The Office of Foreign Assets Control (OFAC) has dramatically intensified its enforcement posture toward Middle Eastern businesses in 2025. For UAE-based companies — from trading houses and banks to technology firms and logistics providers — understanding the contours of US sanctions law is no longer optional. It is an operational imperative.
What Is OFAC and Why Does It Matter to UAE Businesses?
OFAC is a financial intelligence and enforcement agency of the US Department of the Treasury. It administers and enforces economic and trade sanctions based on US foreign policy and national security goals against targeted foreign countries, regimes, terrorists, international narcotics traffickers, and proliferators of weapons of mass destruction.
The critical point for UAE entities is OFAC's extraterritorial reach. A company does not need to be incorporated in the United States, employ US citizens, or even process payments through US banks to be exposed to OFAC liability. Secondary sanctions — particularly those targeting dealings with Iran, Russia, and North Korea — apply to any party globally that engages in conduct prohibited by designated programs. For Dubai's position as a global trade hub, this creates a complex web of compliance obligations that touches every major industry sector.
In 2024 alone, OFAC issued penalties totalling over $1.5 billion globally, with a significant proportion arising from violations connected to Middle East-based entities or trade routes passing through the UAE. The message is unambiguous: OFAC is watching the region closely.
The UAE's Unique Sanctions Risk Profile
The UAE's geographic position, its role as a re-export hub, and its deep trade ties with Iran and Russia create a particularly elevated sanctions risk profile. Several factors compound this exposure:
- Trade corridors to sanctioned jurisdictions: Dubai's role as a transshipment hub means that goods, technology, and capital frequently move through UAE entities on their way to Iran, Russia, or other sanctioned destinations — often without the UAE company's full awareness of the ultimate end-user.
- Free Zone complexity: The UAE's numerous free zones — JAFZA, DMCC, ADGM — attract international businesses but also create structural opacity that OFAC has identified as a mechanism for sanctions evasion.
- Correspondent banking pressure: Major US correspondent banks have significantly tightened their due diligence on UAE-originating transactions. Even routine USD-denominated payments may trigger enhanced scrutiny.
- Beneficial ownership gaps: OFAC's focus on beneficial ownership means that UAE companies must conduct thorough look-through analysis of their counterparties, even where nominal ownership structures appear clean.
- Russia-related exposure post-2022: Since the imposition of sweeping Russia sanctions following the invasion of Ukraine, the UAE has emerged as a key focus jurisdiction for OFAC enforcement given the number of Russian-owned entities and individuals present in the emirate.
"UAE businesses operating in global trade are increasingly in OFAC's crosshairs. The question is not whether your company has sanctions exposure — it is whether you have the legal infrastructure to identify and manage that exposure before a violation occurs." — Dr. Shaun Gregory Morgan, Franklin Morgan Law, Emirates Towers, Dubai
SDN Screening: Your First Line of Defence
The Specially Designated Nationals and Blocked Persons (SDN) List is OFAC's primary tool for identifying sanctioned individuals and entities. As of June 2025, the SDN list contains over 13,000 names — a number that has grown by approximately 35% since 2020. Critically, the list is updated frequently; sometimes multiple times per week.
For UAE businesses, effective SDN screening requires more than a one-time check at onboarding. Best practice involves:
- Automated real-time screening of all counterparties against the SDN list and other OFAC lists (Sectoral Sanctions Identifications, the Foreign Sanctions Evaders list, the Non-SDN Iranian Sanctions Act list)
- Fuzzy-match logic to catch name variants, transliterations, and aliases
- Screening of beneficial owners at a minimum 25% ownership threshold (and ideally lower)
- Geographic screening to flag transactions involving jurisdictions subject to comprehensive sanctions programs
- Regular re-screening of the entire counterparty database — not just new customers
The SDN list must also be understood in the context of OFAC's 50% rule: any entity owned 50% or more (individually or in aggregate) by a designated person is itself considered blocked, even if it does not appear on the SDN list by name. This rule significantly expands the practical scope of sanctions screening obligations for UAE businesses.
Iran Sanctions: The Comprehensive Embargo and Its UAE Implications
Iran remains subject to one of the most comprehensive US sanctions regimes in existence. The Iranian Transactions and Sanctions Regulations (ITSR) and the Iranian Financial Sanctions Regulations (IFSR) effectively prohibit US persons — and non-US persons under secondary sanction provisions — from engaging in virtually any commercial dealing with Iran.
For UAE companies, Iran sanctions present a particular challenge because of the historical depth and geographic proximity of Iran-UAE trade. Key risk areas include:
- Shipments of goods with potential dual-use applications (electronics, chemicals, industrial equipment)
- Financial flows through Iranian-linked trading companies with UAE addresses
- Real estate and rental income from Iranian-owned properties in Dubai
- Service provision to entities in which Iranian nationals hold beneficial ownership
OFAC has demonstrated a willingness to impose significant penalties on UAE entities found to have facilitated Iran sanctions violations — including in cases where the entity itself had no US nexus beyond use of the US dollar in international transactions.
Russia Sanctions and CAATSA: A 2025 Enforcement Priority
Russia sanctions have become the single fastest-growing area of OFAC enforcement since 2022. The Executive Orders imposing broad sectoral sanctions on Russia's financial, energy, defence, and technology sectors — combined with CAATSA (Countering America's Adversaries Through Sanctions Act) secondary sanction provisions — create substantial exposure for UAE companies with Russia-connected business relationships.
In 2025, OFAC has specifically targeted UAE-based entities accused of facilitating the export of controlled technology to Russia in violation of both OFAC sanctions and Export Administration Regulations (EAR) administered by the Bureau of Industry and Security (BIS). Companies providing logistics, financing, or commercial services to sanctioned Russian entities or their affiliates face severe civil and criminal penalties.
OFAC Licenses: When Can You Legally Engage?
Not all dealings with sanctioned parties or jurisdictions are absolutely prohibited. OFAC maintains a licensing regime — both general licenses (published in advance and available to all qualifying parties) and specific licenses (issued on application to individual parties) — that can authorise otherwise-prohibited transactions.
Common categories of OFAC licenses relevant to UAE businesses include:
- General licenses for certain personal remittances, food, medicine, and informational materials to sanctioned countries
- Specific licenses for the wind-down of pre-existing contracts
- Specific licenses for humanitarian transactions
- Specific licenses for certain journalistic or academic activities
Obtaining an OFAC-specific license requires a detailed application that demonstrates the legality and policy legitimacy of the proposed transaction. Legal counsel experienced in OFAC licensing practice is essential, as incorrectly structured applications are routinely denied and can draw unwanted OFAC scrutiny to the applicant's activities.
Penalties and Enforcement: What Is at Stake?
OFAC civil penalties can reach up to the greater of $368,136 per violation or twice the value of the transaction at issue — whichever is higher. For egregious violations, these can be multiplied many times over. Criminal referrals can result in imprisonment of up to 20 years per violation and fines of up to $1 million per violation for individuals. Corporate fines have no statutory maximum.
Significantly, OFAC's penalty guidelines place particular weight on whether the violating entity had a compliance program in place at the time of the violation. A robust, well-documented compliance program — even where it fails to prevent a violation — can reduce penalties by up to 50% compared to penalties assessed against entities with no compliance infrastructure.
Building an Effective OFAC Compliance Program for 2025
OFAC's own Framework for Compliance Commitments identifies five essential components of an effective compliance program:
- Management commitment: Senior leadership must actively champion compliance and allocate adequate resources
- Risk assessment: Companies must conduct and regularly update a comprehensive assessment of their sanctions risk exposure
- Internal controls: Policies, procedures, and automated screening systems must be in place and calibrated to the company's specific risk profile
- Testing and auditing: Regular internal and external audits must test the effectiveness of controls and identify gaps
- Training: All relevant personnel must receive regular, tailored training on sanctions obligations
For UAE businesses, an effective compliance program must account for the specific risk factors of the regional operating environment — including the free zone landscape, Arabic-language customer documentation, and the prevalence of cash-intensive transactions in certain sectors.
The OFAC compliance landscape in 2025 is more demanding than at any point in recent history. For UAE businesses, the cost of inadequate compliance infrastructure is not merely regulatory — it can mean the loss of correspondent banking relationships, reputational damage, and ultimately the ability to operate in international markets. Engaging experienced legal counsel at the earliest opportunity is the most effective risk mitigation strategy available.
Dr. Shaun Gregory Morgan
Dr. Shaun Gregory Morgan is Dubai's foremost OFAC and sanctions lawyer, with over 200 OFAC matters handled and a record of $0 in client penalties. He holds an LLM from Northwestern University School of Law and an MSc in Economics from the London School of Economics (2000), and is admitted to the New York State Bar (No. 1210887).
Dr. Morgan advises multinational corporations, financial institutions, and high-net-worth individuals across the GCC, MENA, and globally on US sanctions compliance, enforcement defense, OFAC license applications, and cross-border corporate law. He is also the founder of DubaiLawyer.AI, a pioneering legal technology platform serving the UAE market.