Sanctions & TFS

The 24-hour freezing rule: a practical guide to sanctions screening for UAE DNFBPs

When the UAE Local Terrorist List or the UN Consolidated List changes, you have hours, not days. This guide walks through exactly what a DNFBP has to do, in order, and how to prove it did.

groAML compliance team Grovisor Business Consultants FZE
Published Updated 11 min read

Checked against the EOCN Guidance on Targeted Financial Sanctions (reported as last amended July 2025)

On this page

At a glance

  • Only two lists carry the 24-hour freezing duty: the UAE Local Terrorist List and the UN Security Council Consolidated List.
  • “Without delay” means immediately, and in any case within 24 hours of a designation.
  • Freeze first, with no prior notice to the customer. You may tell them only after the freeze is in place.
  • Report a confirmed match (CNMR, formerly the FFR) or a partial match (PNMR) on goAML within five business days.
  • Keep every screening result, including false positives, for the period the law requires (groAML's default retention plan is 10 years; confirm against current law).
Who this is for:Real estate brokers and agentsDealers in precious metals and stonesCorporate service providersAuditors and accountantsLawyers and notaries

The rule in one paragraph

When a person or company is added to the UAE Local Terrorist List or the UN Security Council Consolidated List, every financial institution, DNFBP and VASP in the UAE must find out whether it holds their funds or deals with them, and freeze those funds without delay: immediately, and in any case within 24 hours. It must do that without warning the customer, stop providing them any services, and report what it did on goAML within five business days.

Where the rule comes from Article 21 of Cabinet Decision No. 74 of 2020 sets the obligations, and the EOCN's Guidance on Targeted Financial Sanctions (reported as last amended July 2025) explains how to meet them. The EOCN, the UAE's Executive Office for Control and Non-Proliferation, runs the alert system and receives the reports.

The four obligations

The EOCN guidance breaks targeted financial sanctions (TFS) down into four steps. Every DNFBP needs all four, whatever its size.

  1. Register on the EOCN Notification Alert System (NAS), so you are told the moment either list changes.
  2. Screen your customers, their owners and the parties to their transactions against the latest lists, regularly and on every update.
  3. Freeze without delay any funds or assets of a designated person, and stop making funds or services available to them.
  4. Report the measures you took to the EOCN and your supervisory authority on goAML.

Which lists the 24 hours apply to

This is the most common source of confusion. Many firms screen against several international lists, and that is good practice. But the legal freezing duty, with its 24-hour clock, attaches to two lists only.

ListIssued by24-hour freeze?How you report a match
UAE Local Terrorist ListUAE CabinetYesCNMR or PNMR on goAML
UN Security Council Consolidated ListUN Security CouncilYesCNMR or PNMR on goAML
OFAC, EU, UK (HMT) and other national listsForeign governmentsNoNot by CNMR/PNMR. Consult your supervisory authority; consider an STR/SAR
INTERPOL and other criminal listsVariousNoAs above

Based on the EOCN guidance, Sections 4 and 7.

Don't use the wrong report CNMRs and PNMRs are only for matches against the UAE and UN lists. A hit on OFAC or the EU list is not a CNMR, even if you decide to stop the business. Treat it as a risk decision, and file a suspicious transaction or activity report if the facts support one.

When and whom to screen

The 24-hour clock runs from a designation. Screening, though, is not only triggered by list updates. The guidance requires screening:

  • On every update to either list, immediately, so any freeze happens within 24 hours.
  • Before onboarding a new customer.
  • At periodic KYC reviews, and when the nature or ownership of a customer materially changes.
  • Daily, across your customer database.
  • Before processing any transaction with a counterparty.

And it is wider than your current customer list. Screen:

  • existing customers, across every system that holds customer or transaction data;
  • prospective customers, before you transact or start a relationship;
  • former customers from the last five years, even with no active account;
  • every party to a transaction (buyer, seller, agent, freight forwarder) and the ultimate beneficial owners, natural and legal;
  • directors and agents acting for a customer, including anyone with a power of attorney;
  • anyone with a direct or indirect relationship with a designated person.
Match on the key identifiers first For people: full name, date of birth, nationality, ID or passport number and last known address. For companies: name, trade licence and address details. Only then look at aliases (“a.k.a.”). Arabic names are where most tools struggle: Mohammed, Muhammad and Mohamed are the same name, and a screening tool that misses that will miss real matches.

Confirmed, partial or false positive?

Every potential hit ends in one of three outcomes, and each one leads to a different action.

OutcomeWhat it meansExampleWhat you do
Confirmed name matchYour customer's key identifiers match a designated personName, date of birth and nationality all matchFreeze within 24 hours; file a CNMR within 5 business days
Partial name matchSome identifiers match and you can't confirm or rule it outName and date of birth match, but the nationality differs and the spelling is slightly differentSuspend; get ID; file a PNMR within 5 business days
False positiveOn examination it is clearly not the designated personThe listed person is 40; your customer is a 16-year-old studentRecord your reasoning and continue

Definitions and examples from the EOCN guidance.

The first 24 hours, step by step

Here is the sequence when the list changes and one of your customers is on it.

  1. Hour
    0

    A designation is published

    The EOCN Notification Alert System emails registered entities. Your clock starts at the designation, not when you happen to notice it.

  2. Now

    Screen immediately

    Re-screen your customers, former customers, beneficial owners and counterparties against the updated list.

  3. ≤24h

    Freeze, without notice

    Freeze all funds and assets owned or controlled, directly or indirectly, by the designated person, anything derived from them, and anything held for someone acting on their behalf. Do not tell the customer first.

  4. ≤24h

    Stop all services

    You may not make funds, assets or services available to the designated person, directly or indirectly. For a prospective customer, reject the transaction.

  5. ≤5
    days

    File a CNMR on goAML

    Report the freeze to the EOCN and your supervisory authority within five business days, with the supporting documents. Not on goAML? Email tfs@eocn.gov.ae instead.

  6. After

    Notify the customer, keep the freeze

    Once frozen, you may inform the customer. The freeze has no time limit and stays until delisting or an EOCN cancellation decision.

What can still go into a frozen account Interest, profits or other earnings due on the account, and payments due under contracts agreed before the freeze, can still be credited, as long as they are frozen immediately too.

Handling a partial match

A partial match isn't a freeze, but it isn't business as usual either.

  1. Suspend the transaction or service while you investigate.
  2. Ask for identification documents to confirm or rule out the match.
  3. If you can't get them within a reasonable time, which the guidance sets at 10 business days, reject the transaction or service.
  4. File a PNMR on goAML within five business days of the suspension or rejection, saying which applies.
  5. If the customer later produces ID, screen again and act on the new result.

Owned or controlled: the 50% test

The freeze reaches beyond names on the list. You must also freeze the assets of a company that a designated person majority owns, meaning more than 50% of the proprietary rights, or controls. If a designated person owns 51% of an otherwise clean company, that company's funds are frozen too. This is why screening beneficial owners, not just the customer's name, is mandatory.

Records you must keep

  • Every screening result (confirmed matches, partial matches and false positives) for the period the law requires (groAML's default retention plan is 10 years; confirm against current law).
  • A CNMR for relationships, transactions and accounts with the designated person in the five years before the designation, even if you hold nothing for them today.
  • Your reasoning for each false positive. In an inspection, “we checked and it wasn't him” only counts if you can show how you decided.

What getting it wrong costs

Criminal and regulatory exposure

Failing to comply with Cabinet Decision No. 74 of 2020, or failing to have reasonable procedures to comply, is reported to carry criminal penalties (imprisonment and/or a fine). We do not quote the amounts here; confirm the current penalties with your supervisory authority or a UAE-qualified adviser.

On top of that, your supervisory authority can take its own enforcement action.

Three worked examples

These scenarios are illustrative. They apply the rules above to situations DNFBPs meet every week.

A gold dealer and a walk-in buyer

A buyer wants to pay for bullion. Before completing the sale, you screen the buyer and get a partial match: same name and year of birth, different nationality. You suspend the sale and ask for the buyer's passport. If it doesn't arrive within 10 business days, you cancel the sale and file a PNMR within five business days of cancelling.

A real estate broker and a buyer acting through a POA

A property purchase is being signed by an attorney under a power of attorney. You screen the attorney, the buyer behind them and the seller. The buyer is on the UN list. You stop the transaction, freeze any deposit you hold without telling the buyer, and file a CNMR on goAML within five business days.

A corporate service provider and a new client company

A client asks you to set up a company. The shareholder register shows a 60% shareholder who was added to the Local Terrorist List last night. The 50% test applies: the company is majority owned by a designated person, so you reject the engagement, freeze anything you hold, and file a CNMR.

How groAML handles this

groAML refreshes the UAE and UN lists automatically and re-screens your whole customer book each time, including beneficial owners, with Arabic-aware name matching. Every match becomes an alert with a dated decision trail, and each freeze obligation is tracked against its deadline.

See how it works

Your 24-hour readiness checklist

Tick these off for your firm. Your progress is saved in this browser, and the page prints cleanly as a handout.

TFS readiness12 items

Saved only on this device. Nothing is sent to us.

Frequently asked questions

Is it tipping off if I tell the customer their funds are frozen?
Not once the freeze is in place. The EOCN guidance says you may notify the customer after you have taken the freezing measures, but you must not inform them before.
We matched a customer to the OFAC or EU list. Do we file a CNMR?
No. CNMRs and PNMRs are only for matches to the UAE Local Terrorist List and the UN Consolidated List. For OFAC, EU, UK or other lists, consult your supervisory authority on the right course of action, and consider raising an STR or SAR with the FIU through goAML.
What if the match is a prospective customer, not an existing one?
Reject the transaction immediately and submit a CNMR on goAML within five business days. A prospective client is treated the same way as an existing one for reporting.
How long does a freeze last?
There is no time limit. It stays in place until the person is delisted, the EOCN cancels the freeze, or another lawful decision lifts it. On delisting, you lift the measures immediately unless a separate freeze order from a competent authority still applies.
Is registering for EOCN alerts enough?
No. Registration on the EOCN Notification Alert System is the first obligation, but the guidance also expects daily screening of your customer database and checking UN press releases, depending on your business model.
We are not registered on goAML. How do we report?
Reporting entities that are not on goAML email the EOCN at tfs@eocn.gov.ae within five business days of the freezing measure, with the full name of the match, the value of the frozen funds and the supporting documents.

Sources

  1. Guidance on Targeted Financial Sanctions for Financial Institutions, DNFBPs and VASPs, Executive Office for Control and Non-Proliferation (EOCN). Reported as issued January 2021 and last amended July 2025
  2. UN Consolidated List and UAE Local Terrorist List, EOCN
  3. Targeted Financial Sanctions, UAE Ministry of Economy and Tourism
  4. United Nations Security Council Consolidated List, United Nations
  5. Cabinet Decision No. 74 of 2020 on the terrorism lists regulation and implementation of UN Security Council resolutions, UAE Cabinet. Article 21 sets the four TFS obligations

This guide is general information, not legal advice. It reflects the sources listed above as of 3 Oct 2026. Check the current EOCN guidance and confirm with your supervisory authority or a UAE-qualified adviser how these obligations apply to your business.

CDD & KYC

Customer due diligence for UAE DNFBPs: identity, beneficial ownership and the risk-based approach

What CDD and KYC actually require in practice: verifying identity, tracing beneficial ownership to a natural person, when a customer needs simplified, standard or enhanced due diligence, and the ongoing monitoring that doesn't stop once onboarding is done.

11 min read
 goAML reporting

STR and SAR filing on goAML: a practical guide for UAE DNFBPs

What goAML actually is, the real difference between an STR and an SAR, what triggers a filing obligation, realistic timelines, and the record-keeping duty that goes with every report you file.

10 min read

Make the 24-hour rule routine

groAML screens against the UAE Local Terrorist List and the UN Consolidated List, matches Arabic names properly, and keeps a dated record of every check, match and decision.

See how groAML works Talk to Grovisor