A freight forwarder based in Dubai arranges a consolidated shipment for three buyers. Two clear screening without issue. The third sits behind a holding company registered in a free zone, and that holding company has a beneficial owner whose name appears on a UN Consolidated List. Does the prohibition attach to the goods? Does it attach to the freight forwarder? Does it travel up the chain to the manufacturer in Europe who filled the order? As of January 2026, those questions land squarely on the UAE's own sanctions architecture – and the answers matter to every party in the chain.
Supply-chain sanctions mapping under the UAE regime means systematically identifying every node in a commercial chain – counterparty, intermediary, beneficial owner, jurisdiction of transit – and testing each against the applicable prohibitions. The UAE administers sanctions through the Executive Office for Control and Non-Proliferation and implements UN Security Council obligations directly, while operating its own domestic designation list. Where OFAC's extraterritorial reach also extends to the transaction, two regimes apply simultaneously, and the stricter prohibition governs.
This guide walks through the governing regime, the practical mapping sequence, the ownership-and-control tests that determine whether a prohibition attaches, the points where the UAE regime diverges from OFAC and OFSI, and the risk flags that should prompt counsel engagement. It follows a step-by-step structure suited to compliance teams, trade-finance officers, and General Counsel working across the Gulf and beyond.
Step 1: Understand the UAE Sanctions Architecture
The UAE implements its sanctions obligations through a domestic legal order that sits on top of UN Security Council resolutions, giving UN-listed persons and entities direct legal effect. The competent authority is the Executive Office for Control and Non-Proliferation, commonly referred to as EOCN, which maintains the UAE local list and coordinates with the Financial Intelligence Unit on reporting. A counterparty that appears on the UN Consolidated List is therefore automatically prohibited under UAE rules without a separate domestic designation.
This layered architecture has a practical consequence for supply-chain mapping. A compliance team must screen against at least two lists: the UN Consolidated List and the UAE local list. Because the UAE also has significant trade, financial, and transit relationships with jurisdictions whose residents and companies may themselves be subject to OFAC programmes, US secondary-sanctions risk is a constant background question. Any UAE-incorporated business with dollar-clearing relationships or US-person involvement carries OFAC exposure alongside domestic UAE exposure. The two analyses run in parallel, not in sequence.
One further structural point: the UAE has expanded its autonomous sanctions (measures the UAE adopts on its own authority, outside UN mandates) in step with its growing role in international trade. The domestic list is updated periodically, and the EOCN publishes guidance on compliance obligations for regulated and unregulated sectors alike. Supply-chain actors should treat EOCN guidance as a primary source, not a secondary commentary.
Step 2: Define the Scope of Your Supply Chain
Before any screening begins, you need a complete map of who and what to screen. In our experience, most supply-chain failures in the Gulf region do not arise from poor screening tools; they arise from incomplete scope definition. The chain is narrowed too early, and the risk sits in the gap.
A workable scope definition covers five layers:
- Tier-1 counterparties – the entities you contract with directly, including agents, distributors, and freight forwarders
- Beneficial owners and controlling persons – any natural or legal person with an ownership or control interest above the applicable threshold in a Tier-1 entity
- Intermediaries and sub-contractors – any party that handles the goods, finances the transaction, or provides ancillary services along the route
- Jurisdictions of transit and storage – ports, free-zone operators, bonded warehouses, and re-export hubs, particularly in the context of UAE free zones which can host shell structures
- End-user and end-use – the ultimate recipient of the goods and their intended application, relevant to both sanctions and export-control analysis under the EAR and the applicable UAE export rules
The question of end-use is often treated as an export-control matter only. That is a mistake. Under UN Consolidated List obligations and EOCN requirements, end-use matters for sanctions purposes when there is a risk that goods will ultimately benefit a designated person or entity, even if the immediate buyer is undesignated. Have you mapped every step from your warehouse to the ultimate point of delivery?
Step 3: Apply the Ownership-and-Control Test
The prohibition against dealing with a designated person does not stop at the person named on the list; it extends to entities that the designated person owns or controls. Getting this test right is the analytical core of supply-chain sanctions mapping, and the UAE regime, OFAC, and OFSI each approach it differently.
Under OFAC rules, the test is mechanical. Any entity that blocked persons own 50 percent or more in the aggregate – whether directly or through intermediate holding companies – is treated as itself blocked. The intention of the owners and the day-to-day management of the entity are irrelevant to the legal conclusion. This is the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked), and it aggregates across multiple blocked persons: two blocked persons each holding 30 percent of a target company meet the threshold together.
Under OFSI and EU rules, the test adds a control limb. An entity need not be formally majority-owned by a designated person to be caught; it is sufficient that the designated person holds a dominant position, exercises control, or is in a position to direct the entity's affairs. This control analysis is fact-specific. A designated person who is the sole customer of a company, or who has the power to appoint and remove the majority of the board, may control it within the meaning of those regimes even if they own less than 50 percent of the shares.
Where does the UAE sit? The UAE's domestic sanctions rules incorporate the UN Consolidated List approach, which follows the UN Security Council committee determinations. In practice, the EOCN applies an ownership-and-control analysis that mirrors the UN approach rather than the purely mechanical OFAC test. For a business operating through the UAE, this means applying the more demanding control analysis to every beneficial-ownership question, while simultaneously applying the OFAC 50 percent rule to any dollar-denominated or US-person-connected leg of the transaction.
The practical rule is straightforward: where two or more regimes apply, the stricter prohibition governs. Map the ownership chain to the fullest available depth, test it under each applicable regime, and take the most conservative conclusion.
Step 4: Screen, Document, and Escalate
Mapping is not the same as screening, and screening is not the same as clearance. Each is a distinct step with its own documentation requirement.
Screening is the automated or manual comparison of names, identifiers, and addresses against the applicable lists. A clean result at this stage does not end the analysis; it confirms that no exact or fuzzy match was found on the lists consulted at that moment. Lists are updated frequently. A counterparty cleared yesterday may be designated today.
The documentation standard under the UAE regime expects firms to retain records demonstrating that screening was conducted, which lists were consulted, on what date, and what conclusion was reached. In our practice, we consistently advise clients to record not only positive hits but negative results: a dated record of a clean screen is evidence of good-faith compliance if the designation comes later.
Escalation criteria should be set in advance. A compliance team that has to ask "do we escalate this?" in the moment of a hit has already lost time. We regularly advise clients to define, before any transaction opens, the triggers for automatic escalation to a sanctions-qualified compliance officer or to external counsel: a partial name match, an ownership chain that cannot be resolved beyond the second layer, a beneficial owner in a jurisdiction subject to a thematic prohibition, or an end-use description that is inconsistent with the buyer's declared business.
One further practical point: the UAE is a major re-export hub, and the EOCN has been explicit about the risk of goods being routed through UAE free zones to prohibited destinations. Where the transaction involves a free-zone buyer or a re-export arrangement, the end-user due diligence standard is higher, and the documentation burden is correspondingly greater. This is an area where the UAE regime interacts directly with US export-control rules under the EAR, which extend extraterritorially to certain goods regardless of where they are physically located.
Step 5: Manage the Cross-Regime Dimension
A supply chain that passes through the UAE rarely stays within a single sanctions regime. OFAC's extraterritorial reach means that any transaction with a US-origin good, a US-dollar leg, a US-person participant, or a good produced in significant part from US-controlled technology will carry US sanctions obligations on top of UAE domestic requirements. BIS export-control jurisdiction under the EAR travels with the goods themselves, independent of who holds them or where they are.
EU-origin goods add another layer. Under EU dual-use rules and the relevant Council regulations, an EU-based exporter retains obligations with respect to the end-use and end-user of controlled goods even after those goods have entered a UAE free zone. The EU Blocking Regulation further complicates the picture for EU-domiciled businesses: compliance with certain OFAC secondary-sanctions requirements may place them in conflict with their EU obligations. These tensions are not hypothetical; they arise in practice, and they require explicit management rather than passive hope that no regulator notices.
What should a compliance team do when it identifies an apparent conflict between regimes? The first step is to identify which obligations are strict and which can be authorised by licence. The second is to map the corporate structure of the group to determine which entities are subject to which regime. The third is to assess whether an authorisation is available, what it would require, and how long it would take. In a recent matter, we acted for a trading company with entities in both the EU and the UAE whose supply chain for industrial components generated simultaneous OFAC, EU dual-use, and UAE EOCN questions. The resolution required parallel licensing analyses and a redesign of the order-flow so that the entity bearing the highest regulatory burden was not also the entity making the commercial commitment. The matter was resolved without enforcement action.
The position above covers the standard multi-regime structure. Your facts – the counterparty, the goods, the route, and the particular designations in play – change the analysis materially. For an assessment of your exposure across the UAE and intersecting regimes, contact Calder & Vance at info@caldervance.com.
Step 6: Recognise the Risk Flags That Require Counsel
Most supply-chain sanctions mapping can be managed by a well-equipped internal compliance function. But certain patterns consistently indicate that the analysis has exceeded what a standard compliance programme can reliably handle. Recognising those patterns early is itself a compliance skill.
The risk flags we see most often in UAE-related supply chains include the following:
- Ownership opacity beyond two layers: where beneficial ownership cannot be confirmed to the level required for a clean determination, a partial conclusion is worse than acknowledging the gap. An incomplete analysis that leads to approval is not a safe harbour.
- Free-zone structures with no apparent operational substance: a buyer or intermediary incorporated in a UAE free zone with no employees, no physical premises, and a contact who cannot explain the company's business merits elevated diligence, regardless of whether any list name appears.
- Goods with a plausible military or proliferation end-use: dual-use goods, items with ECCN (Export Control Classification Number under the US Commerce Control List) classifications, and goods described in generic terms by a buyer in a procurement-sensitive sector require an end-use analysis that goes beyond list screening.
- Unusual payment routing: payment instructions that route through a jurisdiction or financial institution not connected to the declared commercial relationship are a consistent indicator of ownership-and-control questions that have not been surfaced.
- Counterparty reluctance to provide KYC documentation: a counterparty that declines to provide beneficial-ownership information, corporate registration documents, or end-user certificates is not simply uncooperative; that refusal is itself a risk indicator under the applicable regime.
- A potential apparent violation already in the chain: if a compliance review reveals that a transaction has already been completed with a counterparty that was, or may have been, designated at the time, the question shifts from diligence to enforcement response. That is a distinct analysis and requires a distinct approach.
If a transaction has already been flagged, or a review has surfaced a potential past violation, early external engagement can preserve options that close quickly with time. Contact us at info@caldervance.com to discuss your position confidentially.
Correcting a Common Misconception: UAE Sanctions Are Not Just UN Implementation
A widespread assumption among businesses entering the UAE market for the first time is that UAE sanctions obligations are simply a pass-through of UN Security Council resolutions – that if a counterparty does not appear on the UN Consolidated List, the UAE imposes no restriction. That assumption is incorrect, and it has led to enforcement exposure for businesses that otherwise ran competent compliance programmes.
The UAE maintains its own domestic designation list, separate from the UN list. The EOCN publishes updates, and the domestic list can include persons and entities not on the UN list. Additionally, the UAE has in recent years adopted measures in coordination with its partners in the Financial Action Task Force and the Egmont Group, meaning that the practical compliance standard expected of regulated businesses in the UAE has risen materially beyond pure list-checking.
The myth also ignores the extraterritorial dimension. A UAE-based business that transacts in US dollars, uses a US correspondent bank, or deals in goods with US-origin content carries OFAC obligations that exist independently of UAE domestic rules. In our cross-border practice, we find that businesses planning UAE operations for the first time consistently underestimate the US nexus dimension. The relevant question is not only what the UAE requires, but what every regime with a jurisdictional hook into the transaction requires.
Related practices
- Correspondent banking and de-risking under OFAC – managing OFAC exposure in financial institution and payment relationships
- Supply-chain sanctions mapping under the UN regime – the UN Consolidated List, Security Council obligations, and the mapping sequence
- Trade transaction screening under the Australian regime – practical guidance on Australia's Autonomous Sanctions regime for cross-border transactions