OFAC vs OFSI: Digital-asset counterparty diligence compared

A fintech company headquartered in London is mid-way through onboarding a digital-asset liquidity provider incorporated in a third jurisdiction. The counterparty's wallet addresses screen clean against standard name-matching tools. Then a blockchain analytics alert surfaces a cluster of addresses associated with a designated entity. The deal is paused. The question is not whether sanctions apply – they do – but which sanctions, applied by whom, on what legal theory, and what the business must do before it can proceed. As of January 2026, that question implicates two regimes simultaneously: OFAC in the United States and OFSI in the United Kingdom. The analysis diverges in ways that can determine the outcome.

Digital-asset counterparty diligence under OFAC and OFSI rests on structurally different legal theories. OFAC applies the 50 percent rule (the rule treating any entity owned 50 percent or more in the aggregate by blocked persons as itself blocked) and extends prohibitions to wallet addresses associated with designated persons. OFSI applies an ownership-and-control test that can catch a counterparty through actual control even where a formal ownership threshold is not reached. Both regimes apply to digital-asset service providers operating within their jurisdictions or transacting with their nationals, and where both bite, the stricter prohibition governs.

This analysis runs a single cross-border fact pattern through OFAC and OFSI in turn, maps the points of divergence that create practical compliance decisions, and identifies the risk flags that should trigger counsel involvement before a transaction closes.

The fact pattern: a cross-border digital-asset liquidity trade

A UK-incorporated virtual-asset service provider – call it the operator – proposes to settle a large-value stablecoin position with a counterparty registered in a third jurisdiction. The counterparty's sole corporate shareholder holds 50 percent or more of its equity. That shareholder is a corporate entity. One of the shareholder's own shareholders appears on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) and is separately designated under UK financial-sanctions regulations. The operator has US-dollar clearing relationships and a significant proportion of its treasury is held in a US-dollar stablecoin. Both the operator and its counterparty have addressed wallets on a public blockchain.

This scenario is not unusual. In our cross-border practice we regularly advise businesses that discover mid-transaction that a counterparty's ownership structure reaches a designated person two or three layers back. The legal analysis depends on which regime applies, and on whether the applicable ownership-or-control test is satisfied.

The scenario deliberately crosses jurisdictions. The operator is subject to UK financial-sanctions obligations. Its US-dollar clearing and the stablecoin infrastructure create a potential US nexus. Both the OFAC and OFSI analyses must be run, and they do not produce the same answer on the same facts.

OFAC analysis: the 50 percent rule, wallet designations, and the US nexus

Under the OFAC analysis, the critical first question is whether the counterparty is itself a blocked person by operation of the 50 percent rule. The rule is mechanical. It does not require that the counterparty be independently listed on the SDN List. Where one or more SDN-listed persons own the counterparty in the aggregate to the threshold, the counterparty is treated as blocked regardless of intent, knowledge, or the counterparty's own good faith. The inquiry is about ownership percentages through the chain, aggregated across all listed holders.

In the fact pattern, the SDN-listed individual holds an interest in the corporate shareholder, which in turn holds 50 percent or more of the counterparty. Aggregation is the operative concept. Two questions arise. First, does the SDN-listed individual own 50 percent or more of the corporate shareholder? If so, the corporate shareholder is itself blocked by operation of the rule, and its own 50 percent or more holding in the counterparty extends blockage downward through that chain. Second, even if the individual's holding in the corporate shareholder sits below the threshold, their indirect interest in the counterparty may still be relevant if, when aggregated with any other listed persons' interests, it reaches the threshold at the counterparty level.

This is the aggregation trap. Screening tools that check only whether a direct counterparty appears on a list miss it entirely. The analysis requires mapping every ownership layer and testing each listed person's aggregate direct and indirect interest. How often does a compliance programme actually run that calculation before counterparty onboarding closes?

The wallet dimension adds a further OFAC-specific layer. OFAC has designated specific wallet addresses as blocked property. Blockchain analytics is used by the regulator to trace address clusters; a designation can extend to addresses that transact with or are otherwise associated with a designated person. A transaction that processes through or touches a designated address – even indirectly through a chain of on-chain transfers – creates a potential blocking and reporting obligation. Blocked-property reports are due to OFAC within 10 business days of the blocking event, as currently in force, verify before reliance. That window starts running from the moment property is identified as blocked, not from the moment counsel confirms the analysis.

The US nexus question for the operator is the final OFAC variable. US-dollar clearing relationships and US-dollar stablecoin infrastructure create a plausible US nexus, exposing the operator to OFAC's jurisdiction even as a non-US person. US persons – and, for comprehensive programmes, US-dollar clearing – are within OFAC's reach. Facilitation (assisting or supporting a transaction that a US person would be prohibited from conducting directly) is itself prohibited under the regulations applicable to US persons. A non-US operator with a US-dollar clearing bank may need to consider whether its clearing bank's compliance procedures create a chilling effect and whether the operator's own conduct would be caught as facilitation by any US-person intermediary.

OFSI analysis: the ownership-and-control test and the stablecoin question

OFSI's analysis of the same fact pattern begins from a different legal premise. The UK ownership-and-control test can catch a non-listed entity through either an ownership criterion or a control criterion. Ownership is assessed on a basis similar to OFAC's 50 percent threshold, but control is a separate and broader ground.

Control, under the UK test, is actual control: the ability of the designated person to direct the conduct of the entity in question. UK case law has established that control must be real, not merely theoretical. A minority shareholder who can exercise decisive operational influence over a counterparty may satisfy the control test even without reaching a formal ownership threshold. This matters in digital-asset structures where governance arrangements, voting agreements, or protocol-level permissions can vest effective control in a person who holds no equity at all.

In the fact pattern, even if the SDN-listed individual's indirect interest in the counterparty falls below a threshold that would satisfy the OFAC aggregation analysis, the OFSI control test remains open. If that individual can direct the counterparty's transactions, approve wallet keys, or otherwise determine how the counterparty operates its business, OFSI may reach a conclusion that the counterparty is caught – and OFSI's analysis is independent of OFAC's. The operator, as a UK-based firm, is subject to UK financial-sanctions regulations. The OFSI analysis is not optional.

OFSI operates a licensing regime with defined licensing grounds for financial sanctions, as currently in force, verify before reliance. Where a transaction is blocked under UK law, the operator cannot proceed without a licence unless a general authorisation applies. There is a legal obligation on relevant firms – and a regulated virtual-asset service provider is likely to be a relevant firm – to report knowledge or suspicion of a designated person to OFSI, as currently in force, verify before reliance. The timing of that obligation is not discretionary.

The EU transfer-of-funds regime, as an additional reference point for operators with EU clearing or EU counterparties, applies a zero threshold to transfers between crypto-asset service providers: originator and beneficiary information is required regardless of the value of the transfer, as currently in force, verify before reliance. While the operator in the fact pattern is UK-based and the EU regime does not apply directly, the EU position illustrates the direction of travel. Regulators across jurisdictions are tightening the standard applied to digital-asset transactions, and a compliance programme calibrated only to one regime will miss the aggregate risk picture.

Where the regimes diverge: a criterion-by-criterion comparison

The most significant divergences between OFAC and OFSI on digital-asset counterparty diligence arise across four operational dimensions. Each divergence creates a decision point for a compliance programme running both analyses in parallel.

Ownership test versus control test. OFAC's 50 percent rule is ownership-based and mechanical; it does not require a showing of actual control. OFSI's test adds the control limb, which extends the analysis to governance arrangements and practical influence. A counterparty that passes the OFAC ownership test may still be caught by OFSI on the control limb. The converse is also possible: a structure designed to stay below OFAC's ownership threshold may still satisfy the OFSI control test if the designated person retains operational authority.

Wallet and address designations. OFAC has a developed practice of designating specific wallet addresses, which creates a blockchain-traceable prohibition. OFSI's designation practice focuses on the legal person or individual; address-level designation is less developed under UK law as of early 2026. This means that a blockchain analytics hit on a designated address may create an immediate OFAC obligation but require a more fact-intensive OFSI analysis. Running only one analysis creates a gap.

Reporting obligations. OFAC's blocked-property and rejected-transaction reporting obligation runs on a strict 10 business-day window from the relevant event, as currently in force, verify before reliance. OFSI's reporting obligation for relevant firms is triggered by knowledge or suspicion and is ongoing; the specific timing parameters differ. A business operating under both regimes must track both windows simultaneously.

Liability standard. OFAC's civil-penalty liability is generally strict: no knowledge or intent is required for the violation itself, as currently in force, verify before reliance. OFSI can impose monetary penalties on a strict-liability basis, in force since 2022, as currently in force, verify before reliance. Under current UK law, the maximum OFSI monetary penalty is the greater of £1,000,000 or 50 percent of the breach value, as currently in force, verify before reliance. Both regimes therefore expose a business to significant liability for violations that arise from inadequate diligence rather than intentional wrongdoing.

The practical implication is that a compliance programme which treats OFAC and OFSI as interchangeable will be wrong in both directions: it will miss OFSI control-test exposures and will over-rely on name-matching against the SDN List without the ownership-chain aggregation analysis that OFAC's 50 percent rule requires.

Risk flags specific to digital-asset counterparty diligence

Digital-asset structures create a set of risk flags that either do not arise in conventional counterparty diligence or arise in a materially different form. A compliance programme that treats digital-asset diligence as equivalent to traditional customer due diligence will leave specific gaps.

The first flag is wallet-address clustering. Blockchain analytics platforms can identify address clusters associated with a designated person. A counterparty whose wallets transact with, or are co-attributed to, a designated address cluster presents a risk that name-screening alone cannot detect. The analysis requires integrating on-chain data with the ownership and control analysis – wallet activity may be the first indication that a beneficial owner is reachable by a designation.

The second flag is token-issuer designation. A designation of a stablecoin issuer or protocol-level operator can cascade into a practical inability to use that instrument for settlement. Where the operator's treasury is partially denominated in a stablecoin whose issuer subsequently becomes subject to measures, the position changes without any action by the operator. Treasury concentration in a single stablecoin instrument therefore creates a regime-change risk that is distinct from counterparty risk.

The third flag is governance structure opacity. Many digital-asset entities operate through protocol governance, multi-signature wallet arrangements, or decentralised autonomous organisation structures where formal equity ownership does not reflect actual decision-making authority. Under OFSI's control test – and potentially under OFAC guidance on the practical and economic reality of a transaction – these governance arrangements are legally significant. Is the beneficial controller of the protocol on a sanctions list, even where no formal equity exists?

The fourth flag is the correspondent-bank cascade. US authority allows measures against foreign financial institutions that conduct or facilitate significant transactions for designated persons or specified sectors, as currently in force, verify before reliance. A correspondent-account restriction on a digital-asset firm's banking partner can extinguish the operator's own access to US-dollar settlement infrastructure without any direct sanction being imposed on the operator itself. Diligence must therefore extend to the operator's own banking relationships, not only to the direct counterparty.

The fifth flag is the anti-circumvention signal. A sharp change in trade flows – or wallet-activity patterns – to a third-country intermediary is treated as a diversion red flag. In the digital-asset context, a counterparty that routes transactions through multiple intermediate wallets or jurisdictions before reaching the operator may be creating exactly the pattern that regulators identify as indicative of sanctions evasion. Identifying this pattern in counterparty diligence is a compliance function, not an accusation; but failure to identify it leaves the operator exposed.

The scenario concluded: what the operator must do

Running the fact pattern to its practical conclusion, the operator in the scenario faces a defined set of obligations before the transaction can proceed.

The first obligation is to complete the OFAC ownership-chain analysis. This means mapping every intermediate entity between the SDN-listed individual and the counterparty, calculating whether the aggregate direct and indirect interest of all listed persons reaches the threshold at each layer, and reaching a documented conclusion on whether the counterparty is blocked by operation of the 50 percent rule. The analysis cannot be delegated to a screening platform alone: the aggregation calculation requires a human review of the corporate structure.

The second obligation is to run the OFSI control-test analysis in parallel. The operator cannot assume that a clean OFAC result resolves the OFSI question. The control limb requires a separate factual assessment of whether the SDN-listed individual can exercise actual control over the counterparty, including through governance arrangements that sit outside the formal equity structure.

The third obligation is to check wallet-address associations. If the operator's counterparty has wallet addresses co-attributed to a designated cluster in a reputable blockchain analytics platform, that is a material risk indicator requiring escalation and a documented response.

The fourth obligation is to assess the reporting position. If property has been identified as blocked, the 10 business-day reporting window under OFAC may already be running. If the operator has knowledge or reasonable grounds to suspect that the counterparty is a designated person or owned or controlled by one, the OFSI reporting obligation may also have been triggered. These are not decisions to defer until the transaction is resolved.

The fifth obligation is to consider the licensing question. If the transaction is blocked under either regime, no carve-out, contractual representation, or seller's warranty removes that legal position. The myth that a counterparty's representations in a purchase agreement transfer the buyer's sanctions risk is precisely that: a myth. Reps and warranties do not constitute a licence. If the transaction is to proceed, the operator must either obtain a specific licence or confirm the applicability of a general authorisation under each applicable regime.

In our experience, the businesses that manage this scenario most effectively are those that have already integrated blockchain analytics output, ownership-chain analysis, and a dual-regime review into a single counterparty onboarding workflow before the deal reaches the execution stage. A late sanctions hit – the discovery that a counterparty is caught by one regime or another after a term sheet has been signed – is among the most costly diligence failures in digital-asset practice. The cost is not only the aborted transaction; it is the reporting obligation, the freeze of related positions, and the reputational exposure that follows.

We regularly advise operators, liquidity providers, and financial institutions on exactly this workflow. The position above covers the structural analysis. Your facts – the wallet addresses, the ownership chain, the clearing-bank relationships, and the regimes in play – change the analysis in ways that require case-specific review.

For an assessment of your exposure under OFAC and OFSI in a digital-asset transaction, contact Calder & Vance at info@caldervance.com.

The common objection: "Our seller's reps cover this"

A persistent and operationally dangerous misconception in digital-asset transactions is that a counterparty's representations and warranties in a sale agreement transfer or neutralise the buyer's sanctions risk. They do not.

Sanctions prohibitions are public-law obligations that bind the regulated person regardless of what a private contract says. An agreement in which a seller represents that it is not a designated person and that the transaction does not violate applicable sanctions does not constitute a licence from OFAC, a licence from OFSI, or any other form of regulatory authorisation. If the transaction is blocked under the applicable regime, the prohibition applies. The buyer has a breach-of-contract claim against the seller; it does not have a defence against the regulator.

This distinction matters acutely in digital-asset transactions because the ownership chain, wallet associations, and governance structure of a digital-asset counterparty may not be visible to the seller. A representation that is made in good faith may still be wrong. The OFAC 50 percent rule and the OFSI control test are not satisfied or displaced by a counterparty's honest belief that it is not caught; they are satisfied or not satisfied on the underlying facts.

We have acted in matters where a business completed a transaction relying on counterparty representations, discovered post-closing that an upstream owner appeared on the SDN List, and faced a blocked-property situation that required both a reporting obligation and a remediation strategy. The seller's representations were both genuine and contractually enforceable. Neither fact altered the sanctions position.

The correct approach is to complete the ownership-chain and control analysis before closing, not to substitute a contractual representation for it. The two are not alternatives. Where both have been done and a discrepancy emerges post-closing through new information or a new designation, the pre-closing analysis and its documentation will inform both the reporting decision and any enforcement defence.

When to involve sanctions counsel

Digital-asset counterparty diligence involves counsel at four defined points where the analysis exceeds what an internal compliance function can resolve in real time.

The first is when an ownership-chain analysis identifies a potential listing at any layer and the aggregation calculation is not conclusive. The interpretation of the 50 percent rule through intermediate holding structures, and the interaction with OFSI's control test, are legal questions on which a documented legal position is preferable to a compliance officer's best judgment.

The second is when a blockchain analytics platform returns a cluster association that is ambiguous – where addresses are flagged as "associated with" rather than directly attributed to a designated entity. The legal significance of a cluster association under OFAC policy, and the question of whether the operator has grounds to proceed, requires a legal assessment.

The third is when any property has been or may have been blocked. The reporting obligation is legal in nature and the window is short. The content of the report, the question of whether a voluntary self-disclosure is appropriate, and the steps required to preserve the operator's enforcement position all require counsel involvement from the first day.

Voluntary self-disclosure (a disclosure to a regulator of an apparent violation before the regulator initiates its own inquiry) is a recognised mitigating factor under OFAC's Enforcement Guidelines. The decision whether to make one, when to make it, and on what terms requires experienced advice. A disclosure made too early, too narrowly, or on incorrect legal characterisation can undermine rather than support the operator's position.

The fourth point is when a transaction must be structured or restructured to manage a sanctions risk that the diligence has surfaced. Structuring a transaction to manage genuine compliance risk is lawful and is part of cross-border transactions and diligence practice. It is entirely distinct from arranging a transaction to evade a sanctions obligation, which is never an option this firm or any lawful adviser will assist with.

For cross-border digital-asset transactions with a US or UK nexus, a coordinated OFAC and OFSI review at counterparty onboarding stage is not optional; it is the baseline. For guidance on how to build that into a repeatable workflow, or to discuss a specific counterparty analysis, contact info@caldervance.com.

Related practices

• AIS anomaly indicators – EU service – screening and analysis of AIS transmission anomalies for sanctions-risk assessment
• Ship-to-ship transfer risk: OFAC vs BIS/EAR – analysis of how OFAC and BIS treat ship-to-ship transfers as a sanctions-evasion indicator
• Transit and rerouting red flags: EU vs SECO – a comparison of how EU and Swiss measures address transit diversion and rerouting risk

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.