10 Sanctions Screening Failures Found in UAE Compliance Reviews
In the first half of 2025, the Ministry of Economy and Tourism inspected the UAE’s designated non-financial businesses and professions, logged 1,063 violations, and closed the file with more than AED 42 million in fines – AED 20 million of it against precious metals and gemstone traders, AED 18.5 million against real estate brokerages, and over AED 4 million against corporate service providers and auditors.
Buried inside that figure is a narrower, more specific pattern. Firms rarely fail because they missed a sanctions match outright. They fail because the match arrived late, was checked against the wrong list, or was cleared without anyone writing down why. Sanctions screening in the UAE looks, on paper, like the simplest line item in an AML file: subscribe, screen, freeze, report. In reality, there are many difficulties and complications.
This guide walks through all ten, in the sequence a regulator would actually test them, and read alongside the UAE’s full AML/CFT regulatory framework, it gives an MLRO a working checklist rather than another summary of the law.
Key Takeaways
- Screen both lists. The UN Consolidated List and the UAE Local Terrorist List are separate; a screening tool queried against only one leaves a gap. Evidence: your screening log showing both lists on every run.
- Register on the EOCN’s Notification Alert System (NAS). Evidence: your NAS confirmation and update history.
- Screen beneficial owners and counterparties, not only the named customer. Evidence: your documented screening scope.
- Freeze within 24 hours of a confirmed match, weekends and public holidays included. Evidence: a timestamped freeze order.
- Report through goAML – a Confirmed Name Match Report (CNMR) or Partial Name Match Report (PNMR) – within five business days. Evidence: the goAML submission receipt.
- Write down why an alert was cleared. Evidence: five years of retained, retrievable records under Cabinet Resolution No. 134 of 2025.
Failure 1. Screening the UN Consolidated List but Not the UAE Local Terrorist List
The UAE’s targeted financial sanctions (TFS) regime, set out under Cabinet Decision No. 74 of 2020, treats the UN Consolidated List and the UAE Local Terrorist List as one combined screening obligation, not two optional ones.
Reviews still find screening tools configured for the UN list alone, usually because the vendor’s default template was never updated for the UAE market. A designation on the local list carries the identical 24-hour freeze duty. Screening only the UN list means an entity can pass name screening in the UAE clean while sitting, unfrozen, on the Cabinet’s own local register.
Failure 2. Not Registered on the EOCN Notification Alert System, So Designations Arrive Late
Registration on the Executive Office for Control and Non-Proliferation’s (EOCN) Notification Alert System (NAS) is Step 1 of the four TFS obligations – register, screen, freeze, report – precisely because everything downstream depends on it.
A firm relying on a third-party vendor’s list refresh, checked weekly rather than pushed on every designation, is structurally behind the clock before a single name is ever screened. Ministry of Economy enforcement data shows precious metals dealers and real estate brokerages accounted for 968 of the 1,063 violations recorded in H1 2025, the two sectors most often still running screening as a manual, batch process.
Read against the scale of 2025 AML enforcement, a missed NAS alert is rarely an isolated finding, it tends to surface alongside several others in the same inspection.
Failure 3. Customers Screened, Beneficial Owners and Transaction Counterparties Missed
Cabinet Resolution No. 134 of 2025, the Executive Regulations to Federal Decree-Law No. 10 of 2025, extends screening and due diligence duties beyond the named customer to the beneficial owner identified behind that customer, and, for targeted financial sanctions in the UAE specifically, to transaction counterparties.
A common gap: onboarding screens the shareholder on record, but a nominee arrangement, or a counterparty introduced mid-transaction, never gets run through the same check. On paper the file looks complete. The actual party moving the funds was never screened at all.
Failure 4. Onboarding-Only Screening With No Re-Screen When a List Changes
Ongoing screening is a DNFBP obligation, not a one-time gate at account opening. The EOCN’s own guidance requires screening whenever the Sanctions Lists are updated, in addition to onboarding.
A customer who was clean on day one can be designated on day 400, and the obligation to catch that does not lapse because due diligence was already filed. Firms that screen once, then rely on periodic file reviews every one to three years, are operating a control that was accurate on a single date and stale for every day after it.
Failure 5. Exact-String Matching That Fails on Arabic Transliteration, Aliases and Spelling Variants
A designated name transliterated from Arabic can appear on a sanctions list in several spellings – a diacritic dropped, a “Mohammed” rendered as “Muhammad” or “Mohamed.” A screening engine built for exact-string matching will not flag any of them as a hit. Fuzzy matching for sanctions screening exists precisely to close this gap, but only where a firm has actually configured and tested it against Arabic-script transliteration patterns and known aliases – not left it on a generic English-language default.
Failure 6. Fuzzy-Match Thresholds Never Calibrated, Tested or Documented
The opposite failure is just as common: fuzzy matching switched on, but the sensitivity threshold left at whatever the vendor shipped, never tested against the firm’s actual customer base, and never revisited. Set too loose, it buries genuine matches in noise; set too tight, it misses the transliteration variants it was meant to catch.
Neither the UAE’s targeted financial sanctions framework nor the CBUAE’s guidance for regulated financial institutions prescribes a fixed matching percentage, supervisors expect the firm to set, test, and document its own threshold, sized to its own risk profile, and be able to explain why. “The vendor’s default” is not a documented rationale.
Failure 7. Treating the 24-Hour Clock as Running From Confirmation Rather Than Detection
The 24-hour freeze obligation in the UAE attaches the moment a confirmed match exists – it does not pause while the finding moves up an approval chain. Reviews regularly find internal escalation procedures that treat the clock as starting only once a compliance manager signs off, sometimes a day or more after the front-line alert was raised. That gap is exactly where a firm can have a documented process, a diligent analyst, and a missed statutory deadline all at once.
Failure 8. Partial Freezes, and Screening That Stops at Weekends and Public Holidays
A freeze that covers one account but leaves a second facility at the same institution untouched is a partial freeze, and it does not satisfy the obligation. Separately, the EOCN’s guidance is explicit that the screening and freezing duty continues through weekends and public holidays; if the business is not transacting, the obligation resumes the moment it reopens, without a grace period to catch up.
Firms that pause screening feeds over a public holiday weekend are not pausing a task – they are running four days blind on a control that has a same-day legal deadline attached to it.
Failure 9. False Positives Cleared Without a Written, Evidenced Determination
Most screening alerts are false positives, and clearing them is a normal, expected part of the process. The failure is not in clearing them – it is in clearing them with no record. Under Cabinet Resolution No. 134 of 2025’s record-keeping duty, firms must maintain documented evidence of the measures taken on every alert, retrievable on request.
Where a partial match cannot be resolved from identifiers on file, the EOCN’s own process requires suspending the transaction and reporting a PNMR through goAML – the firm does not get to quietly decide it was nothing and move on without a trail showing how that conclusion was reached.
Failure 10. No Annual Testing, No MLRO Certification and No Retrievable Audit Trail
Cabinet Resolution No. 134 of 2025 requires firms to maintain an independent audit function to test the effectiveness of internal anti-crime policies and controls, and to appoint a Compliance Officer – the MLRO – at management level with the independence and competence to run that programme.3 A screening control nobody has independently tested since it was switched on is not a documented control; it is an assumption. Pairing this internal check with a periodic independent AML audit is what turns “we believe it works” into evidence a Supervisory Authority will actually accept.
Remediating a Screening Gap Before It Becomes a Finding
Records relating to customer due diligence, screening outcomes, and any analysis performed must be retained for a minimum of five years under Cabinet Resolution No. 134 of 2025.3 Remediation starts by rebuilding that file backward: confirm which lists were actually queried on which dates, identify any period screening ran against one list only, and re-screen the full customer, beneficial owner, and counterparty base against both current lists today. Internal control testing at this stage should produce a dated log a supervisor can review line by line, not a one-line assurance that “the gap has been fixed.”
Disclosing a Historical Gap, and What Changes the Outcome
A historical gap discovered through the firm’s own testing, disclosed to the Supervisory Authority with a documented remediation plan already underway, sits in a materially different position than the same gap surfacing first during a Ministry inspection. Federal Decree-Law No. 10 of 2025 does not set a prescription period on money laundering or terrorism financing offences, so a gap does not age out on its own, voluntary, evidenced disclosure is the variable a firm actually controls.6
How ADEPTS Runs a Sanctions Screening Review
A compliance file that looks complete and a screening programme that actually catches a match are not always the same thing and the gap between them rarely shows up until an inspection finds it.
ADEPTS reviews sanctions screening architecture end to end like which lists are queried and how often, whether beneficial owners and counterparties are actually in scope, fuzzy-matching thresholds and their documented rationale, the freeze and reporting workflow against the 24-hour and five-business-day clocks, and the retained evidence behind every cleared alert. Where gaps turn up, ADEPTS builds the remediation file and the AML and CFT compliance programme to close them, not a generic policy update, but controls sized to how the firm actually screens.
Conclusion
None of these ten failures is exotic. Each one is a small, specific gap – the wrong list, the narrow scope, the untested threshold, the clock started late, the missing written rationale – and each is exactly what an inspection is built to find. Sanctions screening is not a control you install once and leave running. It is a control you test, document, and re-test as the lists change and the business grows. Get the evidence right, and a screening review stops being a source of exposure and starts being proof the programme works.
Test Your Sanctions Screening Programme
| # | Failure | Ask Yourself | Evidence That Proves the Control Works |
| 1 | Screening only the UN Consolidated List | Does our screening log show every run querying both lists? | Screening configuration record naming both lists |
| 2 | Not registered on the EOCN’s NAS | Do we receive designation alerts the moment they are issued? | NAS registration confirmation and alert history |
| 3 | Beneficial owners and counterparties unscreened | Is every party to a transaction — not just the customer — screened? | Documented screening scope covering UBOs and counterparties |
| 4 | Onboarding-only screening | Do we re-screen automatically when a list updates? | Re-screening trigger log tied to list update dates |
| 5 | Exact-string matching only | Would our tool catch an Arabic transliteration variant? | Fuzzy-matching configuration and test results |
| 6 | Uncalibrated fuzzy-match thresholds | Have we tested and documented our threshold? | Threshold calibration report with rationale |
| 7 | Freeze clock started at confirmation | Do we freeze within 24 hours of the match, not the sign-off? | Timestamped freeze order vs. alert timestamp |
| 8 | Partial freezes; weekend gaps | Does screening and freezing continue on weekends and holidays? | Freeze coverage record; weekend screening log |
| 9 | Undocumented false-positive clearances | Is every cleared alert backed by a written rationale? | Five-year retained clearance records |
| 10 | No independent testing or MLRO sign-off | Has an independent function tested this control this year? | Independent audit report and MLRO certification |
FAQs
Screening must be ongoing — on onboarding, on every list update, and on a regular cycle in between. The EOCN does not fix a universal daily rule for every sector; higher-risk DNFBPs typically screen daily, while others calibrate frequency to their own risk assessment.
Only a confirmed match triggers the freeze. A partial match is suspended pending further checks, and reported as a PNMR if it cannot be resolved — it does not automatically require freezing every asset tied to the customer.
The UAE’s statutory freeze obligation attaches to the UN Consolidated List and the UAE Local Terrorist List. Firms may screen against OFAC, EU or UK lists as part of a broader risk-based programme, but a match there is reported through an STR, not a CNMR or PNMR.
DNFBP status generally applies screening obligations across the client base, not only to specific engagement types, though the depth of due diligence can be risk-based. Every client relationship still needs to pass through the screening gate at onboarding.
Screening can be outsourced operationally, but the compliance obligation stays with the regulated entity. A stale vendor list is the firm’s finding at inspection, not the vendor’s — contracts should specify update frequency and the firm should verify it.
A CNMR reports a confirmed match against the UN or UAE Local Terrorist List. The Funds Freeze Report has been superseded by the CNMR under updated EOCN guidance. An STR is a separate suspicious transaction report used when suspicion exists outside these two designated lists.
No. Sanctions freezes are applied without prior notice to the designated party, and tipping off a customer about a report or investigation is a separate offence under Federal Decree-Law No. 10 of 2025.
DIFC and ADGM entities remain subject to the federal TFS framework and the EOCN lists in addition to DFSA or FSRA-specific rules — the federal freeze obligation is not displaced by financial free zone regulation.
Yes. Federal Decree-Law No. 10 of 2025 does not impose a prescription period on money laundering, terrorism financing or proliferation financing offences, so a historical gap remains open to enforcement regardless of when it occurred.
NAS registration proof, screening logs showing both lists on every run, documented screening scope for beneficial owners and counterparties, freeze and goAML reporting timestamps, written rationale for cleared alerts, and the most recent independent audit report — all retrievable within the five-year retention window.
References
- Central Bank of the UAE. “Cabinet Resolution No. (134) of 2025 Regarding the Executive Regulations of Federal Decree by Law No. (10) of 2025.” CBUAE Rulebook. Accessed September 11, 2026. https://rulebook.centralbank.ae/en/rulebook/cabinet-resolution-no-134-2025-regarding-executive-regulations-federal-decree-law-no-10.
- Central Bank of the UAE. “Federal Decree-Law No. (10) of 2025 Regarding Anti-Money Laundering, and Combating the Financing of Terrorism and Proliferation Financing.” CBUAE Rulebook. Accessed September 11, 2026. https://rulebook.centralbank.ae/en/rulebook/federal-decree-law-no-10-2025-regarding-anti-money-laundering-and-combating-financing.
- Executive Office for Control and Non-Proliferation. “Targeted Financial Sanctions: UN Consolidated List and UAE Local Terrorist List.” Accessed September 11, 2026. https://www.eocn.gov.ae/en-us/un-page.
- Executive Office for Control and Non-Proliferation. “About the Executive Office.” Accessed September 11, 2026. https://www.eocn.gov.ae/en-us/about-us.
- Ministry of Economy and Tourism (United Arab Emirates). “Economy and Tourism Announces Results of Its Field Inspections for the First Half of 2025.” Press release, July 24, 2025. https://www.moet.gov.ae/en/-/-%D8%A7%D9%84%D8%A7%D9%82%D8%AA%D8%B5%D8%A7%D8%AF-%D9%88%D8%A7%D9%84%D8%B3%D9%8A%D8%A7%D8%AD%D8%A9-%D8%AA%D8%B9%D9%84%D9%86-%D9%86%D8%AA%D8%A7%D8%A6%D8%AC-%D8%AC%D9%88%D9%84%D8%A7%D8%AA%D9%87%D8%A7-%D8%A7%D9%84%D8%AA%D9%81%D8%AA%D9%8A%D8%B4%D9%8A%D8%A9-.
- UAE Legislation (Official Legislation Portal). “Cabinet Resolution No. (134) of 2025 Regarding the Executive Regulations of Federal Decree by Law No. (10) of 2025.” Accessed September 11, 2026. https://uaelegislation.gov.ae/en/legislations/3857/download.
- UAE Legislation (Official Legislation Portal). “Federal Decree by Law No. (10) of 2025 Regarding Anti-Money Laundering, and Combating the Financing of Terrorism and Proliferation Financing.” Accessed September 11, 2026. https://uaelegislation.gov.ae/en/legislations/3314/download.
Related Articles
