Targeted financial sanctions: screening, freezing and reporting in practice

Targeted financial sanctions are the one obligation where the clock matters more than the paperwork. The law defines them plainly: freezing funds, and prohibiting those funds being made available, directly or indirectly, for the benefit of a designated person, entity or organisation.

Two words in that definition carry the weight. Indirectly means the duty is not discharged by declining a payment to a named person; it extends to routes through others. And available is broader than payment — it reaches assets and economic resources placed within reach.

Where designations come from

There are two sources, and a programme needs both. The law refers to persons and organisations designated by resolutions issued by the Cabinet regarding terrorist lists, and by the United Nations Security Council under Chapter VII of the UN Charter.

The UAE's competent authority is the Executive Office for Control and Non-Proliferation, which the law names as the body concerned with implementing targeted financial sanctions in the State. In its current published implementation guidance, the Executive Office states that targeted financial sanctions are to be implemented in accordance with Cabinet Decision No. 74 of 2020 and the relevant Security Council resolutions, and that the sanctions lists are the UN Consolidated List and the Local Terrorist List.

Politically exposed persons and adverse media are a different obligation. They are risk signals that drive due diligence — the regulations require PEP measures such as senior-management approval, source-of-funds enquiry and enhanced monitoring — but PEP status or adverse-media information, by itself, does not trigger a targeted-financial-sanctions freezing obligation. The freezing duty attaches to designations, and to entities owned or controlled by, and persons acting for or at the direction of, a designated person. Folding all of it into one "screening" bucket blurs that line, and a sanctions match and a news article then attract the same handling.

Screening has four triggers, and they are published

The Executive Office sets out four circumstances in which screening must be undertaken: on any update to the sanctions lists, immediately; before onboarding a new customer; on a periodic know-your-customer review, or where there is a material change in the nature or ownership of the customer; and before processing any transaction of a counterparty.

Those first and last triggers are easy to miss in a programme designed mainly around onboarding and periodic review.

This is also why the Executive Office makes registration an obligation in its own right, before screening: reporting entities are required to register on its Notification Alert System so that list updates arrive automatically. A programme that screens diligently against a list it learns about late has a 24-hour clock that started without it.

What happens next depends on which of four results you have

The Executive Office publishes four screening outcomes, and the required action differs for each. Getting this sequence right matters more than acting fast in the abstract.

A confirmed name match is one where the subject matches all the key identifiers published on the list. If that is an existing customer, you freeze immediately and without delay, refrain from providing any funds, assets or services, and report through the applicable goAML TFS report to the Executive Office and your supervisory authority within five business days of taking the freezing measure. If it is a prospective customer, you reject the transaction immediately and report the case.

A partial name match is one where some key identifiers match and you cannot yet conclude either a confirmed match or a false positive. Here the required action is not a freeze. You first cross-check the published identifiers against your own customer, beneficial-ownership and other data, and external sources where appropriate, to see whether the match resolves either way. Where it does not, you suspend the transaction without delay, refrain from providing funds, assets or services as applicable, and file a Partial Name Match Report (PNMR) through goAML within five business days of implementing the suspension — and the suspension stays in place until the Executive Office responds on the status of the match. The distinction is deliberate: a freeze is what a designation produces, and an unresolved identity question is not yet a designation.

A false positive is a match that examination of the key identifiers rules out. Once the match is resolved internally as a false positive, normal business may proceed, provided no other suspicion or concern remains; retain evidence of the verification and make it available to competent authorities on request.

A negative match is no match at all.

Freezing, when it applies, is broad. It reaches funds and assets owned or controlled wholly or jointly, directly or indirectly, by a designated person; assets derived from them; and anything held by a person acting on behalf of or at the direction of a designated person. For companies, the Executive Office's test is more than 50% of proprietary rights or a controlling interest — and a minority holding is still caught where there is evidence the designated person exercises control.

A freeze has no expiry. It stands until the person is delisted, at which point measures are lifted immediately without needing prior approval — unless a competent authority has a separate freeze order in place — or until the Executive Office communicates a cancellation.

You need to be able to show your work

Every screening run, every match considered, every decision to treat a hit as a false positive, with the reasoning and the date. The false-positive record is the one the Executive Office expressly asks you to retain — which is a good indication of how it expects the file to read. Acting correctly and being unable to show how you got there are different problems, and only one of them is visible to a supervisor.

Out of hours, and what is actually required

Sanctions lists do not change during business hours only, and the Executive Office addresses this directly. Reporting entities are expected to have appropriate internal procedures to screen against both lists over weekends and public holidays and to prevent access to or use of funds that may be subject to freezing. Where a reporting entity conducts no business and customers have no access to accounts or assets during that period, the screening obligation starts from the first minute business commences, and freezing measures must then be applied immediately.

That is the requirement. How you meet it is your design decision. In our experience the arrangement that survives a real out-of-hours designation is a named person with standing authority to apply a freeze, a documented escalation path to reach them, and a control that prevents access in the interim — but that is a ZLORYX recommendation, not a published requirement, and a firm that achieves the same outcome another way has met the obligation.

Supervisory authorities are themselves required to ensure full and immediate compliance with Executive Office instructions, through on-site visits and continuous follow-up, and to impose effective, proportionate and dissuasive penalties where they find otherwise.

One thing risk-based treatment does not reach

The regulations allow simplified due diligence where low risk is identified. They also state that simplified measures must still ensure full implementation of the Executive Office's targeted-financial-sanctions instructions. Sanctions screening is not a control you scale down with risk. Where proliferation-financing risk is high, the regulations push the other way and require enhanced internal controls aimed at detecting and preventing violation, non-implementation or circumvention of those instructions.

A closing caution

Lists change. Nothing in this explainer names a designation, and it should not: designations and delistings are live material, and the only correct source for what is on a list today is the authority that maintains it. Treat any list extract inside your own systems as a copy with a date on it, and check the source.

This explainer describes the obligation as at the review date shown above.