A trading company registered in Dubai closes a supply agreement with a counterparty whose ultimate beneficial owner appears on a foreign sanctions list. The UAE's own screening database shows no match. Can the deal proceed? Who is responsible if the goods are re-exported? These questions are not hypothetical. They arrive on compliance desks every week, and the answers determine whether a business retains its banking relationships, its operating licence, and its freedom from criminal liability.
A sanctions risk assessment (a structured review of a business's exposure to prohibitions administered by one or more regulatory authorities) is the foundation of any defensible compliance programme in the UAE. The UAE operates its own autonomous sanctions regime through the Executive Office for Control and Non-Proliferation (EOCN), alongside mandatory implementation of United Nations Security Council consolidated designations. As of August 2026, UAE-nexus businesses also face extraterritorial reach from OFAC, OFSI, and the EU Council – making a single-regime review insufficient.
This page explains the governing regime, the assessment procedure, cross-border risk flags, common compliance weaknesses, how Calder & Vance assists, and when to involve specialist counsel.
What does the UAE sanctions regime require, and who administers it?
The UAE administers its sanctions obligations through the EOCN, which maintains the UAE Sanctions List, and through Cabinet resolutions implementing UN Security Council measures. Every person and entity subject to UAE jurisdiction – including free-zone entities and foreign branches – must screen counterparties against both lists and must freeze assets of designated persons without delay.
The UAE's legal framework draws on two distinct sources of authority. First, UN Chapter VII resolutions bind the UAE as a member state, and the UAE's implementing legislation makes those designations domestically enforceable. Second, the UAE has its own autonomous designation programme, targeting individuals and entities not covered by UN listings. The EOCN publishes and updates the UAE Sanctions List; compliance teams must treat both tracks as live obligations running in parallel.
Reporting obligations accompany the freeze requirement. A financial institution or designated non-financial business that identifies a match must report to the EOCN within a short statutory window. Failure to report is itself a criminal offence under UAE law, separate from any liability for the underlying transaction. Record-keeping requirements apply to all screened transactions for a defined retention period; verify the current period with local counsel before relying on any specific figure.
The practical challenge is that the UAE Sanctions List and the UN Consolidated List capture a fraction of the total exposure for most cross-border businesses. OFAC's Specially Designated Nationals and Blocked Persons List (the SDN List – OFAC's list of persons whose property is blocked and with whom US persons are prohibited from dealing) reaches into every USD-denominated transaction, wherever it is structured. That reach does not disappear because the transaction is documented in Dubai or governed by UAE law.
How does a sanctions risk assessment work in practice?
A well-structured sanctions risk assessment follows a defined sequence: scope the entity, map the risk vectors, test the controls, identify gaps, and produce a remediation plan. Each stage generates documentation that can be placed before a regulator or a counterparty bank as evidence of good-faith compliance.
The scoping phase identifies which regulatory regimes apply to the business. For a UAE-incorporated trading house with USD clearing, OFAC jurisdiction is immediate. For a business exporting items with a US-origin content of 25 percent or more by value, BIS de minimis rules under the Export Administration Regulations (the EAR) may engage US export controls even when the exporter is not a US person. For a business with EU shareholders, EU Council regulations may apply to those shareholders' conduct even if the entity itself is outside EU jurisdiction.
Risk-vector mapping covers five categories: counterparty risk (who the business sells to, sources from, and transacts with); product risk (whether the goods are controlled, dual-use, or subject to end-use restrictions); geographic risk (the jurisdictions in the transaction chain); ownership and control risk (whether any counterparty is owned or controlled by a listed person); and transactional risk (payment routes, intermediary banks, and shipping patterns). We regularly advise businesses that discover their highest risk lies not in the end-buyer but in the freight forwarder or the correspondent bank clearing the payment.
Controls testing examines the screening tool (its list coverage, update frequency, and alert-disposition workflow), the ownership and control test (the process for determining whether a non-listed entity is caught through a listed beneficial owner), escalation procedures, and training records. A gap analysis maps each weakness to its regulatory consequence and to a remediation action with a defined owner and timeline.
The output is a written assessment report. For bofu clients – businesses that have received a bank de-risking notice, a regulator query, or a failed payment referencing sanctions – the report serves a second purpose: it documents the steps taken before and after the trigger event, which is material to any subsequent enforcement review.
The position above covers the standard case. Your facts – the counterparty structure, the goods, the clearing currency, and the regimes in play – change the analysis materially. For a confidential scoping call, contact Calder & Vance at info@caldervance.com.
How does the UAE ownership-and-control test compare with OFAC's 50 percent rule?
The UAE, OFSI, and the EU apply an ownership and control test that can capture an unlisted entity through a listed person's influence, even where the listed person holds less than a majority stake. This is structurally different from OFAC's mechanical threshold.
Under OFAC's 50 percent rule, an entity owned 50 percent or more in the aggregate by blocked persons is itself treated as blocked, regardless of whether it appears on the SDN List. The test is binary: reach the threshold and the entity is blocked. Fall below it and the ownership analysis ends – though a separate OFAC guidance note addresses control, it does not operate as a standalone prohibition in the same way.
Under the UAE regime, and under the UK and EU regimes that many UAE-nexus businesses must simultaneously satisfy, the question is broader. Control can arise through rights, arrangements, or practical influence that fall short of majority ownership. A listed person who holds 35 percent of an entity but who appoints the majority of the board, or who has a contractual veto over significant decisions, may bring that entity within the scope of the prohibition under the control limb of the test. In our practice, we see this divergence produce genuinely different answers on the same fact pattern: OFAC-clean but OFSI-caught, or vice versa.
For UAE-nexus businesses, the implication is direct. A counterparty that clears an OFAC ownership screen may still require a separate UK or EU control analysis if the transaction touches a bank, an investor, or a shareholder subject to those regimes. A sanctions risk assessment that applies only one regime's test to the ownership structure leaves the business exposed on the others.
Where does your counterparty's ownership chain end? If the answer is "we checked the UAE list and saw no match", the assessment is incomplete for most cross-border transactions.
What are the extraterritorial dimensions businesses in the UAE must address?
Extraterritorial reach is the single most misunderstood dimension of UAE-nexus sanctions risk. The UAE's own regime applies to UAE-jurisdiction persons and assets. But at least three foreign regimes can reach the same transaction independently, without any US, UK, or EU territorial nexus beyond a currency, a component, or a shareholder.
OFAC exercises jurisdiction over any transaction cleared in US dollars, over any entity in which a US person holds an interest, and over the export or re-export of US-origin goods or technology. A UAE trading company clearing through a New York correspondent bank is transacting within OFAC's reach on that payment alone. Secondary-sanctions risk – the risk that OFAC designates a non-US entity for providing material support to a primary target – adds a further layer that does not depend on any US nexus in the underlying transaction.
OFSI's reach extends to UK persons, UK-incorporated entities, and conduct partly performed in the UK. EU Council regulations extend to EU persons and entities, wherever incorporated, and to conduct within EU territory. For many UAE-based multinationals, one or more shareholders, directors, or financing banks will bring at least one of these regimes into scope.
BIS export controls under the EAR apply whenever items on the US Commerce Control List (the CCL) are involved, wherever the exporter is located, if the items contain more than a de minimis level of US-controlled content or were produced using US technology. A UAE re-exporter of technology goods that incorporates US components cannot escape EAR jurisdiction simply because neither the buyer nor the seller is a US person.
In our cross-border practice, we regularly advise UAE-nexus clients who discover mid-transaction that their bank has a US parent, their goods contain a US-origin microcontroller, or their investor is an EU national. Each of these facts triggers an independent jurisdictional analysis. A sanctions risk assessment that maps only UAE-list exposure addresses perhaps 30 percent of the real risk picture for a typical international trading company.
If a transaction has already been flagged by a bank or a payment has been returned referencing sanctions, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential initial review.
What are the most common risk flags in UAE sanctions compliance?
Practical experience across UAE-nexus matters identifies a consistent set of failure points. Each represents a gap between what a business believes its controls cover and what a regulator or a bank counterparty will actually test.
The first, and most frequent, is incomplete list coverage. A screening tool configured against only the UAE Sanctions List and the UN Consolidated List misses OFAC's SDN List, HM Treasury's consolidated list, the EU Consolidated Financial Sanctions List, and the BIS Entity List. Each carries distinct legal consequences. A business that fails to screen against OFAC's list cannot rely on UAE-only compliance as a defence in a US enforcement action.
The second is a static screening cadence. Lists change, sometimes multiple times in a week during periods of elevated designation activity. A business that screens at onboarding but not thereafter may hold open relationships with persons designated after the initial check. Periodic rescreening – and immediate rescreening on major list updates – is an operational requirement, not an optional enhancement.
Third is the beneficial ownership gap. Many UAE businesses screen the named counterparty but do not look through to the ultimate beneficial owner. The 50 percent rule under OFAC and equivalent tests under the UAE, OFSI, and EU regimes mean that an unlisted entity owned by a listed person is itself prohibited. Screening only the front-line counterparty and not its ownership chain is the pattern that produces the largest enforcement penalties.
Fourth is an absence of documented escalation. When a screening alert fires, the business must record what it did, why, and by whom. A compliance programme that produces alerts but no documentation trail of their resolution cannot demonstrate good-faith compliance. In an enforcement review, undocumented alerts are treated as potential concealment.
Fifth is the goods-classification gap in export-control-adjacent businesses. A UAE-based re-exporter of technology, defence, or dual-use items who has not classified its products against the US CCL and the EU dual-use list may be engaging in unlicensed exports of controlled items without knowing it. This is a separate legal risk from sanctions but is assessed as part of a comprehensive risk review.
What does an AUDIENCE_MYTH often get wrong about UAE sanctions compliance?
The most persistent misconception we encounter is that FATF compliance and sanctions compliance are the same thing, and that a clean FATF-aligned anti-money-laundering programme is sufficient to satisfy a bank's sanctions queries or a regulator's review.
They are not the same. AML controls address source-of-funds risk, transaction monitoring for suspicious patterns, and customer due diligence to a defined standard. Sanctions controls address whether the specific counterparty, transaction, or item is prohibited by a specific regime – regardless of whether any money-laundering risk is present. A clean-money transaction with a designated person violates sanctions rules. A suspicious-pattern transaction with a non-listed party may trigger AML obligations but no sanctions prohibition.
In practice, a business can pass an AML audit and fail a sanctions review on the same set of facts. The two control systems use different lists, different legal tests, and different regulatory authorities. A bank that asks for evidence of sanctions controls will not accept an AML audit report as a substitute. In our experience, businesses that conflate the two tend to discover the gap at the worst possible moment – when their correspondent bank applies a de-risking notice (a financial institution's decision to exit a relationship to avoid sanctions exposure) or when a transaction is blocked mid-settlement.
The UAE Central Bank has issued guidance that explicitly separates the AML and sanctions control obligations for financial institutions. Non-financial businesses operating in the UAE's free zones are subject to equivalent sectoral guidance from the relevant free-zone authority. Neither programme satisfies the other.
How does Calder & Vance assist with sanctions risk assessment in the UAE?
Our work on UAE-nexus sanctions risk assessment is structured around four deliverables: a jurisdictional scope analysis, a risk-vector map, a controls-gap report, and a prioritised remediation plan. The scope of each engagement is agreed at the outset, with a fixed-fee entry point for the initial assessment phase.
On jurisdictional scope, we identify which regimes apply to the specific entity, its ownership structure, its goods or services, and its transaction routes. This typically covers the UAE regime, UN obligations, OFAC, OFSI, and EU Council regulations as the primary layer, with BIS export-control analysis where goods classification is in scope.
On risk-vector mapping, we test the screening tool's list coverage and alert-disposition workflow, map the beneficial ownership chain for material counterparties, and identify product classification gaps. We use the five-category framework (counterparty, product, geographic, ownership/control, and transactional risk) as the analytical structure.
On controls testing, we stress-test the screening logic, map ownership and control for the highest-risk relationships, and assess the escalation and record-keeping procedures against the applicable standard. Where a business is responding to a bank query or a regulator enquiry, we structure the assessment output to address the specific points raised.
On remediation, we design the programme adjustments to the five-element standard used by US, UK, and EU regulators: written policies, risk-based procedures, training, testing, and senior management accountability. Where local counsel in the UAE is required for implementation, we work alongside them on the substantive analysis.
In a recent matter, a technology-distribution business operating from a UAE free zone received a payment rejection from its correspondent bank citing OFAC concerns. We scoped the apparent exposure, identified that the underlying issue was a beneficial-ownership link that had not been captured by the business's initial screening, and assisted in preparing a compliance-remediation package addressed to the bank's sanctions team. The matter was resolved without a formal enforcement referral. No outcome is guaranteed in similar engagements.
Related practices
- Compliance audit and testing – systematic review of sanctions programme effectiveness across regimes
- Trade finance sanctions controls – managing sanctions exposure in documentary credit and supply-chain finance
- Trade finance controls under BIS / EAR – export-control compliance for trade-finance transactions involving US-origin goods