An Abu Dhabi court spent the summer hearing how a $13 million consignment of rifles, machine guns and grenades was allegedly flown towards Sudan under papers naming the Ministry of Health. The case is a reminder that the documents meant to stop diversion are also the easiest thing in the chain to imitate.
Rifles listed as medicine
In April 2025 the UAE announced it had stopped a weapons shipment bound for Sudan. A year later, in April 2026, the Attorney General referred 13 people and six UAE-registered companies to the State Security Court in Abu Dhabi. Prosecutors allege they arranged a $13 million purchase of Kalashnikov rifles, machine guns and grenades for Sudan's armed forces, of which about $3 million went on illicit commissions, and tried to follow it with a $2 million ammunition deal. According to the prosecution, the aircraft manifest described the cargo as "humanitarian aid/medical" and named the consignee as "Federal Ministry of Health, Republic of Sudan". The documents, prosecutors say, were forged inside the UAE. The court heard evidence through the summer, including recordings and confessions, and the trial was continuing in August. None of the defendants has been convicted, and the charges remain allegations.
The details matter less than the shape. A consignee that exists. A government ministry that sounds plausible. A description that no customs officer would want to delay. Every element was chosen to pass a document check.
What an end-user certificate actually promises
An end-user certificate, or EUC, is a statement signed by the buyer, and for military goods usually by the importing government, saying who will use the goods, for what purpose, and that they will not be passed on without the exporting state's consent. Licensing authorities rely on it before granting an export licence. Banks, insurers, freight forwarders and manufacturers rely on it in turn.
There is no international standard form. The Wassenaar Arrangement and the Arms Trade Treaty describe what a good certificate should contain, and many states have their own templates, but a certificate from one ministry can look nothing like a certificate from another. That variety is one reason forgery works.
More important is what the certificate is. It is a promise made before delivery. It records the buyer's stated intention on the day it was signed. It cannot show what happened when the goods arrived, who paid for them, or where they were six months later. Most diversion happens in exactly those places.
How diversion gets past the paper
The cases fall into a small number of patterns, and each one beats a different kind of check.
The forged certificate. The oldest pattern. In March 1999, according to the UN Panel of Experts on Sierra Leone, 68 tonnes of weapons left Ukraine for Burkina Faso on the strength of a Burkinabè end-user certificate. On arrival in Ouagadougou the cargo was moved to another aircraft and flown to Liberia, from where it reached the Revolutionary United Front in Sierra Leone, under a UN embargo. Human Rights Watch later documented forged Guinean certificates used to buy small arms in Slovakia, and falsified paperwork behind a Ukrainian ammunition shipment to Côte d'Ivoire. The Abu Dhabi case, if the prosecution's account holds, is the same pattern twenty-five years later, with a ministry name replacing a ministry stamp.
The genuine certificate, then re-export. The certificate is real, the first delivery is lawful, and the goods move on later. In April 2025 Reuters reported that a UN panel was examining 81mm mortar rounds seized from a Rapid Support Forces convoy in North Darfur in November 2024. Their serial numbers matched rounds Bulgaria had reported exporting to the UAE in 2019. Bulgaria said it had never licensed exports of defence products to Sudan. The UAE denied supplying the RSF and said the panel had found no substantiated evidence that it had. Whatever the panel concludes, no document check in 2019 could have caught a transfer that happened years later.
The alias. The end user is real but appears under another name. In July 2025 Cadence Design Systems agreed to plead guilty and pay more than $140 million after exporting chip design tools to China's National University of Defense Technology, which had been on the US Entity List since 2015. According to the US Department of Justice, staff were told to refer to the customer as "CSCC" in English and to use the university's name only in Chinese characters, because the matter was "too sensitive". The paperwork named a customer that screening tools did not flag.
The intermediary. Goods are sold to a trading company in a third country with a clean record, which passes them on. This is the main route for dual-use goods reaching Russia. When the UK introduced sanctions end-use controls on 13 May 2026, allowing the government to require a licence where it sees a high risk of diversion, it named 13 countries it considers higher-risk routes, among them the UAE, Türkiye, Kazakhstan, Kyrgyzstan, Armenia and Serbia.
Even official checks find problems
Governments verify end users too, and their results are sobering. A May 2026 audit by the US Commerce Department's Inspector General looked at 676 end-use checks the Bureau of Industry and Security carried out on exports linked to Russia and Belarus in fiscal years 2022 and 2023. Of those, 38 were rated unfavourable and 94 unverified, meaning the end user could not be confirmed. Together that is almost one check in five. The audit also found documentation incomplete in 71% of the checks it reviewed.
These are checks done by government officers, often through embassies, with the authority to visit premises. A private company relying on a certificate and a screening database starts with far less.
Four layers of end-user due diligence
Good end-user due diligence works in layers. Each layer catches a different pattern, and none of them is enough alone.
Layer 1: the document. Check that the certificate is complete and internally consistent: names, addresses, item descriptions and quantities that match the contract; a unique reference number; a date that makes sense; a signatory whose position fits the issuing body. Confirm the issuing authority and the signatory through contact details you find independently, not the phone number printed on the document. Compare the format with genuine certificates from the same authority if you can obtain them. This layer catches crude forgeries. It will not catch a genuine blank form misused by an insider, or a real certificate later ignored.
Layer 2: the end user. Establish that the end user exists, at the stated address, and does work that fits the goods. A ministry of health importing rifles, a university buying parts for guided missiles, or a small trading company ordering ten times its usual volume are all mismatches. Look at ownership and control: corporate registries where they exist, shared addresses and phone numbers with other companies, recently formed entities, directors linked to sanctioned networks, and names in other languages or scripts. The Cadence case turned on a name; screening should cover known aliases and transliterations.
Layer 3: the transaction. Map everyone in the deal, not just the parties on the certificate. Who is the broker? Who is the freight forwarder? Who pays, from which country and which bank? Does the route make sense for the destination? A payment from a third country, a delivery address that differs from the end user's, a request to split shipments, an unusual willingness to pay a premium for speed, or a buyer who declines installation and training are all classic warning signs listed in official export control guidance.
Layer 4: after delivery. Ask for a delivery verification certificate confirming arrival. Where the contract allows, carry out or commission a post-shipment check: someone visits the site, confirms the goods are there and in use as declared, and records serial numbers. Then keep watching. The Bulgarian mortar rounds were identified because people in Darfur posted photographs of the serial numbers online. Researchers such as Conflict Armament Research trace weapons this way across Africa and the Middle East, working back from items found in the field to the original export licence.
Consider a hypothetical case. A European manufacturer of industrial cameras receives an order from a distributor in a Gulf free zone, with a signed end-user statement naming a construction company in Central Asia. The documents are clean. Layer 2 shows the construction company was registered eight months ago and shares a director with a logistics firm. Layer 3 shows payment coming from a Hong Kong account and a request for delivery to the distributor's warehouse, not the site. Each fact has an innocent explanation. Together they describe exactly the route regulators have been warning about, and they justify holding the shipment until someone has visited the construction company.
What these checks cannot do
A company cannot audit a foreign ministry of defence, and it cannot force a government end user to accept a site visit. Post-shipment checks are rare in arms contracts and often refused. A genuine certificate signed by a corrupt official will pass every document test. Some diversion happens years after delivery, long after anyone is looking. The honest aim of end-user due diligence is to make diversion harder and to stop the obvious cases, and to have a documented, reasoned basis for every decision when something goes wrong later.
Checks that need someone in the country
Many of the questions in layers 2 to 4 have answers that only exist locally. Whether the signatory on a certificate still holds that post, or left the ministry last year. Whether the warehouse at the end user's address is a working depot, an empty plot or a forwarding agent's office. Whether a broker is known in the market for moving goods onward to a neighbouring conflict. Whether a unit named on a certificate is the size the quantities suggest, or exists at all. In places like Port Sudan, N'Djamena, Tripoli or the free zones of the Gulf, these facts are known to people who work there, and to almost nobody reading the file abroad.
That local knowledge also makes the document layer stronger. A contact who can confirm through their own channels that a ministry issued a certificate, and that the official who signed it had the authority to do so, is worth more than any amount of comparing stamps.
A certificate records what someone promised on the day they signed it. The goods go wherever the people who hold them decide.
Position as at October 2026. Charges, allegations and denials are described as reported; defendants in the Abu Dhabi case have not been convicted. This article does not constitute legal advice.