How to screen against the UAE Local Terrorist List and UN Consolidated List

Targeted financial sanctions (TFS) in the UAE apply to people, entities and groups on exactly two lists:

• The UAE Local Terrorist List, issued by the UAE Cabinet. The UAE publishes its own national list in line with UN Security Council Resolution 1373 (2001), and the Cabinet adds and removes names by resolution.
• The UN Security Council Consolidated List, maintained by the relevant UN sanctions committees, covering regimes such as ISIL (Da'esh) and Al-Qaida, the Taliban, the DPRK and Iran.

Freezing and prohibition measures also reach entities owned or controlled, directly or indirectly, by a designated person, and anyone acting on their behalf or at their direction.

What about OFAC, EU or UK lists? The EOCN guidance is clear that TFS measures under UAE law apply exclusively to the two lists above. For matches on other lists such as OFAC, the UK or the EU, you should follow the instructions of your supervisory authority. Many businesses still screen against them, because of correspondent banks, counterparties abroad or their own risk appetite.

The obligations in Article 21 of Cabinet Decision No. 74 of 2020 apply to financial institutions and DNFBPs, and the EOCN guidance extends the same steps to virtual asset service providers. Together these are called reporting entities. If you are not sure whether your business is one, see who must do sanctions screening in the UAE.

Reporting entities must register on the EOCN Notification Alert System to receive email notifications whenever a name is added to, removed from, or amended on the sanctions lists. The system also includes a "Follow TFS Instructions" feature that walks you through screening, freezing and reporting.

Registration matters because the 24 hour freezing clock starts from the designation, not from when you happen to hear about it. The guidance also recommends checking UN press releases regularly, or daily depending on your business model, for updates to UN lists.

When to screen. The guidance requires screening:

• immediately whenever either list is updated, so any freeze can happen within 24 hours;
• before onboarding a new customer;
• at periodic KYC reviews, or when there is a material change in the nature or ownership of a customer; and
• before processing any transaction for a counterparty.

Who to screen. Screening is not limited to your customer list. It covers:

• your existing customer database, with every system holding customer or transaction data mapped to screening;
• potential customers, before any transaction or business relationship;
• previous customers with no active relationship, going back five years;
• parties to transactions, such as buyers, sellers, agents and freight forwarders;
• ultimate beneficial owners, both individuals and legal persons;
• persons with direct or indirect relationships with designated persons; and
• directors and agents acting for customers, including anyone holding a power of attorney.

What to match on. Screen on key identifiers first, and only then on aliases ("also known as" names). For individuals the key identifiers are name, date of birth, nationality, ID or passport number and last known address. For companies they are name, trade licence number, registered address and branch addresses. Collecting these at onboarding is what later lets you rule out a false positive quickly.

When a screening result is a confirmed name match, you must:

• freeze without delay, within 24 hours, and without prior notice to the designated person, all funds or other assets they own or control (wholly or jointly, directly or indirectly), assets derived from them, and those of anyone acting on their behalf; and
• stop making any funds, assets or services available to them, in whole or in part, directly or indirectly.

"Funds or other assets" is interpreted widely: bank balances, securities, real estate, gold and jewellery, vehicles, intellectual property and virtual assets are all covered. For a DNFBP, freezing can mean blocking a property transfer or refusing a gold purchase.

A freeze has no time limit. It stays in place until the person is delisted, in which case it is lifted immediately unless another authority has issued a freeze order, or until the EOCN communicates a freezing cancellation decision through goAML.

TFS measures are reported through goAML using one of two reports:

• Confirmed Name Match Report (CNMR) after freezing assets of an existing customer, or after rejecting a potential customer or counterparty who is a confirmed match. The CNMR was called the Funds Freeze Report (FFR) until the EOCN renamed it in July 2025.
• Partial Name Match Report (PNMR) when you cannot conclude whether a match is confirmed or a false positive, after suspending or rejecting the transaction.

Both are due within five business days of taking the freezing, suspension or rejection measure, and are submitted through goAML to both the EOCN and your supervisory authority. A CNMR must include the full name and ID documents of the match, the value of assets frozen with supporting documents, or a description of the rejected transaction or service. Reporting also applies to past relationships and closed accounts from the five years before the designation.

How to decide between a confirmed match, a partial match and a false positive is covered in detail in handling sanctions screening results.

The obligation does not pause for the weekend. Reporting entities need internal procedures to screen and to stop access to assets that may need freezing during weekends and public holidays. Where a business is closed and customers cannot reach any accounts or assets, screening must start from the first minute business resumes, and any freeze must be applied immediately.

Keep records of every screening result, including confirmed matches, partial matches and false positives, for at least five years. A documented false positive is your evidence that a hit was reviewed properly.

Freezing happens without prior notice, and Article 21 of Cabinet Decision No. 74 of 2020 requires policies that stop staff from informing the customer or any third party that a freeze or other measure will be applied. Separately, Article 29 of Federal Decree Law No. 10 of 2025 makes it a criminal offence to warn a person or disclose information about transactions under review as suspicious.

The hard part is not any single check, it is doing all of them every time: rescreening the whole customer base the day a Cabinet resolution adds names, screening every party and beneficial owner, and keeping an auditable record of each decision.

RiskLens360 screens against the UAE Local Terrorist List and the UN Consolidated List, alongside OFAC, EU and other lists and your own internal watch lists, with instant, bulk and periodic screening, case management and full audit logs. Request a demo to see it with your own data.