A trading company based in Dubai closes a distribution agreement with a regional counterparty. Its legal team runs a quick name-check through a commercial screening database. Nothing flags. Three months later, the company's European parent receives a notice: the counterparty is connected to a designated entity through a two-layer ownership chain that the initial search did not surface. The commercial relationship is frozen. The parent's correspondent banks begin asking questions. The deal that looked clean was not.
Counterparty due diligence under the UAE regime requires a structured review of the ownership chain, sanctions-list exposure across multiple authorities, and a documented risk assessment before any transaction closes. The UAE's autonomous sanctions regime – administered through the Executive Office for Control and Non-Proliferation (EOCN) and the UAE Cabinet resolution framework – operates alongside the obligations imposed by the UN Security Council Consolidated List and, in cross-border transactions, the extraterritorial reach of OFAC and the EU Council regulations. As of August 2026, the UAE has materially strengthened its autonomous-sanctions infrastructure and its beneficial ownership (the natural person or persons who ultimately own or control a legal entity) registration requirements, raising the bar for what adequate diligence looks like.
This page sets out the governing regime, the diligence procedure and ownership test, the cross-border complications that most firms underestimate, the risk flags that indicate specialist review is needed, and how Calder & Vance assists clients conducting this work.
What governs counterparty due diligence under the UAE regime?
The UAE's autonomous sanctions regime (the state's own designations programme, separate from and in addition to UN-mandated measures) is grounded in Cabinet resolutions that establish a local consolidated list administered by the EOCN. That list sits alongside the UAE's implementation of UN Security Council resolutions, which is mandatory for all businesses operating in the jurisdiction under the relevant federal instruments. Any counterparty due diligence exercise in a UAE-nexus transaction must therefore check both sources – the UN Consolidated List and the UAE local list – as a minimum.
The UAE Central Bank and the Financial Intelligence Unit have issued guidance on customer due diligence (CDD) and enhanced due diligence (EDD) standards that apply to regulated financial institutions. The Financial Action Task Force (FATF) mutual evaluation process has directly shaped the UAE's legislative programme in recent years. For non-financial businesses and professions, the relevant supervisory authority depends on the trade licence category and the free zone or onshore registration. In practice, the applicable obligations differ between mainland entities regulated by the Central Bank, entities in financial free zones such as the DIFC and ADGM (which operate their own regulatory regimes), and entities in non-financial free zones.
Understanding which authority governs your counterparty – and which list-checks it is required to perform – is the first analytical step. The position above covers the standard case. Your facts – the counterparty's registration, its sector, its ownership chain, and the routes of payment or goods – change the analysis.
For an initial assessment of your UAE diligence exposure, contact Calder & Vance at info@caldervance.com.
How does the ownership and control test work, and how does it compare with OFAC and EU rules?
Under the UAE regime, an entity connected to a designated person through ownership or control may itself be treated as subject to the relevant prohibition. The precise test for ownership and control capture differs from the purely mechanical US rule and has more in common with the EU and UK approach, where the analysis turns on actual influence and not only on a numeric threshold.
Under OFAC's rules, the position is mechanical: any entity that blocked persons own 50 percent or more in the aggregate – directly or through intermediate companies – is itself treated as blocked, regardless of whether it appears on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons). That threshold applies whether one listed person holds the entire stake or multiple listed persons aggregate to reach it. In our cross-border practice, we regularly advise clients who have relied on a single-layer name-check and missed a second-tier aggregation problem entirely.
The EU ownership-and-control test under the relevant Council regulations asks whether a designated person owns or controls the entity. Control can be established through means other than a majority shareholding – for example, through a right to appoint the majority of directors, through contractual dominance, or through a pattern of actual management influence. The UK OFSI approach to ownership and control (the test for whether a non-listed entity is caught through a listed person) is aligned with the EU in its attention to control, and differs from OFAC in that a sub-50 percent stake coupled with evident control can bring an entity within scope.
The UAE framework, in line with its FATF-aligned beneficial-ownership standards, requires analysis of both ownership and control. Firms conducting diligence on a UAE counterparty for a transaction that also has a US, EU, or UK nexus must therefore run three parallel analyses and apply the strictest result. Where the regimes diverge, the stricter prohibition governs the cross-border position. That divergence is where most diligence errors occur.
What does a sound counterparty due diligence procedure look like in practice?
A structured UAE counterparty due diligence exercise follows a defined sequence. Each stage produces documentation that can be produced to a regulator, a correspondent bank, or an enforcement authority if the relationship is later questioned.
- Identify the counterparty fully. Establish the legal name, all trading names, the registration number and jurisdiction, and the registered address. Confirm the relevant supervisory authority.
- Map the ownership chain to the ultimate beneficial owner. Work through all intermediate holding structures to identify the natural persons who ultimately own or control the entity. The UAE beneficial-ownership register requirements apply to most onshore entities; free-zone requirements vary. Collect documentary evidence of each layer.
- Screen against all applicable lists. Run the entity, each intermediate company, and each beneficial owner against the UN Consolidated List, the UAE local list, OFAC's SDN and other relevant lists, the EU Consolidated List, and the UK sanctions list. Where the transaction involves other regime jurisdictions – Switzerland, Singapore, or Canada, for example – add those lists.
- Apply the ownership and control tests for each regime. Do not stop at a clean name-match. For each regime in play, apply the relevant aggregation and control analysis to the ownership chain you have mapped.
- Assess secondary-sanctions risk. For transactions with any US-dollar clearing, US-person involvement, or US-origin goods, apply OFAC's secondary-sanctions analysis separately.
- Document the assessment and apply a risk rating. A documented, reasoned assessment is your primary evidence of good-faith compliance. Record the date of each search, the version of each list consulted, the methodology used, and the conclusion reached.
- Establish ongoing monitoring. A clean result at onboarding does not remain clean indefinitely. Designations are issued without advance notice. A periodic re-screen interval, triggered by defined events (a change in ownership, a new sanctions designation in the relevant sector, or a material change in the transaction structure), should be built into the counterparty management process.
In a recent matter, a regional trading group with operations across the Gulf was expanding its supplier base and needed to conduct systematic diligence on a tranche of new counterparties, several of which held layered structures across multiple jurisdictions. We screened the ownership chain, mapped beneficial ownership against five regimes simultaneously, and identified a control-based connection that the client's existing screening tool had not surfaced. The matter proceeded on a modified structure following a documented risk assessment. No outcome of that kind is guaranteed; the structure of each transaction determines what is achievable.
What are the cross-border and secondary-sanctions complications that UAE diligence frequently raises?
The UAE occupies a specific position in the global sanctions environment: it is a major trade and financial hub with its own autonomous-sanctions regime, a strong FATF-aligned compliance infrastructure, and significant commercial flows with jurisdictions that are themselves subject to major autonomous sanctions programmes. That combination creates a cross-border diligence challenge that is more layered than most single-jurisdiction markets.
Secondary-sanctions risk is the most immediate complication for non-US businesses. OFAC's secondary-sanctions programmes do not require a US nexus in the underlying transaction to create risk for a non-US person. A non-US company that materially supports a designated person can itself face designation, debarment from the US financial system, or correspondent-banking consequences. We regularly advise clients that a UAE counterparty that is not itself on any list can still create secondary-sanctions exposure if its own business flows connect it to designated entities or programmes. The question is not only who the counterparty is, but who the counterparty does business with.
The EU Blocking Regulation (the EU instrument designed to counter the extraterritorial effect of certain US sanctions measures) may also be relevant for EU-based parties to a UAE transaction. Where an EU entity is party to a deal that a US measure would prohibit, the Blocking Regulation creates a competing legal obligation. That conflict requires legal analysis before the decision is made, not after. Similarly, a UK business must consider whether the transaction falls within the territorial scope of UK autonomous-sanctions regulations, which apply to conduct by UK persons and UK-incorporated entities wherever the activity takes place.
For businesses operating through UAE free zones, particularly those in the DIFC and ADGM which apply their own financial-crime and sanctions-compliance rules modelled on international standards, the applicable obligations layer further. A DIFC-regulated entity will have obligations under DFSA rules that go beyond what is required of an unregulated onshore entity. Diligence procedures designed for one type of UAE entity will not automatically transfer.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com.
What are the principal risk flags that indicate enhanced review or specialist counsel is required?
Not every counterparty requires the same depth of review. A risk-calibrated approach applies enhanced diligence where the indicators justify it and documents the rationale for each decision. In our experience, the following indicators consistently signal that a standard name-check is insufficient and that structured legal analysis is required before the transaction proceeds.
- Opaque or layered ownership structures. Where a counterparty's ownership cannot be traced to an identifiable natural person within two layers of documentation, or where intermediate companies are registered in jurisdictions with limited public registers, the ownership-and-control analysis cannot be completed without additional investigation.
- Counterparty operating in a sector subject to heightened scrutiny. Financial services, oil and gas trading, arms and dual-use goods, and precious metals and stones are among the sectors where regulators apply the most intensive review and where designated-entity exposure is historically concentrated.
- Payments routed through third-party intermediaries. Where the entity instructing payment or receiving proceeds is not the entity named in the commercial contract, the diligence must cover the payment intermediary as well. This structure is one of the most common indicators of indirect sanctions exposure.
- Counterparty connections to jurisdictions subject to major autonomous-sanctions programmes. Where a counterparty's commercial relationships – suppliers, customers, or financiers – connect it to entities in those jurisdictions, secondary-sanctions risk and re-export-control risk both arise.
- A recent change in ownership or management. A new beneficial owner or a change in senior management shortly before a transaction closes warrants investigation of the reason for the change and a fresh ownership-and-control analysis.
- Adverse screening results in prior diligence. Where a counterparty has previously generated a screening alert that was resolved through a documented false-positive analysis, the basis for that resolution should be reviewed before relying on it for a new transaction.
- Correspondent-bank queries. If a bank has raised questions about a counterparty or has declined to process a payment, that is a strong indicator that the diligence on file does not satisfy the bank's own sanctions-compliance standards.
What should a business do when it encounters one of these flags? The answer depends on the nature of the flag, the regime in play, and whether the transaction has already been executed. At a minimum, the diligence file should be updated before any further payment or delivery is made, and specialist review sought before the position is treated as resolved.
A common misconception: "our counterparty is not on any list, so we are clear"
The assumption that a clean screening result against the main public lists resolves the sanctions question is the single most frequently encountered compliance myth in UAE cross-border transactions. It is incorrect, and acting on it has caused otherwise compliant businesses to incur significant regulatory exposure.
The reasons are structural. First, as the ownership-and-control analysis above shows, an entity that is not on any list may still be blocked or prohibited by operation of the 50 percent rule or the control test of the applicable regime. Second, secondary-sanctions risk does not require the counterparty to appear on a list; it requires that the counterparty materially supports a designated person or programme. Third, export-control rules – particularly the EAR and its Entity List (BIS's list of parties subject to specific licence requirements) – restrict dealings with parties on controls-specific lists that are separate from OFAC's sanctions lists. A business that has screened only against OFAC and the UAE list and not against BIS's Entity List, the Denied Persons List, or the Unverified List may be exposed to EAR violations that its sanctions-only screening did not catch.
Fourth, the applicable list may have changed since the last check was run. Designations and de-listings occur at short notice. A counterparty that was clean at onboarding may have been designated before the current transaction closed. In our experience, the gap between onboarding diligence and transaction-level re-screening is one of the most common sources of inadvertent exposure in active trading relationships.
We regularly advise compliance teams that are restructuring their diligence procedures after discovering that a long-standing counterparty relationship pre-dates the current sanctions environment and has never been systematically re-screened against the full applicable list universe.
How Calder & Vance assists with counterparty due diligence UAE legal support
Our cross-border sanctions practice provides counterparty due diligence UAE legal support across the full diligence lifecycle: from initial counterparty identification and ownership mapping through to documented risk assessments and ongoing monitoring design. We work with businesses for whom a clean compliance record is a commercial necessity and for whom the reputational and financial consequences of an inadvertent violation are not acceptable.
The specific actions we take for clients conducting UAE counterparty diligence include the following.
- We screen the counterparty and ownership chain against all applicable lists, applying the ownership-and-control test of each regime in play.
- We surface secondary-sanctions risk by assessing the counterparty's commercial connections, not only its list status.
- We structure the transaction and the diligence documentation to withstand regulatory scrutiny if the relationship is subsequently questioned.
- Where the diligence produces an adverse result, we advise on the available options: restructuring the transaction, applying for a licence, engaging with the relevant authority, or declining the relationship.
- Where existing diligence procedures require redesign, we test the screening logic, map ownership and control across the counterparty portfolio, and redesign the programme to an effective compliance standard.
- We advise on the interaction between UAE obligations, OFAC secondary-sanctions risk, EU and UK regime obligations, and BIS export-control requirements in the same transaction.
Our team advises clients across multiple sectors including trading, manufacturing, financial services, and logistics, all of which face distinct UAE diligence challenges. We do not offer a templated product; every engagement is calibrated to the specific counterparty, transaction, and applicable regimes.
Related practices
- Compliance audit and testing – Australia – structured testing of sanctions compliance programmes against the Australian autonomous-sanctions regime.
- Crypto and VASP compliance – BIS/EAR – export-control compliance for virtual-asset businesses subject to US Commerce Department jurisdiction.
- Crypto and VASP compliance – EU – EU sanctions and compliance programme design for virtual-asset service providers.