Extraterritorial Sanctions: How OFAC Reaches UAE-Based Business

UAE-based businesses face simultaneous exposure to OFAC secondary sanctions under EO 14024 and domestic AML obligations under Federal Decree-Law 10/2025. Understanding where US jurisdictional reach ends and UAE regulatory risk begins is now a board-level imperative.

How OFAC Secondary Sanctions Work: The Legal Architecture Reaching into the UAE

The Office of Foreign Assets Control administers a sanctions architecture that extends well beyond US persons and US-dollar transactions. Secondary sanctions — most acutely those under Executive Order 14024 of April 2021 — authorise the US to designate non-US persons, including UAE nationals, UAE-incorporated entities, and UAE-domiciled funds, where those parties have materially supported, or conducted significant transactions with, persons already blocked under the Russia-related sanctions programme. Unlike primary sanctions, secondary sanctions do not require any US nexus: the act of purchasing Russian oil above the price cap, processing a payment for a listed Russian defence entity, or providing professional services that enable evasion can each be sufficient. The jurisdictional theory is extraterritorial by design.

EO 14024 Section 1(a)(iii) authorises designation of any person who has operated or operated in a sector of the Russian economy identified by the Secretary of the Treasury, and Section 1(a)(viii) covers persons who have facilitated significant transactions for or on behalf of designated persons. OFAC has made clear through its enforcement actions and guidance — most notably the September 2024 and January 2025 designation tranches — that UAE-based trading companies, free-zone entities, and logistics intermediaries are squarely within scope. Correspondent banking relationships, trade finance lines, and USD-clearing arrangements are the primary transmission mechanism: once a UAE entity is added to the SDN List, its US correspondent bank severs the relationship, triggering a cascade of secondary de-risking by European and UK counterparties.

For UAE-based financial institutions, the risk is structural. A bank licensed by the Central Bank under CBUAE Law No. 6/2025 that maintains a correspondent relationship with a US bank must contractually comply with that US bank's sanctions policies, which incorporate OFAC requirements by reference. Maintaining a business relationship with an SDN-listed UAE entity therefore creates exposure not only for the institution's US correspondent access but also for potential enforcement by the CBUAE itself, which under Law No. 6/2025 can impose administrative fines of up to AED 1 billion for AML and compliance failures — a figure that now meaningfully overlaps with the scale of US civil monetary penalties.

EU autonomous sanctions under Council Regulation (EU) 833/2014 (as repeatedly amended through 2024) and UK sanctions under the Russia (Sanctions) (EU Exit) Regulations 2019 operate on parallel but distinct legal bases. EU sanctions apply to conduct within EU territory, by EU persons, or — critically — in respect of goods and technology subject to EU export controls regardless of where the transaction occurs. UK sanctions similarly apply to UK persons and certain sterling-clearing transactions. A UAE entity operating in a free zone therefore simultaneously faces three overlapping extraterritorial regimes, each with its own designated-list, licensing framework, and enforcement posture.

The UAE Domestic AML Framework: FDL 10/2025 and Its Interaction with Sanctions Exposure

The UAE's primary AML/CFT/CPF statute is Federal Decree-Law 10/2025, which entered into force on 14 October 2025, repealing Federal Decree-Law 20/2018 in its entirety. Cabinet Resolution 134/2025 (the Executive Regulations, in force 14 December 2025) provides the implementing detail. FDL 10/2025 makes three changes of direct relevance to sanctions-exposed businesses. First, it explicitly adds proliferation financing as a standalone predicate offence, closing a gap that FATF had identified during its 2022 grey-listing review. Second, it introduces personal criminal liability for senior managers and compliance officers where a reporting entity fails to implement adequate AML/CFT/CPF controls — liability that cannot be contracted away or delegated. Third, it raises the maximum administrative fine for legal persons to AED 100 million, and removes the statute of limitations for money laundering offences entirely.

The interface with OFAC secondary sanctions is direct: proceeds of transactions with SDN-listed parties, or funds derived from activities that violate US, EU, or UK sanctions, are capable of constituting the proceeds of a foreign predicate offence under FDL 10/2025, Article 2, which adopts a broad predicate-offence list including any conduct criminalised under UAE law or under the law of a foreign jurisdiction where the conduct occurred. A UAE entity that receives payment from a sanctioned Russian counterparty may therefore simultaneously face a US civil monetary penalty, EU asset freeze, and UAE money laundering prosecution — the triple-track exposure that distinguishes post-2022 sanctions enforcement from anything practitioners encountered before.

Reporting obligations under FDL 10/2025 and Cabinet Resolution 134/2025 require designated non-financial businesses and professions (DNFBPs), including lawyers, accountants, real estate brokers, and company service providers, to file Suspicious Transaction Reports with the UAE Financial Intelligence Unit (UAEFIU) via the goAML platform where they know, suspect, or have reasonable grounds to suspect that funds are linked to sanctions evasion. Failure to report is itself a criminal offence. For advisers handling matters involving potential sanctions exposure, this creates a tipping-off risk: a solicitor who files an STR may inadvertently alert a client to an investigation, yet failure to file creates its own criminal exposure. Navigating this requires a carefully structured legal professional privilege analysis under UAE law, noting that FDL 10/2025 preserves privilege for bona fide legal advice but not for transactions in which the lawyer is a participant.

EO 14024 in Practice: UAE Entity Designation Patterns and the Free-Zone Problem

Since February 2022, OFAC has designated dozens of UAE-incorporated or UAE-resident entities under EO 14024. The designation patterns reveal a consistent typology: trading companies in Jebel Ali Free Zone (JAFZA), Hamriyah Free Zone, and Sharjah Airport International Free Zone (SAIF Zone) used as procurement intermediaries for dual-use goods; UAE-based financial intermediaries routing payments through non-USD correspondent chains to obscure the ultimate sanctioned beneficiary; and individual UAE residents — often holding valid UAE residence visas and operating legitimately licensed businesses — who have been designated as enablers or owned-and-controlled subsidiaries of Russian SDN-listed entities. The 50 Percent Rule is particularly important here: OFAC automatically treats any entity owned 50 percent or more, directly or indirectly, by an SDN as itself subject to SDN restrictions, even if that entity is never separately named. A UAE free-zone company 51 percent owned by a designated Russian oligarch is therefore itself an SDN by operation of law, regardless of whether its name appears on the list.

The free-zone structure creates specific legal complexity. UAE free zones are juridical persons incorporated under their respective free-zone authorities — JAFZA, RAKEZ, DMCC, and others — and are not directly supervised by the Ministry of Economy for AML purposes in the same way as mainland companies. However, Cabinet Decision 109/2023 (the Beneficial Ownership Resolution) applies across the UAE, requiring all companies — including free-zone entities — to maintain a beneficial ownership register identifying any natural person holding 25 percent or more of shares or voting rights, or otherwise exercising ultimate control. The 25 percent threshold for UAE domestic beneficial ownership disclosure purposes differs from OFAC's 50 percent aggregation rule, creating a gap that sophisticated evasion structures have historically exploited. Post-FATF removal, the UAEFIU and free-zone authorities have intensified beneficial-ownership verification requirements, but enforcement remains uneven across jurisdictions.

The DMCC — one of the world's largest free zones by entity count — published updated AML/sanctions compliance guidelines in 2024 requiring member companies to conduct enhanced due diligence on counterparties in FATF-identified high-risk jurisdictions and to screen against both OFAC SDN and EU Consolidated Lists. Non-compliance with DMCC guidelines can result in licence suspension or revocation, which adds a layer of domestic regulatory risk sitting alongside the extraterritorial OFAC exposure. For GCs advising boards of DMCC-licensed entities, the practical implication is that sanctions compliance has moved from a reputational consideration to a licence-continuation requirement.

Bank De-Risking: How Correspondent Banking Pressure Translates into Operational Paralysis

The most immediate and commercially disruptive consequence of OFAC secondary sanctions exposure for UAE businesses is not the designation itself but the anticipatory de-risking by banks. UAE banks operating with USD correspondent relationships — which remains essential for international trade finance — must comply with their US correspondent bank's sanctions policies. Those policies are contractually binding and typically require the UAE bank to terminate relationships with any customer that is, or appears likely to become, an OFAC SDN, or that transacts with SDN-listed parties. The result is that a UAE trading company involved in transactions with Russian counterparties — even transactions not themselves sanctioned — may find its UAE bank accounts closed with minimal notice, irrespective of whether any formal OFAC designation has been issued.

The CBUAE, under Law No. 6/2025, has issued guidance requiring licensed financial institutions to apply a risk-based approach to customer relationships and to avoid unjustified blanket de-risking. However, the tension between CBUAE's anti-de-risking guidance and the contractual obligations imposed by US correspondent banks has not been resolved at the regulatory level. In practice, UAE banks routinely exit relationships with customers operating in Russia-adjacent sectors — shipping, commodities trading, logistics, metals — without conducting the individualised risk assessment that the CBUAE framework requires, because the reputational and correspondent-access risk of maintaining those relationships outweighs the commercial benefit of the individual customer relationship.

For affected businesses, the immediate steps are to document the termination notice carefully, request written reasons from the bank (a right under CBUAE consumer-protection frameworks), and consider whether the de-risking was triggered by a specific transaction, a counterparty relationship, or a broader country-risk policy. If the bank has filed an STR with the UAEFIU, the business will not be informed — the tipping-off prohibition in FDL 10/2025 prevents disclosure. This information asymmetry means that the first indication of a UAEFIU investigation may be a formal information request from the Public Prosecution, which under Federal Decree-Law 38/2022 (the Criminal Procedure Law, in force 1 March 2023) carries compulsory document-production obligations enforceable through pre-trial asset-freezing orders.

UAE financial institutions also face exposure under FDL 10/2025 if they fail to apply enhanced due diligence to customers in sectors identified as high-risk for sanctions evasion. Cabinet Resolution 134/2025 requires reporting entities to apply enhanced measures to correspondent banking relationships with foreign institutions in jurisdictions with inadequate AML controls, and to identify the beneficial owners of any correspondent institution. For a UAE bank maintaining a relationship with a Russian bank — even one not itself designated — this now requires documented enhanced due diligence, ongoing monitoring, and senior-management approval.

Criminal Exposure in the UAE: Penal Code, AML Prosecution, and Asset Freezing

The UAE Penal Code, as restated in Federal Decree-Law 31/2021 (in force 2 January 2022, amended by FDL 36/2022), does not contain a standalone sanctions-evasion offence. However, conduct constituting sanctions evasion will typically engage multiple provisions: Articles 272–274 (fraud and deception), Article 275 (forgery of commercial documents where false documentation is used to conceal the true counterparty), and Article 324 (money laundering as defined by reference to FDL 10/2025). The money-laundering charge is the most significant because FDL 10/2025's removal of the statute of limitations means that historical transactions — potentially stretching back to 2014, the date of the original Russia sanctions programme — could in theory be prosecuted without temporal limitation.

Personal manager liability under FDL 10/2025 is a material development. Under the prior FDL 20/2018 regime, criminal liability attached primarily to the legal person. FDL 10/2025 introduces express provisions holding directors, senior managers, and compliance officers personally liable where the entity's non-compliance results from their wilful default, negligence, or failure to implement required controls. For the GC or CCO of a UAE-licensed financial institution or DNFBP, this is an existential risk: a finding that the institution processed transactions with an SDN-listed counterparty, and that the compliance officer failed to implement adequate screening, could result in personal criminal prosecution, imprisonment under FDL 31/2021, and professional disqualification.

Asset freezing in UAE criminal proceedings is governed by Federal Decree-Law 38/2022 (the Criminal Procedure Law). The Public Prosecution has authority under Articles 94–97 to apply ex parte for precautionary asset-freezing orders against suspects in money laundering and financial crime investigations. These orders are broad in scope and can cover bank accounts, real property, investment portfolios, and shares in UAE-incorporated entities. Critically, DIFC Court Law 2/2025 and the ADGM decision in A17 v B17 [2025] have confirmed that DIFC and ADGM courts can issue worldwide freezing orders in support of foreign proceedings without requiring a local asset nexus — meaning that US or EU enforcement authorities can use UAE courts as a platform for global asset preservation, not merely for UAE-situated assets.

Extradition exposure is also relevant. UAE extradition arrangements are governed by Federal Law 39/2006 as amended by Federal Decree-Law 38/2023. The UAE maintains bilateral extradition treaties with a limited number of states; the US is not among them, and there is no UK–UAE extradition treaty currently in force. However, the absence of a formal treaty does not preclude case-by-case extradition requests through diplomatic channels, and the UAE has in practice transferred individuals to US custody on an ad hoc basis. More significantly, UAE prosecutors may themselves initiate parallel domestic prosecutions based on the same underlying conduct — the aut dedere aut judicare principle embedded in the UAE's international cooperation framework under FDL 39/2006.

Strategic Risk Management: Compliance Architecture for Dual-Exposure UAE Entities

UAE entities with genuine exposure to OFAC secondary sanctions risk — whether as principals, intermediaries, or service providers — require a compliance architecture that simultaneously addresses US, EU, UK, and UAE domestic obligations. A single-jurisdiction compliance programme is no longer adequate. The starting point is an enterprise-wide sanctions risk assessment that maps each business line, each counterparty jurisdiction, and each payment corridor against the relevant SDN, EU Consolidated List, and UK OFAC-equivalent (OFSI) lists, updated in real time. This is not a box-ticking exercise: OFAC's guidance on the 50 Percent Rule requires look-through analysis to identify indirect SDN ownership, which cannot be accomplished through vendor-list screening alone.

For UAE free-zone entities in particular, the beneficial ownership register required by Cabinet Decision 109/2023 should be reviewed not only for domestic compliance purposes but as a sanctions-risk diagnostic. Any shareholder chain that includes a Russian national, a Russian-incorporated entity, or a third-country entity with material Russian ownership should be examined against the SDN List and EU list at each level. Where uncertainty exists about the sanctions status of an ultimate beneficial owner, a formal OFAC general licence or specific licence application may be required before transacting — a process that typically takes 90–120 business days and requires detailed factual disclosure.

Transaction monitoring under FDL 10/2025 and Cabinet Resolution 134/2025 requires reporting entities to flag and investigate transactions that are inconsistent with a customer's stated business profile or that involve jurisdictions identified as high-risk. For UAE businesses in commodities, shipping, or logistics — sectors heavily implicated in OFAC enforcement — this means building bespoke transaction-monitoring rules that capture the specific typologies OFAC has identified: third-country invoicing, triangular shipping routes, unusual payment intermediaries, and discrepancies between declared end-use and actual cargo manifests. The goAML STR filing obligation arises where there are reasonable grounds to suspect sanctions-evasion — a lower threshold than certainty, and one that compliance teams must be trained to identify.

Legal professional privilege under UAE law provides an important but limited protection. Communications between a UAE-licensed lawyer and a client for the purpose of obtaining genuine legal advice are privileged and not disclosable in AML investigations, consistent with FDL 10/2025's carve-out for legal advisers. However, privilege does not attach to communications made to facilitate the commission of a criminal offence, and the characterisation of a transaction as a legal-advice request does not automatically immunise it. Any instruction that carries sanctions-evasion risk should be structured from the outset to preserve privilege, with engagement letters clearly delineating the legal advice function from any operational role.

Responding to OFAC Designation or UAE Domestic Investigation: Procedure and Priorities

If a UAE entity or individual receives notice of OFAC designation — whether through publication on the SDN List, a blocking notice from a US financial institution, or a formal communication from OFAC's Office of Global Targeting — the immediate response must be simultaneous on multiple tracks. Within the UAE, the priority is to assess whether any UAE bank accounts have been frozen by the bank's own sanctions compliance protocols, to identify any pending transactions that may be blocked, and to take advice on whether to file a voluntary STR with the UAEFIU or whether doing so would constitute self-incrimination under FDL 38/2022. These questions require coordinated legal and compliance advice; they cannot be sequenced.

On the US side, a designated person may seek administrative reconsideration from OFAC, submit a Petition for Delisting under 31 CFR Part 501, or seek a specific licence to wind down blocked transactions during the reconsideration period. The delisting process typically requires demonstrating that the factual basis for the designation is erroneous, that the designated person has severed all connections to the conduct giving rise to the designation, and that adequate remedial measures are in place. This is a negotiated process, not a judicial one, and OFAC has wide discretion. UAE-based petitioners should be aware that submitting a delisting petition through US counsel does not create any obligation on OFAC to suspend enforcement in the interim.

Where the UAE Public Prosecution initiates a parallel domestic investigation — which may occur independently of any OFAC action, based on STR filings or UAEFIU analysis — the criminal procedure framework under Federal Decree-Law 38/2022 applies. A suspect has the right to legal representation from the moment of questioning under Article 68, and any statement made without counsel being offered may be challenged. Pre-trial asset-freezing orders can be challenged by way of an application to the criminal court under Article 97, demonstrating that the frozen assets are not proceeds of crime and that the freeze causes disproportionate harm. The standard for discharge is demanding, and applications should be supported by comprehensive evidence of the legitimate commercial origin of the frozen funds.

Practical checklist

• Screen all counterparties against OFAC SDN, EU Consolidated, and OFSI lists before transacting — not only at onboarding.
• Apply the 50 Percent Rule: look through indirect ownership chains to identify unlisted SDN-owned counterparties.
• Update Cabinet Decision 109/2023 beneficial ownership registers and cross-check against all applicable sanctions lists.
• Implement dedicated transaction-monitoring rules for Russia-adjacent typologies: triangular shipping, third-country invoicing, unusual intermediaries.
• Brief senior management and compliance officers on personal liability under FDL 10/2025 — negligence is sufficient for criminal exposure.
• Maintain documented legal-advice engagement structures to preserve privilege under FDL 10/2025's DNFBP carve-out.
• Establish a clear escalation protocol for OFAC blocking notices, bank de-risking events, and UAEFIU information requests.
• If a UAE entity holds Russian-national shareholders at any level, obtain a written sanctions-status opinion before processing any material transaction.

Frequently asked questions

Related guides

• Can a Company Itself Be Prosecuted? Corporate Criminal Liability (Article 66)
• The Privilege Trap: Why Your UAE Internal Investigation May Not Be Protected
• From SCA to CMA: The UAE's New Market Abuse and Insider Trading Regime
• White-Collar & Financial Crime — full guide

Published 15 July 2026. General information only — not legal advice. Contact us for matter-specific advice.