Case study
A Dubai trading firm learned the hard way: the cheapest vendor cost them AED 2.4 million
In late 2022, a mid-sized Dubai-based electronics importer awarded a bulk supply contract to a Sharjah-registered vendor who came in 18% under the next best bid. Six months later, the vendor stopped answering calls, a shipment was seized because the goods breached UAE sanctions compliance, and the founder discovered the supplier’s trade licence had been suspended before the contract was even signed. No one on the procurement team had run a basic vendor check. This piece walks through what went wrong, what the team tried, what eventually worked, and why vendor due diligence has to sit at the front of every procurement process in the UAE.
Before and after: two ways to onboard the same vendor
Price-first shortlisting. The team compared three quotes, picked the lowest, and signed within a week. No trade licence verification. No UBO (ultimate beneficial owner) lookup. No sanctions screen. The vendor’s bank account was in a jurisdiction the company had never worked with. Payment terms were 50% up front.
Diligence-first shortlisting. The same team now runs a five-day check before any contract over AED 100,000. Trade licence status, audited financials, sanctions and PEP screening, litigation history, and a reference call with two prior clients. Payment is milestone-based. Two vendors have been rejected this year; both later showed up in fraud alerts.
The UAE context
Why the UAE market makes this harder than most
The UAE hosts more than 200 nationalities and, according to the Ministry of Economy, over 1 million registered businesses across the seven emirates and 40+ free zones. That mix is a strength for procurement (deep supplier pools, competitive pricing, global connections) and a risk (fragmented registries, cross-border ownership, language and documentation variance).
A trade licence issued in DMCC does not appear on the same registry as one issued in the Sharjah mainland or in RAKEZ. A vendor’s audited accounts may be in English, Arabic, Hindi, or Russian. Beneficial owners often sit in a second or third jurisdiction. Procurement teams that treat every supplier as a local vendor miss the layered checks the market actually requires.
According to the ACFE’s 2024 Report to the Nations procurement fraud accounts for roughly 21% of all occupational fraud cases globally, with a median loss of about USD 200,000 per case. In the Middle East, PwC’s 2022 Global Economic Crime Survey put procurement fraud among the top three fraud categories reported by regional companies. Skipping diligence is not a small oversight, it is a direct line to that statistic.
What the team tried first (and why it kept failing)
After the AED 2.4 million loss, the electronics importer’s leadership demanded a fix. The first attempts were all cosmetic. Here is what they tried, in order:
- Adding a vendor questionnaire. A 12-page PDF the supplier filled in themselves. Every vendor claimed clean records. Nothing was verified independently.
- Requiring three quotes. This controlled price but did nothing for legitimacy. All three quotes could come from shell entities.
- Asking legal to “take a look”. The legal team reviewed contract language but had no procurement data, no access to sanctions databases, and no time to chase trade licence status across seven emirates.
- Trusting long-tenured account managers. Two of the fraud cases the company later uncovered involved vendors introduced by internal staff who received undisclosed commissions.
- Using free online searches only. Google returns the vendor’s own website. It does not return suspended licences, ongoing DIFC Courts cases, or OFAC listings.
Each of these felt like progress on paper. None of them changed the actual risk profile of a new vendor. The team was checking the wrong things at the wrong depth.
What worked: the six checks that now run before any contract signature
The fix was not more paperwork, it was structured verification. Every new vendor over a defined spend threshold now moves through six checks before procurement can raise a PO. This mirrors what a proper financial due diligence engagement looks like, scaled down for recurring procurement decisions.
- Company registration. Verify the trade licence directly with the issuing authority (DED, DMCC, ADGM, RAKEZ, etc.), not from a scanned PDF the vendor emails. Confirm the activity codes actually cover what you are buying. A general trading licence does not authorise the vendor to supply regulated medical goods.
- Financial stability. Request two years of audited financials. Look at working capital, debt levels, and whether the auditor is registered with the UAE Ministry of Economy. A vendor whose turnover is one tenth the size of your contract is a delivery risk regardless of price.
- Legal and compliance checks. Search UAE court records (Dubai Courts, DIFC Courts, Abu Dhabi Judicial Department) for active litigation. Confirm VAT registration with the FTA. Confirm ESR and UBO filings where applicable.
- Sanctions and watchlists. Screen the entity and its beneficial owners against the UAE Local Terrorist List, UN Consolidated List, OFAC SDN, EU and UK sanctions lists. This is not optional under the UAE’s AML/CFT regime, and penalties for onboarding a sanctioned counterparty start at AED 50,000 and escalate quickly.
- Company reputation. Reference calls with at least two prior clients (not the ones the vendor supplied, ones you find independently). Check trade credit bureau data via Al Etihad Credit Bureau where available.
- Previous fraud or legal history. Adverse media screening in both English and Arabic. A vendor with a clean English-language footprint may still have a fraud judgment reported in Al Bayan or Emarat Al Youm.
Common mistakes
Where procurement teams still slip up
- Treating the lowest bid as the winning bid without weighting risk.
- Refreshing vendor files only at onboarding, never during the contract lifecycle.
- Accepting self-declared UBO information without independent verification.
- Skipping diligence on “referred” vendors because someone senior vouched for them.
- Running sanctions checks in English only, missing Arabic-script name variants.
- Assuming free zone entities are automatically pre-vetted (they are licensed, not diligenced).
The cheapest vendor is only cheap until the first thing goes wrong. After that, they are the most expensive decision on the balance sheet.
The bottom line for UAE procurement leaders
Vendor due diligence is not a compliance chore, it is a pricing input. When you know a supplier is financially stable, clean on sanctions, and has no active litigation, you can negotiate harder and pay faster. When you do not know, you are betting the contract value on hope. In a market with 200+ nationalities, dozens of registries, and cross-border ownership as the norm, hope is a poor procurement strategy.
Build the six checks into your process. Run them before contract signature, not after the invoice dispute. The cost of proper diligence is almost always a rounding error against the loss it prevents.
Frequently asked questions
What is vendor due diligence in the UAE context?
Vendor due diligence is the structured process of verifying a supplier’s legal, financial, and reputational standing before signing a contract. In the UAE it typically includes trade licence verification with the issuing authority (DED, DMCC, ADGM, and so on), audited financial review, sanctions screening against UAE and international lists, court and litigation searches, and UBO checks.
It goes beyond collecting documents from the vendor. The point is independent verification from primary sources.
How long does a proper vendor check take?
For a standard commercial vendor with a UAE trade licence, a full diligence pack usually takes three to seven working days. Sanctions and adverse media screening can be run in hours. Financial and litigation reviews take longer because they depend on the vendor providing audited accounts and on court record searches across multiple emirates.
For higher-risk categories (regulated goods, cross-border payments, government-adjacent contracts), plan for two to three weeks.
Is vendor due diligence legally required in the UAE?
Certain elements are. Under UAE AML/CFT regulations, designated non-financial businesses and professions must screen counterparties against sanctions lists and identify beneficial owners. Companies subject to Economic Substance Regulations and UBO rules have parallel obligations. Financial institutions have the strictest requirements.
For general commercial procurement, the full six-step diligence process is not statutory, but skipping sanctions and UBO checks can trigger regulatory penalties starting at AED 50,000 and rising sharply for repeat breaches.
Why does choosing the cheapest vendor cause problems later?
A price 15% to 20% below the market usually reflects one of three things: the vendor is undercapitalised and cutting corners, the vendor is subsidising the deal to win access before renegotiating, or the vendor is operating outside licensed activities. All three create downstream cost, whether through failed delivery, quality disputes, regulatory seizure, or contract renegotiation.
Total cost of ownership, not sticker price, is what procurement should be optimising for.
Can we run vendor due diligence in-house or do we need a specialist?
Basic checks (trade licence verification, VAT registration, public court records, reference calls) can be handled in-house by a trained procurement or compliance team. Sanctions screening ideally uses a dedicated database rather than free tools, because coverage of Arabic-script name variants and beneficial owner networks matters.
For high-value contracts, cross-border vendors, or acquisitions, a specialist provider is usually better value because they carry the tooling, language capability, and access to regional adverse media that most internal teams do not have.
How often should we re-check existing vendors?
At minimum annually for material vendors, and immediately if there is a trigger event: ownership change, adverse media hit, missed delivery, or regulatory action against a similar entity. Sanctions lists update daily, so many companies run automated screening against their full vendor master on a monthly or weekly cadence.
A vendor cleared two years ago is not the same risk as a vendor cleared last month.
Baseball fan, dreamer, record lover, Saul Bass fan and holistic designer. Performing at the nexus of beauty and intellectual purity to create not just a logo, but a feeling. I’m fueled by craft beer, hip-hop and tortilla chips.
