Aggregating holdings across several listed persons under OFAC: explained

A multinational headquartered in one jurisdiction runs a compliance check on a proposed acquisition target. Three shareholders appear on OFAC's SDN List (OFAC's list of Specially Designated Nationals and blocked persons). None holds more than twenty percent on its own. The compliance team flags the situation as amber, not red, and the deal moves forward. Six months later, OFAC disagrees. The target was blocked the entire time – because the three holdings aggregated past the threshold. This is the gap that generates enforcement exposure and, in our experience, it is far more common than firms expect.

Under OFAC's 50 percent rule (the rule treating entities owned 50 percent or more by blocked persons as themselves blocked), aggregation across several listed persons is mandatory and mechanical: each blocked person's stake is added to every other blocked person's stake, regardless of whether those persons are related, whether they act together, or whether any single one of them crosses the threshold alone. As of January 2026, this rule operates under IEEPA and the relevant programme regulations, with no knowledge or intent required for a civil violation. The BIS/EAR regime governing export controls applies a structurally distinct test – and understanding where the two regimes diverge is essential for any cross-border business with complex ownership chains.

This analysis maps the principal divergences point by point: the aggregation mechanism itself, the treatment of indirect and layered holdings, the distinction between ownership and control, what BIS/EAR requires, how the UK and EU positions compare, the risk flags that signal a hidden problem, and when the analysis compels specialist input.

Divergence 1: the aggregation mechanism – how OFAC adds up the stakes

OFAC's aggregation rule adds every blocked person's ownership interest in a given entity together, and if the combined total reaches or exceeds 50 percent, the entity is itself treated as blocked – with no need for any single blocked person to cross that line alone. The rule operates under IEEPA and the applicable programme regulations and is set out in OFAC's guidance on the subject. It is the single most consequential structural feature of US sanctions for corporate ownership analysis.

The mechanics are worth stating precisely. Suppose an entity has four shareholders. Two are on the SDN List and each holds twenty-four percent. A third SDN holds five percent. The remaining forty-seven percent is held by clean parties. The two larger SDN stakes total forty-eight percent. Add the five percent and the aggregate SDN ownership reaches fifty-three percent. The entity is blocked. None of the three SDNs controls it; none even holds a plurality. None of that matters. The rule is arithmetic.

OFAC liability for civil violations is generally strict. Knowledge of the SDN status of a shareholder, knowledge that the aggregate threshold is met, or any element of intent is simply not required for the violation to exist. The firm that completes the transaction is liable the moment it engages with blocked property. That creates a design challenge that pure name-screening cannot solve: a tool that checks only whether a named party is listed will never detect an unlisted entity that is blocked by aggregation.

What is the practical implication? Every ownership inquiry must ask not just "is this counterparty listed?" but "do listed persons together own 50 percent or more of it?" Those are different questions, and they require different data.

Divergence 2: indirect and layered holdings – tracing the chain

OFAC's aggregation rule applies to both direct and indirect ownership, meaning that a blocked person's stake in an intermediate holding company is counted through to the ultimate operating entity on a proportionate basis. The rule does not stop at the first corporate layer. It follows the chain.

The tracing logic works proportionately. A blocked person holding sixty percent of a holding company that itself holds forty percent of an operating entity contributes twenty-four percent of indirect blocked ownership to the operating entity (sixty percent of forty percent). Add that to any direct holdings or other indirect routes and the aggregate may reach the threshold even though the operating entity appears, at first glance, to be several removes from any SDN. In our experience, this is the layer at which most screening failures occur.

Intermediate entities that are themselves blocked by the rule add a further complication. If an SDN owns fifty percent or more of a mid-tier holding company, that mid-tier is blocked. A transaction involving it is prohibited regardless of the target entity's own SDN status, and the blocked mid-tier's stake in any downstream entity counts toward the aggregation calculation for those entities too. The cascade can be deep.

Contrast this with a simpler name-based check. Screening the operating entity's direct shareholder register against the SDN List will not reveal a blocked mid-tier if the mid-tier's name does not appear on the List. That is why beneficial ownership data, not just registered shareholder data, is the necessary input – and why the data quality underlying a screening exercise matters as much as the screening logic itself.

Divergence 3: ownership versus control – where OFAC and the EU/UK part company

OFAC's rule is an ownership test. Control, in the sense of practical management or voting power, is not the trigger. An entity is blocked if blocked persons own fifty percent or more in the aggregate, full stop. A person who controls a company through contractual arrangements, voting agreements, or practical dominance – but who owns less than fifty percent of it – does not, under the OFAC rule alone, cause the entity to be blocked. That is a genuine and important boundary.

The UK and EU positions are structurally different. Under OFSI's regime, the ownership and control test (the UK and EU test for whether a non-listed entity is caught through a listed person) can extend the asset-freeze to an entity that a designated person controls, even where the ownership threshold is not met. OFSI's guidance addresses both the ownership limb and the control limb as independent routes to caught status. The EU position under the relevant Council Regulation similarly captures entities "owned or controlled" by listed persons, and the control limb requires a qualitative assessment of actual influence.

In our cross-border practice, this divergence produces situations where the identical ownership structure is blocked for EU and UK purposes but not, on strict OFAC analysis, for US purposes – or vice versa. A multinational that applies only the OFAC ownership test to all of its counterparties will systematically underestimate its exposure under OFSI and the EU rules. Conversely, a firm trained on the EU control concept may assume that OFAC operates the same way, and miss a blocked entity that is held just below fifty percent through a single SDN but well above through aggregation.

The practical takeaway for sanctions risk & compliance programmes is that no single test suffices for multi-regime exposure. The ownership analysis must be run separately under each applicable regime, using each regime's own criteria.

Divergence 4: the BIS/EAR regime – a structurally different question

BIS/EAR export-control restrictions on dealings with listed parties – principally the Entity List (BIS's list of parties subject to licence requirements or restrictions) and the Denied Persons List – operate on a different legal basis from OFAC's sanctions. The question BIS asks is not whether a counterparty is owned fifty percent or more by a listed entity; it is whether the counterparty is itself a listed party, or whether a transaction would, in substance, benefit a listed party or violate an end-use restriction.

This means that, in principle, an unlisted subsidiary of a listed Entity List party is not automatically subject to the same licence requirement that applies to its parent. The analysis turns on whether the specific counterparty is listed and on the nature of the goods, technology, or transaction. BIS controls are item- and end-use-specific: the same entity may be freely available to deal with for one class of goods and restricted for another.

However, a parallel rule does apply in certain circumstances. BIS's rules extend listed-entity restrictions to entities owned 50 percent or more by a listed party, as a general matter; the specific mechanics and the instruments through which this operates are subject to ongoing regulatory development and have been subject to postponement and revision as recently as 2025 and 2026. Any firm relying on this analysis for a specific transaction should verify the current position before relying on it, as the rules in this area are actively evolving.

The contrast with OFAC is significant in three ways. First, the OFAC 50 percent rule is unconditional: it does not vary by item or end-use. Second, OFAC's rule aggregates across multiple blocked persons; BIS restrictions on subsidiaries are typically based on majority ownership by a single listed entity. Third, the consequences differ: an OFAC violation involving a blocked party can engage the full civil and criminal enforcement apparatus under IEEPA; a BIS restriction involves a separate licensing regime with its own penalty structure. Where a counterparty has both an SDN-listed shareholder and an Entity List parent, both analyses must be run independently. For detailed guidance on how BIS/EAR affiliate-level restrictions operate, see our service page at affiliate-level restrictions under the BIS/EAR regime.

Divergence 5: the aggregation question in the UN, Swiss, and Canadian regimes

For businesses with exposure beyond the US, UK, and EU, the ownership and control question arises in every major regime, but the answers are not uniform. A cross-border compliance programme that resolves the OFAC question and assumes the analysis travels has not completed the work.

UN Security Council Consolidated List measures are implemented by member states through their national instruments. The Consolidated List itself does not specify an ownership aggregation threshold; implementation depends on the national regime in question, which may apply its own ownership or control test. Where a business is subject to both UNSC-implementing measures and autonomous sanctions in a given jurisdiction, the applicable national test governs.

Switzerland (SECO) frequently aligns its measures with the EU, which means the EU's ownership-and-control test, including its control limb, is typically the operative framework for Swiss-aligning regimes. Canadian sanctions under SEMA and JVCFOA have their own ownership and control provisions; the analysis is not identical to either the OFAC or EU approach. Australia's autonomous sanctions, administered by DFAT, apply an ownership or control test that practitioners should assess against the specific designating instrument.

In our experience, the firms that manage multi-regime exposure well maintain a jurisdiction matrix that maps, for each regime relevant to their business, the precise ownership threshold (if any), whether a control limb exists, and how aggregation across multiple listed persons is treated. That matrix is a living document: regime guidance and legislation change, and what was accurate twelve months ago may not be accurate now.

Divergence 6: risk flags – the patterns that signal a hidden aggregation problem

Aggregation failures rarely present with an obvious red flag. They emerge from the interaction of incomplete ownership data, screening logic that asks only about direct listed holders, and corporate structures that have not been reviewed since the underlying designations occurred. Several patterns recur.

The first is the fractional-holding pattern: multiple shareholders each below twenty-five percent, where sanctions screening checks each name but does not sum the stakes held by SDNs. This is the most common single cause of aggregation failure in the ownership-chain reviews we conduct.

The second is the post-acquisition legacy: a firm acquires a target, inherits its shareholder register, and does not re-screen the inherited register against the current SDN List. Designations made after the acquisition date will not be caught by the original pre-acquisition diligence. Sanctions records must be kept for five years, and the obligation to screen is ongoing, not one-time.

The third is the intermediate-entity gap: ownership data obtained from a commercial registry shows only direct holders of the target entity, not the composition of those holders' own ownership chains. A blocked intermediate holding company does not announce itself on the target's share register.

The fourth is stale data. SDN designations occur on short notice. A counterparty that was clean on the date of the original screen may have a newly listed shareholder the following week. Screening is a point-in-time exercise; it is not a standing confirmation of clean status. Compliance counsel and sanctions lawyers regularly see matters where a transaction was correctly cleared at inception and became non-compliant before closing because of an intervening designation.

A sharp change in the ownership structure of an established counterparty – a new shareholder substituted for one that was screened, or a restructuring that inserts a new intermediate entity – is a particularly acute risk flag. It may indicate ordinary commercial reorganisation, or it may not. Either way, the screening and ownership analysis must restart from the point of the change.

Divergence 7: the myth that name screening is enough – and what actually closes the gap

The most persistent misunderstanding in sanctions compliance is that screening counterparty names against the major lists constitutes a complete control. It does not. Name screening confirms that the named entity is not itself listed. It says nothing about whether the entity is blocked by aggregation.

This matters for aggregating holdings across several listed persons precisely because the entity that is subject to the blocking prohibition is, by definition, not on any list. It is blocked because of who owns it, not because of anything on its own record. A list-match tool will never return a hit for it. The protection comes from ownership analysis, not from screening.

What closes the gap? Five elements, applied consistently:

• Beneficial ownership data obtained from a source that goes beyond the direct shareholder register – covering at least two to three layers of the chain, and deeper where the structure suggests complexity.
• Aggregation logic applied to all SDN-listed owners, not just to individual holdings assessed in isolation.
• A control-limb assessment under the UK and EU rules, conducted separately from the OFAC ownership analysis.
• A re-screen trigger whenever ownership changes, whenever a new designation is published in a relevant programme, or on a defined periodic basis – not only at the point of onboarding.
• A documented rationale: if the analysis concludes the entity is not blocked, the reasoning should be recorded so that it is available as evidence of good-faith compliance if the position is later questioned.

For a parallel analysis of how these issues arise under EU sanctions rules, including the EU control test and the EU General Court's approach to evidence standards, see our companion analysis at aggregating holdings: OFAC vs EU compared. For the intersection of these questions with blockchain analytics and digital-asset screening, see blockchain analytics and sanctions screening.

When does the analysis require specialist input?

Many ownership analyses are straightforward: a simple cap table, no SDN involvement, a clean result. Specialist compliance counsel input becomes necessary when the facts move away from that baseline.

A decision matrix is useful here. If a counterparty has no SDN-linked shareholders in its direct register and the underlying beneficial ownership structure is well-documented, a well-designed internal process should suffice. If the structure has SDN-linked parties below the fifty percent threshold individually, the aggregation question requires a formal calculation, documented reasoning, and a legal opinion if the result is close or the transaction is material. If the structure has both SDN-linked shareholders and Entity List involvement, the BIS and OFAC analyses must be run independently, and the interaction between them assessed. If the structure involves a jurisdiction with lower data quality – making the ownership picture genuinely uncertain – the appropriate response is enhanced diligence, not a clean opinion on incomplete data.

The position above covers the standard case. Your facts – the counterparty's ownership chain, the programme in question, the jurisdictions involved, and the goods or services at stake – change the analysis. If a transaction has already proceeded and a potential aggregation issue has subsequently come to light, an early review can preserve options, including the question of whether a VSD (voluntary self-disclosure to a regulator) is appropriate. Voluntary self-disclosure is a recognised mitigating factor in OFAC's Enforcement Guidelines, and timing matters. We act for multinationals, financial institutions, and exporters on sanctions risk & compliance matters across the major regimes, and we regularly advise on exactly these ownership and aggregation questions. Contact us at info@caldervance.com.

Related practices

• Affiliate-level restrictions under BIS/EAR – how Entity List restrictions extend to subsidiaries and affiliates under US export controls
• Aggregating holdings: OFAC vs EU – point-by-point comparison of the OFAC and EU ownership tests and divergences

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.