UAE targeted financial sanctions: what Cabinet Decision 74 of 2020 asks of you

If you are a bank, an exchange house, a real estate broker, a dealer in precious metals or a corporate service provider in the UAE, targeted financial sanctions are not a background obligation. They come with short deadlines, a named supervisory office and an expectation that you can show your working. This post sets out what UAE Cabinet Decision 74 of 2020 and the surrounding framework ask of a regulated firm, and what that means for the way you screen.

This is a practical explainer, not legal advice. The obligations below are described as published by the UAE authorities; check the current text and your supervisor’s guidance before relying on them.

Key takeaways

• Under UAE AML rules, regulated firms must screen against both the UN Security Council Consolidated List and the UAE Local Terrorist List, and must act on updates to either without delay.
• A confirmed match triggers a freeze without prior notice and a report to the Executive Office for Control and Non-Proliferation (EOCN), on the timelines the EOCN publishes.
• Partial and false matches carry their own reporting expectations and need to be documented, not silently discarded.
• The evidential burden sits with you: which lists you checked, when, against which version, and why you concluded what you did.

The framework in one paragraph

The UAE’s anti-money-laundering and counter-terrorist-financing regime rests on Federal Decree-Law 20 of 2018 on AML, as amended, together with its implementing regulation. Targeted financial sanctions sit alongside that regime in Cabinet Decision 74 of 2020, which regulates the UAE terrorist list and gives effect to the UN Security Council resolutions on the suppression of terrorism, terrorist financing and the financing of proliferation. The Executive Office for Control and Non-Proliferation, the EOCN, is the body that administers the lists, receives freeze and match reports and issues guidance on how firms should comply.

Who is caught? Financial institutions, designated non-financial businesses and professions (DNFBPs) and, under later measures, virtual asset service providers. The DNFBP category is wide in the UAE and includes real estate brokers and agents, dealers in precious metals and stones, auditors and accountants, lawyers and notaries when they handle certain transactions, and company and trust service providers.

Which lists you must screen

The regime points firms at two lists in particular.

The first is the UN Security Council Consolidated List, which combines the individuals and entities designated under the Council’s sanctions committees. The UAE applies these designations directly, so a change on the UN list is a change in your obligations on the day it is published.

The second is the UAE Local Terrorist List, issued by the UAE Cabinet and published through the EOCN. This list is specific to the UAE, is not mirrored on OFAC or EU feeds, and is updated by Cabinet decision. It is the list most often missing from screening tools built for other markets. AdverseMe parses it daily from the official file; the UAE coverage page describes how.

Screening against OFAC, the EU and the UK is not what Cabinet Decision 74 requires, but most UAE supervisors expect it as part of a risk-based approach, and banks that clear in dollars apply OFAC’s rules in practice. A sound programme screens the two mandatory lists and the major international feeds together. AdverseMe covers 13 official sanctions feeds alongside the five GCC and MENA national lists; the coverage page lists them.

When you must screen

The obligation is continuous, not one-off. Firms are expected to screen at onboarding, before executing transactions with a counterparty, and on an ongoing basis against the current version of each list. The EOCN publishes updates through its notification system and expects subscribed firms to re-screen their customer base when a list changes, without waiting for the next periodic review.

That last point is where most manual programmes break. A list update on a Tuesday afternoon means every existing customer needs re-checking, and a monthly refresh does not satisfy “without delay”. AdverseMe’s monitoring diffs every list version as it lands and re-screens only the names affected by the change, so a new designation surfaces the day it is published rather than at the next review cycle.

What happens on a match

The framework distinguishes between a confirmed match, a partial or potential match and a false positive, and each has its own path.

On a confirmed match, the firm must freeze the funds and assets of the designated person without delay and without prior notice, refrain from making any funds or services available to them, and report the freeze to the EOCN within the period the EOCN specifies. The EOCN’s guidance describes the freezing action and the report; the reporting timelines it publishes are short, measured in business days, so the internal escalation path has to be ready before the match happens.

On a partial or potential match, where the name is close but the identifiers do not line up, the firm is expected to investigate, and where the match cannot be resolved, to report it. Silently discarding a near match because it “looks like a different person” is the failure mode supervisors look for.

On a false positive that has been resolved, the expectation is documentation: what was matched, what evidence was used to rule it out and who decided. The Engine Trace in AdverseMe keeps this by design. Every source searched, every candidate returned and every match dropped as a wrong-entity match is on the record, so a resolved false positive is a documented decision rather than an absence of one.

Arabic names and transliteration

A specific difficulty with the UAE list, and with the other national lists in the region, is that the official entries are in Arabic with Latin transliterations that vary from one publication to the next. A screening engine that matches on a single Latin spelling will miss entries; one that matches too loosely will bury the analyst in noise. AdverseMe parses the five GCC and MENA lists daily and applies Arabic transliteration handling so that variant spellings of the same name are matched, then puts the four independent judges on the result so the score reflects the evidence rather than the spelling.

Keeping the evidence

Cabinet Decision 74 and the surrounding rules put the record-keeping burden on the firm. For each customer you need to be able to show which lists were screened, on what date, against which list version, what came back, how each hit was resolved and, where relevant, what was reported to the EOCN. Supervisors and auditors ask for this per file, not per programme.

AdverseMe’s PDF report is built to be that file: a one-page brief, then each finding with every judge’s vote and reasoning side by side, then the trace of what was searched. Reports are free to download on every plan.

A short checklist for DNFBPs

• Confirm you are in scope with your licensing authority and register with the EOCN’s notification system.
• Screen every customer and beneficial owner against the UN Consolidated List and the UAE Local Terrorist List, and add the major international feeds.
• Re-screen the whole book whenever either list changes, not at the next periodic review.
• Have a freeze-and-report procedure ready before the first match, with the EOCN’s current timelines written into it.
• Keep a per-customer record of what was screened, when, against which version, and how each match was resolved.

Our DNFBP use case walks through how a real estate broker or a corporate service provider runs this in AdverseMe in one screening. Plans start on the pricing page; to run your first screening against the UAE and UN lists today, get started.