Central Bank of the UAEchapter by chapter

Section 2.1-2.72 Sanctions Compliance Program

Licensed financial institutions must maintain a sanctions compliance programme with senior management commitment, documented risk assessment, internal controls, training, and independent audit testing.

Section 2.82.8 Record Keeping

Licensed financial institutions must keep sanctions risk, customer due diligence, transaction, and suspicious transaction records for at least five years, producing them immediately on authority request.

Section 3.23.2 Maintenance of UN Consolidated List and Local Terrorist List

Licensed financial institutions must obtain current UN Consolidated and UAE Local Terrorist lists from official sources, register for automated notifications, and verify that vendor lists contain all names.

Section 3.3-3.63.3-3.6 Screening Operations

Customers must be screened at onboarding and periodically against sanctions lists, with all payment parties and free-text fields screened; potential matches must be suspended and false positives documented.

Section 3.73.7 Confirmed Match

On a confirmed match, licensed financial institutions must freeze all funds without delay and without prior notice, meaning within 24 hours of a UN or Cabinet listing decision.

Section 44 Notification to CBUAE and Executive Office

Licensed financial institutions must immediately report frozen funds, sanctions matches and suspected links to the CBUAE, and notify the CBUAE and Executive Office within two business days of freezing.

Section 2.8-retRecord Retention — Sanctions risk assessment, transaction, CDD, account file, correspondence, ID co

Firms must retain sanctions risk assessments, transaction, customer due diligence, account, correspondence, ID, and suspicious transaction report records for at least five years after the latest triggering event.