Sanctions Compliance Policy (UAE)

A Sanctions Compliance Policy in the United Arab Emirates is a formal governance document that sets out a company's framework for identifying, assessing, and managing the risk of engaging in transactions or relationships with individuals, entities, countries, or vessels subject to applicable economic and trade sanctions. Sanctions are measures imposed by governments or international organisations to restrict commercial activity with designated targets — typically as a response to terrorism, weapons proliferation, human rights violations, or aggressive military conduct.

The UAE sanctions compliance landscape is multi-layered and has grown significantly in complexity since the country joined the Financial Action Task Force (FATF) as a full member in 2024. At its core, UAE sanctions compliance is governed by: UAE Cabinet Resolution No. 74 of 2020, which establishes the National Targeted Financial Sanctions (TFS) framework implementing UN Security Council resolutions on terrorism and proliferation financing; the Anti-Money Laundering and Combating the Financing of Terrorism Law — Federal Decree-Law No. 20 of 2018 — which criminalises terrorist financing and implements the TFS framework obligations; and the AML-CTF Executive Regulations, Cabinet Decision No. 10 of 2019, which set out detailed screening and reporting requirements for regulated entities.

The UAE TFS framework requires all UAE persons — companies and individuals, regulated and unregulated — to freeze assets of, and refrain from transacting with, any person or entity designated on the UAE national TFS lists or the UN Security Council Consolidated Sanctions List. The National Anti-Money Laundering Committee (NAMLCFTC), operating under the UAE Cabinet, maintains and publishes the UAE TFS designations, coordinated with the Ministry of Economy, the Central Bank of the UAE, the Ministry of Foreign Affairs, and relevant emirate authorities.

The UN Security Council, of which the UAE is a member, imposes binding sanctions through Chapter VII resolutions. The consolidated UN sanctions list — maintained by the 1267 Sanctions Committee — designates individuals and entities associated with Al-Qaeda, ISIS, the Taliban, North Korea, and Iran, among others. All UN member states are legally obligated to implement these sanctions, and UAE entities are bound through the TFS framework.

For companies with international financial connections — particularly those conducting US dollar transactions or dealing with US-regulated entities — the extra-territorial reach of US OFAC, EU Council, and UK OFSI sanctions programmes creates additional practical compliance obligations that a complete Sanctions Compliance Policy must address. The forms-legal.com Sanctions Compliance Policy (UAE) template provides a structured framework for all these obligations, available in PDF and Word format.

A Sanctions Compliance Policy is needed for UAE companies in the following circumstances.

For financial institutions supervised by the Central Bank of the UAE — banks, exchange houses, finance companies, and payment service providers — a formal sanctions compliance programme is a mandatory regulatory requirement. The Central Bank's AML-CTF Regulatory Framework requires automated, real-time sanctions screening, designated sanctions compliance officers, documented match assessment procedures, and immediate FIU notification of true hits. Failure to maintain an adequate sanctions compliance programme is one of the most serious regulatory violations a UAE financial institution can commit.

For DNFBPs supervised by the Ministry of Economy for AML purposes — real estate agents, auditors, accountants, lawyers, dealers in precious metals, and company service providers — sanctions screening against UAE TFS lists and UN consolidated sanctions lists is a mandatory element of Customer Due Diligence. The Ministry of Economy conducts inspections and expects to see documented screening procedures.

For all UAE companies engaged in international trade — import/export of goods, cross-border services, and international financial transactions — a sanctions compliance policy is a practical necessity regardless of regulatory classification. The TFS framework applies to all UAE entities without exception, and a trading company that inadvertently processes a payment from or to a designated terrorist entity faces serious legal consequences.

For companies that conduct US dollar transactions — which includes virtually all UAE companies involved in international trade, given the dollar's role as the primary trade currency — practical exposure to US OFAC sanctions is significant. A sanctions policy that acknowledges this exposure and establishes appropriate controls protects the company from inadvertent OFAC violations and from correspondent bank relationship termination.

For companies with European partners or investors — particularly those in sectors subject to EU sanctions on Russia, Iran, Belarus, or other targeted regimes — a sanctions compliance policy is increasingly a condition of the business relationship, as EU companies conducting Know Your Customer due diligence assess their counterparties' sanctions compliance frameworks.

A complete UAE Sanctions Compliance Policy must include the following elements.

Scope of applicable sanctions: A clear identification of the sanctions frameworks that are relevant to the company's operations — UAE TFS lists, UN consolidated sanctions list, and, where appropriate, US OFAC, EU Council, and UK OFSI programmes based on the company's financial connections and transaction profile. The scope should be updated as the company's business evolves.

Sanctions screening programme: A documented procedure for screening all new customers, counterparties, agents, and intermediaries against applicable sanctions lists before establishing a relationship or entering into a transaction; for rescreening existing relationships on a risk-based basis; and for immediate rescreening when applicable sanctions lists are updated. For financial institutions, automated real-time screening is required. For other companies, manual or semi-automated screening is acceptable if it is thorough and systematic.

Potential match response: A clear procedure for responding to potential sanctions matches — halting the transaction; escalating to the Sanctions Compliance Officer without alerting the customer; conducting a true-hit versus false-positive assessment; and, for true hits, freezing assets, filing STRs with the FIU, and notifying relevant authorities under the TFS framework.

Sanctions Compliance Officer: Designation of a senior officer with sanctions compliance responsibility, adequate authority, and contact details.

Record-keeping: Retention of screening records, match assessments, and FIU notifications for five years under the AML Law.

Training: Annual sanctions compliance training for all employees with sanctions-relevant functions. The forms-legal.com Sanctions Compliance Policy (UAE) covers all mandatory elements under the TFS framework and AML Law.

Completing the Sanctions Compliance Policy begins with entering the company's full registered name, emirate, effective date, and nature of business. The business type selection is important because it determines the regulatory framework and the intensity of the screening programme required. Financial institutions supervised by the Central Bank of the UAE face the most demanding sanctions compliance requirements; trading companies with cross-border exposure face significant practical risk; and general commercial companies have the most flexibility in designing a proportionate programme.

Designate the Sanctions Compliance Officer. Enter the name and title of the person responsible for the sanctions compliance programme — overseeing screening, assessing potential matches, managing FIU notifications, and maintaining records. For financial institutions, this is typically the Chief Compliance Officer or a dedicated Sanctions Manager. For smaller companies, the General Manager or head of finance may assume this role with appropriate training. The Sanctions Officer must have access to current UAE TFS lists and UN consolidated sanctions lists — available from the Ministry of Economy and the UN Security Council websites — and to whatever screening tool the company uses.

Enter the sanctions escalation contact — a dedicated email address or secure channel through which employees can report potential matches to the Sanctions Officer promptly and confidentially. This channel must be monitored continuously during business hours.

Select the review period. Annual review is required for regulated entities and recommended for all companies. The review should assess: changes to the UAE TFS lists; new UN Security Council designations; changes to the company's customer base, transaction profile, or geographic reach; lessons from any potential match assessments; and regulatory feedback from Ministry of Economy or Central Bank inspections.

After completing the wizard, obtain board or general manager approval, distribute the policy to all relevant employees, and provide immediate sanctions screening training. Verify that access to current sanctions lists is available and that the screening process is operational before the policy takes effect. For financial institutions, verify that automated screening systems are configured correctly and tested.

Legal requirements for a UAE Sanctions Compliance Policy arise from the following sources.

UAE Cabinet Resolution No. 74 of 2020 establishes the TFS framework. It requires all UAE persons to comply with designations on the UAE TFS lists and UN Security Council sanctions lists, to freeze assets of designated parties immediately upon designation or discovery, to refrain from providing any funds or economic resources to designated parties, and to report frozen assets and prohibited transactions to the relevant authority. The obligation applies universally — not just to regulated financial institutions.

Federal Decree-Law No. 20 of 2018 criminalises terrorist financing — providing funds for terrorist acts or to terrorist organisations — and implements the TFS framework obligations. Violation of the TFS framework is treated as terrorist financing and subject to the law's full sanctions, including imprisonment of up to ten years and fines of up to AED 5 million. The AML-CTF Executive Regulations, Cabinet Decision No. 10 of 2019, require regulated entities to implement sanctions screening as part of their CDD programme and to file STRs when a designated party is identified.

For financial institutions, the Central Bank of the UAE's AML-CTF Regulatory Framework — which implements FATF Recommendations 6 (Targeted Financial Sanctions for Terrorism and Terrorist Financing) and 7 (Targeted Financial Sanctions for Proliferation Financing) — imposes specific requirements including automated screening, immediate asset freezing, notification procedures, and independent audit. The Central Bank has imposed significant fines on banks that have failed to implement adequate sanctions controls.

For DNFBPs, the Ministry of Economy's AML-CTF supervision framework requires screening of all customers and counterparties against applicable sanctions lists as part of CDD.

For DIFC and ADGM entities, the DFSA and FSRA respectively impose sanctions compliance requirements consistent with FATF standards and relevant UN Security Council resolutions, in addition to federal UAE obligations.

Common mistakes in UAE sanctions compliance policies include the following.

Screening only against UAE TFS lists and ignoring UN consolidated sanctions lists is an inadequate approach. The TFS framework established by Cabinet Resolution No. 74 of 2020 explicitly requires compliance with UN Security Council sanctions lists, and failing to screen against the UN consolidated list — maintained by the 1267 Sanctions Committee and available on the UN website — leaves a significant gap. The UN list includes designations for Al-Qaeda, ISIS, the Taliban, North Korea, and Iran-linked entities that are actively involved in international financial transactions. A UAE company that unknowingly transacts with a UN-designated party has violated the TFS framework regardless of whether the party also appears on the UAE national list.

Using manual, ad hoc name searches rather than a systematic, documented screening process is a compliance failure waiting to happen. Effective sanctions screening requires consistent methodology — the same lists, the same fuzzy matching parameters, the same documentation — applied to every new customer and counterparty without exception. A compliance culture where screening is done 'when it seems relevant' rather than systematically for all onboarding and high-value transactions provides no genuine protection. Financial institutions supervised by the Central Bank of the UAE must use automated screening tools with documented match-review procedures and threshold settings reviewed by the Sanctions Compliance Officer.

Failing to update screening when the UAE TFS or UN sanctions lists are updated leaves the company unaware of new designations. Sanctions lists are updated frequently — sometimes daily — in response to new intelligence and Security Council decisions. A company that screened a customer at onboarding three years ago but never rescreened may find that the customer was subsequently designated. Periodic batch rescreening of existing customer and counterparty records is a minimum standard for regulated entities, and for financial institutions, real-time screening of all transactions is required.

Ignoring third-country sanctions exposure — particularly US OFAC sanctions — because 'US law does not apply to UAE companies' is a serious misunderstanding of practical sanctions risk. US correspondent banking relationships, US dollar transactions, and US-regulated counterparties all create channels through which OFAC can enforce its sanctions regime. The correct approach is not to assume that OFAC sanctions are inapplicable, but to assess the company's specific nexus to US-regulated financial channels — particularly if it processes US dollar payments through correspondent banks — and to manage that exposure with appropriate contractual representations and counterparty screening. OFAC civil penalties for violations by non-US parties can be substantial, and being named in an OFAC enforcement action has severe reputational consequences that effectively exclude the company from the international financial system.