EOCN and Targeted Financial Sanctions in the UAE: What CBUAE, DFSA, FSRA and SCA Firms Must Screen

Listen To Our Podcast🎧

• 1:55

EOCN and Targeted Financial Sanctions in the UAE: What CBUAE, DFSA, FSRA and SCA Firms Must Screen

Secure. Automate. – The FluxForce Podcast

Why does UAE sanctions screening answer to more than one text?

If you run compliance at a UAE bank, exchange house, broker, fund manager or insurer, your sanctions screening answers to more than one text. A federal law, a Cabinet Decision and the EOCN's guidance set the duties. Your own regulator, whether that is the Central Bank, the DFSA in the DIFC, the FSRA in ADGM or the capital markets authority onshore, then writes those duties into its own rules and checks them in inspections. The duties are the same everywhere. The wording, the notification routes and the version numbers are not, and several of them changed between July 2025 and March 2026.

This guide sets out what targeted financial sanctions (TFS) are in the UAE, what the EOCN expects every firm to do, how to resolve a screening hit, and what each of the four supervisors named in the title adds. It ends with the evidence each screening decision should leave behind and the questions MLROs ask most often.

It reflects the EOCN guidance as last amended in March 2026, the DFSA AML module version AML/VER30/04-26 and the FSRA AML Rulebook version VER11.210526, as they stood on 23 October 2026. It isn't legal advice. Check the current text with your supervisor before you change a procedure.

Request the sanctions screening procedure template

The template gives you a written screening procedure to adapt, covering scope, list sources, match handling, escalation and recordkeeping. It is written for several jurisdictions, so add the UAE sections from this guide: the two TFS lists, NAS registration, the weekend route, the CNMR and PNMR routes, your supervisor's notification route and the record fields above. If you want to see screening on your own data first, you can run Sanctions Screening in observation mode: the agent runs next to your team and doesn't clear, block or file anything.

Get the sanctions screening procedure template

What is the EOCN, and what are targeted financial sanctions in the UAE?

The EOCN is the Executive Office for Control and Non-Proliferation. It administers the UAE's targeted financial sanctions regime. The FSRA's AML Rulebook describes it this way: the EOCN is the federal body responsible for administering Cabinet Resolution No. (74) of 2020, and the focal point for implementation of Targeted Financial Sanctions in the UAE. Older documents, including the CBUAE's 2021 announcement, use its former name, the Executive Office of the Committee for Goods and Materials Subject to Import and Export Control.

Three texts make up the legal base. Federal Decree by Law No. 10 of 2025, dated 30 September 2025, is the AML law. It requires financial institutions, DNFBPs and virtual asset service providers to implement forthwith the instructions issued by the Executive Office or any other Competent Authorities concerning Targeted Financial Sanctions. The EOCN's guidance records that this legislation repealed Federal Decree Law No. 20 of 2018 and its amendments, and that Cabinet Decision No. 134 of 2025, the new implementing regulation, repealed Cabinet Decision 10 of 2019 and its amendments. Cabinet Decision No. 74 of 2020, issued on 27/10/2020, sets out the TFS regime itself. The EOCN's Guidance on Targeted Financial Sanctions explains how to meet it in practice, and its cover page reads Last Amended: March 2026.

TFS has a narrow legal meaning in the UAE. In the guidance's words, TFS measures as per UAE legislation apply exclusively on individuals, entities, and groups that are listed on the UAE Local Terrorist List, pursuant to a UAE Cabinet Decision, or the UNSC Consolidated List, pursuant to a decision by the relevant UNSC Sanctions Committee. Those two lists are the "Sanctions Lists" in everything that follows. OFAC, EU and UK designations are not part of the UAE TFS regime, although they still matter, as a later section explains.

The measures are freezing and prohibition. A freeze must happen without delay, which the EOCN defines as immediately or in any case within 24 hours upon designation of an individual, entity, or group on the UAE Local Terrorist List or UNSC Consolidated List. Cabinet Decision 74 uses the same clock: within 24 hours of the Listing decision being issued by the UN Security Council, the Sanctions Committee or the Cabinet, as the case may be. Asset freezing and prohibition measures have no time limit. They stay until the person is delisted or the EOCN cancels the freeze. Upon delisting, all TFS measures are to be lifted immediately without prior approval from EOCN or the relevant SA, unless there is an active Freeze Order related to the delisted Person issued by a Competent Authority (FIU, Public Prosecution, etc.).

The regime reaches past the names on the lists. The freeze also applies to any entity directly or indirectly owned or controlled by an individual, entity, or group designated under (a). It applies as well to any individual or entity acting on behalf of or at the direction of any individual, entity, or group designated under (a) & (b).

Two recent changes affect any procedure written before them. The March 2026 update reflects the reimposition of UN measures on Iran: on 28 September 2025, the UN announced the re-application of resolutions 1696 (2006), 1737 (2006), 1747 (2007), 1803 (2008), 1835 (2008) and 1929 (2010) concerning the Islamic Republic of Iran. The July 2025 update renamed a report. In the EOCN's words, the naming convention of the previously known Funds Freeze Report (FFR), which was used to report Confirmed Name Matches, has been updated to Confirmed Name Match Report (CNMR). If your procedure, goAML templates or training material still say FFR, they are out of date.

What does Cabinet Decision 74 require of every firm?

The EOCN's TFS page puts it in one line: Article 21 of Cabinet Decision 74 of 2020 has set the main TFS obligations on Financial Institutions, Designated Non-Financial Businesses and Professions, and Virtual Assets Service Providers (Reporting Entities). The EOCN groups them into four steps:

• Every change to the Sanctions Lists is pushed to subscribed firms by the EOCN Notification Alert System. A list change reaches the firm through the EOCN Notification Alert System, which triggers a screening run across customers, transactions and related parties. A confirmed match from the screening run leads to freezing measures, applied without delay and without prior notice to the listed person. Once the freezing measures are in place, the firm files a goAML report: a CNMR for a confirmed match or a PNMR for a partial one. The goAML report goes to the EOCN and to the supervisory authority, which checks compliance in its supervision.

1. Register on the EOCN Notification Alert System.
2. Screen customers, related parties and transactions against the two Sanctions Lists.
3. Implement TFS measures: freeze without delay, and make no funds or services available to the listed person.
4. Report the measures taken through goAML.

Registration comes first. Reporting Entities are required to register to the Notification Alert System on the EOCN's website, which sends an email when a name is added, amended or removed. Cabinet Decision 74 then requires firms to regularly screen their databases and transactions against names on lists issued by the UN Security Council, the Sanctions Committee or the Local Lists, and also immediately when notified of any changes to any of such lists. When a match is found, firms must implement freezing measures, without delay, and without prior notice to the Listed Person, immediately when a match is found through the screening process. They must also implement decisions to lift freezing measures without delay when a person is delisted.

Article 21 lists the cases in which a firm must immediately notify the Supervisory Authority: funds identified and actions taken, any match and its details, a match on a previous or occasional customer, and suspicion of a link to a listed person. One of those cases is easy to miss: no action has been taken due to a false positive, and the inability to dismiss such false positive through available or accessible information. The firm must also establish and effectively implement internal controls and procedures to ensure compliance with the obligations arising from this Decision. It must establish and implement policies and procedures that prohibit staff from, directly or indirectly, informing the customer or any third party that freezing or any Other Measures shall be implemented.

The first figure shows the four steps as one chain. Every change to the Sanctions Lists is pushed to subscribed firms by the EOCN Notification Alert System. A list change reaches the firm through the EOCN Notification Alert System, which triggers a screening run across customers, transactions and related parties. A confirmed match from the screening run leads to freezing measures, applied without delay and without prior notice to the listed person. Once the freezing measures are in place, the firm files a goAML report: a CNMR for a confirmed match or a PNMR for a partial one. The goAML report goes to the EOCN and to the supervisory authority, which checks compliance in its supervision.

The EOCN guidance adds a set of standing obligations. Firms must adopt reasonable measures to consider beneficial owners, signatories, and powers of attorney with respect to accounts or transactions held by Reporting Entities when searching for activities by designated Persons. They must ensure having the appropriate human and technical resources to meet the obligations of implementing TFS. They must also conduct ongoing TFS training and awareness sessions to relevant employees and senior management. Supervisory Authorities will verify compliance by FIs, DNFBPs, and VASPs during their supervisory activities.

The penalties sit in the 2025 law. Under its Article 33, any person who violates the instructions issued by the Executive Office or any other Competent Authority related to Targeted Financial Sanctions shall be punished with imprisonment and a fine of not less than twenty thousand dirhams (AED 20,000), or by either of these two penalties. Separately, the supervisory authority can apply the enforcement actions set out under Article (17) of the same law. The guidance also protects firms that act in good faith: a person who freezes funds or refuses services in compliance with Cabinet Decision 74 shall be exempt from any damages or claims, resulting from such actions, including penal, civil, and/or administrative liability.

When must you screen, and what must you screen?

The EOCN expects regular and ongoing screening, with four fixed triggers. The first is upon any updates to the Sanctions Lists. In such cases, screening must be conducted immediately to ensure compliance with implementing freezing measures without delay (within 24 hours). The others are prior to onboarding new customers, upon periodic KYC reviews or if there is a material change in the nature or ownership of the customer, and before processing any transaction of a counterparty. Email alerts are not the only source you should watch: Reporting Entities should also check the UN website for press releases regularly or daily (depending on business model) to remain vigilant on any updates to UN Sanctions Lists.

The list-update trigger is the one that tests your operating model, because a designation can land at any hour. The EOCN says Reporting Entities should have appropriate internal procedures to effectively screen against the UAE Local List and the UNSC Consolidated List at weekends and on public holidays. Its exception is narrow: if the Reporting Entity is not conducting any business activities or transactions and where customers do not have access to any assets or accounts during weekends or holidays, then the screening obligation starts from the first minute of commencement of business and freezing measures must be applied immediately. If your customers can reach their accounts on a Saturday, through cards, apps or instant payments, that exception doesn't help you, and your procedure needs a weekend route.

The scope is wide. The EOCN lists existing customer databases, potential customers and previous customers with no current active accounts/relationship up to a period of 5 years. It adds names of parties to any transactions (e.g., buyer, seller, agent, freight forwarder, etc.) and ultimate beneficial owners (UBOs), both natural and legal. It also lists names of Persons with direct or indirect relationships with designated individuals, entities or groups, and directors and/or agents acting on behalf of customers (including individuals with power of attorney). Cabinet Decision 74 itself names beneficial owners: firms must search for the names of beneficial owners.

Coverage of systems matters as much as coverage of people. If the Reporting Entity uses an automated screening system, all systems containing customer data and transactions need to be mapped to the screening system to ensure full compliance. In practice that means core banking, cards, trade finance, the brokerage or custody platform, the policy administration system and any legacy book that still holds a customer record. A system that isn't mapped leaves its customers and transactions unscreened.

Screening starts with the identifiers the lists publish. It is essential to ensure that the screening is done on the key identifiers first prior to considering any other identifiers, such as aliases. For natural persons the EOCN's examples are the name, date of birth, nationality, ID or Passport Number and Last Known Address. For legal persons they are the entity's name, Trade License Number, Address of Registration and the addresses of branches.

Manual screening is allowed. Reporting Entities may use a manual screening process, depending on the size and nature of their business. So is outsourcing, with a caveat that every MLRO should copy into the procedure: the ultimate obligation on ensuring compliance with TFS obligations lies with the Reporting Entity. Reporting Entities are advised to do their own checks on the robustness of the screening processes implemented by third party service providers when deciding to utilize their services. Our sanctions screening guide explains how name matching works and why it generates so many alerts.

How should you resolve a screening hit?

The EOCN recognises four results: a confirmed name match, a partial name match, a false positive and a negative match. The difference between them is the identifiers, not the name alone.

• Every hit goes to a key identifier check, which compares the name, date of birth, nationality and ID or licence number with the listed entry. If every key identifier matches, the key identifier check returns a confirmed name match. If some identifiers match and the analyst can't settle the question, the key identifier check returns a partial name match. If the identifiers show a different person, the key identifier check returns a false positive, which needs an internal record but no report.

The second figure shows how one hit becomes one of those results. Every hit goes to a key identifier check, which compares the name, date of birth, nationality and ID or licence number with the listed entry. If every key identifier matches, the key identifier check returns a confirmed name match. If some identifiers match and the analyst can't settle the question, the key identifier check returns a partial name match. If the identifiers show a different person, the key identifier check returns a false positive, which needs an internal record but no report.

A false positive needs no report, but it does need a record. When the key identifiers show it isn't the listed person, no reporting is required; however, internal documentation on the False Positive result should be maintained. Write that documentation as if someone will read it in two years, because the record has to be kept. Reporting Entities are required to maintain records of all screening results (Confirmed Name Match, Partial Name Match, and False Positives) for at least five years.

A partial name match is the result that needs judgment. It applies when you can't verify the hit either way after looking at the identifiers. For an existing customer, the EOCN assumes you already hold the ID documents. If they don't settle it, you must either suspend the transaction immediately without delay, refrain from offering any funds or other assets or services or reject the transaction and submit a PNMR to the EOCN and the relevant SA through the goAML platform within five business days from rejecting the transaction or any suspension measure taken.

The EOCN's own worked example shows how small the gap can be. A customer's first and middle name and nationality match a listed person, but the date of birth differs by one year, 1965 against approximately 1966. The firm can't verify the match, so it suspends, files a PNMR and waits for the EOCN.

Cabinet Decision 74 adds a reporting duty here that is easy to miss. If an analyst can't dismiss a possible false positive with the information available, that unresolved case is itself one of the situations the firm must notify. A procedure that lets analysts close hard cases as "probably not him" is exposed on exactly this point.

An unresolved possible false positive is not a closed case. Cabinet Decision 74 lists it among the cases the firm must notify immediately, so the record should show either the identifier that ruled the match out or the report that was made.

What must happen after a confirmed or partial match?

The clock starts at the match. For a confirmed match on an existing customer, the EOCN's instruction is to freeze immediately without delay, refrain from offering any funds or other assets or services and submit a Confirmed Name Match Report (CNMR) detailing the freezing measures to the EOCN and the relevant SA through the goAML platform within five business days from taking any freezing measure. In case the Confirmed Name Match is a potential customer (a prospective client), you must reject the transaction immediately and submit a CNMR. The freeze covers everything the listed person owns or controls: the guidance says to freeze without delay (within 24 hours) and without prior notice to the designated individual, entity, or group, all the funds or other assets.

• A confirmed name match on an existing customer leads to a freeze within 24 hours, without notice to the customer. The freeze is reported in a CNMR through goAML within five business days. A partial name match on an existing customer leads to a suspension of transactions and services. The suspension is reported in a PNMR through goAML within five business days. The PNMR stays open until the EOCN response tells the firm to lift the suspension or to freeze.

The third figure shows the two report routes side by side. A confirmed name match on an existing customer leads to a freeze within 24 hours, without notice to the customer. The freeze is reported in a CNMR through goAML within five business days. A partial name match on an existing customer leads to a suspension of transactions and services. The suspension is reported in a PNMR through goAML within five business days. The PNMR stays open until the EOCN response tells the firm to lift the suspension or to freeze.

A PNMR doesn't close itself. The firm must maintain suspension measures until further instructions are received from EOCN via goAML on whether to cancel the suspension or move to a freeze. For a prospective customer or counterparty the route is different: if the Reporting Entity is unable to obtain the identification documents within a reasonable time (10 business days) of identifying the Partial Name Match, then the transaction or service should be rejected (cancelled) and a PNMR submitted through goAML within five business days from rejection of the transaction or service. Attach the documents you have. Note that the EOCN will not be able to verify the result of a Partial Name Match (Confirmed Match or False Positive) in the event of lack of ID documents.

Both reports have obligatory content. The EOCN lists the full name and ID documents of the matched person, the amount of funds or other assets frozen, with documentary proof such as statements or title deeds, and a description of rejected transaction or service where no funds are held. Look back as well as forward. CNMRs should also be reported on previous business relationships and transactions occurring and accounts held prior to the designation, covering a timeframe of five years. That includes closed accounts, so your screening of former customers has a purpose beyond the record.

Two timing rules sit side by side, and procedures should state both. Cabinet Decision 74 requires firms to notify the supervisory authority immediately in the listed cases. The EOCN guidance sets the goAML reporting window at five business days from the freeze, suspension or rejection. The CBUAE's 2021 announcement put it plainly for banks and other licensed financial institutions: LFIs must immediately notify CBUAE, as well as the Executive Office, of any freezing measures and/or attempted transactions. Our reading is that the freeze and the first notification are immediate, and the goAML report with its attachments follows within the five business days. Confirm the expected route with your supervisor.

Tipping off has a clear boundary. Staff must not tell the customer before the freeze. As long as the customer is notified after the freezing measures have been taken, it is not considered as tipping off. The goAML mechanics, including registration and report types, are covered in our guide to goAML registration and STR filing in the UAE.

Does a freeze cover companies the listed person owns?

Yes, above a threshold, and the EOCN gives a test. When assessing whether a legal entity is majority owned, the criterion is the possession of more than 50% of the proprietary rights of the legal entity or having a controlling interest in it. Its worked example has a listed person holding 51% of a company: the company's funds are frozen, but the two other shareholders' own funds are not, because they aren't listed and there is no evidence they act for the listed person.

A minority stake doesn't trigger a freeze of the company, but it isn't a reason to stop watching. However, Reporting Entities must remain attentive to any changes in the ownership structure of the legal entity, for example if the listed person's stake rises above 50% or they gain control. Any profit or sale proceeds due to the listed person must still be frozen. Control can exist without ownership, which is why the guidance treats acting on behalf of or at the direction of a listed person as its own route to a freeze.

For a screening procedure, this means ownership data is part of sanctions screening, not a separate KYC exercise. If your UBO records are stale, your TFS control is weaker than its match rate suggests.

What do CBUAE, DFSA, FSRA and SCA firms each need to know?

All four supervisors apply the same federal regime. None of them lets a firm opt out of Cabinet Decision 74, and each points back to Article 21. The differences are in how they write it into their own rulebooks, how they want to be notified, and how current their own documents are.

• Federal Decree by Law No. 10 of 2025 sits above Cabinet Decision 74: it requires firms to carry out EOCN instructions on targeted financial sanctions immediately and makes breaching them a crime. Cabinet Decision 74 applies to CBUAE-licensed financial institutions through the CBUAE guidance for licensed financial institutions. Cabinet Decision 74 applies in the DIFC through DFSA AML Rule 10.2.1. Cabinet Decision 74 applies in ADGM through FSRA AML Rule 11.1.1. Cabinet Decision 74 applies to capital market firms supervised by the CMA, formerly the SCA, as Reporting Entities under the EOCN guidance.

The fourth figure shows the structure. Federal Decree by Law No. 10 of 2025 sits above Cabinet Decision 74: it requires firms to carry out EOCN instructions on targeted financial sanctions immediately and makes breaching them a crime. Cabinet Decision 74 applies to CBUAE-licensed financial institutions through the CBUAE guidance for licensed financial institutions. Cabinet Decision 74 applies in the DIFC through DFSA AML Rule 10.2.1. Cabinet Decision 74 applies in ADGM through FSRA AML Rule 11.1.1. Cabinet Decision 74 applies to capital market firms supervised by the CMA, formerly the SCA, as Reporting Entities under the EOCN guidance.

CBUAE: licensed financial institutions

The Central Bank's Guidance for Licensed Financial Institutions on the Implementation of Targeted Financial Sanctions is in its rulebook, marked Effective from 4/7/2021. The CBUAE's announcement at the time said the guidance came into effect on July 8, 2021, so expect both dates in references. It doesn't create new law; it sets out the expectations of the CBUAE for LFIs to be able to demonstrate compliance with these requirements. Its own conflict rule matters now that the 2018 law has been repealed: in the event of a discrepancy between this Guidance and the legal or regulatory frameworks currently in force, the latter will prevail.

The CBUAE's expectations go beyond the screening engine. Its announcement expects each LFI to develop, implement and regularly update a sanctions compliance programme that covers risk assessment, the screening process and staff training. In its words, this should be applied across their institutions, including branches, subsidiaries, and other entities in which LFIs hold a majority interest. For a group with foreign branches, that means the UAE TFS lists and timings reach the whole group's screening set-up as well as the UAE entity.

DFSA: firms in the DIFC

The DFSA's AML module, version AML/VER30/04-26, puts sanctions in chapter 10. Rule 10.2.1 says a Relevant Person must establish and maintain effective systems and controls to ensure that on an ongoing basis it is properly informed as to, and takes reasonable measures to comply with, relevant resolutions or sanctions issued by the United Nations Security Council. It then ties those systems to the federal regime: the systems and controls must enable the Relevant Person to comply with the requirements in Article 21 of Cabinet Decision No. 74 of 2020. The guidance to that rule spells out what this covers, including the obligations to apply or cancel freezing orders, to apply transaction prohibition measures, and to report and cooperate with regulatory authorities.

Group screening tools are allowed in the DIFC, with the same caveat the EOCN gives. However, the Relevant Person retains responsibility for ensuring that its systems and controls are effective to ensure compliance with this module. Rule 10.3.1 adds a duty to track findings from UAE authorities, the FIU, FATF and others, and a Relevant Person must immediately notify the DFSA in writing if it becomes aware of non-compliance by a person with a finding.

FSRA: firms in ADGM

The FSRA's AML Rulebook, version VER11.210526, gives TFS its own chapter 11. Rule 11.1.1 is wider than the DFSA rule on scope: it covers relevant resolutions or Sanctions which it is required to comply with, under legislation applicable in ADGM or any other jurisdiction. Like the DFSA, it requires that the systems and controls referred to in (1) must enable the Relevant Person to comply with the requirements in Article 21 of Cabinet Resolution No. (74) of 2020. It also has its own notification duty: a Relevant Person must immediately notify the Regulator when it becomes aware that it is, for or on behalf of a Person, carrying on an activity, holding assets or doing business that may breach sanctions it must comply with.

The FSRA states its expectations on screening and reporting directly. The Regulator expects Relevant Persons to perform checks on an ongoing basis against their customer databases and records for any names appearing in resolutions or Sanctions. On reporting it warns that failure to do so, including failure to file a report relating to a confirmed or partial match with a Targeted Financial Sanctions list, may result in the Regulator taking appropriate action.

The FSRA also publishes notices. Notice No: FSRA/FCCP/80/2025 of July 2025 tells firms to subscribe to the Executive Office for Control and Non-Proliferation (EOCN) notification system and lists the screening triggers and scope. It also says that a PNMR or FFR is only filed in relation to matches against TFS lists. That notice predates the CNMR rename and still lists the 2018 law, so read it alongside the March 2026 EOCN guidance.

SCA, now the Capital Market Authority: onshore capital market firms

If your licence came from the Securities and Commodities Authority, your supervisor has a new name. Federal Decree-Law No. 32 of 2025 says the CMA shall replace the Securities and Commodities Authority (SCA) established under Federal Law No. (4) of 2000 concerning the Emirates Securities and Commodities Authority and Market, in all its rights, obligations, and contracts, and shall be considered its legal successor. It also provides that the term "Securities and Commodities Authority" shall be replaced with "Capital Market Authority" wherever it appears in any legislation. The decree-law says it shall come into effect as of January 1, 2026.

The CMA's powers include issuing decisions related to preventing and detecting money laundering and terrorism financing activities, including customer due diligence procedures. For this guide we didn't find a separate TFS rule issued by the SCA or the CMA. CMA-supervised brokers, fund managers and other capital market firms are Reporting Entities under Cabinet Decision 74 and the EOCN guidance, so the four steps above apply to them in full. Check the CMA's current circulars for any notification route it adds.

DNFBPs and virtual asset service providers have the same Article 21 duties, under their own supervisors. Our guide to DNFBP compliance in the UAE covers real estate, gold and corporate service providers. For a regulator-by-regulator overview of the wider AML regime, see our UAE jurisdiction page.

What about OFAC, EU and UK sanctions lists?

Your firm may also screen against OFAC, EU and UK lists, for example because of its correspondent banks, its US dollar business or its group policy. Those lists don't trigger the UAE TFS process. The EOCN's instruction is that for designations on other unilateral / multilateral sanctions lists (e.g. OFAC, UKHMT, EU, etc.), contact your Supervisory Authority (SA) on the appropriate course of action for dealing with matches on other sanctions lists.

The goAML reports are not interchangeable. A firm should not use CNMRs or PNMRs for those matches, since CNMRs/PNMRs are used to report matches with the UAE Local Terrorist List and UN List only. Suspicion is a separate route: any suspicious transactions or activities that might be related to sanctions evasion, and which do not include Confirmed or Partial Name Matches to the Sanctions Lists, should be reported to the FIU by raising a STR/SAR through the goAML platform. The FSRA's Notice 80/2025 puts the responsibility plainly: it is the responsibility of a Relevant Person to assess what other Sanctions apply from time to time and how to comply.

In a procedure, this becomes two decision trees that share one screening engine. A hit on the UAE Local Terrorist List or the UN list goes down the TFS route, with its 24-hour freeze and five-day report. A hit on OFAC, EU or UK lists goes down your policy route, with a supervisor consultation and an STR where there is suspicion. Write both routes down, so that an analyst never has to decide at the time which report applies.

What evidence should each screening decision leave?

The rules set the outcomes. They say less about the file. From the duties above, this is our reading of what a defensible screening record holds for each hit. It is a recommendation, not a quotation from any one text.

Keep all of it for at least five years, including false positives, as the EOCN requires. If you use our sanctions screening procedure template, this table is the UAE-specific record section to add to it. The template gives you a structured, written procedure covering screening scope, list sources, match-handling workflows, escalation rules, and recordkeeping requirements. It is written for several jurisdictions, so add the UAE Local Terrorist List, the EOCN Notification Alert System, the CNMR and PNMR routes and your supervisor's notification route.

Who decides what in UAE sanctions screening?

The sources put the decisions with the firm and its people, not its tools. The EOCN says the ultimate obligation on ensuring compliance with TFS obligations lies with the Reporting Entity, even when screening is outsourced. The DFSA and FSRA say the same about group databases. Software, including AI agents, can do most of the rescreening, matching and preparing. The calls on matches, freezes and reports stay with accountable people: the analyst decides the result of each hit, and the MLRO approves every freeze, suspension, rejection and goAML report.

• A list update from the EOCN Notification Alert System reaches the AI agent layer, which rescreens the customer base against the change. The AI agent layer compares name, date of birth, nationality, address and ID numbers, and sends each potential match to the analyst with its reasoning. The AI agent layer writes every proposed clear and every list version used to the audit trail. The analyst decides whether a hit is a false positive, a partial name match or a confirmed name match, and escalates every confirmed or partial match to the MLRO. The MLRO approves the freeze or suspension and the goAML report, and that decision is kept in the audit trail with the evidence.

The fifth figure shows where an AI agent layer fits. A list update from the EOCN Notification Alert System reaches the AI agent layer, which rescreens the customer base against the change. The AI agent layer compares name, date of birth, nationality, address and ID numbers, and sends each potential match to the analyst with its reasoning. The AI agent layer writes every proposed clear and every list version used to the audit trail. The analyst decides whether a hit is a false positive, a partial name match or a confirmed name match, and escalates every confirmed or partial match to the MLRO. The MLRO approves the freeze or suspension and the goAML report, and that decision is kept in the audit trail with the evidence.

Conclusion

Every regulated firm in the UAE, whichever authority licensed it, works from one targeted financial sanctions regime. Cabinet Decision 74 sets four duties, the EOCN's March 2026 guidance explains them, and the 2025 AML law makes breaching EOCN instructions a crime. The CBUAE, DFSA and FSRA write those duties into their own rules. The SCA's firms now answer to the Capital Market Authority.

Most of what the texts ask for is procedure rather than matching technology: a weekend route, every system mapped, partial matches reported rather than closed, CNMR in place of the old FFR, and OFAC hits kept out of the TFS reports. Write down each of those decisions, keep the record behind every hit, and test a sample each quarter.

Ask for an observation-mode run

Request the sanctions screening procedure template

The template gives you a written screening procedure to adapt, covering scope, list sources, match handling, escalation and recordkeeping. It is written for several jurisdictions, so add the UAE sections from this guide: the two TFS lists, NAS registration, the weekend route, the CNMR and PNMR routes, your supervisor's notification route and the record fields above. If you want to see screening on your own data first, you can run Sanctions Screening in observation mode: the agent runs next to your team and doesn't clear, block or file anything.

Get the sanctions screening procedure template

Frequently Asked Questions

About the author

Sahil Kataria

Founder and CEO of FluxForce

Sahil works on secure AI and financial technology for regulated industries. His engineering background spans identity verification, payment security and compliance automation. He has led teams across Africa, the United States, Europe and India.

At FluxForce.ai, his focus is on explainable AI and auditable financial workflows. He writes for banking and compliance teams about the practical decisions behind these systems: how to assess risk, keep controls visible and introduce automation without losing accountability.

View Sahil Kataria author profile →