Sanctions Compliance in the UAE: OFAC, EU and 2025 AML Law

Sanctions Compliance in the UAE: OFAC, EU and the 2025 Legal Landscape

Global finance is always shifting, but few forces put as much pressure on international business as economic sanctions. For companies operating in a global hub like the United Arab Emirates (UAE), sanctions compliance is not merely a regulatory hurdle; it is a basic pillar of operational integrity and legal survival. Powerful extraterritorial regimes, primarily the U.S. Office of Foreign Assets Control (OFAC) and the European Union (EU), now meet the UAE’s own rapidly evolving legal framework. The result is a complex, high-stakes environment.

Related: Explore our High Net Worth Legal Services in the UAE.

This article looks at the dual challenges of OFAC and EU sanctions and examines the UAE’s response, particularly the landmark legal changes introduced in 2025. Understanding all three is essential for any business that wants to reduce risk and operate smoothly in the Middle East’s financial heart.

Related: Explore our Data Protection Officer services in the UAE.

The Global Sanctions Compliance Imperative: OFAC and the EU

The sanctions regimes enforced by the United States and the European Union are the two most significant global compliance challenges. Both aim to promote international peace and security, but their scope, legal basis and enforcement mechanisms differ. This creates a complex web of obligations for multinational companies.

Related: Explore our Data Protection Officer services in the UAE.

OFAC: The Extraterritorial Giant

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) administers and enforces economic and trade sanctions based on U.S. foreign policy and national security goals. OFAC’s power comes largely from its extraterritorial reach: its rules can apply to non-U.S. persons and entities under certain conditions.

Related: Explore our Crypto Regulation Compliance services in the UAE.

Key aspects of OFAC compliance include:

• The 50 Percent Rule: This is a critical and often misunderstood element. Any entity owned 50% or more, directly or indirectly, by one or more blocked persons (Specially Designated Nationals or SDNs) is itself considered blocked, whether or not it is explicitly named on the SDN list.
• U.S. Nexus: OFAC sanctions typically apply to U.S. persons wherever they are located, to all transactions in or transiting the U.S., and in some cases to foreign entities owned or controlled by U.S. persons. For a company in the UAE, simply dealing in U.S. dollar transactions or involving U.S.-origin goods can trigger OFAC jurisdiction. This dual-jurisdiction reality often leads to "de-risking", where financial institutions and businesses cut ties with entire sectors or regions to avoid the perceived compliance burden and the risk of massive fines. This defensive strategy is understandable, but it can stifle legitimate trade. It shows why careful legal counsel is needed to balance compliance with commercial viability.
• Strict Liability: Most OFAC civil violations are based on strict liability. A violation can occur even if the person or company had no knowledge or intent to violate the sanctions. This is why robust, proactive screening and due diligence matter.

The EU’s Restrictive Measures

The European Union’s sanctions, known as "restrictive measures," are based on the EU’s Common Foreign and Security Policy (CFSP). Unlike OFAC, the EU framework is generally more geographically limited, but it still has a major impact:

• Direct Applicability: EU regulations are directly applicable in all EU Member States, which ensures uniform application across the bloc.
• Scope: EU sanctions typically apply to: (a) nationals of Member States; (b) entities incorporated or constituted under the law of a Member State; (c) any business conducted in whole or in part within the EU.
• Focus on Sectoral Sanctions: The EU often uses sectoral sanctions, targeting specific industries or types of transactions (e.g., energy, finance) in relation to sanctioned countries, alongside asset freezes and travel bans on listed individuals and entities.

For businesses in the UAE, the challenge lies in the divergence between these two regimes. A transaction that is permissible under EU law may be prohibited under OFAC rules, and vice versa. A compliance program must therefore be sophisticated enough to satisfy both jurisdictions at the same time. Because these requirements are so layered, many businesses seek specialist guidance to establish a robust Corporate Governance & Compliance framework that is both legally sound and operationally efficient.

The UAE’s Proactive Stance: The 2025 Legal Framework

As a major global financial and trade hub, the UAE has taken decisive steps to strengthen its Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF) framework, with a direct and significant impact on sanctions compliance. The year 2025 marks a new era with the introduction of Federal Decree Law No. 10 of 2025 and its Executive Regulations.

Federal Decree Law No. 10 of 2025: A New Foundation

The New AML Law repeals and replaces the previous 2018 framework, signalling the UAE’s commitment to aligning with the highest international standards, particularly those set by the Financial Action Task Force (FATF). The law broadens the scope of offences and significantly increases the penalties for non-compliance. For instance, the 2025 Law sets a new minimum fine of AED 20,000 for violations against the Executive Regulations, with maximum penalties reaching millions of Dirhams, alongside potential imprisonment for serious offences. This firm stance on enforcement highlights the UAE government’s zero-tolerance policy towards financial crime.

Executive Regulations: Putting Compliance into Practice

Cabinet Decision No. 134 of 2025, the Executive Regulations, gives the New AML Law its operational force. It introduces several key compliance changes that directly affect how businesses manage sanctions risk.

1. Explicit Inclusion of Proliferation Financing

A critical expansion of the UAE’s compliance mandate is the explicit inclusion of Proliferation Financing (PF). The Executive Regulations now require all in-scope entities, namely Financial Institutions (FIs), Designated Non-Financial Businesses and Professions (DNFBPs) and Virtual Asset Service Providers (VASPs), to:

“...identify, mitigate and document proliferation financing risks and to implement targeted financial sanctions controls.”

This adds a new layer of screening and due diligence to ensure that funds or services do not contribute to the development or acquisition of weapons of mass destruction. It is a direct requirement for businesses to build targeted financial sanctions controls into their daily operations.

2. Enhanced Due Diligence and Transparency

The new regulations significantly strengthen Customer Due Diligence (CDD) and transparency requirements, which are the foundation of effective sanctions screening:

• Stricter UBO Requirements: The rules for Ultimate Beneficial Ownership (UBO) are now more prescriptive, requiring companies to update UBO details within 15 working days and explicitly prohibiting bearer shares. This makes it harder for sanctioned individuals or entities to hide their ownership behind complex corporate structures.
• Lower Thresholds for VASPs: Recognising the higher risk associated with virtual assets, the Executive Regulations impose a lower CDD trigger for VASPs (AED 3,500 or more) compared to traditional FIs (AED 55,000 or more). This ensures that the fast-growing virtual asset sector meets stringent compliance standards.

3. Expanded Enforcement Powers

The new framework significantly strengthens the UAE’s Financial Intelligence Unit (FIU), reinforcing the government’s ability to act swiftly against illicit finance. The FIU Head is now authorised to order immediate suspensions (up to 10 working days) and 30-day freezes of suspected criminal funds. This is a clear escalation of enforcement power. Businesses must maintain real-time compliance readiness to avoid having their assets or transactions frozen.

These new local requirements, combined with the ever-present threat of OFAC and EU enforcement, make expert legal guidance indispensable. Companies must ensure their internal policies are fully aligned with the New AML Law and its Executive Regulations. For support with these local laws and with setting up a robust compliance framework, businesses often turn to specialist legal consultants in the region. A clear, legally sound Corporate Governance Framework is the first step toward reducing these risks and ensuring long-term business continuity in the UAE.

For professional legal guidance, explore our Business Compliance Advisory and AML Compliance service pages.

Building a Multi-Jurisdictional Sanctions Compliance Program

A sanctions compliance program that works in the UAE must address the requirements of OFAC, the EU and the new 2025 UAE laws. This calls for a comprehensive, risk-based approach.

1. Comprehensive Risk Assessment

The first step is a thorough, documented risk assessment. It should identify and analyse the company’s exposure to sanctions risk based on its:

• Geographic Footprint: Where the company operates, where its customers are located and where its supply chain originates.
• Products and Services: Whether the company deals in high-risk sectors (e.g., finance, trade, virtual assets).
• Customer Base: The nature of its clients, including the risk associated with their UBOs and jurisdictions.

2. Dynamic Screening and Monitoring: The Role of Technology

Compliance is a continuous process, not a one-time check. Companies must implement dynamic screening systems that check customers, suppliers and transactions against all relevant sanctions lists in real time: OFAC’s SDN list, the EU’s consolidated list and the UAE’s local lists.

The sheer volume of data and the speed of transactions in a global hub like Dubai make manual screening obsolete. Modern sanctions compliance relies heavily on RegTech (Regulatory Technology) solutions. These tools use Artificial Intelligence (AI) and Machine Learning (ML) to:

• Automate Screening: Instantly check names, addresses and other identifiers against global sanctions lists, reducing the risk of human error.
• Reduce False Positives: Advanced algorithms can tell similar names apart (e.g., John Smith vs. Jon Smyth) and reduce the number of "false positives" that need time-consuming manual review.
• Monitor Transactions in Real Time: Flag suspicious transaction patterns or movements of funds to high-risk jurisdictions before they are completed.
• Maintain Audit Trails: Automatically log all screening and due diligence activities, providing an essential record for regulatory audits and demonstrating a commitment to compliance.

Investment in such technology is no longer optional. It is a necessity for any business serious about sanctions compliance in the UAE’s 2025 regulatory environment.

3. Training and Internal Controls

The human element is often the weakest link. Regular, mandatory training for all relevant staff (especially compliance, sales and finance teams) is crucial. Internal controls must ensure that any potential match or red flag is immediately escalated and investigated before a transaction is processed.

4. Reporting and Cooperation

The UAE’s strengthened FIU powers mean that timely and accurate reporting of suspicious transactions (STRs) is more critical than ever. Companies must have clear internal procedures for identifying, documenting and reporting potential violations to the relevant authorities, while strictly observing the prohibition on "tipping off".

Practical Challenges: The Compliance Officer's Dilemma

Even with a robust legal framework and advanced technology, day-to-day sanctions compliance in the UAE presents unique and significant challenges for compliance officers and legal teams. The difficulty comes from the need to harmonise three distinct, often conflicting, legal spheres: U.S., EU and UAE law.

1. Managing the "De-risking" Fallout

Fear of massive OFAC fines has led many international banks and financial institutions to adopt a "de-risking" strategy, reducing or ending relationships with clients in jurisdictions perceived as high-risk, including parts of the Middle East. This has a knock-on effect on legitimate businesses in the UAE, making it difficult for them to access essential financial services. Compliance officers must therefore manage their own internal risk and also deal with an overly cautious banking environment. That often means providing extraordinary levels of documentation and transparency to keep banking relationships.

2. The Proliferation Financing (PF) Mandate

The explicit inclusion of Proliferation Financing (PF) in the 2025 UAE law is a significant compliance change. PF is often harder to detect than traditional money laundering or terrorism financing because the transactions may appear legitimate on the surface (e.g., dual-use goods). Compliance teams must now develop specialist expertise to identify red flags related to the procurement of materials, technology and expertise that could contribute to Weapons of Mass Destruction (WMD) programs. This requires careful supply chain due diligence and a deep understanding of international export control lists, going beyond simple name screening.

3. Data Privacy vs. Transparency

The push for greater transparency, particularly on Ultimate Beneficial Ownership (UBO) under the new UAE regulations, can sometimes conflict with stringent data privacy laws, such as the EU’s General Data Protection Regulation (GDPR). Companies that process data for EU citizens or entities must carefully balance the legal obligation to disclose UBO information to UAE authorities with their duty to protect personal data. This requires a careful legal review of data handling protocols to ensure compliance with both transparency and privacy requirements.

The Future of Sanctions Compliance in the UAE

The direction of sanctions compliance in the UAE is clear: more regulation, greater enforcement and a continued commitment to international standards. The 2025 legal framework is not an endpoint but a milestone in the UAE’s journey to becoming a global leader in financial integrity.

1. Increased Focus on Virtual Assets

The explicit inclusion of VASPs in the new AML/CTF framework signals a permanent and heightened focus on the virtual asset sector. As the UAE continues to position itself as a hub for FinTech and crypto innovation, regulatory scrutiny will only intensify. Future compliance efforts will likely centre on the "Travel Rule" for virtual asset transfers and the development of specialised tools to track and screen decentralised finance (DeFi) transactions for sanctions evasion.

2. Harmonisation and Cooperation

The divergence between OFAC and EU sanctions remains a challenge, but the UAE’s role as a bridge between East and West will require greater international cooperation. The UAE’s FIU will continue to strengthen its ties with international counterparts, leading to faster information sharing and more coordinated enforcement actions. This means that a sanctions violation detected in one jurisdiction is increasingly likely to trigger action in the UAE.

3. The Need for a Proactive Legal Partner

In this changing environment, the role of legal counsel goes beyond reacting to regulatory changes. It becomes a proactive partnership focused on risk management. Businesses need advisers who can interpret the letter of the law, anticipate future regulatory trends and build resilient compliance programs.

Conclusion: Sanctions Compliance as a Competitive Advantage

The 2025 legal changes confirm the UAE’s position as a responsible and highly regulated financial centre. For international businesses, this new environment is a clear call to action: sanctions compliance must move from a back-office function to a core business priority.

Combining OFAC and EU requirements with the UAE’s stringent new AML/CTF and PF laws demands a level of legal expertise that few in-house teams possess. By investing early in a comprehensive, multi-jurisdictional compliance program, businesses can avoid crippling fines and reputational damage. They can also gain a competitive advantage by demonstrating reliability and integrity in the global marketplace.

Related Services: Explore our sanctions compliance services in the UAE, including support on avoiding sanctions penalties.

Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Readers should seek professional legal advice tailored to their specific circumstances before making any decisions or taking any action based on the content of this article.

Nour Attorneys Team

Additional Resources

Explore more of our insights on related topics:

• Navigating the New Era of UAE Insurance Law: Policy Types, Claims, and the 2025 Regulatory Landscape
• Building Resilient Organizations: Navigating the UAE's 2025 Legal Risk Management Landscape
• The Great Transition: Navigating the UAE’s Energy and Utilities Regulatory Landscape in 2025
• FinTech Frontier: Navigating UAE's 2025 Regulatory Landscape for Opportunities and Compliance