Targeted financial sanctions require speed and precision. A UAE business must be able to receive list updates, screen relevant parties, identify ownership or control, stop prohibited activity and make the correct report without warning the designated person.
Cabinet Resolution No. 74 of 2020 establishes the UAE framework for implementing the UAE Local Terrorist List and relevant United Nations Security Council sanctions. The Executive Office for Control and Non-Proliferation publishes guidance and instructions. The obligations are not limited to banks: natural and legal persons in the UAE must comply, with additional systems and reporting expectations for financial institutions, DNFBPs and virtual-asset service providers.
Understand the difference between AML and TFS
AML transaction monitoring looks for activity that may involve criminal proceeds or another offence and can lead to a suspicious transaction report. Targeted financial sanctions apply because a person or entity is designated under the relevant list framework, or because funds are owned or controlled by, or made available to, a designated party.
The response is therefore different. The Executive Office’s current instruction says a confirmed sanctions match should be reported using a Fund Freeze Report and a potential match using a Partial Name Match Report. It expressly says an STR or SAR should not be used to report confirmed or potential name matches under the UAE Local Terrorist List or UN Consolidated List.
A case can involve both regimes, but staff should not improvise. The procedure must define which alert goes to which decision-maker, what action is taken and which report type is used.
Subscribe and keep list data current
Sanctions screening is only as reliable as its source data. Article 21 requires relevant institutions and DNFBPs to register on the Executive Office website to receive notifications. Maintain evidence of subscription, monitored mailboxes, assigned owners and continuity during leave.
Do not rely solely on an annual customer refresh. The Executive Office describes daily screening of the UN Consolidated List and Local Terrorist List, while the Cabinet Resolution requires constant verification and screening when changes are notified. The programme should screen existing databases following updates and before performing transactions or entering serious business relationships.
If a screening vendor is used, confirm which lists and fields it covers, how quickly updates are loaded, how aliases and scripts are handled and what evidence is retained. Responsibility remains with the business.
Screen more than the customer’s name
Article 21 identifies customers, transaction parties, potential customers, real beneficiaries and persons or organisations with direct or indirect relationships. A clean company name is not enough if a designated individual owns or controls the company or a payment benefits a designated party.
Screen natural-person beneficial owners, directors, authorised signatories, payers, payees, banks, intermediaries and relevant vessels or other identifiers where the business model requires it. Use name, date of birth, nationality, address, identification number and other available data to distinguish a true match from a similar name.
Ownership and control analysis matters. The Executive Office’s guidance addresses majority and minority interests, control and acting on behalf or at the direction of a designated person. The file should explain the analysis rather than recording only a vendor score.
“Screening generates an alert. Evidence and judgment determine the response.”
Separate potential and confirmed matches
A potential match exists where the available information is insufficient to confirm or dismiss the connection. It requires prompt investigation and a PNMR under the current instruction. A confirmed match exists where identifiers and ownership or control evidence establish that the party is designated or subject to the freezing obligation.
The escalation process should be fast but controlled. Frontline staff need authority to pause a transaction while compliance examines the alert. Compliance should access onboarding records, transaction data and independent sources without contacting the customer in a manner that could amount to prior notice.
Document the alert, list source and version, identifiers compared, ownership analysis, reviewer, time of each action and final decision. False positives should be resolved using reliable identifiers and retained so repeated alerts can be handled consistently, while still rechecking when list or customer data changes.
Freeze without delay and without prior notice
For a confirmed match, the obligation is to freeze funds and other assets without delay and without prior notice. “Funds” is defined broadly and includes tangible and intangible, movable and immovable, digital and other assets and economic resources. The business must also refrain from making funds, assets or services available directly or indirectly to the designated party unless authorised.
The operational plan should identify who can stop payment, delivery, account access, transfer, disposal or other use. A policy that requires a lengthy executive committee meeting may not meet a 24-hour outer limit. Delegated emergency authority and 24/7 contact routes may be necessary for businesses operating continuously.
Freezing is not confiscation and should not be lifted merely because the customer objects. Follow official de-listing, false-positive, exemption and unfreezing processes. Preserve the asset and all related records while complying with lawful directions.
Report through the correct channel
The private-sector instruction requires reporting to the Executive Office and relevant supervisor through goAML: an FFR for a confirmed match and PNMR for a potential match, each within five business days with supporting information. It notes an alternative email route for persons who are not goAML users.
A report should state the party, list entry, relationship, assets or services, ownership or control, action taken, timestamps and supporting documents. Keep submission confirmations and follow-up correspondence confidential. Coordinate with the supervisory authority where required.
Test the end-to-end control
Quality testing should use realistic variants: transliteration, reversed names, incomplete birth dates, an indirect shareholder, a payment ordered by a non-customer, and a list update arriving outside office hours. Measure how long the alert takes to reach a decision and whether evidence can be reproduced.
List governance: Confirm official sources, update frequency, mailbox monitoring and vendor coverage.
Party coverage: Include customers, prospects, beneficial owners, transaction parties and connected persons.
Escalation: Define who pauses, investigates, confirms, freezes and reports.
Authority: Give named staff the ability to act within the required timeframe.
Reporting: Distinguish FFR, PNMR and STR/SAR workflows.
Evidence: Retain list versions, identifiers, analysis, timestamps and submissions.
A sanctions programme succeeds when it can act under pressure without guessing. Current list data, broad party coverage, ownership-aware analysis and pre-authorised escalation turn an abstract legal obligation into a control that can operate within hours.
Official sources
Your perspective
How was this article?
Finished reading
Share this perspective
Pass it to a colleague, client, or decision-maker who would find it useful.
About the author
Akash Chetwani, CFA
Senior Partner · Advisory
Advisory
Cross-border advisory for professionals, founders, investors, and globally connected families.