Sanctions due diligence for a deal touching UAE

A deal that routes capital, equity or payment through the United Arab Emirates now lands on the compliance agenda of every bank, correspondent, and co-investor involved. That is not a theoretical concern. It is the practical reality our desk has observed across cross-border transactions structured through Hong Kong in the past two years. The compliance window does not stay open indefinitely: a counterparty file that fails a bank's sanctions screen can stall a closing in a matter of days.

Sanctions due diligence for a deal touching the UAE is the structured process by which the principals, their counsel and their bankers verify that no party, asset, payment channel or ultimate beneficial owner falls within a sanctions designation – whether under the United Nations sanctions lists implemented by Hong Kong, the UAE's own domestic regime, or the unilateral measures of third states that the correspondent banking network will apply regardless of the deal's governing law. The process runs from counterparty identification through to a documented compliance file that the deal's bankers can rely on at closing.

This note sets out how Lockhart & Yip structures that process for a deal with UAE exposure, what the client must own at each stage, and where the Hong Kong and UAE interfaces create specific compliance pressure.

Why a UAE-touching deal triggers an elevated sanctions review

The United Arab Emirates sits at a busy intersection of capital corridors. It is simultaneously a receiving jurisdiction for investors from the Mainland, Central Asia, the Gulf Co-operation Council and Africa, and a routing jurisdiction for payments denominated in US dollars that must clear the international correspondent banking network. That network applies the unilateral measures of its principal regulatory jurisdictions – primarily the United States and the European Union – as a commercial matter, regardless of whether Hong Kong or the UAE is legally required to do so.

Hong Kong implements United Nations sanctions and does not give domestic effect to unilateral measures of other states. That is the correct statement of Hong Kong law. But it does not resolve the banking question. A USD-denominated payment leg in a Hong Kong–UAE deal will pass through a US correspondent. That correspondent will screen the payment against OFAC lists. If the screen produces a hit – or a near-match on name, nationality or ownership chain – the payment stops. The deal stops with it.

For a principal using Hong Kong as the holding or transacting entity, this creates a practical compliance requirement that sits above the formal legal obligation. The sanctions due diligence file must be prepared to a standard that satisfies the correspondent's compliance function, not only the legal minimum. In our cross-border practice, we prepare files to that higher standard from the outset, because an inadequate file discovered at wire-transfer stage is far more disruptive than one prepared correctly beforehand.

The trigger is almost always one of three events: a bank's pre-clearance request before it will process the USD leg; a co-investor or co-lender performing its own counterparty check; or an inbound buyer conducting acquisition-level enhanced due diligence (EDD, the heightened know-your-customer and source-of-funds review applied to higher-risk counterparties or jurisdictions). Each of these has a deadline. That deadline is the window that closes.

The governing regime: what Hong Kong applies and what the correspondent network applies

Understanding the governing instruments is the foundation of the compliance file. There are three layers, and the file must address all three.

The first layer is the United Nations sanctions regime implemented through Hong Kong. The United Nations Sanctions Ordinance (the principal Hong Kong statute giving effect to UN Security Council resolutions designating persons, entities and states) requires that no person or entity in Hong Kong deal with a designated party. Verification against the UN consolidated list is therefore a legal requirement, not merely a best-practice step.

The second layer is the UAE's own domestic sanctions regime (the UAE's framework for designating and freezing assets, administered through the UAE Executive Office for Control and Non-Proliferation). Where a counterparty is incorporated or resident in the UAE, this regime is directly applicable to their conduct and may affect the deal's structuring and documentation.

The third layer is the extraterritorial effect of the unilateral measures of third states – principally OFAC's Specially Designated Nationals and Blocked Persons list (the SDN list, the US Treasury designation list that US persons and US dollar-clearing institutions must observe), the EU's restrictive measures lists, and the UK's sanctions regime under the Russia (Sanctions) (EU Exit) Regulations and related instruments. These are not Hong Kong law. They are commercial constraints imposed by the correspondent banking network and by co-investors and co-lenders operating under US, EU or UK licences.

The compliance file that closes a deal must show a clear result across all three layers for every principal, every intermediate holding entity, and every ultimate beneficial owner in the chain. Where any party has a UAE nexus – incorporation, residency, banking relationship, or beneficial ownership – the EDD threshold is typically triggered.

For advice on the full scope of Lockhart & Yip's Sanctions & AML practice, including how we structure compliance files for clients across different risk profiles, that page sets out our approach and the matters we regularly handle.

The sequence above describes the standard position. Your matter turns on the documents, the jurisdictions actually engaged, and the order of steps – which is where the route is won or lost. For a structured assessment of your UAE-touching deal's sanctions exposure, write to us at info@lockhartyip.com.

How does the diligence process actually run?

The process has six steps. Each step produces a document the client retains and can present to a bank, a co-investor or a regulator.

Step 1 – Entity and beneficial-ownership mapping. We identify every legal entity and every natural person in the ownership chain, from the deal-level vehicle to the ultimate beneficial owner. For a UAE-touching deal this typically means mapping the UAE-incorporated operating company or free-zone entity, any intermediate BVI or Cayman holding layer, the Hong Kong HoldCo or SPV, and the individual principals. We use the client's corporate documents and, where appropriate, registry extracts from the relevant offshore registries.

Step 2 – List screening against all three layers. Every identified person and entity is screened against the UN consolidated list, the UAE domestic list, the OFAC SDN and sectoral-sanctions lists, and the EU and UK restrictive-measures lists. Screening is run on full legal names, transliterations, aliases and nationality data. Where a party has a Mainland Chinese or Central Asian background, the name-matching protocol must account for transliteration variants.

Step 3 – Ownership and control analysis. A clean name-screen result is not a clean result if ownership above a threshold – 50% or more under OFAC's standard ownership test – is held by a designated party. We analyse the ownership structure against each regime's own aggregation and control rules. These rules differ: the EU's threshold differs from OFAC's; the UAE's own rules apply to UAE entities. The file must document the analysis under each regime separately.

Step 4 – Source-of-funds review. For UAE-touching deals, the correspondent banking network will almost always require a source-of-funds narrative for the payment leg. This is a distinct exercise from entity screening. It requires documentary evidence of how the funds that are being moved or invested were originally generated – commercial revenues, asset disposals, prior investment exits. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance imposes its own source-of-funds requirements in Hong Kong. We prepare the source-of-funds narrative to satisfy both the AML ordinance and the bank's EDD requirements simultaneously.

Step 5 – Contractual and payment-channel structuring. Where the compliance analysis identifies a risk point – a potential near-match, a nationality that triggers enhanced screening, a payment leg that will cross a US correspondent – we advise on the contractual documentation and payment sequencing that manages that risk within the law. This is compliance structuring, not circumvention. The distinction is precise: we document the legal basis for the payment, we do not route around a prohibition.

Step 6 – Compliance file assembly and certification. The final deliverable is a written compliance file: entity-map, screen results, ownership analysis, source-of-funds narrative, and a summary opinion addressed to the bank or co-investor. The file is dated and versioned. If the deal's timeline extends, the screen results must be refreshed before closing – list changes are continuous.

The Hong Kong and UAE cross-border interface: where the two systems meet

This is the section most foreign principals underestimate. Hong Kong and the UAE are not adversarial systems. They are both common-law-influenced commercial jurisdictions with active AML regimes and, in Hong Kong's case, a clear constitutional position on sanctions. But they interact in specific ways that shape the compliance file.

First, Hong Kong's Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) requires licensed corporations and financial institutions to apply customer due diligence and enhanced due diligence in circumstances defined by the ordinance and the regulators' AML guidelines. The UAE is treated as a higher-risk jurisdiction for AMLO purposes by many Hong Kong-licensed institutions – meaning that any Hong Kong financial institution handling the deal's payment leg or providing custody will apply EDD to the parties. That EDD requirement flows directly to the compliance file we prepare.

Second, the UAE has been subject to evolving international assessments by the Financial Action Task Force (FATF, the inter-governmental body that sets global AML standards) over recent years. The current position should be verified against the FATF website before any file is finalised. FATF status affects the de-risking posture of correspondent banks and will be a live issue in any banker's compliance review of a UAE-touching payment.

Third, the UAE's own licensing and ownership rules for operating entities – particularly those in free zones such as the Dubai International Financial Centre (DIFC, a common-law financial hub within Dubai operating its own courts and financial regulator) or the Abu Dhabi Global Market (ADGM, the common-law international financial centre on Al Maryah Island) – interact with the beneficial-ownership analysis required for the compliance file. A DIFC or ADGM entity has its own regulatory relationship with its domestic authority. That relationship must be documented in the ownership map.

Fourth, and practically: deals between Hong Kong and the UAE will often carry a payment leg that must pass through a USD-clearing bank. That bank's compliance function sits in New York or London. Its screen is run against OFAC and OFSI. The compliance file must therefore address those screens as a practical matter, regardless of whether the client is under any direct legal obligation to OFAC or OFSI.

For an illustration of how we have approached cross-border sanctions due diligence in a comparable offshore-hub context, our matter note on a deal touching the Cayman Islands describes a similar structural approach.

What documents and decisions must the client own?

Counsel can prepare and analyse, but the client is the instructing party – the one whose name appears on the compliance file and who is responsible for its accuracy. That responsibility cannot be delegated. Several document categories belong to the client exclusively.

The beneficial-ownership declaration is the client's own representation of who ultimately owns and controls each entity in the chain. We draft the template and review the content, but the client must sign it and stand behind it. A false declaration is an AML offence under Hong Kong law; in a UAE context it may also constitute a breach of the UAE's own AML requirements. This is the document on which the entire file rests.

The source-of-funds documentation – bank statements, audited accounts, tax filings, transaction records showing the origin of the capital – must come from the client. We advise on what is needed and in what form, but we cannot manufacture this documentation. The quality of the underlying financial records directly determines the quality of the compliance file.

The decision on payment sequencing and currency is a commercial decision with legal consequences. Where a dual-currency option exists – for example, a deal structured to allow a non-USD settlement leg – the client and its bankers must decide whether to exercise it. We advise on the legal consequences of each option. The business decision belongs to the client.

Where the deal involves ongoing payment flows – earn-outs, deferred consideration, royalties, loan repayments – the compliance obligation does not end at closing. The client must maintain a live watch on the designation lists for the counterparty and beneficial owners for the life of the payment arrangement. We advise on how to structure that ongoing monitoring obligation. We do not provide the monitoring function itself; that is an operational task for the client's compliance team or banking relationship manager.

If an earlier compliance attempt stalled – perhaps a bank declined to process a payment leg without adequate documentation – a second read of the file can identify the gap and the steps still available. For advice on how to re-approach a stalled position, email info@lockhartyip.com with a brief description of where the matter currently stands.

Common errors: what foreign counsel and principals frequently miss

In our cross-border practice, we regularly see five errors in UAE-touching compliance files prepared without specialist cross-border input.

The first is treating a UN-clean result as a complete screen. It is not. The UN list is the legal floor in Hong Kong. The correspondent banking network screens against OFAC and the EU lists regardless. A party who appears on neither the UN list nor the OFAC SDN list may still appear on OFAC's sectoral-sanctions lists (instruments that restrict specific categories of transaction with designated persons, without requiring a full freeze). Sectoral exposure is missed more often than SDN exposure.

The second error is screening the named counterparty without screening the full ownership chain above it. OFAC's 50% rule (under which an entity owned 50% or more by a designated person is itself treated as blocked, even if it does not appear by name on the SDN list) is well understood in principle. It is frequently under-applied in practice when the ownership chain is multi-layered or when intermediate entities are registered in jurisdictions with limited public registry information.

The third error is preparing a compliance file that answers the legal question but not the banker's question. Bankers applying EDD are asking a reputational and commercial question as well as a legal one. A file that demonstrates legal compliance but provides no narrative context for a complex ownership structure or a significant cash movement is likely to produce a request for further information – which introduces delay. The file must tell a coherent story, not merely produce clean screen outputs.

The fourth error is ignoring the timing of list updates. Sanctions designations are issued without notice. A file that was clean when prepared may not be clean at closing if a designation is issued in the interval. The compliance file must be re-screened immediately before the relevant payment or closing step, not only when the deal is initiated.

The fifth error, which appears specifically in Hong Kong-structured deals, is assuming that because Hong Kong does not implement unilateral measures, no correspondent banking issue arises. It invariably does. The assumption conflates the legal position with the commercial reality. A deal structured through a Hong Kong entity with a UAE counterparty and a USD payment leg sits squarely within the OFAC correspondent banking perimeter, regardless of how the deal documents are drafted.

For a comparable analysis of compliance file preparation in a Cyprus-counterparty context, the matter note on a Cyprus AML and source-of-funds file illustrates the same discipline applied across a different jurisdiction pair.

Decision matrix: situation, instrument, route, timing, risk

The compliance route for a UAE-touching deal is not uniform. It depends on the deal type, the payment currency, and the ownership structure of the UAE counterparty.

Situation A: a Hong Kong HoldCo acquiring a UAE free-zone operating company from a GCC-based private seller. The governing instruments are the UN sanctions ordinance (Hong Kong legal floor), OFAC's sectoral and SDN lists (correspondent banking constraint), and the DIFC or ADGM entity's own licensing documentation. The route runs through entity mapping, full-chain ownership screening, source-of-funds file for the acquisition price, and a pre-wire bank clearance submission. Timing is led by the bank's processing window, typically shorter than the deal timeline. The principal risk is an undisclosed beneficial owner in the seller's chain.

Situation B: a Mainland-origin principal using a BVI holding entity above a Hong Kong SPV to invest into a UAE real-estate vehicle alongside a co-investor from Central Asia. Here the compliance layer is more complex. The Mainland nexus, the BVI layer, and the Central Asian co-investor each introduce separate screening considerations. The OFAC screen must cover the Mainland parent's own owners. The BVI layer requires registry confirmation of the beneficial-ownership declaration. The Central Asian co-investor may have a nationality-based screening flag regardless of actual designation. The compliance file is longer, the source-of-funds narrative is more detailed, and the bank pre-clearance step is more likely to require a direct conversation between our desk and the bank's compliance officer. Timing risk is elevated. Involving locally licensed Hong Kong firms at an early stage – for the AML aspects governed by Hong Kong law – is standard practice on this type of file.

Situation C: an ongoing commercial relationship with a UAE counterparty where periodic payments are made through a Hong Kong operating account. The initial compliance file was prepared at contract inception. The obligation is now to maintain a watch function and to refresh the file before each material payment. The risk here is operational: the watch function is often not embedded in the client's internal process, and a designation issued mid-contract is missed. We advise on the watch-and-refresh protocol as part of the initial engagement.

The self-assessment checklist

Before a principal brings a UAE-touching deal file to counsel, a short internal review will identify the gaps and accelerate the engagement. The questions to address internally are:

Can you name every natural person who ultimately owns or controls each UAE-registered entity in the deal at the 10% ownership level? At 25%? At 50%?
Do you have current government-issued identification documents for each of those persons?
Can you produce audited accounts or bank statements showing the source of the funds being committed to the deal?
Do you know the currency and routing of the payment leg, and whether it will pass through a US correspondent bank?
Has anyone in the chain – a beneficial owner, an intermediate entity, a named counterparty – been subject to sanctions proceedings or a sanctions inquiry in any jurisdiction in the past five years?
Has a bank already raised a compliance query or declined a payment instruction in connection with this deal or this counterparty?

If the answer to the last question is yes, that is the starting point for the engagement, not the end of it. A declined payment instruction typically indicates a file gap that can be identified and addressed. Counsel on our desk see this scenario regularly.

Related practices

Holding Structures – structuring BVI, Cayman and Hong Kong holding layers for deals with UAE exposure
M&A & Transactions – cross-border acquisition due diligence and transaction documentation across the Hong Kong–UAE corridor

Frequently asked questions

What is the first step in sanctions due diligence for a deal touching the UAE?

The first step is a complete beneficial-ownership map of every entity and natural person in the deal chain, from the transacting vehicle to the ultimate individual owner. Without a complete map, the screening exercise – which follows immediately – cannot be run accurately. A partial map produces a partial result, which will not satisfy a bank's EDD function. In practice, this step is often the most time-consuming, because beneficial-ownership information for multi-layered structures is rarely in one place at the outset of an engagement.

What documents are needed for sanctions due diligence for a deal touching the UAE?

The core documents are: current government-issued identification for each ultimate beneficial owner; corporate documents for each entity in the chain (including registry extracts and constitutional documents); audited financial statements or equivalent records showing the source of the deal funds; and any existing compliance documentation the client holds from prior bank or regulatory interactions. For UAE-registered entities – particularly those in the DIFC or ADGM – the entity's own regulatory filings and licence documents form part of the file. The completeness of the documentary record directly determines the quality of the compliance file delivered to the bank or co-investor.

Do I need a Hong Kong adviser for sanctions due diligence for a deal touching the UAE?

A Hong Kong adviser is relevant where the deal structure, the payment leg, or the holding entity has a Hong Kong nexus. In that case, the Anti-Money Laundering and Counter-Terrorist Financing Ordinance creates specific obligations for Hong Kong-licensed financial institutions handling the transaction, and those obligations shape what the compliance file must contain. Beyond the legal requirement, a cross-border counsel based in Hong Kong brings a working understanding of how local banks apply their EDD standards to UAE-touching transactions – which is often where the practical compliance challenge sits.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.