How to approach sanctions due diligence for a deal touching the UAE

Sanctions due diligence for a deal touching the United Arab Emirates requires a structured, multi-regime review: the practitioner must map every party, payment channel, and underlying asset against the UN sanctions lists, the UAE's own domestic regime, and any unilateral measures that may follow the transaction through correspondent banking, because a gap at any one of those layers can close the deal's financing or trigger an enforcement action after closing.

The commercial pressure to move quickly on UAE-connected deals is real. The UAE sits at the intersection of Gulf capital, Asian manufacturing chains, and European distribution networks. For a Hong Kong-seated group structuring or acquiring an asset in the UAE, or routing payments through a UAE correspondent bank, the compliance question is not theoretical. Banking access and the payment channel are the points where a due diligence failure becomes visible and costly.

This guide sets out the practical sequence. It addresses each step in order, identifies the gate that must be cleared before moving to the next, and flags the common error that causes otherwise well-managed deals to stall or attract regulatory attention.

Why does the UAE create a distinct sanctions environment for cross-border deals?

The UAE operates a domestic sanctions regime administered by its own Executive Office for Control and Non-Proliferation, implementing both UN Security Council measures and, increasingly, its own autonomous listings – and the interaction between those layers is not always straightforward for a Hong Kong-based group whose primary compliance reference point is the United Nations sanctions framework.

Hong Kong implements United Nations sanctions under the United Nations Sanctions Ordinance. It does not give domestic legal effect to the unilateral sanctions measures of other states. That position is clear and consistent. The practical complication arises at the correspondent-banking layer: a transaction routed through a bank with US dollar clearing, or an entity with EU nexus, carries the unilateral-measures overlay into the deal whether or not the parties intend it. The UAE's own financial institutions are subject to that overlay because of their correspondent relationships.

In our cross-border practice, we regularly see in-house teams treat the UN list check as the end of the sanctions review for deals with Gulf exposure. It is the beginning. The UN list check establishes the floor. What sits above that floor – the UAE domestic regime, the correspondent-banking reach of third-state measures, and the beneficial-ownership profile of the counterparty's principal shareholders – is where the enforcement risk concentrates.

The result is that a deal touching the UAE must be reviewed against three layers simultaneously: the UN measures applicable in both Hong Kong and the UAE, the UAE domestic sanctions regime, and the unilateral-measures reach that follows the payment channel. Each layer requires different documentation and a different analytical approach.

What is the first step, and what must be cleared before the deal can proceed?

The first step is a formal scoping exercise: identify every party with a legal or economic connection to the transaction and map each against all three sanctions layers before any commercial negotiation produces a binding commitment.

Scoping begins earlier than most deal teams expect. The obligation to screen is not triggered by signing or closing – it is triggered by the point at which a prohibited relationship would be created. For a deal with a UAE counterparty, that means screening before the letter of intent is issued, not after. A conditional exclusivity arrangement can itself constitute a prohibited dealing if the counterparty is on a relevant list.

The scoping output is a party matrix (a structured register of all entities, natural persons, jurisdictions, and payment channels involved in the transaction). The party matrix drives every subsequent step. It must include: the direct counterparty and its ultimate beneficial owners; any intermediate holding entities, including BVI or Cayman vehicles sitting between the deal and the principals; the banks and payment intermediaries through which consideration will flow; and any key commercial counterparties of the target business that would be inherited through the acquisition.

The gate at this step is completeness. An incomplete party matrix is the most common source of a sanctions gap. The temptation to rely on the counterparty's own disclosure is understandable under commercial time pressure, but it is not a sufficient control. Independent verification of the ownership chain – through registry records, official filings, and reliable commercial databases – is the standard the deal team will be held to if the matter is later scrutinised.

The sequence the reader faces at this step is therefore: draft the party matrix in full, verify the ownership chain independently, run the screen against all three layers, document the result and the methodology, and obtain sign-off from the compliance function before engaging commercially.

How does the beneficial-ownership layer interact with UAE-specific risk?

Beneficial ownership is the structural point at which UAE-connected deals most often reveal hidden exposure, because the UAE's corporate environment – like those of the BVI and the Cayman Islands – permits layered holding structures that can place a designated person several steps removed from the visible deal party.

The UAE's Ultimate Beneficial Owner Register, introduced as part of the country's anti-money-laundering and counter-terrorism-financing reform programme, requires UAE entities to maintain and file beneficial ownership information. That register is not universally public, and access for foreign counsel varies. For a Hong Kong-based deal team, the practical approach is to require contractual disclosure of the full ownership chain as a condition of proceeding, supported by certified constitutional documents from each layer, and to verify that disclosure against publicly available information.

Where the beneficial ownership chain includes a national or entity from a jurisdiction carrying elevated UN sanctions risk – Iran, North Korea, Syria, and others subject to UN Security Council measures – the analysis becomes a legal constraint, not a commercial negotiation. The deal cannot proceed until the exposure is resolved or the party is removed from the structure.

In our experience, the intermediate holding layer is where the gap most often appears. A UAE operating company may be held by a BVI entity whose shareholder is a trust with an undisclosed protector from a high-risk jurisdiction. The party matrix must follow the chain to the natural person level in every holding layer, not just the immediate counterparty.

For a practical illustration of how a multi-layer BVI beneficial-ownership structure interacts with AML due diligence obligations, our analysis at AML source-of-funds file: BVI counterparty addresses the methodology in detail.

How does the payment channel create a compliance obligation independent of the parties?

The payment channel is a distinct compliance object. A deal whose parties are clean on all three sanctions layers can still generate a regulatory problem if the funds flow through a correspondent banking relationship that applies third-state unilateral measures, or through a UAE bank that has itself imposed enhanced screening in response to its own regulators' expectations.

Hong Kong's banks, including those with significant trade-finance books serving Gulf clients, manage their own correspondent-banking compliance frameworks. Those frameworks reflect not only the UN measures applicable in Hong Kong, but also the policies of their US dollar, euro, and sterling clearing banks – which are subject to the unilateral measures of their home-state regulators. The result is that a HK-seated group routing a payment through the correspondent chain may find the payment paused, returned, or subjected to enhanced documentation requirements because of a factor in the deal that the group had not identified as a sanctions concern.

The practical implication is that payment-channel due diligence must be run in parallel with party due diligence, not after it. The deal team should identify the proposed payment route early, engage with the account-holding bank's compliance team on the structure and the parties, and obtain clarity on the bank's own screening requirements before the payment is instructed. A payment return at a late stage of a deal, particularly in a time-sensitive acquisition, creates both a financing and a reputational risk that is difficult to manage retroactively.

The contextual bridge the deal team must build here is between the legal compliance position and the operational banking position. Those two positions can diverge. A payment may be legally permissible under the UN measures and the UAE domestic regime, and still be declined by a bank exercising its own risk appetite. Documenting the compliance analysis in advance, and sharing that documentation proactively with the clearing bank, is the most reliable way to manage the channel risk.

The sequence the reader faces at this payment-channel step is: identify the full payment route including all intermediate correspondent institutions; obtain the account-holding bank's written guidance on documentary requirements; prepare a compliance summary addressed to the bank's own screening criteria; and confirm the route before consideration is paid.

The sequence above describes the standard position. Your matter turns on the documents, the jurisdictions actually engaged, and the order of steps – which is where the route is won or lost. For a structured assessment of your sanctions due diligence position across the Hong Kong and UAE interface, write to us at info@lockhartyip.com.

What is the most common mistake, and how does the correct sequence avoid it?

The most common mistake in UAE-connected sanctions due diligence is treating the compliance review as a single event conducted at one point in the deal, rather than as a continuous obligation that runs from scoping to post-closing integration.

Designations change. A party who was clean at the time of the letter of intent may be listed between signing and closing. A beneficial owner whose status was unresolved at the time of the preliminary screen may become the subject of a UN Security Council listing in the weeks before the funds move. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance, which governs the AML and sanctions-compliance obligations of financial institutions and certain regulated entities in Hong Kong, is built around a continuous-monitoring standard, not a point-in-time check.

What does the correct sequence look like? The party matrix is run at scoping, refreshed at signing, and run again immediately before closing. Any new party introduced after signing – a replacement guarantor, an additional counterparty, a changed payment intermediary – is screened at the point of introduction. The compliance file records each screen with a date, a methodology note, and a result. If any screen produces a potential match, the file records the steps taken to resolve it: a false-positive determination with supporting reasoning, a referral for legal advice, or a decision to restructure or withdraw.

The second dimension of this mistake is scope compression. Teams under time pressure sometimes narrow the beneficial-ownership review to the immediate counterparty, exclude inherited commercial counterparties of the target business, or treat the payment-channel review as a back-office step. Our desk sees the consequences of each of those compressions regularly. The inherited counterparty list of a UAE operating business can be extensive, and a sanctions exposure in the customer or supplier base of the target is an inherited exposure of the buyer post-closing.

For a parallel treatment of similar issues in the Cyprus-connected context, the briefing at AML source-of-funds file: Cyprus counterparty addresses the comparable beneficial-ownership and payment-channel points.

How does the Hong Kong seat affect the legal obligations in this review?

A Hong Kong-seated deal team operates under the obligations of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the United Nations Sanctions Ordinance. Those instruments establish the legal floor for the review conducted from the Hong Kong side of the transaction.

The United Nations Sanctions Ordinance gives effect in Hong Kong to the sanctions measures designated by the UN Security Council. It covers asset freezes, prohibitions on dealing, and travel bans as designated by the relevant UN committees. All Hong Kong entities – and foreign entities conducting business through Hong Kong – are subject to those measures. The prohibition on dealing with a designated person applies regardless of where the deal is structured, where consideration is paid, or which governing law the contract specifies.

The Anti-Money Laundering and Counter-Terrorist Financing Ordinance imposes AML and know-your-client obligations on specified financial institutions and designated non-financial businesses and professions operating in Hong Kong. For a deal team working through a Hong Kong-regulated financial institution, those obligations are directly applicable. For a corporate or legal team that is not itself a regulated entity under the Ordinance, the practical exposure arises through the financial institutions that service the deal: banks that apply the Ordinance's standards will require the deal team to produce documentation that satisfies the bank's own compliance function, regardless of whether the corporate is itself a regulated person.

The cross-border interface between Hong Kong and the UAE creates an additional layer of analytical work: the deal team must be able to demonstrate that the review addresses the obligations applicable on both sides of the transaction, and that the compliance file is structured to respond to questions from regulators or financial institutions in either jurisdiction. A file that satisfies the Hong Kong standard but does not address the UAE domestic regime, or vice versa, is incomplete for cross-border purposes.

Our full Sanctions & AML practice page sets out the scope of the advice we provide on cross-border sanctions and AML compliance matters of this kind.

Decision checklist: before the deal proceeds

A structured pre-commitment checklist provides the compliance function with a documented basis for the decision to proceed, and the deal team with a clear record if the matter is later scrutinised. The following checklist reflects the sequence described in this guide.

Step 1 – Party matrix. Has a complete party matrix been prepared, covering all entities, natural persons, beneficial owners, payment intermediaries, and key inherited counterparties? Is the ownership chain verified to the natural person level through independent sources?

Step 2 – Sanctions screen (three layers). Has the party matrix been screened against the UN consolidated sanctions list, the UAE domestic sanctions list administered by the Executive Office for Control and Non-Proliferation, and the unilateral-measures lists relevant to the payment channel and correspondent banks? Has the screen been documented with a date and methodology?

Step 3 – Payment channel. Has the proposed payment route been mapped, including all correspondent banking relationships? Has the account-holding bank's compliance team been engaged to confirm the documentary requirements? Has a compliance summary been prepared for the bank's screening process?

Step 4 – Beneficial ownership resolution. Where the screen produces a potential match or an unresolved beneficial-ownership question, has that question been referred for legal advice and documented? Has the file recorded the resolution, whether a false-positive determination or a structural change?

Step 5 – Continuous monitoring. Is there a mechanism for re-screening the party matrix at signing, at closing, and at the introduction of any new party? Is the compliance function aware of the obligation to act promptly if a designation is issued between screens?

Step 6 – Cross-border file. Does the compliance file address the legal obligations applicable in both Hong Kong and the UAE? Is it structured to respond to a regulatory or banking inquiry from either side?

If any step returns a negative answer, the compliance gap should be resolved before the deal proceeds. A checklist item left incomplete is a documented risk that the institution or counterparty will identify if the deal is later reviewed.

What the objection misses: "our counterparty is UAE-incorporated, so the exposure is theirs"

A common initial position from deal teams unfamiliar with cross-border sanctions exposure is that responsibility for UAE-side compliance rests with the UAE-incorporated counterparty. That position is incorrect in two respects.

First, the prohibition on dealing with a designated person applies to the Hong Kong-seated party, not only to the UAE party. If the Hong Kong group enters a transaction with a designated entity – or provides funds, services, or economic benefit to a designated person through the transaction – the HK entity has committed a breach under the United Nations Sanctions Ordinance, regardless of whether the UAE counterparty has also committed a breach under its own domestic law.

Second, the payment channel creates independent exposure. A payment made by the Hong Kong group to a clean UAE entity, which is then routed onwards to a designated person by the UAE entity, can attract regulatory attention if the Hong Kong payer had reason to know or should have known of the onward payment. The inherited-counterparty review of the UAE target's business relationships is the control that addresses this second dimension of exposure.

Responsibility for the due diligence review rests with the Hong Kong-seated party. The counterparty's own compliance cannot substitute for it. Contractual warranties from the counterparty about its sanctions status are a useful supplement to the review, but they do not replace it.

If an earlier compliance review produced an incomplete or stalled result, a second read of the file and a re-structured approach to the beneficial-ownership and payment-channel steps can identify the gaps and the routes still open. For a structured re-assessment of a stalled or incomplete sanctions due diligence file, contact info@lockhartyip.com.

Related practices

• Sanctions & AML – cross-border sanctions compliance, AML due diligence, and payment-channel risk advisory
• M&A & Transactions – cross-border acquisition structuring and transaction-level regulatory review

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

Related

• Sanctions Aml
• Aml Source Funds File Bvi Counterparty Bvi Analysis 3
• Aml Source Funds File Cyprus Counterparty Cyprus Briefing

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.