures are warranted. Engage qualified sanctions compliance counsel at the point of receipt, not after a first draft is already circulating internally.
Step 2: Preserve records and impose an information hold immediately
From the moment a formal request is received, an information hold must be imposed across every system, custodian, and location that holds potentially responsive material. Destruction or alteration of records after a request is issued can constitute an independent offence under the applicable UAE instruments, separate from and potentially more serious than any underlying conduct.
The hold should cover email accounts, enterprise resource-planning records, shipping documentation, transaction logs, KYC files, screening records, and board or management communications relating to the relevant counterparty or shipment. Where records sit with third parties – freight forwarders, financial institutions, external advisers – the hold notice should reach them promptly.
Document the hold itself. A written record showing when the hold was imposed, who authorised it, which custodians were notified, and how compliance was verified serves two purposes. It demonstrates good faith to the authority. It also protects the business if the scope of the request later expands and the authority questions what was preserved.
One practical complication arises frequently in cross-border operations. Records relevant to a UAE information request may also be subject to blocking statutes, data-protection rules, or legal-privilege protections in other jurisdictions. The EU Blocking Regulation (protecting EU-resident companies from complying with certain extra-territorial demands) is one example. Privilege under English law is another. These tensions must be identified at the hold stage, not resolved under deadline pressure at the response stage. We regularly advise clients on exactly this conflict, and the sequencing matters considerably.
Step 3: Map the request and build the response structure
A disciplined response begins with a precise mapping exercise: each question or document request in the authority's letter receives a discrete entry in a working document that tracks the responsive material identified, the gaps, the privilege claims, and the intended treatment.
Work through the request line by line. For each item, ask four questions. First: is the requested document or information in the firm's possession, custody, or control? Second: does responsive material exist that the firm does not currently hold – and is there an obligation to obtain it? Third: is any responsive item subject to a claim of legal privilege, confidentiality, or a competing legal obligation in another jurisdiction? Fourth: does producing the item risk waiving privilege or creating adverse inferences in a parallel investigation?
The mapping document becomes the backbone of the response. It also allows counsel to identify where the firm should provide context alongside the raw documentation – because a bare production of documents, without explanation of what they do and do not show, can be read in ways the authority may find more concerning than a carefully framed narrative response.
Where gaps exist – documents that should exist under good compliance practice but do not – the response must address them honestly. Asserting that records were not maintained is better than leaving the authority to draw its own inference. Where the gap itself reflects a compliance failure, counsel should assess whether a voluntary disclosure of the underlying conduct is appropriate, either in the UAE or in parallel jurisdictions.
How does the UAE enforcement procedure compare with OFAC, OFSI, and EU processes?
The UAE's approach shares structural features with the major Western regimes but differs in several procedurally significant ways. Understanding those differences is essential for any cross-border business whose UAE response may also trigger obligations elsewhere.
Under OFAC's enforcement process, a business that receives an administrative subpoena or pre-penalty notice operates within a well-documented procedural framework: a defined period to respond to the pre-penalty notice, the option to seek an informal resolution, and published Economic Sanctions Enforcement Guidelines that set out the factors OFAC weighs. The process is relatively transparent, with published penalty settlements providing benchmarks. OFAC also accepts voluntary self-disclosures (VSD – a formal self-report of an apparent violation, which under OFAC guidelines qualifies the matter for treatment as a non-egregious case and can reduce the base civil penalty by a significant proportion). Businesses responding to a UAE request who face parallel US exposure should consider the VSD question immediately.
OFSI in the United Kingdom operates under SAMLA and its thematic regulations. Information requests from OFSI carry statutory force. OFSI's published enforcement guidance sets out its approach to assessing the seriousness of a violation and the mitigating effect of self-disclosure. Like OFAC, OFSI publishes a monetary penalties regime that functions as a deterrent signal. A business responding to the UAE authority that has also processed transactions through UK-regulated banks may find that the same underlying conduct attracts OFSI scrutiny.
The EU regime, administered through Council regulations implemented by member-state competent authorities, varies somewhat by member state in its procedural detail. An annulment action before the EU General Court remains available to challenge a designation – a route not directly available in the UAE context, where administrative and judicial review procedures follow the national framework. The EU General Court has developed a body of case-law on proportionality and the standard of evidence required to maintain a designation, which practitioners increasingly cite as a reference point in comparable proceedings in other regimes.
The UAE's own procedure is more recent and, in some respects, less extensively codified in public guidance than the OFAC or OFSI equivalents. Response timelines are set in the request itself or in the applicable instrument; they are not always uniform. The authority retains significant discretion in how it weights cooperation, the quality of the response, and the adequacy of the firm's compliance controls. That discretion makes the quality of legal representation at the response stage material to the outcome in a way that is somewhat different from the more rule-bound US process.
Does your response to the UAE authority create a record that another regulator – OFAC, OFSI, or an EU competent authority – could later seek to obtain? In many cross-border matters, the answer is yes. Structure the response with that possibility in mind.
Step 4: Draft, review, and submit the response
The written response to the authority should open with a clear, factually accurate summary of the firm's position and its cooperation stance. Authorities in the UAE, as elsewhere, respond better to a response that leads with the bottom line – what happened, what the firm did, and how the response is structured – than one that buries the key facts in exhibits.
The body of the response addresses each request item in sequence, cross-referencing the documents produced. Where a document is withheld – on grounds of privilege or a competing legal obligation – the response should identify the item withheld, the basis for withholding it, and the jurisdiction whose law is relied upon. A bare refusal without explanation is likely to be treated as obstruction.
Narrative context should be proportionate and accurate. Avoid over-explanation that introduces new issues or concedes facts not in evidence. Avoid under-explanation that leaves the authority to fill gaps adversely. The tone should be professional and cooperative without being gratuitously apologetic, which can be read as an admission of serious fault where none has been established.
Before submission, the response and every exhibit should be reviewed by sanctions counsel who has not been involved in drafting – a second-reader check against the original request to confirm that every item has been addressed or expressly reserved, that no accidental admissions have been introduced, and that the documents produced are consistent with the narrative. We have acted in matters where an internal draft submitted without this check created a more serious problem than the original conduct under review.
Submission should be tracked. Obtain a receipt – whether electronic or physical – and record the date and method of submission. If the authority acknowledges receipt, preserve that acknowledgement. If the deadline falls on a public holiday, confirm in advance whether the relevant rules permit deferral or require prior notice.
Risk flags and when to involve external sanctions counsel
Several patterns signal that a UAE information request carries elevated legal risk and requires immediate external counsel involvement rather than an in-house or administrative response.
The request references a named individual, entity, or vessel that appears on the UAE Cabinet list, the UN Consolidated List, or the SDN List (OFAC's list of Specially Designated Nationals and blocked persons). In this situation, the information request may be a precursor to a formal enforcement action, and the firm's response will form part of the evidentiary record.
The request covers a period during which the firm processed transactions involving goods with a plausible dual-use application – electronics, chemicals, precision machinery – and the requesting authority is the Strategic Goods Authority rather than the financial-sanctions body. The legal questions differ, and the risk of an inadvertent admission on one set of issues while addressing the other is real.
The firm has operations or banking relationships in the United States, United Kingdom, or the EU. A cooperative response to the UAE authority that honestly describes transactions processed through those jurisdictions may create parallel disclosure obligations. Coordinate before submitting.
The request arrives alongside, or shortly after, a separate inquiry from a correspondent bank, a payment-platform compliance team, or a freight forwarder. Concurrent informal inquiries from business counterparties often signal that the underlying transaction has been flagged by multiple parties and that a formal enforcement process is already in motion in more than one jurisdiction.
The timeline given in the request is unusually short. A compressed response window typically indicates that the authority already holds significant information and is testing whether the firm's account is consistent with what the authority knows. This is not the moment for an unguided internal response.
Common objections and a frequent misconception
One objection we hear regularly from in-house teams is that a UAE information request is less serious than one from OFAC or OFSI, and that a competent internal response will suffice. This underestimates the current enforcement environment. The UAE has invested significantly in its sanctions and strategic-goods compliance infrastructure, and the consequences of an inadequate response – including referral to the public prosecutor, cancellation of operating licences, or deregistration from UAE financial markets – are material for any business with regional operations.
A second misconception is that cooperation necessarily means full disclosure of everything the authority asks for. It does not. Cooperation means responding completely to the legal obligations the request creates, asserting legitimate protections (privilege, blocking-statute obligations, data-protection requirements) transparently, and doing so on time. A partial response that identifies and explains its omissions is treated very differently from a partial response that conceals them.
A third point that comes up frequently: firms assume that because the UAE has not historically published enforcement decisions in the same volume as OFAC or OFSI, the enforcement risk is lower. That assumption is outdated. The UAE's post-FATF-review enforcement posture has hardened, and the absence of published precedent does not mean the absence of enforcement. It means that the enforcement record is less visible, which makes independent legal advice more – not less – important.
Related practices
- EU apparent violation assessment – assess EU sanctions exposure, structure a voluntary disclosure, and manage the competent authority process
- Responding to UN-related information requests – guide to responding when a matter engages the UN Consolidated List or Security Council committee procedures
- Voluntary self-disclosure under Australian sanctions rules – step-by-step guide to VSD under the Australian autonomous-sanctions regime administered by DFAT