CBUAE — Sanctions

Sanctions compliance refers to the processes and controls organisations implement to ensure they do not conduct business with sanctioned individuals, entities, countries, or sectors. Sanctions are restrictions imposed by governments and international bodies to achieve foreign policy and national security objectives.

UAE financial institutions must comply with multiple sanctions regimes: UAE domestic sanctions (administered by the Executive Office for Control and Non-Proliferation), UN Security Council sanctions, and in practice, many institutions also screen against US OFAC and EU sanctions lists due to international business relationships and correspondent banking requirements.

Sanctions screening is the process of checking customers, transactions, and counterparties against sanctions lists to identify prohibited or restricted parties. Screening must be conducted at customer onboarding, before processing transactions, when sanctions lists are updated, and periodically against the entire customer base.

If screening identifies a potential match, the institution must investigate to determine if it is a true match or a false positive. True matches require the institution to freeze the relevant assets or reject the transaction, file a report with the relevant authorities, and refrain from processing any further transactions involving the sanctioned party until authorised to do so.

Penalties for sanctions violations can include significant financial fines, criminal prosecution of individuals and institutions, restrictions on business activities, and reputational damage. The UAE has strengthened its enforcement framework and is actively pursuing sanctions violations as part of its commitment to international compliance standards.

All relevant staff must receive training on the sanctions regimes applicable to the institution, internal screening and escalation procedures, how to handle potential matches, reporting obligations, and the consequences of non-compliance. Training must be regular, documented, and updated when sanctions regimes change.

A sanctions risk assessment evaluates the institution's exposure to sanctions-related risks based on its customer base, geographic footprint, products and services, and transaction patterns. It identifies areas of higher risk and informs the design of screening processes and controls. Assessments should be updated at least annually.

Targeted sanctions (also called smart sanctions) restrict specific individuals, entities, or sectors while allowing broader economic activity to continue. Comprehensive sanctions impose broad restrictions on an entire country, severely limiting or prohibiting most economic and financial transactions. Both types require different screening and compliance approaches.

Sanctions compliance is closely integrated with AML/CFT requirements. Both involve customer due diligence, ongoing monitoring, and reporting to authorities. The CBUAE expects financial institutions to maintain a unified compliance framework that addresses sanctions, AML, and CFT together rather than as separate programmes.

Institutions must retain records of all screening results (including false positive resolutions), blocked or rejected transactions, reports filed with authorities, sanctions risk assessments, training records, and any correspondence with regulators regarding sanctions matters. Records must be maintained for a minimum of five years.

The CBUAE requires all LFIs to implement automated screening systems to check customers, beneficial owners, and counter-parties against the UAE Local Terrorist List and the UN Consolidated List. Screening must occur at the time of onboarding (KYC) and daily against any updates to the sanctions lists (batch screening).

This course is mapped to the "Guidance for LFIs on the Implementation of Targeted Financial Sanctions" (TFS). It covers the legal requirement to "Freeze Without Delay" (within 24 hours) any funds belonging to a sanctioned individual or entity and the mandatory reporting of "Partial Name Matches" and "Confirmed Matches" via the GoAML portal.

Staff must be trained on "Alert Discounting" procedures. A "Potential Match" occurs when an automated system identifies a similarity between a customer and a sanctioned person. Staff must use "Secondary Identifiers" (Date of Birth, Nationality, Passport Number) to determine if it is a "False Positive" (same name, different person) or a true match. Training ensures staff do not incorrectly discount real matches or unnecessarily block innocent customers.

Under UAE AML Law, it is a criminal offense to "tip off" a customer that they are being investigated or that a suspicious activity report has been filed. Staff must be trained on how to handle customer inquiries when an account is frozen due to a sanctions match without revealing the underlying regulatory reason, thereby protecting the integrity of the investigation.

CBUAE standards require that screening systems undergo regular independent testing and calibration. Compliance and IT staff must be trained to ensure "Fuzzy Matching" logic is set at an appropriate threshold to capture spelling variations or transliteration differences (e.g., Mohammed vs. Muhamed) common in the UAE’s multicultural environment.