A UAE company can hold no US assets, employ no Americans, and open no US office — and still find its accounts frozen and its correspondent banking severed because of a decision taken in Washington. Sanctions and export controls are where a trade hub's greatest asset, its openness, becomes its sharpest legal risk.
Two systems, one desk
Every UAE business that moves goods or money across a border sits at the intersection of two distinct legal orders. The first is the UAE's own framework: a domestic sanctions and non-proliferation regime that the Emirates has built deliberately and rapidly over the past few years. The second is the extraterritorial reach of foreign regimes — chiefly the United States, but also the European Union and the United Kingdom — whose rules follow the dollar, the technology, and the counterparty rather than the passport of the company involved. A compliant posture requires managing both. Treating them as one, or ignoring either, is how good businesses end up in bad places.
The UAE framework: screen, freeze, without delay
The centrepiece of the domestic regime is Cabinet Decision No. 74 of 2020, concerning the UAE list of terrorists and the implementation of UN Security Council resolutions on countering the financing of terrorism and the proliferation of weapons of mass destruction. It gives domestic legal force to two categories of listing: the UN Consolidated List, which flows from Security Council committees under resolutions such as 1267/1989 (ISIL and Al-Qaida), 1988 (Afghanistan) and 1718 (the DPRK); and the UAE's own Local Terrorist List, maintained nationally.
The operative obligation is deceptively simple and unforgiving in practice: any person in the UAE must freeze the funds and assets of a listed party without delay and without prior notice. "Without delay" is a term of art — it means hours, not a business cycle. There is no grace period in which to seek instructions, no notice to the customer, and no discretion to net off or complete a pending transaction first. Article 21 fixes the core screening and freezing duties on financial institutions, designated non-financial businesses and professions, and virtual asset service providers — but the freeze obligation itself reaches every natural and legal person in the country.
Coordinating and supervising this machinery is the Executive Office for Control and Non-Proliferation (EOCN), the federal body that also administers the UAE's export control regime. Practically, compliance begins with registration on the EOCN's Notification Alert System, through which listings and amendments are pushed in near real time. A business that is not registered cannot credibly claim to be screening "without delay," because it will not learn of a designation until it is already too late.
What this means operationally
- Screen customers, counterparties, beneficial owners and — where relevant — vessels and cargo against both the UN Consolidated List and the Local Terrorist List.
- Register for and monitor the EOCN alert system so that new designations trigger action the same day.
- Have a pre-drafted freeze-and-report procedure: who acts, who signs, and how the required report reaches the authorities.
The long arm: why a purely UAE company is still exposed
Here is the point most commercial teams underestimate. US sanctions administered by the Office of Foreign Assets Control (OFAC) do not stop at America's borders. They attach to conduct with a US nexus, and that nexus is easy to acquire without ever intending to. A US-dollar payment almost always clears through a correspondent bank in New York; for the instant it does, the transaction passes through US jurisdiction, and any sanctioned party in the payment chain becomes visible — and actionable — to OFAC. Add US-origin software, US-manufactured components, a US person somewhere in the approval loop, or a US-incorporated affiliate, and the exposure compounds.
Beyond this "primary" reach lies the sharper instrument: secondary sanctions. These do not require any US nexus at all. They allow the US government to penalise a non-US person — a UAE trading company, say — for dealing with certain sanctioned targets, by designating that company itself, cutting off its access to the US market, and severing its dollar-clearing relationships. For a business that trades internationally, loss of correspondent banking is not an inconvenience; it is an existential event, because banks de-risk long before regulators act.
The dollar is the tripwire. A company can breach no UAE law, employ no Americans, and still lose its banking the day a counterparty three links up the chain is listed in Washington.
The EU and UK operate their own autonomous regimes with their own extraterritorial edges, particularly for firms with European touchpoints, euro or sterling clearing, or EU/UK persons in the structure. The lists do not always match, which is why a single global screening filter is insufficient.
Export controls and the diversion problem
The UAE's position as a re-export and transshipment hub is commercially invaluable and precisely what makes it a focus of diversion concern. Goods that enter for legitimate onward trade can be re-routed to prohibited end-users or end-uses. The domestic answer is Federal Decree-Law No. 43 of 2021 on commodities subject to non-proliferation controls — which replaced the earlier 2007 law and applies across the entire territory, including the free zones. It regulates import, export, re-export, transit, transhipment and brokerage of controlled items, administered by the EOCN.
The national Control List for dual-use items tracks the international regimes — the Wassenaar Arrangement, the Nuclear Suppliers Group, the Missile Technology Control Regime, the Australia Group and the Chemical Weapons Convention framework — so that items with both civilian and military or WMD-relevant applications require authorisation to move. For traders and logistics operators, the critical discipline is the end-user and end-use check: knowing not just who your immediate customer is, but where the goods will actually come to rest, and screening for the red flags of diversion — mismatched end-users, implausible routing, reluctance to disclose the ultimate destination.
Building a defensible programme
Enforcement, whether domestic penalty, foreign designation or a bank's quiet decision to exit the relationship, tends to punish the absence of a system more than any single mistake. A risk-based programme is the defence:
- Screening. Screen against UN, UAE local, OFAC (SDN and sectoral), EU and UK lists — not one consolidated approximation — and re-screen when lists change, not only at onboarding.
- Export diligence. Classify goods against the Control List, obtain licences where required, and document end-user and end-use checks for re-exports.
- Contractual protection. Build sanctions and export-control representations, warranties, ongoing covenants, audit rights and termination triggers into supply, distribution and financing agreements, so a counterparty's later listing gives you a clean exit rather than a shared liability.
- Payment-channel awareness. Understand which currency and banking rails a transaction touches, because the choice of settlement currency can decide which regime applies.
- Governance. Assign named responsibility, keep records, and be able to show a regulator or a bank a living programme rather than a paper policy.
The organising insight for any UAE business is that compliance here is not about proving you did nothing wrong. It is about being able to demonstrate, quickly and on the record, that you had a system designed to catch the thing before it happened — and that when a list changed, you moved without delay.
Key instruments referenced: UAE Cabinet Decision No. 74 of 2020 (Terrorism Lists Regulation and implementation of UN Security Council resolutions); Federal Decree-Law No. 43 of 2021 on commodities subject to non-proliferation controls; the mandate of the Executive Office for Control and Non-Proliferation; relevant UN Security Council resolutions; and the US, EU and UK autonomous sanctions regimes. This page is general information, not legal advice.