Sanctions and Export Control Compliance for Gulf Financial Institutions

Sanctions Compliance · August 2026

No area of financial crime compliance illustrates the complexity of operating in the Gulf better than sanctions and export control.

UN Security Council Sanctions The Foundation

United Nations Security Council Resolutions (UNSCRs) represent the most universally applicable sanctions framework for Gulf institutions. All six GCC states are members of the United Nations and are therefore bound by UNSCR sanctions decisions, including targeted financial sanctions (asset freezing and restrictions on making funds available to designated persons), arms embargoes, travel bans and commodity restrictions.

UNSCRs are adopted under Chapter VII of the UN Charter, making them binding on all UN member states. National implementation varies by jurisdiction, but the obligation to implement UNSCR-designated targeted financial sanctions flows directly from a state’s UN membership.

For financial institutions, the practical implication is straightforward in principle: they must not process transactions for, or make funds available to, individuals or entities designated by a relevant UNSCR, and they must freeze assets belonging to such persons. In practice, the challenge lies in maintaining accurate, timely lists of designations and implementing screening procedures capable of identifying designated persons across customer databases, transaction flows and counterparty records.

The UN Security Council maintains the ISIL (Daesh) and Al-Qaida Sanctions List, and the relevant UNSCRs set out the procedures for designations and de-listing. Financial institutions that become aware of potential matches against UN sanctions lists have obligations to report to their national competent authority.

UAE Independent Sanctions Regime The UITRs

The UAE has developed an independent national sanctions framework, distinct from UNSCR obligations, under a series of Cabinet Decisions and Federal Decrees collectively referred to as the UAE Targeted Financial Sanctions Resolutions (UITRs). This framework allows the UAE to designate persons and entities under UAE domestic law independently of UNSCR designations.

Federal Law No. 7/2014 on Combatting Terrorism Crimes provides the legislative foundation for UAE counter-terrorism sanctions, including the authority to designate persons and entities and to impose asset freezing obligations. The UITRs implement the targeted financial sanctions requirements under this framework.

For financial institutions licensed by the UAE Central Bank or operating in UAE free zones, compliance with the UITRs is a regulatory obligation. The scope of UAE designations may differ from UN or OFAC lists, meaning that a name that clears a UN sanctions screen may still appear on a UAE-specific list that requires separate action.

The UAE Central Bank has published guidance on sanctions compliance for licensed financial institutions, requiring them to maintain adequate systems and controls for sanctions screening, including screening against UAE-specific designation lists.

US OFAC Sanctions and GCC Exposure

The United States Office of Foreign Assets Control (OFAC) administers one of the most comprehensive and consequential sanctions regimes in the world. OFAC sanctions apply to US persons (individuals and entities subject to US jurisdiction), transactions within US jurisdiction (including US dollar transactions that pass through US correspondent banks), and, in certain circumstances, foreign entities that engage in transactions that cause US sanctions violations.

For Gulf financial institutions, OFAC’s reach operates primarily through the US dollar clearing system. When a Gulf bank processes a US dollar transaction, that transaction passes through a US correspondent bank, bringing it within US jurisdiction. OFAC’s Iranian Transactions and Sanctions Regulations (31 CFR Part 560) and Iranian Financial Sanctions Regulations (31 CFR Part 561) are of particular relevance to Gulf institutions given the geographic proximity and trade relationships between the Gulf and Iran.

OFAC’s 50 Percent Rule is a critical compliance concept for Gulf institutions. Under this rule, entities that are owned 50 percent or more by a sanctioned person are themselves treated as sanctioned persons, regardless of whether they appear on an OFAC list. This means that a Gulf institution dealing with a counterparty that is majority-owned by a sanctioned individual or entity must treat that counterparty as sanctioned and cannot process transactions for it.

The practical implications of the 50 Percent Rule for Gulf institutions include the need to understand the beneficial ownership of counterparties beyond the immediate counterparty, to screen for OFAC sanctions across their entire counterparty base, and to design transaction screening procedures that account for the possibility that a seemingly unrelated entity may be majority-owned by a sanctioned person.

OFAC has taken enforcement action against financial institutions worldwide for sanctions violations, including cases involving Gulf institutions and transactions involving Iran. Gulf financial institutions that process US dollar transactions should treat OFAC compliance as a regulatory priority.

EU Sanctions and GCC Exposure

The European Union imposes restrictive measures (commonly referred to as EU sanctions) under the EU’s Common Foreign and Security Policy framework. EU sanctions are binding on EU member states and entities operating within EU jurisdiction, but their extraterritorial reach is more limited than that of OFAC.

However, EU sanctions are of increasing relevance to Gulf financial institutions in several contexts. Where a Gulf institution processes a transaction involving an EU counterparty, the EU counterparty’s own compliance obligations may create ripple effects that affect the Gulf institution’s correspondent banking relationships. Additionally, EU sanctions on Russia and Russian entities have generated significant compliance attention, with implications for Gulf institutions engaged in trade finance or correspondent relationships with EU banks that have Russian exposure.

Gulf institutions should monitor EU sanctions developments as part of their sanctions horizon-scanning programme, particularly in the context of evolving EU restrictive measures on Russia, Iran and other jurisdictions of Gulf relevance.

FATF Recommendation 6 Targeted Financial Sanctions

FATF Recommendation 6 establishes the international standard for targeted financial sanctions related to terrorism and proliferation financing. It requires countries to implement targeted financial sanctions to freeze the assets of designated persons and to prevent them from making funds or assets available to designated persons.

For GCC states, FATF Recommendation 6 is the international standard that informs the design of their domestic targeted financial sanctions frameworks, including the UAE’s UITRs. The FATF has published guidance on the implementation of targeted financial sanctions, which provides practical direction for financial institutions on the steps required to comply with designation and asset-freezing obligations.

FATF mutual evaluation reports for GCC states have assessed compliance with Recommendation 6, and the findings provide insight into the effectiveness of each jurisdiction’s implementation. Institutions should be aware of the FATF evaluation findings for the jurisdiction in which they operate, as these findings inform the direction of supervisory expectations.

DNFBP Sanctions Obligations in the GCC

Designated Non-Financial Businesses and Professions (DNFBPs) are subject to AML/CFT and sanctions obligations across the GCC. In the UAE, DNFBPs include dealers in precious metals and stones, real estate agents, lawyers, accountants, trust and company service providers, and dealers in high-value goods.

DNFBP sanctions obligations in the UAE include screening customers and transactions against sanctions lists, reporting suspected sanctions violations and maintaining records of sanctions compliance activities. The scope of DNFBP obligations varies by jurisdiction, and financial institutions should be aware that their DNFBP counterparties may have independent sanctions compliance obligations that create compliance considerations for the financial institution.

The overlap between AML/CTF obligations and sanctions compliance is particularly evident in the DNFBP context, where the same customer due diligence and transaction monitoring obligations that apply to AML can also support sanctions compliance objectives.

Export Controls and Dual-Use Goods

The UAE occupies a significant position in global re-export trade, including the movement of goods that have potential dual-use applications (civilian and military). UAE export control regulations impose obligations on entities involved in the transfer of controlled goods, and financial institutions may encounter these obligations in the context of trade finance.

Export control compliance is distinct from financial sanctions compliance, though the two frameworks share common objectives of preventing the facilitation of proliferation, terrorism and other threats to international security. Gulf financial institutions involved in trade finance should understand the export control context of the transactions they process and should have procedures for identifying transactions that may involve controlled goods.

De-listing Processes

For financial institutions, a sanctions compliance programme must include a process for handling potential de-listing scenarios. Where a Gulf institution has frozen assets or blocked transactions based on a potential sanctions match, and the customer subsequently obtains a de-listing or delisting from the relevant sanctions authority, the institution must be able to unblock those assets and resume normal service.

De-listing processes vary by sanctions regime. UN de-listing requests are processed through the relevant UN Security Council committee. OFAC de-listing requests (formally, petitions for removal from OFAC’s list) are processed through OFAC’s administrative process. UAE de-listing requests are handled through the UAE’s domestic process under the UITRs.

Financial institutions should document their de-listing procedures and ensure that relevant staff are trained to handle de-listing notifications appropriately.

Compliance Programme Elements for Gulf Institutions

A sanctions compliance programme for a Gulf financial institution should incorporate several key elements. These include governance and senior management oversight, written policies and procedures covering all applicable sanctions regimes, screening systems capable of matching against UN, UAE, OFAC and relevant EU sanctions lists, transaction screening procedures that account for OFAC’s 50 Percent Rule, staff training on sanctions obligations, horizon-scanning for regulatory developments, and audit and testing of the sanctions compliance programme.

The intersection between AML and sanctions compliance deserves particular attention. In many Gulf institutions, these functions operate separately but share common data, systems and processes. An integrated financial crime compliance approach, where AML and sanctions controls are designed with awareness of each other’s requirements, is more efficient and more effective than siloed programmes.