A trading company based in Dubai closes a supply agreement with a counterparty in a third market. Weeks later, the firm's bank flags a concern: one of the counterparty's shareholders appears on a list maintained by the UAE's financial-sanctions authority. The question is immediate and practical. Is the counterparty itself caught? Does the contract survive? Who, under the UAE regime, is responsible for having asked these questions before the deal closed?
Counterparty due diligence under UAE rules is governed by the Executive Office for Control and Non-Proliferation (EOCN) and enforced through the UAE's autonomous sanctions and anti-money-laundering regime, which operates alongside its obligations as a UN Security Council member state. The regime applies to businesses operating in or through the UAE and requires screening against multiple lists – the UN Consolidated List, the UAE local list, and, for institutions with cross-border exposure, the major international lists that may trigger secondary-sanctions risk. As of mid-2026, the regime has tightened its enforcement posture and widened the range of regulated persons subject to enhanced due diligence requirements.
This briefing sets out who administers the UAE's counterparty due diligence rules, what the obligations require, where the UAE regime intersects with OFAC, OFSI, and EU rules, and what risk flags should prompt a call to sanctions counsel.
Who administers counterparty due diligence under UAE?
The UAE counterparty due diligence regime sits across two principal authorities: the EOCN, which coordinates the UAE's autonomous sanctions designations and UN-derived obligations, and the Central Bank of the UAE (CBUAE), which supervises financial institutions on anti-money-laundering and counter-proliferation-financing obligations. For non-financial businesses – free-zone operators, traders, manufacturers, real-estate professionals, and designated non-financial businesses and professions (DNFBPs) – the relevant supervisory authority depends on the sector and the emirate.
The legal basis is the UAE's federal framework on anti-money laundering, countering the financing of terrorism, and countering proliferation financing, read alongside Cabinet Decisions that implement UN Security Council resolutions under Chapter VII of the UN Charter. The Cabinet Decision mechanism is the domestic conduit through which UN designations acquire legal force in the UAE. Domestically autonomous designations – those not derived from a UN resolution – are made by Cabinet Decision and published through the EOCN. Businesses subject to the regime must screen against both layers.
In our cross-border practice, we regularly see multinational groups underestimate the reach of the UAE's domestic designation list. The local list is not merely a mirror of the UN Consolidated List; it includes persons and entities designated autonomously, sometimes ahead of an equivalent UN or Western-regime action. Relying solely on UN screening misses this exposure entirely.
What does the UAE regime require of a business conducting counterparty due diligence?
The UAE regime requires businesses to apply a risk-based approach, beginning with the identification and verification of the counterparty's identity, the beneficial ownership structure, and the purpose of the business relationship. For regulated entities, this means implementing a customer due diligence programme that maps to the five-element standard: identification, verification, beneficial-owner assessment, purpose-and-nature assessment, and ongoing monitoring.
Beneficial ownership is a central concern. The UAE has progressively aligned its beneficial-ownership threshold rules with international standards, requiring businesses to identify and verify natural persons who exercise ultimate control. Where a counterparty is a legal person, the analysis must go behind the nominal ownership layer to identify the natural person – or persons – who ultimately own or control it. The UAE's approach to aggregated holdings mirrors the international standard: where multiple related parties collectively reach the relevant threshold, that aggregation is the trigger, not the individual percentage alone.
Enhanced due diligence is required in a range of situations: where the counterparty is a politically exposed person (PEP) or is connected to one; where the business relationship is cross-border and involves a jurisdiction assessed as high-risk; where the transaction is complex, unusually large, or has no apparent legitimate purpose; or where the counterparty's ownership and control structure is opaque. The UAE regime does not fix a single monetary threshold below which screening obligations disappear; risk-based proportionality applies throughout.
Record-keeping obligations accompany all of these steps. Businesses must retain due diligence documentation for a defined period after the end of the business relationship, in a form that is accessible to the relevant supervisory authority on request. The period prescribed by the applicable UAE federal rules is among the standard international benchmarks – verify the precise duration against the current Cabinet Decision before relying on it.
How do the UAE's ownership and control tests compare with OFAC and OFSI?
The differences between the UAE, US, and UK ownership tests are not merely technical; they determine whether a transaction is permissible and, if so, under what conditions. A cross-border compliance programme must handle all three if the business operates across those jurisdictions.
Under OFAC's rules, derived from IEEPA and the applicable programme regulations, the 50 percent rule (OFAC's rule treating entities owned 50 percent or more, in the aggregate, by one or more blocked persons as themselves blocked) applies mechanically. Ownership is the test; control is not a separate, standalone trigger under the OFAC framework, though it is considered in the context of certain specific programmes. Two listed persons each holding a quarter of an entity do not, individually, reach the OFAC threshold. Together they do.
Under OFSI (the UK's Office of Financial Sanctions Implementation), the test is ownership and control. An entity can be caught even where no single listed person owns more than 50 percent, if a listed person has the ability, in practice or in right, to direct the entity's affairs. This is the key divergence from OFAC. The OFSI position is that both ownership and control, separately assessed, can trigger the prohibition.
The EU ownership and control test is substantively similar to OFSI's. The EU General Court has confirmed in several annulment proceedings that the control limb requires a concrete assessment of whether a listed person can exercise decisive influence over the entity's decisions. That inquiry is fact-specific and involves examining constitutional documents, shareholder agreements, board composition, and contractual arrangements.
The UAE regime's approach is aligned in principle with the international ownership-and-control standard. In practice, this means a business working between Dubai, London, and Brussels faces three tests that are convergent in policy intent but divergent in the detailed mechanics of aggregation, the definition of control, and the documentary evidence required to demonstrate independence from a listed person. Where tests diverge, the stricter prohibition governs: no transaction should proceed on the basis that one regime permits it if another applicable regime prohibits it.
The position above covers the standard multi-regime analysis. Your facts – the counterparty's jurisdiction of incorporation, the nature of the goods or services, the ownership layering, and the specific regimes in play – change the outcome. For a cross-regime review of a specific counterparty, contact Calder & Vance at info@caldervance.com.
What are the key risk flags in UAE counterparty due diligence?
Risk flags in UAE counterparty due diligence fall into three broad categories: structural opacity in the counterparty's ownership chain, jurisdictional exposure to secondary-sanctions risk, and transactional indicators that suggest the relationship may be used to route value to or from a sanctioned person or territory.
Structural opacity is the most common source of missed risk. A counterparty that presents a nominee director, a multi-layer free-zone structure with no apparent commercial rationale, or a beneficial-ownership disclosure that terminates at a trust or foundation rather than a natural person is a counterparty that warrants additional scrutiny. The UAE's free-zone environment creates legitimate efficiencies for cross-border trade. It also creates structure that, if not interrogated carefully, can obscure the identity of the person who actually controls the entity and its assets.
Jurisdictional exposure arises where the counterparty, its shareholders, its customers, or its operational counterparties have connections to territories or persons subject to OFAC, OFSI, or EU sanctions. The UAE regime does not impose secondary sanctions in the sense that OFAC does – it does not, as a general matter, designate foreign businesses solely for transacting with a US-sanctioned entity. But a business based in the UAE that processes USD transactions will be clearing through US correspondent banks. Those banks apply OFAC's rules. A transaction that is technically permissible under the UAE regime may still be refused, blocked, or reported by the clearing bank under OFAC authority. We regularly advise UAE-based firms on exactly this gap between domestic permissibility and international clearance risk.
Transactional indicators include payments that are structured in a way that obscures the beneficiary, goods with dual-use potential routed through an intermediary with no apparent distribution function, and unusually compressed timelines that limit the ability to complete enhanced due diligence before value moves. Each of these indicators, individually, might have an innocent explanation. When they cluster, the risk-based approach requires enhanced scrutiny and, in some cases, a decision not to proceed.
When does UAE counterparty due diligence intersect with export-control obligations?
The UAE is a signatory to international export-control arrangements and has implemented its own national export-control regime, supervised through the EOCN's strategic-trade function. Businesses exporting controlled goods from or through the UAE – including dual-use items, technology, and software – face obligations under both the UAE's domestic controls and, if the items are of US or EU origin, the extraterritorial reach of the EAR and the relevant EU dual-use rules.
The EAR (the US Export Administration Regulations, administered by BIS) applies to items of US origin wherever they are located, and to certain categories of foreign-produced items that incorporate a defined threshold of US-origin content or technology. A manufacturer in the UAE re-exporting US-origin components must assess whether an export licence is required under the EAR, regardless of whether the UAE's own regime would require one. The Entity List maintained by BIS – which names foreign persons subject to additional licence requirements – is a separate obligation from OFAC's SDN List, and a business that screens against only one may miss a hit on the other.
The intersection of UAE counterparty due diligence with export-control obligations is practically significant for three sectors: financial institutions financing the purchase of controlled goods; freight forwarders and logistics providers transporting them; and manufacturers and distributors of dual-use items with end-users in the Gulf region. In our practice, the due diligence question and the export-control question arise in the same transaction more often than compliance teams structured by functional silo would expect. The ownership-and-control analysis required to clear the sanctions screen feeds directly into the end-user assessment required for the export-control screen. A single, integrated counterparty review is more efficient and more reliable than two parallel exercises that use different evidence standards.
If a transaction has already been flagged by a bank or a clearing institution, or if a shipment has been held at a port under an export-control query, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential assessment.
How is counterparty due diligence enforced under UAE?
Enforcement of counterparty due diligence obligations under the UAE regime is conducted by the CBUAE for financial institutions, and by sector-specific supervisory authorities for DNFBPs and other regulated persons. The EOCN has a coordinating and intelligence function, and works with law-enforcement bodies – including the UAE's Financial Intelligence Unit – where a suspected breach involves a frozen-assets obligation or a proliferation-financing concern.
The UAE's enforcement posture has strengthened materially in recent years. The country completed its mutual evaluation under the Financial Action Task Force (FATF) process and, as of mid-2026, has pursued an active programme of regulatory reform to align its anti-money-laundering and counter-proliferation-financing framework with international benchmarks. That reform programme has included an increase in supervisory inspections, more frequent requests for documentation from regulated entities, and a higher stated willingness to impose penalties for systemic failures in due diligence processes.
Penalties under the UAE regime for failure to comply with counterparty due diligence obligations can include administrative fines, suspension or withdrawal of a licence to operate, and, where the failure is connected to a broader financial-crime matter, criminal referral. The quantum of a penalty and the route to sanction depend on the severity of the failure, the degree of cooperation with the supervisory authority, and whether the entity had a documented, risk-based compliance programme in place at the time of the failure.
Cooperation and voluntary disclosure are weighed positively by UAE supervisory authorities, in a manner broadly analogous to the treatment of VSD (voluntary self-disclosure to a regulator) under OFAC's enforcement framework and OFSI's published enforcement guidance. A business that discovers a gap in its counterparty due diligence programme, and that acts promptly to remediate it and report to the relevant authority, is in a materially better position than one that waits for the examination to surface the gap. The window for that proactive action, however, is not indefinite.
A common misconception: the UAE regime is less strict than Western regimes
One objection we hear regularly from businesses establishing or expanding operations in the UAE is that the regime is, in practice, less demanding than OFAC or OFSI, and that a compliance programme calibrated for the Western regimes will automatically satisfy the UAE standard. This is inaccurate in two respects.
First, the UAE's autonomous designation list includes names not present on the SDN List or the OFSI consolidated list at the same time. A programme calibrated solely against those Western lists will miss UAE-specific designations. Second, the UAE's beneficial-ownership and enhanced-due-diligence requirements have been substantially overhauled as part of the post-FATF-evaluation reform programme, and in some respects – particularly around real-estate and high-value-goods sectors – the documentation standards now expected by UAE supervisors are more prescriptive than a multinational firm's standard global policy would anticipate.
The practical conclusion is not that the UAE regime is harder than OFAC or easier than OFSI. It is that the UAE regime is a distinct legal obligation, with its own authority, its own list, its own enforcement posture, and its own documentation standards. It must be treated as such, not as a derivative of any Western regime.
We have acted for firms that discovered this gap during a supervisory examination rather than during the design of their programme. The difference in remediation cost – and in the supervisory conversation – is significant. Designing the programme correctly before the examination is materially less expensive than correcting it after.
Related practices
- Sanctions compliance audit and testing – stress-testing your screening logic and due diligence documentation against regulatory standards
- Crypto and VASP compliance under BIS/EAR – export-control obligations for virtual-asset businesses handling US-origin technology
- Crypto and VASP compliance under EU rules – EU sanctions and dual-use obligations for virtual-asset service providers
Frequently asked questions on UAE counterparty due diligence
Who administers counterparty due diligence under UAE?
The EOCN is the principal authority for autonomous sanctions designations and UN-derived obligations. The CBUAE supervises financial institutions on anti-money-laundering and counter-proliferation-financing due diligence. DNFBPs and other regulated persons are supervised by sector-specific UAE authorities. All regulated entities must screen against both the UAE Cabinet Decision list and the UN Consolidated List. For firms with USD-clearing exposure, OFAC's rules apply in parallel through US correspondent banks, regardless of the UAE domestic position.
What does UAE prohibit in relation to counterparty due diligence?
The UAE regime prohibits dealing with designated persons, making funds or economic resources available to them, and conducting financial or commercial transactions that would benefit a listed party. It further requires that regulated persons not proceed with a business relationship where the counterparty's identity, beneficial ownership, or the purpose of the relationship cannot be established to the required standard. Where enhanced due diligence is triggered and the concerns cannot be resolved, the obligation is to decline or exit the relationship and, in appropriate cases, to file a suspicious-transaction report.
How is counterparty due diligence enforced under UAE?
Enforcement is conducted by the CBUAE and sector-specific supervisors, with the EOCN coordinating on sanctions-specific matters. Enforcement tools include administrative fines, licence suspension, and criminal referral for the most serious failures. The post-FATF-evaluation reform programme has resulted in a more active supervisory posture, with increased documentation requests and inspections. Cooperation with supervisors and proactive remediation of identified gaps are weighed positively in enforcement decisions, in a manner broadly analogous to the treatment of voluntary disclosure under OFAC and OFSI frameworks.
About the author
Viktor Lindqvist advises exporters and trading houses on dual-use export controls, maritime and trade sanctions, and end-use compliance. Calder & Vance – International Sanctions & Export Control Counsel.
About Calder & Vance
Calder & Vance is an independent international sanctions and export-control boutique. We advise multinationals, financial institutions, exporters, and individuals on the major regimes – OFAC and BIS in the United States, OFSI and ECJU in the United Kingdom, the EU Council regulations and the EU General Court, the United Nations Consolidated List, and the regimes of Switzerland, Canada, Australia, the UAE, Singapore, and Japan. Our work is limited to lawful compliance, licensing, delisting, enforcement defence, and due diligence. To discuss a matter, contact info@caldervance.com.
To discuss your UAE counterparty due diligence programme or a cross-regime screening question, contact Calder & Vance at info@caldervance.com.
Disclaimer: This material is general information, not legal advice, and is not a substitute for advice on your specific facts. Sanctions and export-control rules change frequently and differ by regime; verify the current position before relying on anything stated here. Calder & Vance does not advise on circumventing or evading sanctions. For advice on your situation, contact info@caldervance.com.