Our Expert in United Arab Emirates
UAE M&A sanctions exposure has moved from a compliance footnote to a front-of-mind deal risk in 2026, and buyers who treat it as a box-ticking exercise are the ones losing deals or inheriting liabilities. Elevated geopolitical tensions, continued international AML scrutiny and aggressive cross-border enforcement mean that a single sanctioned counterparty in a target’s supply chain, or a weak beneficial-ownership file, can now stop a transaction at signing. This playbook gives in-house counsel, private equity acquirors, banks and transactional lawyers a concrete, deal-level workflow: how to screen targets, how to run enhanced due diligence, when export controls bite, and precisely how to allocate risk in the share purchase agreement.
It takes a position throughout, recommending specific structures over vague “it depends” hedging, and ends with a decision framework your deal team can apply immediately.
Sanctions, export-control and AML risk in UAE transactions are three distinct problems requiring three different remedies. Treat them separately from the first day of diligence, screen continuously, and hard-wire the results into your SPA. Here is the immediate action list.
Consider two common scenarios. In the first, a private equity buyer is days from signing when screening reveals that the target’s largest raw-material supplier is majority-owned by a listed party. Because the supply contract is central to the target’s revenue, the deal cannot close as structured; the buyer must either force divestment of the contract or walk. In the second, a strategic acquirer discovers mid-diligence that the target’s bank has frozen certain accounts pending an AML inquiry. The transaction proceeds, but only with a substantial escrow and a binding remediation programme. Both outcomes were avoidable with earlier screening, and both illustrate why UAE M&A sanctions and AML risk are now deal-defining.
Foreign sanctions may affect a UAE transaction where their respective jurisdictional rules are engaged, including through the parties, ownership structure, financing arrangements, payment flows or other relevant connections. They should, however, be distinguished from the UAE sanctions framework. UAE targeted financial sanctions implement relevant UN Security Council resolutions and the UAE Local Terrorist List. US sanctions may apply where there is a US jurisdictional nexus, while certain US sanctions programmes can also create secondary-sanctions exposure for non-US persons. UK and EU sanctions have their own jurisdictional scope. Deal teams should therefore identify the sanctions regimes relevant to the particular transaction rather than assume that all foreign sanctions regimes apply generally to UAE transactions.
The UAE has invested heavily in strengthening its AML/CFT framework in line with international standards set by the Financial Action Task Force. That maturing regime raises the compliance bar for targets: buyers should expect regulators and correspondent banks to demand robust KYC and beneficial-ownership evidence. In UAE M&A sanctions and AML diligence, a target with weak controls is not just a reputational issue, it is a source of potential fines, licence risk and integration delay.
UAE M&A sanctions and AML compliance sits across a layered set of federal regulators, free-zone authorities and international partners. Understanding which body owns which risk is the first step to structuring around it. The current federal AML/CFT/CPF framework is principally set out in Federal Decree-Law No. 10 of 2025 regarding Anti-Money Laundering, and Combating the Financing of Terrorism and Proliferation Financing and Cabinet Resolution No. 134 of 2025, its Executive Regulations. The UAE targeted-financial-sanctions framework includes Cabinet Resolution No. 74 of 2020, under which relevant UN Security Council sanctions and the UAE Local Terrorist List are implemented.
At the federal level, the Central Bank of the UAE supervises licensed financial institutions for AML/CFT/CPF compliance. The UAE Financial Intelligence Unit is established within the Central Bank but acts independently and exclusively receives suspicious-transaction reports from financial institutions, designated non-financial businesses and professions and virtual asset service providers. The Ministry of Economy and Tourism supervises designated non-financial businesses and professions falling within its remit for AML/CFT/CPF purposes. Export and non-proliferation controls should be considered separately, with the Executive Office for Control and Non-Proliferation performing the functions assigned to the competent authority under the UAE controlled-goods framework.
UAE targets may operate within financial free zones that have their own AML regulatory frameworks. In ADGM, the FSRA’s Anti-Money Laundering and Sanctions Rulebook applies to the Relevant Persons within its scope. In the DIFC, Relevant Persons are subject to the DFSA’s AML framework. These requirements operate alongside applicable UAE federal AML/CFT/CPF legislation and the federal targeted-financial-sanctions framework, so buyers should identify both the federal requirements and the financial free-zone rules applicable to the particular target and activity.
Beyond UAE requirements, foreign sanctions regimes may also be relevant depending on their respective jurisdictional rules and the particular transaction. US sanctions may apply through a US nexus and, under certain programmes, may create consequences for non-US persons. UK sanctions apply within their statutory territorial and personal scope, including to UK persons wherever they operate. EU sanctions similarly apply within EU jurisdiction, including to EU nationals and entities incorporated under Member State law. Banking, financing and contractual requirements may also impose broader commercial restrictions than UAE law itself.
| Regulator | Core remit | Practical relevance in M&A |
|---|---|---|
| Central Bank of the UAE | AML/CFT supervision of financial institutions; hosts the Financial Intelligence Unit | Sets KYC, monitoring and reporting standards you will test in diligence |
| Ministry of Economy | AML supervision of designated non-financial businesses; trade and export-related policy | Relevant where the target is a DNFBP or handles controlled goods/technology |
| ADGM (FSRA) / DFSA | Free-zone AML and financial-sanctions rulebooks | Governs targets domiciled in ADGM or DIFC; separate compliance regime |
| FATF / foreign authorities | International AML standards; OFAC/EU/UK sanctions | Drives secondary-sanctions and correspondent-bank risk |
The core of any credible sanctions and AML programme is a repeatable workflow that runs from intake to closing. Do not delegate this to a single pre-closing check, screen in stages and escalate on hits.
Begin by separating the three risk streams because each requires different information and analysis. Sanctions diligence is principally person-, entity-, ownership- and transaction-centric: under the UAE targeted-financial-sanctions framework, the analysis should cover the relevant sanctions lists as well as applicable ownership and control rules. Export-control diligence focuses on whether the target handles goods, software or technology falling within the UAE controlled-goods regime and whether its activities require permits or approvals. AML diligence focuses on the target’s applicable regulatory obligations, beneficial ownership, customer due diligence, transaction monitoring, reporting and wider financial-crime controls.
Effective screening should use the official sanctions lists relevant to the transaction, together with original corporate documents and reliable commercial screening tools where appropriate. Commercial databases can assist with sanctions, PEP and adverse-media screening but should supplement rather than replace verification against official sources and underlying corporate evidence. UAE beneficial-ownership information should principally be verified through the target’s statutory UBO records and supporting documentation, as registrar-held beneficial-ownership information is not generally available as a public registry. Adverse-media searches may also be conducted in relevant languages where this is appropriate to the target and its activities.
Run screening at three defined points and set clear escalation thresholds:
Set a rule that any potential list match, any PEP with control, and any counterparty in a comprehensively sanctioned jurisdiction is escalated to counsel before the deal proceeds.
Treat the following as automatic escalation triggers: opaque ownership chains with nominee shareholders; counterparties or suppliers in comprehensively sanctioned territories; unexplained cash flows or round-tripping; missing or backdated KYC files; frozen accounts or a bank exit; and manufacturing of goods with obvious dual-use or defence applications. A hit against a red flag does not automatically kill a deal, but it must be cleared, quantified or contractually allocated before closing.
Once screening flags the risks, due diligence is where you gather the evidence to price and allocate them. The choice between share and asset acquisitions materially affects what liabilities transfer; the Share Purchase vs Asset Purchase in the United Arab Emirates (2026) analysis is a useful companion when you decide whether to carve out contaminated assets.
Obtain the full corporate chain: constitutional documents, share registers, group structure charts, and details of every intermediate holding entity. Map ownership up to the ultimate beneficial owners and cross-check each layer against sanctions lists. Offshore intermediate entities warrant particular attention because they can obscure ownership that would otherwise trigger sanctions exposure.
Beneficial-ownership diligence should identify the natural persons who ultimately own or control the target and test that conclusion against the target’s statutory UBO records, shareholder records, constitutional documents and supporting evidence. For entities governed by Cabinet Resolution No. 109 of 2023, the analysis does not stop at a 25% ownership or voting-rights threshold: control by other means and, where no individual can otherwise be identified, the applicable senior-management fallback must also be considered. Nominee arrangements should be investigated to identify the underlying principal. The seller may also be required to confirm the completeness of the ownership information provided and to give appropriately drafted sanctions warranties.
Review banking relationships, correspondent-bank arrangements and significant payment flows. Identify politically exposed persons where relevant under the applicable AML framework and apply the required enhanced due-diligence measures. Adverse-media findings should be assessed against reliable evidence and investigated where material. Any resulting contractual protection should be tailored to the underlying identified risk rather than assuming that representations, warranties or escrow are appropriate in every case.
For AML-regulated targets, test the operation of the compliance framework rather than relying solely on written policies. Subject to applicable confidentiality and data-protection restrictions, review appropriate samples of customer due-diligence files, compliance monitoring, governance, escalation procedures, remediation measures and legally disclosable regulatory correspondence, and interview the compliance function. A sample document request may include constitutional and shareholding documents, the UBO register and supporting evidence, AML/CFT/CPF policies and risk assessments, appropriate samples of customer KYC files, compliance monitoring and remediation records, and relevant export-control permits and classification determinations. Copies of suspicious-transaction reports or detailed STR filing histories should not be requested as ordinary diligence material; information relating to STRs is subject to statutory confidentiality requirements.
Export controls can be material in UAE M&A where a target deals in goods, software or technology falling within the UAE controlled-goods and non-proliferation regime. Federal Decree-Law No. 43 of 2021 regulates specified forms of circulation of scheduled goods, including import, export, re-export, transshipment, in-transit shipping, transportation between ports and brokerage activities. Whether a permit or other approval is required should therefore be determined by reference to the particular item and activity involved.
The first question is whether the target handles goods, software or technology included in the current UAE Schedule of Goods Subject to Control and Non-Proliferation under Cabinet Resolution No. 156 of 2025. The classification exercise should cover the target’s products and, where applicable, controlled software and technology, together with existing permits, end-user documentation and compliance history.
A share acquisition should not, without further analysis, be characterised as a controlled transfer merely because ownership of the target changes. The UAE regime applies to the regulated circulation of scheduled goods, which may include listed software and technology. Buyers should therefore determine whether signing, closing or post-closing integration will involve a regulated activity under Federal Decree-Law No. 43 of 2021 or require an existing permit or approval to be obtained, amended or updated.
Apply a structured sequence: identify the goods, software and technology handled by the target; classify them against the current UAE control schedule; review existing permits, end-user documentation and compliance history; and determine whether the transaction or post-closing operating model involves any regulated circulation or requires a permit or approval to be obtained or amended. Where a permit is necessary for lawful closing or continued operation of a material part of the business, it should be addressed expressly in the transaction timetable and, where appropriate, as a condition precedent to closing.
The three risk streams look similar from a distance but demand different evidence, timing and contractual remedies. The table below sets them side by side.
| Dimension | Sanctions screening | Export controls | AML / CFT / CPF |
|---|---|---|---|
| Legal basis & source | UAE targeted-financial-sanctions framework, including the UN Consolidated List and UAE Local Terrorist List; relevant foreign sanctions regimes assessed separately | Federal Decree-Law No. 43 of 2021, Cabinet Resolution No. 97 of 2024 and the current Schedule of Goods Subject to Control and Non-Proliferation under Cabinet Resolution No. 156 of 2025 | Federal Decree-Law No. 10 of 2025, Cabinet Resolution No. 134 of 2025 and applicable sector-specific or financial-free-zone rules |
| Primary regulators/enforcers | Executive Office for Control and Non-Proliferation and relevant supervisory and enforcement authorities; foreign authorities only where the relevant foreign sanctions regime applies | Executive Office for Control and Non-Proliferation, customs authorities and other competent authorities within their respective functions | Relevant supervisory authority; UAE Financial Intelligence Unit for suspicious-transaction reporting; competent law-enforcement authorities |
| Scope (who/what) | Designated persons and entities, persons or entities owned or controlled by them, persons acting on their behalf or at their direction, and affected funds or other assets | Goods, software and technology falling within the UAE controlled-goods regime and the regulated circulation or brokerage of those items | Customer due diligence, beneficial ownership, transaction monitoring, suspicious-transaction reporting, governance and other applicable AML/CFT/CPF obligations |
| Trigger in M&A | Designated-party exposure, ownership or control by a designated person, frozen assets, prohibited dealings or other applicable sanctions restrictions | Target handles controlled goods, software or technology; existing or proposed activities require a permit or other approval | Material weaknesses in KYC, beneficial-ownership verification, monitoring or reporting; regulatory investigation; suspicious financial flows or other identified compliance deficiencies |
| Typical consequences | Mandatory asset freezing, prohibition on making funds or services available, reporting obligations and potential administrative or criminal consequences | Permit restrictions or refusal, administrative or criminal consequences, seizure or detention of goods and disruption to regulated activities | Regulatory remediation, administrative or criminal consequences, licence or supervisory action and business disruption |
| Due-diligence focus | Official-list screening, ownership and control analysis, material counterparties, transaction flows and relevant adverse information | Classification, existing permits, end-user documentation, customs records where relevant and compliance history | Statutory UBO records, customer due-diligence systems, AML/CFT/CPF policies and risk assessments, monitoring, governance and legally disclosable compliance records |
| Deal impact (structure) | Specific sanctions conditions, suspension or termination rights, tailored warranties and, where legally permissible, other risk-allocation measures | Permit or approval conditions precedent, restructuring or asset carve-outs, and appropriate post-closing covenants | Pre- or post-closing remediation, tailored warranties, covenants, indemnities or holdbacks for identifiable historical liabilities |
| Timing sensitivity | Continuous; sanctions-list and ownership/control status should be rechecked before signing and closing | Permit and approval requirements should be identified early and reflected in the transaction timetable | Ongoing; some deficiencies may be capable of remediation before or after closing, while mandatory reporting obligations must be addressed when triggered |
| Evidence required | Official-list results, ownership and control evidence, corporate records and documented screening analysis | Permit copies, classification determinations, end-user documentation, relevant customs records and compliance records | UBO records and supporting evidence, appropriate KYC samples where legally permissible, policies, risk assessments, monitoring and remediation records |
| Remediation options | Suspend or restructure the transaction, replace or exit relevant counterparties, seek any available authorisation, or terminate where the transaction cannot lawfully proceed | Obtain or amend required permits, restructure affected activities or assets, delay closing where necessary, or make required regulatory submissions | Strengthen controls, implement a remediation plan, impose contractual protections and make any mandatory or otherwise appropriate regulatory report |
The key implications for structuring are clear:
The right structure follows from the diligence findings. Do not default to boilerplate reps; draft to the specific risks identified.
Where sanctions or AML risk is material to the transaction, the SPA should include representations and warranties calibrated to the target’s activities and the applicable legal regimes. Sanctions warranties may address designation status, ownership or control by designated persons, prohibited dealings and material sanctions investigations or notices, using a clearly defined concept of Applicable Sanctions. AML warranties should reflect the target’s actual regulatory status and may address compliance, customer due diligence, monitoring and reporting systems to the extent applicable and legally disclosable. Avoid unqualified warranties that effectively require every owner, director or counterparty to be unsanctioned under every sanctions regime worldwide.
Where a permit, regulatory approval, restructuring step or termination of a problematic counterparty relationship is necessary for lawful closing, it should be addressed through an express condition precedent rather than relying solely on a warranty. A new sanctions designation should be addressed through a specific sanctions condition, suspension mechanism and illegality or termination provision where appropriate, rather than relying only on a general material adverse change clause.
For quantified historical or remediable compliance liabilities that are legally capable of contractual allocation, an escrow or holdback tied to a defined remediation plan may be appropriate. It should not, however, be used as a substitute for resolving a current sanctions prohibition, dealing with frozen funds or other assets, or obtaining a permit or authorisation required for the transaction to proceed lawfully. Where escrow is used, the agreement should establish clear release conditions, milestones and a longstop date.
Indemnities may be appropriate for identifiable historical or contingent liabilities that cannot be fully quantified at signing, provided the seller has sufficient covenant strength. A price adjustment may be appropriate for discrete and measurable exposures. Where the target or a relevant owner becomes designated, closing should first be suspended while the applicable freezing, reporting and authorisation consequences are assessed. Termination may be appropriate where the transaction cannot lawfully proceed or an essential permit or approval cannot be obtained. Where a condition precedent can eliminate a material regulatory risk before closing, it will generally provide stronger protection than a post-closing indemnity.
Risk allocation does not end at closing. Build an integration-period compliance programme that carries forward the diligence findings.
Impose audit and information rights allowing the buyer to test remediation progress, and continue periodic sanctions screening of counterparties acquired with the business. Assign ownership of the remediation plan to a named individual with a reporting line to the board.
Where AML deficiencies surface, first determine whether any mandatory reporting obligation has been triggered and identify the correct authority. Suspicious-transaction reports by reporting entities are submitted to the UAE Financial Intelligence Unit. Other regulatory notifications or remediation may need to be addressed with the target’s competent supervisory authority, which may include the Central Bank of the UAE, the Ministry of Economy and Tourism, the DFSA or the relevant ADGM authority depending on the entity and activity concerned. Targeted-financial-sanctions reporting should be treated separately under the applicable EOCN framework.
If diligence or integration identifies a potential historical sanctions breach, AML reporting failure or other regulatory deficiency, the first step is to determine whether notification is mandatory and which authority is competent to receive it. Where disclosure is not expressly mandatory, the merits and timing of any voluntary notification should be assessed case by case with counsel, taking into account the applicable regulatory framework, confidentiality and privilege, the seriousness of the issue and the remediation undertaken. It should not be assumed that voluntary disclosure automatically results in more favourable enforcement treatment.
Use these rules to pick the right mechanism once diligence is complete.
| Situation | Recommended structure |
|---|---|
| Exposure quantifiable; fix likely within a short, contractible window; seller solvent | Escrow / holdback tied to remediation plan |
| Target directly listed, or licence denial probable, or authorisations unobtainable before closing | Termination / right to walk |
| Risk latent and hard to quantify; seller can stand behind indemnities | Indemnity-heavy approach with extended survival |
| Third-party licence or regulator consent required for core assets or tech transfer | Condition precedent (licence / consent) |
Managing UAE M&A sanctions, export-control and AML risk in 2026 is a discipline, not a checklist: screen early and continuously, verify beneficial ownership against primary sources, classify controlled goods before you sign, and translate every material finding into a specific SPA remedy. The buyers who succeed are those who separate the three risk streams, price them honestly, and match each to the right structure, escrow, condition precedent, indemnity or termination. Do that, and UAE M&A sanctions risk becomes a manageable, allocable feature of the deal rather than a last-minute deal-stopper. Deal teams facing a live transaction should obtain bespoke screening and SPA drafting tailored to the target’s specific profile.
This article was produced by Global Law Experts. For specialist advice on this topic, contact Jakob Kisser at Kisser Legal, a member of the Global Law Experts network.
posted 20 minutes ago
posted 38 minutes ago
posted 56 minutes ago
posted 1 hour ago
posted 1 hour ago
posted 2 hours ago
posted 3 hours ago
posted 3 hours ago
posted 3 hours ago
posted 4 hours ago
posted 4 hours ago
posted 4 hours ago
Find the right Legal Expert for your business
Send welcome message