Sanctions, Export Controls and Foreign Investment in the UAE

Mainstream

Compliance with sanctions, export controls and regulation of foreign investment in the UAE is not three separate areas of compliance, but a single strategic frontier.

The question is not whether the company is complying with the formal lists of banned individuals. The question is whether a business structure, a particular transaction or a supply chain will result in asset locks, personal liability of beneficiaries, or criminal prosecution in three months, a year or three years.

Therefore, effective regulatory risk management in the UAE is based on three interrelated audits:

1. Does the activity contradict the requirements of the applicable sanctions regimes (the UN, the US, the EU, the UK, local lists of the UAE) taking into account their extraterritorial effect?
2. Is the product, technology or service subject to export controls (dual-use goods, military products) and has the necessary licenses been obtained?
3. Is the chosen ownership structure and type of activity acceptable for a foreign investor in terms of the UAE’s strategic sectors legislation and compliance requirements?

If these three vectors are not consolidated into a single matrix before the launch of a project or transaction, the business risks not just a fine, but a complete loss of access to the dollar financial system, forced liquidation of the company or seizure of assets.

When a common strategy is needed

The need to build a unified strategy of sanctions, export and investment compliance arises if your company:

• registers a business or opens an account with foreign participation in the UAE;
• invests in strategic sectors of the UAE economy;
• trades through the UAE in goods with high added value, raw materials or technologies;
• conducts international payments in US dollars through correspondent accounts of UAE banks;
• has in the supply chain subsanctioned jurisdictions related to re-export;
• Structuring a holding company with assets in several jurisdictions, using the UAE as a hub;
• • Attracting funding or preparing for M&A with Middle Eastern partners
• • Faces bank inquiries about ultimate beneficiaries, origin of funds or payment assignment;
• Works with crypto assets or virtual assets in the UAE;
• The company plans to supply subsanctioned goods from Asia through the UAE ports to third countries.

The mistake most companies make

Many entrepreneurs and legal departments start with the question: “Did our counterparty get on the sanctions list?”

That's the wrong first question. It is just a point check at the finish line that doesn't defend strategically.

The right question is: “What configuration of the transaction, ownership structure, and contractual protection would eliminate the risks of asset locking and ensure business continuity, given the extraterritorial pressures of regulators?”

Sometimes the best result is not the rejection of the transaction, but the creation of a “clean” compliance echelon within the UAE with the involvement of a local legal opinion. Sometimes, it is a supply chain restructuring. Sometimes, it is necessary to obtain an export license or a conclusion about the absence of restrictions on the strategic sector before submitting documents to the bank.

Regulatory compliance in the UAE requires not formal checks on databases, but architectural thinking.

Step 1. Identify applicable sanctions regimes and their intersection

The first thing to map is not lists, but jurisdictional layers of risk.

A company in the UAE may simultaneously be subject to:

• Local legislation of the UAE: Federal Law No. 20 of 2018 on AML/CFT, implementation of UN Security Council resolutions (executed through the Executive Office for Control and Non-Proliferation);
• The United States Regime (OFAC): Extraterritorial application for transactions in the U.S. dollar, U.S. goods, technology, or persons;
• The EU and UK regimes: critical for business with European partners, especially on dual-use goods;
• Requirements of UAE banks: Each bank (especially one with correspondent accounts in the United States) has its own risk scoring, often more stringent than formal legislation.

Ignoring extraterritorial sanctions when doing business in the UAE is the most common reason for freezing payments and closing accounts.

Step 2. Classification of UAE Export Control

Export controls in the UAE are regulated by Federal Law No. 13 of 2007 on Dual-Use Goods and a number of by-laws. The Committee on Dual-Use Goods and Materials (CBRN) is the key body.

It is necessary to clearly define:

• Whether the product or technology falls under the UAE dual-use lists, Wassenaar Arrangements or national export lists;
• Whether a re-export license through free zones is required;
• Whether the requirement covers technology transfer, software or know-how, including intra-corporate transfers;
• Is there a duty to obtain an End-User Statement?

The flow of goods through Dubai (Jebel Ali) is under special attention. An error in classification may be regarded by the regulator or bank as a violation of the export regime and entail sanctions comparable to the violation of financial restrictions.

Step 3. Check investment restrictions under UAE law

With the passage of Federal Decree-Law No. 26 of 2020 on commercial companies, foreigners are allowed 100% ownership in most sectors. However, there is a Strategic Impact List that retains restrictions on foreign ownership or requires special approval.

This step requires analysis:

• to which code of economic activity the project belongs;
• Is this code included in the list of strategic (defense, oil and gas exploration, energy, transport, telecommunications, healthcare, certain financial services);
• Whether licensing is required at the emirate or federal level;
• Whether the activity permits work in a particular free zone or only on the mainland (Mainland);
• There are restrictions on the citizenship of the director or general manager.

An incorrect structure of participation in the strategic sector entails the risk of forced liquidation and loss of investment.

Step 4. Conduct a comprehensive Due Diligence of counterparties and ultimate beneficiaries

In the UAE, standard “sanctions screening” is not enough. Multilayer analysis is required:

• KYC/KYB: ownership structure up to the ultimate natural person (UBO), passport copies, proof of address, origin of capital (Source of Wealth);
• Checking the sanctions lists: United Nations consolidated list, SDN List (OFAC), EU lists, UK HMT, UAE local lists;
• Screening of related persons: Family members, politically exposed persons (PEPs), former officials from high-risk jurisdictions
• Analysis of reputational risks: negative information in the media, signs of circumvention of sanctions, the use of front structures;
• Check of the end-use of the goods: Will the product go into prohibited final use (military, nuclear, WMD programs).

Without this layer, all other steps lose their legal footing.

Step 5. Structuring a deal: Choice of jurisdiction, currency and payment route

At this stage, sanctions, export controls and investments are combined into a single transaction architecture.

Key decisions:

• Jurisdiction of the parties to the transaction and applicable law: Whether the English law or the DIFC/ADGM law provides sufficient protection for the sanctions clauses;
• Currency of settlement: Using dirham instead of the dollar reduces, but does not eliminate, OFAC’s extraterritorial risks if the transaction passes through U.S. correspondents.
• Corresponding bank and payment route: It is important to check the compliance appetite of a bank operating in the UAE in advance. Some banks automatically reject payments with any element of sanctioned jurisdiction, even if not prohibited by local law.
• Contract structuring: the possibility to suspend execution without penalties in case of sanction risk (Sanctions Clause), the guarantee of release from liability.

Step 6. Developing contractual protection

An international contract subject to UAE law or used in transactions with an Emirati element should include not standard, but customized clauses:

• Sanctions clause with the right of immediate termination or suspension of execution when the counterparty is included in the sanctions lists or when the bank demands;
• Export control clause with the obligation to provide end-user licenses and certificates;
• Investment compliance clause, ensuring that the ownership structure complies with the UAE investment laws and is not subject to the restrictions of strategic sectors;
• Force majeure and hardship with a direct listing of regulatory prohibitions, revocation of licenses, freezing of accounts as grounds for reviewing or terminating obligations.

The UAE courts and DIFC/ADGM arbitrations are extremely sensitive to public policy and mandatory rules. Therefore, the absence of a clear compliance framework in the contract is often interpreted against a party who has not shown due diligence.

Step 7. Asset protection and compliance documentation

Many companies are not investigated for intentional misconduct, but for failing to prove their integrity.

In the UAE, it is critical to form a “compliance dossier” for each project:

• legal opinion on the admissibility of the structure in terms of sanctions and export control;
• Written Sanctions Compliance Program policies and procedures
• protocols of checks of counterparties and decisions on approval of transactions;
• correspondence with banks confirming the disclosure of information about the essence of transactions;
• licenses and opinions from the UAE Dual-Use Goods Committee;
• Documented results of Due Diligence.

When you freeze your account or request from local authorities, the presence of such a dossier is the main factor that allows you to quickly remove the blocking and avoid transferring information to foreign regulators.

Step 8. Continuous monitoring and auditing

The regulatory environment of the UAE is dynamic. The sanctions lists are updated every week. The legislation on investment and export control is being modernized.

A strong strategy includes:

• Automated monitoring of sanctions lists for the entire chain of counterparties;
• periodic review of the classification of goods when changing the legislation;
• annual audit of the ownership structure for compliance with federal and Emirati acts;
• Update of compliance policy to take into account new risks and best practices of the Dubai Financial Services Authority (DFSA) and the FSRA (ADGM).

A fragmented approach versus a unified strategy

How to strengthen your position before the regulatory review

The best protection is not built at the moment of force majeure, but when you start a business in the UAE.

When structuring a business and signing contracts, it is necessary to:

• to record in writing why the company does not consider the person or transaction to be sanctioned;
• obtain prior approval from the bank for a non-standard payment route;
• Include in the investment agreement guarantees of compliance with the laws of the UAE on strategic sectors;
• agree on the right to audit the counterparty for sanctions and export control;
• Create an internal procedure for escalating regulatory doubts to the level of the board of directors;
• to reflect in corporate documents the distribution of responsibility for compliance.

In the UAE, there are no references to ignorance of the laws. The international investor is presumed to be aware of all applicable restrictions.

Typical Mistakes in Managing Sanctions, Export and Investment Risks in the UAE

1. Relying on the UAE not imposing sanctions on Russia or other countries, and ignoring OFACBank dealing in dollars, will refuse payment even if local law formally permits the transaction.
2. Using the UAE mainland license for the strategic sector without the consent of local authorities can lead to administrative and criminal liability for management.
3. The goods that have left through the Jebel Ali Free Zone to the country under embargo, poses a risk of secondary sanctions for the entire group.
4. The appointment of such a person as a director of a company in the UAE is a direct trigger for blocking the account.
5. The beneficiary, “clean” two years ago, could be sanctioned today. The bank will see it first.
6. Free zone regulators (DMCC, DIFC, ADGM) have strict compliance standards, often outpacing mainland regulation.
7. Many goods from the IT sector, oil and gas equipment and pharmaceuticals are dual-use goods.
8. If there is no economic presence in the UAE and the company is used only for making payments, it is a red flag for investigation.

Checklist for international business in UAE

Before starting a project or a major transaction, 18 questions must be answered:

1. Who are the ultimate beneficiaries of all parties to the transaction?
2. Are there any SDN, EU, UK, UN or UAE local terrorist lists?
3. Are any of the PEP members or related to PEP?
4. Is the product, technology or service related to dual-use goods on the UAE lists?
5. Have you obtained all the necessary export licenses and end-user certificates?
6. Is the business in accordance with the commercial license and does it not apply to strategic sectors?
7. Is the ownership structure acceptable under the UAE Commercial Companies Act?
8. In what currency will the payment be made and through which correspondent banks?
9. Does the payment route pass through jurisdictions that are under comprehensive sanctions?
10. Does the contract contain a sanctions and export control clause with the right of immediate termination?
11. Are the related companies and affiliates of the counterparty checked?
12. Is the counterparty requested to confirm the origin of funds and assets?
13. Is the commercial purpose of the transaction documented, excluding the charge of circumvention of sanctions?
14. Does the company have a written policy on sanctions and export compliance?
15. Is there a Compliance Officer in the UAE?
16. Has an independent audit of the transaction been conducted by an external lawyer before submitting documents to the bank?
17. Is the package ready to respond promptly to the regulator’s request?
18. Are the risks of secondary sanctions assessed in the event of a change in the political environment?

What a strong strategy looks like

The UAE’s strong regulatory security strategy consists of five load-bearing structures:

1. Regulatory Mapping

Identify all applicable sanctions, export and investment regimes, including extraterritorial ones, and map them on assets and cash flows.

2. Structural Architecture

Building a corporate and contractual structure that legally isolates risks within acceptable limits using the capabilities of DIFC, ADGM and free zones.

3. Compliance Fencing

Creating compliance dossier, automated screening, policies and procedures that serve as evidence of good faith.

4. Contractual Armor

Incorporation into treaties of preventive clauses, guarantees, assurances and mechanisms for regulating incidents.

5. Crisis Protocol

Pre-developed action plan for freezing the account, request of the regulator or inclusion of the counterparty in the sanctions lists.

Without a fifth element, the entire system can crash within 48 hours of receiving a request from the bank.

FAQ

Can a UAE company legally do business with a person under US sanctions if the UAE has not imposed its sanctions?

The UAE does not directly apply US law. However, almost any bank in the UAE that has a correspondent relationship with U.S. banks will refuse to make such a payment. Moreover, this creates the risk of secondary sanctions for the bank and the company. Strategically, this business is extremely risky.

What if my goods are shipped through the UAE to a third country, and there are suspicions of re-export to a sanctioned state?

It is necessary to immediately implement the End-Use Monitoring program, request end-user certificates and consider obtaining an export license with the UAE Committee. Ignoring this risk is one of the most common grounds for investigation.

Is 100% foreign ownership in the UAE cybersecurity or defense technology sector allowed?

Nope. These sectors are usually included in the list of strategic activities. They require government approval, and in some cases, local partner involvement or a complete ban on foreign ownership. Each case requires a separate analysis.

Is it enough to check the counterparty only on the SDN list?

Not enough. It is necessary to check the consolidated list of the UN, the EU list, the UK, the local list of terrorists of the UAE, as well as to analyze adverse media information and links with PEP. UAE banks check many bases at once when processing payments.

Can a bank in the UAE freeze an account without a court order?

Yes, the bank is required to freeze the account and notify the UAE Financial Intelligence Unit (FIU) if it has reasonable suspicions of money laundering, terrorist financing or sanctions violations. This does not constitute a breach of bank secrecy and does not require a prior court order.

How to protect the UAE M&A deal from regulatory surprises

Prior to signing the binding documents, it is necessary to conduct an extended compliance due diligence (sanctions, export control, investment compliance) with the participation of local lawyers and prepare a full package of documents for preliminary approval of the structure with the bank and, if necessary, with the regulatory authorities of the emirate.

Related services

• International regulatory risk management and strategic legal support in the UAE
• Sanctions, export controls and international compliance
• International Arbitration and Cross-Border Dispute Resolution
• Business registration, licensing and structuring of investments in the UAE (Mainland, Free Zone)
• Due Diligence of Contractors and Corporate Investigations
• Banking and Financial Regulation in the UAE
• Asset Protection and Compliance Audit

Related material

• The sanctions regimes of the United States, the EU and the United Nations: Practical aspects for business in the UAE
• UAE Export Control: Guide to dual-use goods
• The UAE Commercial Companies Act: Full analysis of opportunities for foreign investors
• How UAE banks check payments: Internal procedures and how to prepare for them
• Structuring of a holding company in the UAE without sanctions risks
• Compliance file: What UAE regulators are asking for in the investigation
• Due Diligence of the ultimate beneficiary in the MENA region: features and pitfalls

Conclusion

The management of sanctions, export and investment risks in the United Arab Emirates cannot be broken down into three independent folders. This is a unified system in which sanctions compliance determines banking services, export control determines the admissibility of the flow of goods, and investment restrictions determine the legitimacy of the ownership of an asset.

The winner is not the one who just ticked the scoring system. The winner is the one who, before the first transaction, has built a business architecture in which the UAE jurisdiction becomes not a point of vulnerability, but a legal shield that strengthens the negotiating position, protects assets and ensures the continuity of operations in any regulatory storm.