New Requirements for UAE Companies Under Updated Targeted Financial Sanctions Guidance

Key Points:

• Through updated guidance, the UAE has introduced a significant change to how it administers sanctions regimes—expanding its focus from a limited implementation of multilateral sanctions to more broadly imposing its own unilateral targeted sanctions and associated freeze orders and reporting requirements.
• The new regime applies to all persons in the UAE, placing obligations on them to register with the Executive Office to receive electronic notifications, screen their potential and existing customers against certain sanctions lists, freeze the funds of and cease providing funds to any individual or entity that is on any one or more such sanctions lists and notify the Executive Office within two business days from taking any such action. The updated guidance sets out additional obligations if the relevant UAE person is a financial institution or DNFBP, terms that are defined in more detail below.
• Any violator of the UAE’s targeted financial sanctions regime is subject to imprisonment or a fine of not less than AED 50,000 and not more than AED 5,000,000 per violation. Financial institutions and DNFBPs face additional administrative penalties, including the cancellation of their trade license and being banned from working in the sector related to their violation.

  ---

On May 6, 2021, the Executive Office of the Committee for Goods Subject to Import and Export Controls (the “Executive Office”) issued important updated guidance (the “Guidance”) on the measures that persons in the UAE, financial institutions, and designated non-financial businesses and professions ("DNFBPs") must take to comply with the United Arab Emirates’ (UAE) targeted financial sanctions regime. The Executive Office is one of the authorities responsible for overseeing the administration and implementation of the UAE’s export controls regime as well as targeted financial sanctions. The Guidance is issued in connection with Cabinet Resolution 74 of 2020, which regulates the UAE’s terrorist lists and implements certain United Nations Security Council resolutions aimed at preventing and suppressing terrorism, terrorist financing and the proliferation of armaments (the “Resolution”).

The Guidance introduces a significant change to the regulatory landscape in the UAE, shifting the UAE sanctions regime from one that was largely only implementing multilateral (United Nations Security Council) sanctions, to one that also imposes its own unilateral targeted sanctions and associated freeze orders and reporting requirements. Currently, the targets of UAE sanctions are principally individuals and entities designated on sanctions lists for terrorism-related reasons.

This Alert outlines the UAE legal framework for targeted financial sanctions (Part I); the new requirements issued under the Guidance (Part II); and the criteria for determining whether a UAE entity is a financial institution or DNFBP subject to additional requirements under the Guidance (Part III).

I. UAE Legal Framework for Targeted Financial Sanctions

This chart sets out the UAE’s legal framework in relation to targeted financial sanctions and provides a brief summary of the relevant laws.

II. Targeted Financial Sanctions Obligations Under the New Guidance

Article 60 of the AML Regulations, summarized in the above linked chart, requires compliance with instructions issued by any UAE authority that is responsible for implementing the United Nations Security Council resolutions regarding the prevention and suppression of terrorism and terrorist financing. Although the Guidance does not make an explicit link to Article 60, Article 60 nonetheless presumably provides a basis for the Executive Office—as a UAE authority responsible for implementing United Nations Security Council resolutions—to articulate obligations in the Guidance that have the force of law.

In this respect, the Guidance articulates significant obligations that, although intended mainly for financial institutions and DNFBPs, extend requirements applicable to all legal and natural persons in the UAE. Specifically, all natural and legal person in the UAE must:

1. Register with the Executive Office’s website (available here) to receive automated email notifications.
2. Screen, by undertaking ongoing and daily checks against the sanctions lists issued by the United Nations and the UAE, including the UAE’s local terrorist list (“Sanctions Lists”). These checks must be done against existing customer databases, names of parties to any transactions, potential customers, beneficial owners, names of individuals with whom the relevant UAE person has a direct or indirect relationship, directors and/or agents acting on behalf of customers.
3. Apply targeted financial sanctions by freezing the funds of and ceasing to make funds available to those individuals and entities listed on one or more of the Sanctions Lists. Importantly, freezing is distinct from rejecting. Rejecting a funds transfer involves a refusal to process the transaction and a return of the funds to their original owner. Freezing requires that the person applying the targeted financial sanctions seize the funds and hold them—not making them available to their original owner.
4. Notify the Executive Office within two business days from taking any action referenced in (c) above.

In addition to the above, financial institutions and DNFBPs have the following additional obligations:

1. Cooperate with the Executive Office and relevant supervisory authorities in verifying the accuracy of the information submitted.
2. Implement the decisions of the United Nations Security Council and UAE Cabinet, including the removal of targeted financial sanctions where appropriate.
3. Set and implement:
   1. Internal controls and procedures to ensure compliance with the obligations arising from the Resolution.
   2. Policies and procedures that prohibit staff from, directly or indirectly, informing the customer or any third party that a targeted financial sanction or any other measures have been placed against them.

If a person (natural or legal) fails to comply with the obligations set out in the Guidance and related laws, they can be subject to imprisonment or a fine of no less than AED 50,000 and no more than AED 5,000,000 per violation. In addition to these monetary penalties, financial institutions and DNFBPs also face additional administrative sanctions, including, among others, having their trade license canceled, being banned from working in the sector related to their violation and constraining the powers of any member of their board of directors who is responsible for the violation.

III. Defining “Financial Institution” and “DNFBP”

Financial Institution

If you are a natural or legal person who undertakes any one or more of the activities listed in Article 2 of the AML Regulations, then you are a “financial institution” for the purposes of the AML Law, AML Regulations, the Resolution and the Guidance. These generally include, banks, finance companies, exchange houses, money service businesses (including hawala brokers or other monetary value transfer services), insurance companies, agencies and brokers and securities and commodities brokers, dealers, advisors and investment managers.

DNFBP

Although part of the analysis, determining whether you or your business is a DNFBP requires more of an analytical approach than simply checking against a list of activities listed in the AML Regulations. Please see below a summary of the various factors that should be taken into consideration when determining whether you or your business is a DNFBP.

UAE Federal AML Law DNFBP Categories

Article 3 of the AML Regulations states that a DNFBP is a business that falls within one of the following categories: (a) real estate agency; (b) dealers in precious metals and stones; (c) lawyers, notaries, other independent legal businesses and independent accountants; (d) credit companies and funds service providers; and (e) other businesses and professions designated by virtue of a resolution by the Minister of Finance. If you or your business undertake any one or more of these activities (whether specifically listed or designated by the Minister of Finance), then you or your business is a DNFBP and do not need to continue with the remainder of the analysis set out below.

Business Activity Designation

A company may also be a DNFBP if it has certain business activities listed on its trade license, as identified by the International Standard of Industrial Classification(s) (ISIC). To access the list of ISIC activities for DNFBPs, please click here. However, a company simply having a business activity on its trade license that matches one that is listed on the linked document does not automatically designate that company as a DNFBP, as the competent authorities would take a substance over form approach. This also means that a business engaged in the activities listed on the linked document would likely be considered a DNFBP even if it does not have that activity listed on its trade license. In other words, in taking a substance over form approach, the competent authorities would look at what the business does in practice versus merely what is listed on its license.

High-Risk Business Activities

There is also a practical analysis under UAE law as to whether the nature of a company’s business activities presents a heightened risk of money laundering/terrorist financing, i.e., whether the company’s business would make it easy to conceal illicit funds because it conducts financial activities on behalf of its customers such that the ultimate beneficiaries and/or source of funds behind transactions could be easily obscured. These heightened risks are typically associated with the DNFBP categories listed above and other types of businesses that deal in high-value/liquid assets (e.g., cash-based businesses or cryptocurrency). If a UAE person deals in high-value/liquid assets that pose a heightened risk of money laundering or terrorist financing, then it may be a DNFBP despite not meeting any of the conditions noted above.