What the EOCN has published
The EOCN is the UAE body concerned with implementing targeted financial sanctions. TFS means two things: freezing, without delay, the funds and other assets of designated persons, and a ban on making funds, other assets or services available to them, directly or indirectly. Designated persons are those on the UAE Local Terrorist List, issued by the Cabinet, or on the United Nations Security Council (UNSC) Consolidated List.
The EOCN’s Guidance on Targeted Financial Sanctions for financial institutions (FIs), designated non-financial businesses and professions (DNFBPs) and virtual assets service providers (VASPs) was first issued in January 2021. The current version is marked “Last Amended: March 2026”. It replaces the July 2025 version.
What changed in March 2026
The guidance’s own version table lists four updates.
1. The legal framework now points to the new AML law. Federal Decree-Law No. 10 of 2025 came into force on 14 October 2025 and repealed Federal Decree-Law No. 20 of 2018. Its Executive Regulations, Cabinet Resolution No. 134 of 2025, came into force on 14 December 2025 and repealed Cabinet Resolution No. 10 of 2019. Cabinet Decision No. 74 of 2020 remains the core TFS instrument and is cited throughout the guidance. The new law requires reporting entities to “implement forthwith the instructions issued by the Executive Office or any other Competent Authorities concerning Targeted Financial Sanctions” (Article 19(1)(e)).
2. Iran is back. On 28 September 2025, the UN announced that its earlier Iran resolutions, including resolution 1737 (2006), had been re-applied under the “snapback” process in resolution 2231 (2015), with effect from 8 p.m. New York time on 27 September 2025. The 1737 sanctions list was re-established, and 43 individuals and 78 entities were added back to the UNSC Consolidated List. The EOCN guidance now lists Iran (UNSCR 1737 and its successor resolutions) alongside the Democratic People’s Republic of Korea as a proliferation financing TFS regime. The July 2025 version had said that Iran-related TFS under resolution 2231 were no longer in effect from 18 October 2023. Members of the Security Council remain divided on whether the 1737 Committee’s mandate is valid. The UAE guidance, however, treats the regime as in force. In RegLex’s view, UAE firms should screen and freeze on that basis.
3. Penalties now come from the new law. The guidance now cites Article 33 (criminal penalties) and Article 17 (administrative penalties) of Federal Decree-Law No. 10 of 2025. The previous figures of one to seven years’ imprisonment and fines of AED 50,000 to AED 5,000,000 have been removed. See “Penalties” below.
4. FAQs 3 and 6 are updated to reflect the new law.
One further change is not in the version table. The list of situations that trigger screening no longer includes a separate line for “daily screening of customer’s databases”. The guidance still requires “regular and ongoing screening”, immediate screening whenever the lists change, and suggests checking UN press releases regularly or daily, depending on your business model. In RegLex’s view, this is not a reason to stop daily screening: the 24-hour freeze deadline is hard to meet any other way.
Your four core obligations
Article 21 of Cabinet Decision No. 74 of 2020 sets the main obligations. The guidance groups them into four steps.
Step 1: Register
Register on the EOCN Notification Alert System (NAS) to receive automatic emails when the lists change. A practical tip from RegLex: make sure alerts reach more than one person, so a holiday or sick day does not delay a freeze.
Step 2: Screen
Screen against the UAE Local Terrorist List and the UNSC Consolidated List:
- immediately when either list is updated;
- before onboarding a new customer;
- at periodic KYC reviews, or when there is a material change in a customer’s nature or ownership; and
- before processing any transaction with a counterparty.
Screening should cover existing and potential customers, former customers for up to five years, parties to transactions, beneficial owners, persons with direct or indirect relationships with designated persons, and directors, agents and holders of powers of attorney.
For weekends and public holidays, you need procedures to screen and to stop access to assets that may need freezing. If you are closed and customers cannot access assets, screening starts from the first minute of business and freezes must be applied immediately.
Step 3: Freeze and prohibit
“Without delay” means immediately, and in any case within 24 hours of the listing decision. Freeze, without prior notice, all funds or other assets owned or controlled, directly or indirectly, by the designated person, funds derived from them, and those of anyone acting on the designated person’s behalf or at their direction. A company is caught if a designated person owns more than 50% of it or controls it. Freezes based on control or “acting on behalf of” must rest on documentary evidence, not on suspicion alone. Freezes have no time limit: they stay in place until delisting or an EOCN cancellation decision.
Step 4: Report
Reporting entities report through goAML:
- Confirmed Name Match Report (CNMR), formerly the Funds Freeze Report. File within five business days of freezing, or of rejecting a prospective customer or counterparty.
- Partial Name Match Report (PNMR), where you cannot confirm or rule out a match. For an existing customer, suspend without delay, file within five business days and keep the suspension in place until the EOCN responds. For a prospective customer or counterparty, first try to obtain ID documents; if you cannot within 10 business days, reject the transaction and file a PNMR within five business days.
- False positives are not reported, but you must document them.
Keep all screening results for at least five years. CNMRs also cover relationships and accounts, including closed accounts, in the five years before the designation. Persons that are not FIs, DNFBPs or VASPs, and so are not required to use goAML, report by email to tfs@eocn.gov.ae within five business days.
Do not tell the customer before you freeze. Telling them after the freeze has been applied is not tipping off.
What about OFAC, EU and UK sanctions?
UAE TFS obligations apply only to the UAE Local Terrorist List and the UNSC Consolidated List. A match on another list, such as OFAC, the EU or HM Treasury, should not be reported as a CNMR or PNMR. Consult your supervisory authority on the right course of action, and consider whether a suspicious transaction report (STR) is needed.
Penalties
- Criminal: anyone who breaches instructions of the EOCN or any other competent authority on TFS faces imprisonment and a fine of not less than AED 20,000, or either penalty (Article 33). Where the offence is committed on a company’s behalf or in its name by its representatives, directors or agents, the company faces a fine of AED 200,000 to AED 10,000,000 (Article 27(2)).
- Administrative: supervisory authorities can impose penalties ranging from a warning, to fines of AED 10,000 to AED 5,000,000 for each violation, to licence revocation (Article 17).
- DNFBPs supervised by the Ministry of Justice or the Ministry of Economy: Cabinet Resolution No. 71 of 2024 sets specific fines for TFS failures. Examples are AED 50,000 to AED 1,000,000 for failing to register on the EOCN system or to screen, and AED 500,000 to AED 1,000,000 for failing to freeze. The resolution was issued under the old law. Article 41(3) of the new law keeps earlier resolutions in force, so far as they do not conflict with it, until they are replaced.
Anyone who freezes funds, or refuses services, in good faith under Cabinet Decision No. 74 of 2020 is protected from liability for doing so.
A note on DIFC and ADGM
The federal TFS regime applies to any person in the UAE, including FIs, DNFBPs and VASPs. Firms in the DIFC and ADGM must also follow their own regulator’s rules (the DFSA and the FSRA respectively). This briefing covers the federal TFS regime only.
What this means for your business
- Now: confirm that your screening tool includes the re-established Iran (1737) entries. Re-screen your customer base if you have not done so since 27 September 2025.
- This month: update your TFS policy and procedures so they cite Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025, and replace the old penalty figures.
- This month: check your NAS registration, who receives alerts, and your weekend and holiday cover.
- At your next training session: use the CNMR and PNMR terminology, and walk staff through the five-business-day deadlines and the 10-business-day ID rule.
- Ongoing: record reasons for every false positive, and keep screening records for at least five years.
The lists move. On 13 May 2026, the EOCN announced that the UAE had added 16 individuals and five entities linked to Hezbollah to its Local Terrorist List.