Sanctions Compliance for UAE Financial Institutions: A Comprehensive Guide

Compliance Guide · August 2026

The sanctions compliance landscape for UAE financial institutions is among the most complex in the world.

The UAE Domestic Sanctions Framework

The legislative foundation of UAE sanctions compliance is Federal Law No. 7/2014 on Combatting Terrorism Crimes. This law provides the authority for the UAE to designate persons and entities involved in terrorism and terrorism financing, to freeze their assets and to prohibit the making of funds or assets available to them. The law also establishes criminal penalties for violations.

The UAE Targeted Financial Sanctions Resolutions (UITRs), issued under Cabinet authority, implement the specific procedures for designation, asset freezing and de-listing that give effect to Federal Law No. 7/2014. The UITRs establish the processes by which the UAE adds names to its domestic sanctions list, communicates those designations to financial institutions and requires the freezing of designated persons’ assets.

For UAE financial institutions, the practical obligation is clear: screen customers, counterparties and transactions against the UAE domestic sanctions list; freeze assets of any designated person identified; and do not make funds or assets available to designated persons without appropriate authorisation. The consequences of failing to comply with these obligations include regulatory enforcement, financial penalties and potential criminal liability.

UN Security Council Resolutions The Universal Floor

United Nations Security Council Resolutions establish the universal baseline of sanctions obligations for all UN member states, including the UAE. Under Chapter VII of the UN Charter, UNSCRs that impose targeted financial sanctions are binding on all UN member states and must be implemented without the need for domestic legislation to give them effect, though domestic implementation mechanisms (such as the UAE UITRs) are used to operationalise them.

The UN sanctions framework relevant to UAE financial institutions includes the targeted financial sanctions associated with the Islamic State in Iraq and the Levant (ISIL, also known as Daesh) and Al-Qaida sanctions regime, as well as sanctions relating to proliferation financing that flow from UNSCRs addressing North Korea and Iran.

Financial institutions should maintain screening capabilities that cover the UN sanctions lists as a minimum baseline, recognising that the UAE domestic list, OFAC lists and other lists may contain additional names that require separate screening.

OFAC and the Extraterritorial Reach of US Sanctions

The Office of Foreign Assets Control administers the most consequential sanctions framework affecting UAE financial institutions, despite being a US domestic regulatory authority. OFAC’s reach into UAE financial activity operates primarily through the US dollar clearing system, which virtually all UAE banks use for international transactions.

When a UAE bank processes a US dollar transaction, that transaction passes through a US correspondent bank, bringing it within US jurisdiction. OFAC’s sanctions regulations, including the Iranian Transactions and Sanctions Regulations (31 CFR Part 560) and the Iranian Financial Sanctions Regulations (31 CFR Part 561), impose obligations on transactions within US jurisdiction that UAE banks must consider.

The OFAC 50 Percent Rule is of particular practical importance. Under this rule, any entity that is owned 50 percent or more by a sanctioned person is itself treated as sanctioned, regardless of whether it appears on an OFAC list. For UAE financial institutions, this means that screening must extend beyond named parties to include beneficial ownership assessment of counterparties, and that a counterparty that is majority-owned by a sanctioned person must be treated as sanctioned.

OFAC has taken enforcement action against financial institutions globally for sanctions violations, and there have been instances involving Gulf financial institutions and Iranian-related transactions. These enforcement actions serve as reminders that OFAC compliance is not an abstract obligation but a concrete regulatory risk that UAE financial institutions must manage.

EU Restrictive Measures and UAE Exposure

European Union restrictive measures (commonly referred to as sanctions) are primarily implemented within EU jurisdiction, but they have implications for UAE financial institutions through several channels. UAE institutions that maintain correspondent relationships with EU banks may be affected by EU counterparties’ compliance obligations. Additionally, transactions involving EU-designated persons, goods or services may create compliance considerations.

The EU’s restrictive measures related to Russia have generated significant compliance attention globally, with implications for financial institutions worldwide that process transactions involving Russian parties or that maintain relationships with EU counterparties with Russian exposure. UAE financial institutions engaged in trade finance or correspondent banking should monitor EU sanctions developments as part of their horizon-scanning programme.

DNFBP Sanctions Obligations in the UAE

Designated Non-Financial Businesses and Professions in the UAE are subject to sanctions obligations under the UAE’s AML/CFT framework. DNFBPs include precious metals and stones dealers, real estate agents, lawyers, accountants, trust and company service providers, and dealers in high-value goods.

The scope of DNFBP sanctions obligations in the UAE is established by Cabinet Decision No. 10/2019 on Anti-Money Laundering and Combating the Financing of Terrorism, which implements FATF standards across a range of covered entities including DNFBPs. DNFBPs are required to screen customers and transactions against sanctions lists, report suspicious activities and maintain compliance records.

For financial institutions in the UAE, DNFBP compliance is relevant in two ways. First, financial institutions that themselves fall within DNFBP categories (for example, a bank that also operates as a precious metals dealer) must comply with DNFBP obligations. Second, financial institutions that have DNFBP customers should be aware of those customers’ independent sanctions obligations, as a DNFBP customer’s sanctions violation could have reputational and compliance implications for the financial institution.

VARA and Virtual Asset Sanctions

Dubai’s Virtual Assets Regulatory Authority (VARA) is the dedicated regulatory body for virtual asset service providers (VASPs) operating in Dubai and the Dubai Virtual Assets Regulatory Zone (VARA Zone). VARA has issued a comprehensive regulatory framework for virtual asset service providers, which includes AML/CFT obligations that incorporate sanctions compliance requirements.

VASPs licensed by VARA are required to conduct customer due diligence, screen against sanctions lists (including UAE domestic designations, UN sanctions lists and, in practice, OFAC sanctions lists for VASPs processing transactions involving US dollar-denominated assets or US counterparties), maintain transaction records and report suspicious activities.

For financial institutions that engage with VASPs, whether as counterparties, customers or correspondent entities, the VARA regulatory framework creates additional compliance considerations. The intersection between virtual asset transactions and traditional financial institution sanctions obligations is an evolving area that requires careful management.

DIFC and ADGM Special Economic Zone Considerations

Entities operating within the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) are subject to sanctions obligations that derive from both UAE domestic law and the specific regulatory frameworks of each financial free zone.

The DFSA (Dubai Financial Services Authority) and the FSRA (Financial Services Regulatory Authority of Abu Dhabi Global Market) have each issued AML/CFT regulations for entities within their respective jurisdictions, and these regulations incorporate sanctions compliance expectations that align with FATF Recommendation 6 and the UAE domestic framework.

Financial institutions operating in the DIFC or ADGM should ensure that their sanctions compliance programmes satisfy the requirements of both the applicable free zone regulator and the UAE Central Bank, and should understand the relationship between these regulatory frameworks.

Payment Screening and Trade Finance Sanctions

The operational heart of sanctions compliance for a UAE financial institution is the screening of payments and transactions. Payment screening must cover the sender and recipient of each transaction, the beneficiary of any instruction, and any intermediate routing institution, against all applicable sanctions lists.

In the trade finance context, sanctions screening extends beyond the financial transaction to the underlying goods and counterparties. Trade finance transactions involving goods that are subject to export controls, or counterparties in jurisdictions subject to comprehensive sanctions, create specific compliance obligations that go beyond the standard payment screening process.

UAE financial institutions processing letters of credit, guarantees and other trade finance instruments should have screening procedures that address the goods, the issuing and beneficiary banks, and the ultimate parties to the underlying transaction.

Compliance Programme Elements

A sanctions compliance programme for a UAE financial institution should incorporate the following elements, drawn from FATF guidance, OFAC compliance programme expectations and UAE regulatory requirements.

Governance and senior management oversight: The programme should have a clear governance structure, with senior management accountable for sanctions compliance and a designated sanctions compliance officer with appropriate authority and resources.

Written policies and procedures: Policies should cover all applicable sanctions regimes (UAE domestic, UN, OFAC and relevant EU measures), the procedures for screening, the escalation and investigation of potential matches, the handling of blocked and rejected transactions, and the process for de-listing.

Screening systems: The institution should deploy screening capabilities that cover all applicable sanctions lists, that can handle the volume and speed of the institution’s transaction flows, and that provide adequate matching sensitivity while managing false positive rates. The screening system should account for name variations, transliterations and the OFAC 50 Percent Rule.

Transaction monitoring: In addition to list-based screening, the institution should monitor transaction patterns for indicators of sanctions evasion, including structuring, unusual routing and patterns consistent with the use of intermediary entities to obscure sanctions-relevant parties.

Training: Staff who handle payments, correspondent banking, trade finance or customer-facing roles should receive training on sanctions obligations and the red flags of sanctions evasion.

Testing and audit: The sanctions compliance programme should be subject to independent audit on a periodic basis, with testing of screening effectiveness, policy compliance and the adequacy of the programme against current threats.

Reporting and record-keeping: The institution should maintain records of screening decisions, blocked transactions, rejected transactions and potential matches, and should have clear procedures for reporting to the UAE Financial Intelligence Unit where required.

Enforcement and Regulatory Expectations

The UAE’s regulatory authorities have increased their focus on sanctions compliance in recent years, driven partly by the FATF mutual evaluation process and partly by international scrutiny of the UAE’s role in sanctions evasion networks.

Enforcement actions by UAE regulatory authorities, the DFSA and the FSRA have included financial penalties, licence conditions and supervisory requirements for institutions with inadequate sanctions compliance programmes. These actions serve as a signal that sanctions compliance is a regulatory priority and that institutions with deficient programmes can expect regulatory consequences.

UAE financial institutions should treat their last regulatory examination findings on sanctions as a baseline for programme improvement and should engage proactively with their regulators on emerging sanctions compliance issues.