Sanctions compliance is often treated as a formality, something to complete once at onboarding and file away. But in the UAE, both the letter of the law and the practical reality of live, constantly-updated sanctions lists say otherwise. Here’s why a one-time check is no longer enough, and what businesses should be doing instead.
A client passes sanctions screening at onboarding. The file is marked clear, and the relationship moves forward.
But sanctions lists don’t stand still and neither do clients.
The UAE’s targeted financial sanctions (TFS) regime is built around this reality. Under Cabinet Decision No. 74 of 2020, businesses must screen against the UAE Local Terrorist List and the UN Consolidated List not just once, but immediately whenever those lists are updated, before onboarding, before processing transactions, and whenever a customer’s details change. A client who was clear at the start of a relationship may not stay that way and if screening is treated as a one-off onboarding exercise, an important change can easily be missed.
And it isn’t only sanctions lists that move.
Ownership structures shift. New beneficial owners or controlling persons can enter the picture. A business might expand into new jurisdictions or start dealing with new counterparties. Any of these can change the sanctions exposure of a relationship that looked straightforward at onboarding.
This is why sanctions screening should be treated as an ongoing control, not a one-time check. The point is written into the law itself and the UAE’s AML/CFT framework, currently Federal Decree-Law No. 10 of 2025 and its executive regulation, Cabinet Resolution No. 134 of 2025, expects businesses to keep watching a relationship for as long as it lasts, not just at the start.
For firms in the financial free zones, this expectation is spelled out even more directly. ADGM’s FSRA and DIFC’s DFSA AML rulebooks which require “ongoing sanctions screening”, each set out this obligation in addition to, not instead of, the federal requirements.
Technology can make this easier. Automated screening tools can flag changes and generate alerts, but the technology is not the control by itself. Someone still needs to understand each alert, investigate potential matches, and make sure the right action follows.
The real risk is not a client who fails a sanction check today. It is a client who would fail one today but was only ever checked once.
So perhaps the real question is not “Did we screen this client?”
It is “Would we know if their sanctions status changed tomorrow?”
Speak to our Compliance Team to explore how effective screening and ongoing monitoring can strengthen your compliance framework.
Contact Details
Email: admin@bankslegal.com
WhatsApp: +971 55 655 2447
