Sanctions Due Diligence in M&A Transactions in the UAE

Mainstream

The sanction due diligence of M&A transactions in the UAE is not a formal database check. It is the identification of hidden risks that can destroy the value of an asset after the transaction closes.

The main question is not whether the seller has an office in Dubai and a DMCC license. The main question is whether the buyer will inherit undisclosed sanctions ties, transaction history with sanctioned persons or the risks of secondary sanctions that will block banking services, dollar settlements and the possibility of attracting Western financing.

Therefore, effective sanctions due diligence in the UAE is based on three checks:

What is the real geography of the business and the compliance history of the asset?Whether the closing of the transaction will lead to the automatic operation of sanctions regimes (USA, EU, UK, UN) against the buyer.

If these three issues are not resolved before the SPA is signed, the buyer risks obtaining an asset that cannot be refinanced, integrated into an international group, or even kept on the perimeter without violating global compliance policies.

When the sanction due diligence in the UAE is critically required

The sanction check ceases to be optional and becomes critical if:

• The target is registered in the Dubai Free Zone (DIFC, DMCC, JAFZA) or on the mainland.
• Nominal structures or trusts are present in the property chain
• Historically, business has been linked to dual-use goods trade
• transactions with Iran, Syria, Venezuela, North Korea or Crimea
• Logistics is used through third countries
• The final beneficiaries are citizens of Russia, Belarus, Iran or are connected with state structures.
• The company has trade flows through the sanctioned sectors (oil, metals, technology, financial services)
• The seller refuses to disclose the ultimate beneficiaries, citing “privacy in the UAE”
• The transaction is financed with the involvement of Western banks or funds
• the buyer is a public company of the United States, the EU or the United Kingdom, or a subsidiary thereof

A mistake that most buyers make

Many investors start with the question:

Does the target comply with UAE local law?

That's the wrong first question.

The right question is:

Will the acquisition of this asset put the buyer at risk of secondary sanctions, lose access to correspondent accounts in dollars, or be forced to explain to OFAC?

The UAE’s specificity is that local legislation does not in itself impose most international sanctions regimes (except for mandatory UN resolutions). That is, from the point of view of the Dubai regulator, the business can be completely legal, but it is toxic from the point of view of compliance assessment by a Western bank or regulator. Checking only on UAE local registries (e.g., DIFC or DMCC) does not reveal the risks of secondary sanctions.

Step 1. Check the real ownership structure

The first thing to learn is not the target’s financial statements or EBITDA, but the ownership architecture.

Key elements for analysis:

• corporate structure up to the final individual
• Nominee shareholders, widely used in the UAE
• Use of funds and trusts in DIFC or ADGM
• Citizenship and Tax Residence of the Ultimate Beneficiaries
• Beneficiary-State Relations (PEP Status)
• The presence of offshore strata (BVI, Cayman, Panama, Switzerland) that have historically changed beneficiaries
• Structure of ownership of intellectual property and main assets
• changes in the ownership structure over the past 3-5 years, especially during periods of increasing sanctions regimes (2014, 2022)
• the presence in the capital of persons directly or indirectly covered by the SDN List (OFAC), the UK Sanctions List or the consolidated EU list;

In the UAE, the problem is compounded by the fact that data on ultimate beneficiaries (UBOs) are not always publicly available. The UBO obligation exists (Economic Substance Regulations, the DIFC registry), but the control over the reliability of the data is not absolute. Therefore, a formal certificate of beneficiary from the seller cannot be the only source of certainty.

Step 2. Conduct forensic analysis of transactions and business partners

Due diligence in M&A requires a forensic approach, not just a compliance questionnaire.

The following should be analysed:

• contractors over the past 3-5 years
• geography of supply and payment
• use of trading houses and traders in DMCC and JLT (frequent link in “gray” schemes)
• logistics chains (route deviation, transshipment in the ports of Iran or Syria under the guise of the UAE)
• compliance of the nomenclature of goods with the declared business profile
• links with companies sanctioned or included in OFAC enforcement actions in the UAE
• Transactions with cryptocurrency through Dubai VARA-licensed exchanges
• settlements in AED, EUR and other currencies bypassing the dollar system if this masks the sub-sanctions flows
• presence in the state or among partners of persons associated with the IRGC, the Syrian regime, Iranian or Russian defense structures

Internal documents are of particular value: invoices, bills of lading, certificates of origin, correspondence with banks, compliance conclusions, if any. The sign of risk is often not the presence of a problem counterparty, but the inability of the target to explain the nature of the relationship with him.

Step 3. Assessing the jurisdictional risks

The UAE’s sanctions due diligence is at the junction of several legal regimes at the same time:

• UN regime, which the UAE follows through local legislation
• U.S. regime (OFAC), extraterritorial for non-U.S. persons but critically important because of the dollar
• EU
• UK regime (OFSI) of importance in DIFC
• regimes of Switzerland, Canada, Australia

The analysis should answer the question: Does the transaction or asset have a US nexus? This can be expressed in dollar payments, use of goods of American origin (more than 10% of components), participation of American employees, financing from correspondent banks in the United States or American investors.

If US nexus is present, the verification standard is as stringent as possible, regardless of whether the company is registered with the DMCC.

Step 4. Check the license and operating perimeter

In the UAE, it is important to understand not only “who owns” but “what the business actually does.”

It should be verified:

• activity in a trading license (for example, general trading – high-risk profile)
• trade-off
• product range (dual-use, military, oil & gas equipment, technology)
• Existence of export and import restrictions
• participation in supply chains of sanctioned goods (for example, unmanned components, microelectronics, products for oil refining)
• using the Dubai company as a transit hub for re-export to high-risk jurisdictions

Practice shows that the General Trading License in Dubai often covers activities that, from the point of view of Western compliance, look like circumvention of sanctions. Therefore, the license profile is a trigger for in-depth verification, not a formality.

Step 5. Analyze the banking track and the history of denials of service

The most important indicator of sanctions risk in the UAE is the compliance history of financial institutions.

It is necessary to request and analyze:

• List of all banks that have served the company in the last 5 years
• Derisking (Closing Accounts) at the Bank’s Initiation
• denial of payment
• Requests for additional documents from compliance departments of banks
• Account blocking and suspension of operations
• use of less transparent banks (including regional banks) instead of international banks (HSBC, Standard Chartered, Citi)
• history of obtaining mortgage or project financing from Dubai Islamic Bank, Emirates NBD, Mashreq and their requests for source of funds
• Bank accounts in friendly jurisdictions, if the main activity is related to the regions under sanctions

The “banking dossier” of an asset often tells more about it than the official statements. A company that two international banks left in a year is toxic, even if the seller attributes it to "technical reasons."

Step 6. Identify the “red flags” of M&A deals in the UAE

Some circumstances of the transaction require a suspension of the process and in-depth verification.

Red flags:

• Seller urgently sells business before the entry into force of the new package of sanctions
• Refusal to provide UBO with reference to “lawyer secrecy” in the UAE
• The seller insists on closing the transaction through a long chain of intermediaries
• Using Cryptocurrencies as the Main Method of Payment for Assets
• transfer of assets to another Dubai Free Zone immediately before the transaction
• request of the seller not to request information from banks
• Lack of clear explanation of the origin of capital (source of wealth) of the seller

Step 7. Integrate Sanctions Assurances into SPAs

Once due diligence is complete, the buyer must be protected through a legally binding mechanism.

The transaction documentation should include:

• Detailed Sanctions and Guarantees (Sanctions Representations & warranties)
• risk-list
• Seller’s obligation to disclose all historical sanctioned transactions
• Special assurance of the absence of direct or indirect beneficiaries from the SDN List
• assurance of full disclosure of UBO
• Special indemnification mechanism in case of losses from post-closed sanctions investigations
• a buyer’s right to unilaterally withdraw from the transaction (MAC clause) if new sanctions are imposed between signature and closure affecting the target, the seller or its beneficiaries
• conditions on escrow of the price in case of hidden sanctions risks after closing

Standard assurances from English law without the specifics of the UAE sanctions are practically useless.

Step 8. Assess the risk of post-closed derisking

Even if the target is “clean” at the time of the transaction, the main question is: Will it be able to continue working after the change of ownership?

It is necessary to model:

• Will the bank keep the account after notification of the change of control?
• Will key counterparties refuse to cooperate due to increased compliance requirements to the buyer?
• How will logistics partners respond?
• Is it possible to block assets when opening a new account?
• Will compliance triggers work for insurers, licensors and lenders?

In the UAE, there are cases when even a net asset lost banking service when it moved to a new owner, because the bank simply did not want to understand and applied a policy of “better close than risk”.

Common mistakes in the UAE sanctions due diligence

1. Rely only on local registries UAE Registers are not integrated with OFAC and do not reflect sanctions risks.
2. Legal license DMCC does not mean that the business does not work with subsanctioned jurisdictions.
3. If a seller is citing confidentiality, the transaction should be stopped, not justified by “local specifics.”
4. Offshore for the beneficiary from the UAE often hides persons who for various reasons are undesirable to publicly own the asset.
5. For a local UAE company, the threat is not a UN ban, but the risk of OFAC secondary sanctions that will lead to disconnection from the dollar.
6. Without them after the closing of the transaction, all risks fully pass to the buyer.
7. The departure of international banks is not a technical moment, but a symptom of sanctions toxicity.
8. Even a net asset must be “repackaged” into the buyer’s compliance perimeter.

Comparison: Due Diligence on the UAE mainland vs. Free Zones

Choosing between the mainland and the free zone for a deal does not change the essence of the verification, but changes the focus of the analysis: On the mainland, the beneficial structure is more deeply checked, in the free zone - the trade track and banking history.

Checklist of the buyer of the asset in the UAE (sanctions aspect)

Before signing an SPA, you need to answer 15 questions:

Who is the ultimate beneficiary and what is its citizenship?Who has been the beneficiary for the last 5 years?Does the structure have nominee shareholders or DIFC/ADGM funds?What is the source of the seller's capital?What jurisdictions did the company do business?Have transactions with high-risk countries?What banks served the company and were there cases of account closure?In what free zones is the company registered?What is the nomenclusion of goods or services?Does the US trace (US dollar, goods, persons) in the payment chain?Who are the key contractors, or will OFIs be easy to open? What kind of sanctions assurances does the seller give and is he ready to provide them with escrow?What is the strategy for integrating the asset into the buyer's compliance perimeter?

FAQ

Direct purchase of an asset from or with a sanctioned person may be regarded as a violation of sanctions regimes (especially if there is a jurisdictional trigger of the US, EU or UK). Detailed analysis of the transaction structure and licensing (if applicable) is required. For some Russian beneficiaries who are not under personal sanctions, a deal is possible, but the verification should be strengthened.

Do offshore trusts in DIFC protect against sanctions risks? Professional compliance does not analyze the legal shell, but control and benefit. A DIFC trust, the beneficiary of which is a sanctioned person, inherits all the risks of the beneficiary.

A local firm will conduct a title and license check, but the sanctions check is a separate expert track at the intersection of international law, knowledge of OFAC practice and forensic analysis. Only a combination of local and international expertise can produce reliable results.

This is a critical red flag, requiring a complete stop of the process until the reasons are clarified. You cannot close a transaction in the expectation of “opening an account again later”.

Conclusion

The sanction due diligence in the UAE M&A transactions is not a legal formality, but a commercial necessity.

The UAE and Dubai remain a key hub for international business, but it is this hub’s role that attracts capital flows and transactions to the jurisdiction that require close compliance assessment. Unlike many other jurisdictions, the purity of an asset is not presumed here – it is proved.

A strong buyer’s strategy is based on forensic analysis of the ownership structure, mapping transaction flows, analysis of the bank track, and detailed sanctions assurances in the SPA. The goal is not just to close the deal, but to get an asset that can be financed, consolidated and sold in the future.

In international transactions, the winner is not the first to sign the term sheet. The winner is the one who understands the true sanctions biography of the asset before closing and knows for sure that after the transaction he will not become a defendant in the OFAC investigation.