A trading company with operations in both New York and London screens a prospective distributor before signing a distribution agreement. The screening tool returns a clean result. Six weeks later, the compliance team discovers that a recently listed individual holds a significant stake in the distributor's parent. Two regulators, two sets of rules, two different answers about whether the transaction should have proceeded at all.
Counterparty due diligence under OFAC and OFSI follows different legal tests, different ownership thresholds, and different enforcement expectations. Under OFAC, a non-listed entity is treated as blocked when listed persons own it 50 percent or more in the aggregate. Under OFSI and the equivalent EU rules, a control test sits alongside the ownership threshold and can catch entities that the OFAC mechanical test would not. As of July 2026, both regimes are active enforcement priorities, and divergences in how a business screens counterparties carry real transactional and regulatory risk.
This analysis maps those divergences criterion by criterion, identifies the points at which the regimes converge, and sets out a practical sequence for businesses that operate under both simultaneously.
What makes counterparty due diligence under OFAC distinct?
OFAC's counterparty due diligence obligation rests on a single consolidated question: is the person or entity on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons), or is it owned 50 percent or more by one or more SDN-listed persons? That question is mechanical. OFAC applies it without regard to the intent of the parties or to whether the underlying ownership is exercised actively.
The governing authority is IEEPA and the programme-specific regulations administered by OFAC. Those instruments prohibit US persons from dealing with blocked parties and, critically, extend the prohibition to entities that meet the ownership threshold – even when those entities are not themselves named. OFAC calls this its 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked). The practical effect is that a company can be blocked by operation of law without appearing on any published list.
In our experience, this is the point at which screening programmes most often fail. A tool that searches only published lists will miss the unlisted subsidiary of an SDN. The same logic applies across indirect ownership chains: if a listed person holds forty percent of an intermediary, and that intermediary holds sixty percent of the target counterparty, the question is whether the listed person's effective ownership in the target meets or exceeds the threshold when indirect holdings are counted. In many layered structures, it does.
Aggregation compounds the exposure further. Two or more listed persons, each with a minority stake, can together satisfy the fifty percent threshold. Neither would trigger it alone. A business that checks each listed person's stake in isolation – rather than aggregating across all listed shareholders – will produce a systematically under-inclusive result.
How does the OFSI ownership and control test differ?
OFSI's test for when a non-listed entity is caught as a designated person has two distinct limbs: ownership and control (the UK and EU test for whether a non-listed entity is caught through a listed person). The ownership limb mirrors OFAC's in its threshold: an entity that a designated person owns fifty percent or more – directly or indirectly – is treated as subject to the same financial-sanctions prohibitions. That much converges.
The control limb diverges sharply. OFSI can treat an entity as subject to the financial-sanctions regime when a designated person controls it, even where ownership is below fifty percent. Control can arise from contractual arrangements, voting rights, board composition, veto rights over material decisions, or practical ability to direct the entity's activities. There is no fixed numerical threshold for control. This is a facts-and-circumstances assessment, not a mechanical calculation.
Why does this matter for counterparty screening? A target company may have a listed person holding, say, thirty-eight percent of its equity. Under the OFAC ownership test alone, that would not satisfy the threshold. Under OFSI, the same facts could produce a different answer if the listed person also holds a contractual right to appoint the majority of the board, or a veto over the company's strategic decisions. The EU regime follows materially the same structure. Businesses that apply OFAC's fifty percent threshold as the universal test for all jurisdictions are operating a systematically under-inclusive programme when UK and EU obligations are also in scope.
We regularly advise clients on exactly this mismatch. The consequence is not theoretical. A business that clears a counterparty under the OFAC test and then routes a payment through a UK-regulated bank may find that the bank's own OFSI compliance team flags the same counterparty that the client's programme passed. The practical divergence surfaces at the point of execution.
Related practices
- Compliance audit and testing – assessing screening logic, ownership mapping, and programme design across regimes
- OFSI counterparty due diligence analysis – the UK regime, the control test, and OFSI's enforcement posture in detail
The position above covers the standard structure of each test. Your facts – the nature of the interest held, the contractual rights attached to it, the jurisdiction of your counterparty's operating entity, and the currencies and payment routes involved – change the analysis considerably. For an assessment of your exposure under OFAC and OFSI, contact Calder & Vance at info@caldervance.com.
Where do the secondary-sanctions obligations diverge?
Secondary sanctions are a distinct instrument of US policy that OFAC administers. They extend US sanctions risk beyond the reach of primary prohibitions, creating exposure for non-US persons that engage in significant transactions with certain designated parties or in certain sectors, even where no US nexus would otherwise exist. OFSI does not operate a secondary-sanctions regime in the same sense. The UK's extraterritorial reach operates through different mechanisms, including the correspondent-banking relationship and the application of UK financial-sanctions rules to UK-incorporated entities and their branches worldwide.
This divergence is highly material for counterparty due diligence. A European or Asian business conducting due diligence for a transaction that involves no US-dollar clearing and no US-person involvement may conclude it has no OFAC primary-sanctions exposure. That analysis may be correct as far as it goes. But if the transaction involves a party subject to US secondary-sanctions designations in a relevant sector, the non-US counterparty could still face OFAC's secondary-sanctions risk: OFAC could designate the business itself, deny it access to the US financial system, or signal to US-person counterparties to terminate relationships.
In counterparty screening terms, a programme designed only to catch primary-sanctions violations will not surface secondary-sanctions risk. Those are different queries. Primary screening asks: is this counterparty blocked, and does the 50 percent rule extend blocking to it? Secondary screening asks: is this counterparty operating in a sector or with parties that creates secondary risk for us under OFAC's programme-specific rules? Both questions require separate answers. Running only one is a significant gap.
OFSI's enforcement approach has grown more assertive, and the UK has extended its own sanctions reach to cover certain extraterritorial conduct by UK persons and entities. Practitioners advising on OFAC matters note that a client with both US and UK regulatory obligations should maintain separate but coordinated screening logic for primary OFAC, secondary OFAC, and OFSI obligations. A single pass through a combined list is not sufficient.
How do the due-diligence standards differ in practice?
OFAC has published compliance guidance that sets out the five essential components of a sanctions compliance programme: management commitment, risk assessment, internal controls, testing and auditing, and training. That guidance does not create a statutory standard in itself, but it frames what OFAC will look at when assessing whether a voluntary self-disclosure or a penalty mitigation argument has substance. A business that can demonstrate a well-functioning programme against those five components is in a meaningfully different position from one that cannot.
OFSI's enforcement guidance similarly identifies the factors that will inform its penalty decisions: the seriousness of the breach, the compliance history of the firm, whether there was awareness of the violation, and the steps taken after discovery. OFSI has a power to impose civil penalties and to publish details of monetary penalties. As of July 2026, OFSI has used its public reporting powers to signal expectations to the wider market, and a penalty decision published in the UK carries market and reputational consequences beyond the fine itself.
For counterparty due diligence specifically, the practical implication is this: neither OFAC nor OFSI prescribes the exact form a due-diligence process must take. Both will look at whether the process was proportionate to the risk – the size of the transaction, the jurisdiction of the counterparty, the sector, the presence of red flags, and the depth to which the ownership chain was investigated. A cursory name-check for a high-value transaction with a counterparty in a high-risk jurisdiction is not proportionate. A detailed ownership-chain review for a small, routine domestic transaction may be disproportionate in the other direction. The programme must be calibrated.
In a recent matter, a mid-sized financial services firm had applied a uniform screening standard across all counterparties regardless of transaction size or counterparty jurisdiction. When a transaction was queried by OFAC under a programme with significant secondary-sanctions reach, the firm's compliance records showed that the due-diligence file contained only a list-check output. We assisted the firm in reconstructing a proportionate response, preparing a VSD (voluntary self-disclosure to a regulator), and redesigning the programme to a risk-based standard. The matter resolved without a penalty. We do not guarantee that outcome.
What are the key risk flags that due diligence should surface?
Risk-flag identification is the operational core of counterparty due diligence. A screening programme that only checks names against published lists will miss the majority of actual sanctions risk vectors. Both OFAC and OFSI expect a proportionate programme to surface and investigate the following categories.
Ownership opacity is the primary flag. Where a counterparty declines to provide complete beneficial-ownership information, offers a structure involving nominee shareholders, registers in a jurisdiction with limited public corporate-registry data, or has recently undergone a structural reorganisation that has the effect of diluting a previously held stake – each of those warrants deeper investigation, not acceptance at face value.
Jurisdiction combinations carry embedded risk. A counterparty incorporated in one jurisdiction, operating from another, and banking in a third creates a multi-regime question. The same transaction may engage OFAC, OFSI, and the EU regime simultaneously. Each regime may produce a different answer about whether the counterparty is caught. The stricter prohibition governs the conduct of any party subject to both. A business operating under both US and UK obligations must apply whichever test is more restrictive to its own conduct – it cannot elect the more permissive regime.
Sector exposure is a distinct vector. Certain sectors carry elevated secondary-sanctions risk under specific OFAC programmes regardless of whether any individual counterparty is listed. Operating in those sectors, or transacting with counterparties that do, requires programme-specific analysis beyond name-screening.
Adverse-media indicators supplement list-screening. A counterparty that is not designated but whose principals appear regularly in reporting relating to sanctions violations, enforcement actions, or designated-person networks presents a risk that a list-check alone will not capture. Adverse-media monitoring is a component of a proportionate programme, not an optional refinement.
How do the regimes converge – and where does the stricter test govern?
Despite the divergences set out above, OFAC and OFSI converge on a number of material points. Both operate a prohibitions-based model: absent a licence or a general authorisation, the default is that a transaction with a designated person or an entity caught through the ownership or control tests is prohibited. Both place the compliance burden on the person proposing to transact. Both use a risk-based enforcement approach that considers the quality of the programme, the voluntary self-disclosure decision, and the seriousness of the apparent violation when calibrating a penalty.
Both also operate general licence (a standing authorisation that permits a defined category of transactions without a separate application) mechanisms that allow certain otherwise-prohibited activities to proceed without a case-by-case application. The scope and terms of those general authorisations differ between regimes, and reliance on an OFAC general licence does not confer OFSI authorisation, and vice versa.
Where a business is subject to both regimes simultaneously – as most significant cross-border businesses are – the operative principle is that the stricter prohibition governs. A transaction that OFAC would permit under a general licence but that OFSI has not authorised remains prohibited under UK law for UK-connected persons. A business that has obtained an OFAC specific licence (a case-by-case authorisation to conduct an otherwise prohibited transaction) has not, by that fact alone, obtained the corresponding OFSI authorisation. Separate applications, or separate analysis of existing general authorisations, are required under each regime.
This is the single most common misunderstanding we encounter among compliance teams that have historically focused on OFAC as the primary regime. OFAC programme coverage is extensive and its secondary-sanctions reach is significant. But for businesses with UK connections, OFSI operates an independent set of obligations with its own enforcement posture and its own licensing gate. Those obligations run in parallel and must be managed in parallel.
If a transaction has already been flagged, or a filing has been refused under either regime, an early review can preserve options that narrow with time. For a confidential review of a potential breach or a counterparty exposure under OFAC and OFSI, contact Calder & Vance at info@caldervance.com.
When does a cross-border business need counsel on this?
The point at which internal compliance resource reaches the limit of what it can reliably handle is rarely obvious from the inside. The following situations consistently warrant external counsel with cross-regime coverage.
A counterparty that screens clean at the list-check level but whose ownership chain is incomplete, opaque, or undergoing change requires a structured ownership-and-control analysis. That analysis needs to be conducted against the specific programme rules of each regime in play, not against a generic fifty-percent threshold.
A transaction that involves a jurisdiction, a sector, or a transaction type with known secondary-sanctions sensitivity under an OFAC programme requires programme-specific advice, not general screening. The secondary-sanctions risk question is separate from the primary-prohibitions question.
A situation in which a counterparty has been cleared under one regime but flagged under another requires a cross-regime reconciliation exercise. The firm cannot proceed on the basis of the more permissive clearance. It needs to understand what the stricter regime requires and whether an authorisation is available.
A potential breach – whether a transaction that proceeded on the basis of an incomplete ownership review, a payment routed through a blocked party, or a filing that was submitted and refused – requires immediate triage. Our practice covers OFAC licensing, OFSI enforcement responses, and VSD preparation under both regimes. We assess the scope of the apparent violation, advise on voluntary self-disclosure, and prepare the penalty defence.
The myth we encounter in well-run compliance teams is that a thorough list-check, consistently applied, is sufficient for counterparty due diligence. It is not. Under OFAC, the fifty percent rule means that a clean list-check result does not rule out blocking through an unlisted subsidiary or holding vehicle. Under OFSI, the control test means that the threshold question extends beyond equity ownership. A programme that relies solely on list-checking is a programme that has not been calibrated to the actual legal tests it purports to address. We regularly advise on redesigning those programmes and on the ownership-mapping methodology that underpins a defensible review.
Our cross-border practice covers both regimes under one engagement structure, which avoids the coordination risk that arises when OFAC and OFSI matters are handled by separate, siloed teams. That coordination risk is itself a compliance exposure: the firm cannot apply the stricter test if neither team knows what the other has assessed.
See also our analysis of counterparty due diligence under the Singapore regime for businesses with Asia-Pacific exposure and an overview of the interaction between that regime and secondary-sanctions risk.