Most AML controls give you time. Sanctions screening does not. A weak risk assessment is a finding at your next inspection. A thin customer file is a finding whenever someone opens it. Sanctions are different: the obligation runs on a clock measured in hours, and it starts before you know anything has happened.
Sanctions screening UAE regulators expect is also the control most often bought rather than built. A firm licenses a screening tool, switches it on, and assumes the obligation is discharged. The tool covers perhaps a third of what is required.
Short answer: UAE reporting entities must screen against two mandatory lists — the UAE Local Terrorist List and the UN Security Council Consolidated List — under Cabinet Decision No. 74 of 2020. On a confirmed match you must freeze without delay, meaning immediately and in any case within 24 hours of designation, refrain from providing any funds or services, and file a Confirmed Name Match Report through goAML within five business days. You must not close the account and must not tip off the customer.
Sanctions screening UAE: which lists actually bind you?
This is the sanctions screening distinction firms get wrong most often, and they get it wrong in both directions.
Two lists are mandatory for sanctions screening. The UAE Local Terrorist List, issued by the Cabinet on the proposal of the Supreme Council for National Security, and the UN Security Council Consolidated List. Cabinet Decision No. 74 of 2020 treats them together as the Sanctions Lists that reporting entities must screen against, and a confirmed match to either one triggers the freezing obligation automatically.
Everything else in sanctions screening — OFAC, the EU consolidated list, the UK OFSI list, other national regimes — is risk-based. Those designations may matter enormously to your business, particularly if you have USD clearing, correspondent relationships or cross-border exposure. But a foreign designation does not, by itself, trigger a freezing obligation under UAE law.
The two ways firms get this wrong
The first sanctions screening error is over-freezing. A firm treats an OFAC hit as though it were a UAE designation and freezes assets it has no UAE legal basis to freeze. That creates contractual and civil exposure to the customer, and it is a decision that should be taken deliberately with legal advice rather than automatically by a screening rule.
The second, and more common, is under-screening the mandatory lists. Firms load OFAC and the UN list into their tool because those are what international vendors ship by default, and never load the UAE Local Terrorist List at all. That is a direct breach of the domestic obligation, and it is trivially easy for an examiner to test.
A practical detail worth knowing: the Local Terrorist List is published in PDF and Excel; the UN Consolidated List in PDF, HTML and XML. If you are loading lists into screening software, use the Excel and XML versions. Firms that copy names out of a PDF by hand introduce errors and fall behind on updates.
The 24-hour freeze obligation in sanctions screening
Direct answer: “Without delay” means applying freezing measures immediately, and in any case within 24 hours of designation of an individual, entity or group on the UAE Local Terrorist List or the UN Consolidated List. The window is measured from designation, not from the moment your systems notice.
That last sentence is the whole problem, and it is why sanctions screening is an infrastructure question rather than a policy one.
If a name is designated at 08:00 and your screening surfaces it at 22:00, you have already consumed more than half the window on detection alone, before anyone has verified the match, escalated it, obtained authority or applied the freeze. The obligation has not moved. Your available time has.
This is the argument for real-time screening rather than periodic batches, and it applies to transaction monitoring and screening design generally. Supervisory guidance points toward continuous screening for higher-volume institutions and near-real-time with a short maximum lag for smaller ones. An overnight batch is not a tuning problem you can fix with better rules — it is structurally unable to meet a 24-hour obligation.
There is a related sanctions screening point about out-of-hours cover. Designations do not observe the UAE working week. If a match surfaces at 18:00 on a Thursday and nobody with freeze authority is reachable until Sunday morning, the window has closed. Whoever holds that authority needs a deputy and a reachable escalation path, which is a governance question rather than a technology one.
Sanctions screening matches: what to do with each kind of hit
Confirmed match
If the individual or entity matches all the key identifiers published on the Sanctions Lists, it is a Confirmed Name Match. For an existing customer: freeze immediately without delay, refrain from making any funds, assets or services available, and submit a Confirmed Name Match Report detailing the freezing measures to the Executive Office and your supervisory authority through goAML within five business days of taking the measure. For a prospective customer, reject the transaction immediately and submit the report.
Freeze is not close. Closing the account does not comply with the obligation under Cabinet Decision No. 74 of 2020. The relationship is frozen and preserved, not terminated. This is counterintuitive — the instinct of most businesses is to exit the customer — and it is one of the most common errors in practice.
Partial match
Some identifiers match and others cannot be verified. Suspend the transaction, request identification documents, and assess against the listed identifiers. Where you remain unable to verify after reviewing the documents, the suspension measures stay in place rather than lapsing by default. A partial match that quietly times out and releases is a control failure.
No match
A sanctions screening false positive still generates an obligation: record the determination, with enough analysis to withstand later scrutiny, and retain it. Two reasons. It is evidence the control operated, and it is the raw material for tuning. If the same name generates the same false positive every month, the rule needs adjusting — and that tuning decision is exactly what a reviewer will look for in an independent AML audit.
Delisting
When a designation is lifted, all targeted financial sanctions measures are to be lifted immediately, without needing prior approval, unless a separate freeze order from a competent authority such as the FIU or Public Prosecution remains active. The cancellation decision reaches you through goAML. Firms that keep a freeze in place after delisting out of caution are creating a different problem.
Throughout, there is no tipping off. The designated party must not learn from you that a freeze has been applied or a report filed.
Who does sanctions screening have to cover?
Supervisory guidance is explicit that sanctions screening covers the customer database, the parties related to a transaction, potential clients, and beneficial owners. In practice there are six populations, and the gap between them is where findings come from.
| Population | What is commonly missed |
|---|---|
| Existing customers | Screened at onboarding and never re-screened, so a customer designated after onboarding is invisible |
| Prospective customers | Screened after the relationship is documented rather than before it goes live |
| Transaction counterparties | Only the payer is screened, not the payee, or only inbound payments |
| Beneficial owners | The corporate entity is screened but the people controlling it are not |
| Former customers | Records are retained for five years but never re-screened against updated lists |
| Related parties | Directors, authorised signatories and agents fall outside the customer record entirely |
When a list is revised, the requirement is not only to screen going forward. You update the lists, re-screen the existing base against the revised list, and cover former customers inside the retention window. That is a batch job in addition to real-time screening, not instead of it. If your KYC and CDD procedures do not capture beneficial owners and related parties in a screenable form, the screening tool has nothing to work with.
What a sanctions screening programme actually contains
This is the point of the article. Buying sanctions screening software addresses matching. It does not address registration, list management, authority, workflow, evidence or testing.
- Registration with the Executive Office alert system, so designations reach you
- goAML registration and working access for the person who files reports
- The mandatory lists loaded from Excel or XML, not transcribed by hand
- An automated update process, because manual updates fall behind
- Real-time screening at the event rather than an overnight batch
- Fuzzy matching tuned for transliteration — Arabic names romanise many ways
- A written match-handling procedure covering confirmed, partial and false positive
- Freeze authority that functions outside office hours, with a named deputy
- A tested filing workflow for confirmed and partial match reports
- False positive records retained with reasoning for five years
- Annual end-to-end testing using designated test names
- Periodic certification that the programme is adequate
Item eleven is the sanctions screening test almost nobody runs, and the one that proves the rest. Running a known designated name through the live system, end to end, demonstrates that detection, escalation, freeze and filing all work. It takes an afternoon. Without it you are asserting the control works rather than evidencing it, and the difference matters at inspection.
Item six deserves a note too, because it is where sanctions screening is hardest in this market. Transliteration is a genuine technical problem in this market. The same Arabic name can appear in Latin script in a dozen forms, and a matching threshold tuned for Western names will miss variants while generating noise elsewhere. Tuning for the actual customer base is part of screening configuration, not an optional refinement.
Where sanctions screening sits in the wider framework
Sanctions screening is not a standalone control. It draws on the AML risk assessment for the geographies and customer types that drive your exposure, on policies and procedures for the match-handling rules, on the MLRO for freeze authority and reporting, and on training so that front-line staff know what to do with an alert rather than clicking through it.
For firms without the internal capacity to run this continuously, it is one of the functions most commonly delivered through an outsourced AML function. For virtual asset businesses there is an additional layer, because address screening and blockchain analytics sit alongside name screening — covered separately in our crypto AML compliance work.
The most common sanctions screening findings
Across reviews, the same gaps recur, and almost all of them are configuration or governance rather than intent.
- The UAE Local Terrorist List not loaded, because the vendor shipped OFAC and the UN list by default
- Screening performed at onboarding only, so any designation after that date is invisible
- Overnight batch screening against a 24-hour obligation
- Beneficial owners and authorised signatories outside the screened population
- Matching thresholds left at vendor defaults, untuned for Arabic transliteration
- Alerts cleared with no recorded reasoning, so the control leaves no evidence
- Freeze authority resting with one person, with no deputy and no out-of-hours path
- The account closed rather than frozen on a confirmed match
- No end-to-end test ever run against a known designated name
The reason this list is so consistent is that sanctions screening is usually procured rather than designed. Somebody buys a tool, switches it on with default settings, and the obligation is treated as met. The tool is necessary and it is not sufficient, and the distance between those two things is where every finding in the list above lives.
Sanctions screening UAE: frequently asked questions
What is sanctions screening?
Sanctions screening is the process of checking customers, counterparties, beneficial owners and transactions against official sanctions lists to identify designated individuals and entities. In the UAE it forms part of the targeted financial sanctions regime and carries freezing and reporting obligations on a match.
Which sanctions lists must UAE businesses screen against?
Two are mandatory: the UAE Local Terrorist List and the UN Security Council Consolidated List, treated together as the Sanctions Lists under Cabinet Decision No. 74 of 2020. Other regimes such as OFAC, the EU and UK lists may be screened as risk management but do not automatically trigger UAE freezing obligations.
Does an OFAC designation require a freeze in the UAE?
Not automatically. OFAC is a United States regime. A UAE freezing obligation arises from designation on the UAE Local Terrorist List or the UN Consolidated List. An OFAC hit may still be commercially and legally significant, particularly for USD exposure, but it should be assessed rather than treated as an automatic freeze trigger.
What does ‘without delay’ mean?
Applying freezing measures immediately and in any case within 24 hours of designation on the UAE Local Terrorist List or the UN Consolidated List. The period runs from designation, not from when your systems detect the match.
What must we do on a confirmed name match?
Freeze immediately without delay, refrain from making funds, assets or services available, and submit a Confirmed Name Match Report to the Executive Office and your supervisory authority through goAML within five business days of taking the measure. For a prospective customer, reject the transaction and submit the report.
Should we close the account of a sanctioned customer?
No. Closing the account does not comply with the obligation under Cabinet Decision No. 74 of 2020. The assets are frozen and preserved. This is a common and understandable error, because the commercial instinct is to exit the relationship.
What is a partial name match?
A hit where some identifiers match but others cannot be verified. Suspend the transaction, request identification documents and assess against the listed identifiers. Where verification remains impossible after review, suspension measures stay in place rather than lapsing automatically.
Is batch sanctions screening acceptable in the UAE?
It is structurally difficult to reconcile with a 24-hour obligation. If designation occurs in the morning and an overnight batch surfaces it late that night, most of the window is gone before verification begins. Guidance points to real-time screening for higher-volume entities and near-real-time with a short maximum lag for smaller ones.
Who do we need to screen?
Existing customers on an ongoing basis, prospective customers before the relationship goes live, parties to transactions, beneficial owners, former customers within the retention window, and related parties such as directors and authorised signatories.
Do we need to re-screen when a list is updated?
Yes. Update the lists, re-screen the existing customer base against the revised list, and cover former customers within the five-year retention window. This periodic re-screening sits alongside real-time screening rather than replacing it.
What happens when someone is delisted?
All targeted financial sanctions measures are lifted immediately, without needing prior approval, unless a separate freeze order from a competent authority remains active. The cancellation decision is communicated through goAML.
Do we need to record false positives?
Yes. Record the determination with sufficient reasoning to withstand later scrutiny and retain it. It evidences that the control operated and provides the basis for tuning the matching rules.
Can we tell the customer their assets have been frozen?
No. Tipping off is prohibited. The designated party must not learn from you that a freeze has been applied or that a report has been filed.
How do we test that sanctions screening actually works?
Run known designated names through the live system end to end — detection, escalation, freeze and filing — at least annually, and retain the results. Testing is what converts an assertion that the control works into evidence that it does.
Sanctions screening UAE: where this leaves you
Sanctions screening is the control where the difference between having a system and having a programme shows up fastest, because the deadline does not wait for you to assemble evidence afterwards. Either the freeze went on within the window or it did not, and the timestamp is in the record.
The three sanctions screening questions worth asking internally today are short. Is the UAE Local Terrorist List actually loaded in our screening tool. If a name were designated at nine o’clock tonight, when would we find out. And who applies the freeze if that person is on leave.
Ontrax designs and tunes sanctions screening and transaction monitoring for financial institutions, DNFBPs and virtual asset businesses from DIFC, Dubai — list configuration, matching thresholds tuned for the UAE name base, match-handling procedures, freeze governance, and end-to-end testing against designated names.
If you are not certain which lists are loaded in your system, that is the place to start, and it takes an hour to find out. Get in touch.
Primary sources and further reading
- UAE Executive Office for Control and Non-Proliferation (EOCN) — the Sanctions Lists, freezing obligations and reporting guidance
- Ministry of Economy and Tourism — Targeted Financial Sanctions — DNFBP guidance, TFS reporting and the automatic reporting system
- Central Bank of the UAE — Targeted Financial Sanctions — obligations and reporting for licensed financial institutions
- Financial Action Task Force — Recommendations 6 and 7 on targeted financial sanctions
