A bank or exchange house in the UAE can be exposed to several sanctions regimes at once. UAE law implements the United Nations sanctions. A payment in US dollars, a correspondent relationship or a US person on staff can bring US sanctions into play. A branch, subsidiary or customer in Europe or the UK can do the same for EU and UK measures. Each regime decides for itself who is targeted, what counts as ownership or control, and what must be reported, and each can change overnight.
Sanctions screening is often treated as a technology problem. It is better understood as a legal and judgment problem that technology helps to solve. The institutions that manage it well are clear about which rules apply to them, understand where those rules differ, and have the people and procedures to act quickly when a match appears.
The UAE baseline
The foundation is FATF Recommendation 6, which requires countries to implement UN Security Council targeted financial sanctions and to "freeze without delay the funds or other assets" of designated persons. In the UAE this is given effect through Cabinet Decision No. 74 of 2020, which covers the UN Consolidated List and the UAE Local Terrorist List.
The obligations are specific. As the FSRA reminded firms in its 2025 notice, relevant persons must "Freeze without delay (within 24 hours) the funds owned or controlled, directly or indirectly" by designated persons, and report through goAML within five business days, filing a Fund Freeze Report for a confirmed match or a Partial Name Match Report where a match cannot be ruled out. Firms must also subscribe to the notification system of the Executive Office for Control and Non-Proliferation so they receive list changes as they happen. Freezing must take place without prior notice to the customer, as Crowe notes.
For licensed financial institutions, the CBUAE's Guidance on Transaction Monitoring and Sanctions Screening sets out how screening should work. Lists "must include, at a minimum, all names on the UN Consolidated List and the Local Terrorist List", and institutions "may also include other jurisdictional lists". Customers must be screened before onboarding and at least daily afterwards, payments should be screened before they are completed, and institutions operating in several jurisdictions should decide which lists apply in each. The guidance also expects pre-implementation testing of screening systems, periodic testing, and independent validation by people with sufficient expertise.
Why other regimes matter
The legal minimum in the UAE is the UN and Local lists. In practice most institutions must look much further, because their exposure to other regimes comes through their business rather than through UAE law.
The US is the clearest example. OFAC's Framework for OFAC Compliance Commitments lists among the root causes of past violations the routing of payments through the US financial system and non-US persons facilitating prohibited transactions. The joint guidance published by OFAC and the UK's OFSI in June 2026 describes US sanctions as having "explicit extraterritorial reach", including secondary sanctions on non-US persons, according to DLA Piper. UK sanctions, by contrast, rest mainly on territory and nationality, applying to UK persons wherever they are and to others with a UK nexus.
For a Gulf institution, that means a US dollar payment, a correspondent bank, or a group entity in London or Frankfurt can bring a foreign regime directly into its operations. Correspondent banks will also expect their respondents to manage these risks, whatever the legal minimum at home.
Where the regimes differ
Ownership and control. This is where many errors begin. OFAC treats an entity as blocked if it is owned 50 percent or more by one or more blocked persons in aggregate. The UK applies a "more than 50 percent" threshold, generally does not aggregate the holdings of different designated persons, and has a separate test of control. The EU, in Best Practices updated in July 2024, refers to ownership of "50% or more", aggregates the holdings of designated persons, and treats "the power to exercise a dominant influence" as control, including de facto control through front persons, trusts or shell companies. The UAE obligation, meanwhile, applies to funds owned or controlled, directly or indirectly, by designated persons. The same corporate structure can therefore be caught by one regime and not by another.
Scope. A single event can produce very different obligations. When UN sanctions on Iran were reimposed through the snapback mechanism on 27 September 2025, the EU and UK followed on 29 September. According to Squire Patton Boggs, the UN regime "does not itself impose a general embargo on Iranian crude oil, gas or petrochemicals", while the EU measures go well beyond it, covering oil, gas, petrochemicals and related financing and insurance, and freezing the assets of Iran's central bank and major commercial banks. The UK added 71 entries to its lists. The EU and UK also set different wind down and licensing periods.
Lists and data. The lists themselves change format. Since 28 January 2026 the UK Sanctions List has been the only source of UK designations, the OFSI Consolidated List is no longer updated, and the OFSI Group ID is no longer issued for new designations. Any screening system still relying on the old list or identifier is screening against out of date data.
Liability and enforcement. Both the US and the UK now apply strict liability for civil sanctions breaches, the UK for breaches after 15 June 2022. In the US, the limitation period for sanctions violations was extended from five to ten years in April 2024, and OFAC's record keeping requirement was extended to ten years by a final rule in March 2025. UK sanctions law has no limitation period. In the EU, Directive (EU) 2024/1226 requires member states to criminalize intentional sanctions violations, with a transposition deadline of 20 May 2025.
Reporting. In the UAE, freezes and partial matches are reported to the Executive Office through goAML within five business days. US persons must report rejected transactions to OFAC. OFSI has no equivalent requirement for rejected transactions. An institution operating across these regimes needs a clear map of what is reported, to whom and by when.
As DLA Piper summarizes the OFAC and OFSI guidance, sanctions alignment between regimes does not mean legal equivalence. Compliance with one regime does not satisfy another.
Managing the complexity
In our view, eight practices allow an institution to manage multiple regimes without being overwhelmed.
- Decide which regimes apply, and why. Distinguish between regimes the institution is legally bound by, regimes it applies because of its business exposure, and regimes it applies as a matter of risk appetite. Document the decision for each legal entity and jurisdiction, as the CBUAE guidance expects, and have it approved by senior management.
- Assess sanctions risk on its own terms. A sanctions risk assessment should consider customers, products, geographies, currencies, counterparties and trade flows. It is the second of the five components in the OFAC Framework, alongside management commitment, internal controls, testing and auditing, and training.
- Control list management. Updates to the UN and Local lists should flow into screening systems automatically and immediately, as the CBUAE requires. Other lists should be updated on a defined timetable, and changes in list formats, such as the UK's move to a single list, should be managed as system changes with testing.
- Calibrate screening to the risk. The CBUAE expects the treatment of name variations and misspellings to reflect the level of sanctions risk. OFAC has identified failure to screen for alternate spellings as a root cause of violations. Names transliterated from Arabic, Persian, Russian and other scripts need particular care. Matching thresholds should be tested with realistic data, including known variations of listed names, before deployment and periodically afterwards.
- Look beyond names. Screening a customer's name is not enough. Ownership and control must be assessed against the test each regime applies, and trade and payment screening should cover counterparties, banks, vessels, ports and goods where relevant.
- Prepare for the match. Procedures should state who reviews an alert, who decides to freeze, how the 24 hour UAE deadline is met, what is reported under each regime, and how tipping off is avoided. These procedures should be rehearsed, not written and filed.
- Keep records for the long term. With ten year limitation and record keeping periods in the US and no limitation period in the UK, the reasons for discounting an alert may need to be explained many years later.
- Watch the horizon. Sanctions change with events. The Iran snapback showed how quickly obligations can shift across several regimes at once. A small team responsible for monitoring developments and translating them into screening and policy changes is worth its cost.
Questions for senior management
- Have we documented which sanctions regimes apply to each part of our business, and why?
- Do our ownership and control assessments reflect the different tests used by the UAE, the US, the EU and the UK?
- Are our screening systems using current list sources and identifiers?
- When were our matching thresholds last tested with realistic name variations?
- Could we freeze and report a confirmed UAE match within the required timeframes, at any time of day?
Sanctions are one of the few areas of financial crime compliance where an institution can be in breach without any intent, and where the consequences can follow years later. Multiple regimes add to the difficulty, but they do not make it unmanageable. An institution that knows which rules apply, understands where they differ and has tested its screening and response will be in a strong position with its supervisors and its correspondent banks. Kompass advises institutions on sanctions program design, screening effectiveness testing and sanctions training.