A private equity house has signed heads of terms on a mid-market acquisition. The target operates across the United Kingdom and continental Europe. Screening returns a clean result on the target itself. Yet one of the target's subsidiaries holds a minority stake in a joint venture whose ultimate beneficial owner appears on a European Union designations list. Does that hit block the deal under OFSI? Does it also block it under the EU regime? Must completion be halted, or can a licence authorise the transaction? These are not hypothetical anxieties. They are the questions that derail transactions at the point of execution – and they arise precisely because the UK and EU regimes, though they share a common origin, now diverge in ways that matter.
Sanctions due diligence in M&A under OFSI and the EU regime requires more than list-screening. Both regimes apply an ownership and control test that can catch non-listed entities through a listed person's interest; the two regimes have diverged since the UK's departure from the EU, and the stricter prohibition governs. As of January 2026, a cross-border deal touching UK and EU assets requires a dual-regime analysis run in parallel.
This analysis maps the divergences that practitioners and M&A teams most consistently miss: the ownership and control test, the licensing routes, reporting obligations, and the residual risk of US secondary-sanctions exposure sitting behind both regimes.
What legal authority governs, and how do the two regimes differ at source?
OFSI administers the United Kingdom's financial-sanctions regime under the Sanctions and Anti-Money Laundering Act ("SAMLA") and the relevant thematic regulations made under it. The EU regime operates through Council Regulations and Council Decisions binding directly on EU member states. The two regimes share lineage – the UK transposed EU sanctions into retained law at the point of departure – but they have since diverged through independent amendments, new designations, and differing guidance from OFSI and the European Commission respectively.
The practical consequence for an M&A deal is that a designation added by the EU Council after the divergence date may not appear on the UK Consolidated List, and vice versa. A clean OFSI check is not a clean EU check. Running one list against the other as a proxy is a structural error we encounter regularly in deal review.
Both regimes operate alongside the United Nations Security Council Consolidated List, which creates a floor. Where the UN list captures a person, both UK and EU obligations follow. In our cross-border practice, the UN list is rarely the issue in M&A; it is the autonomous UK and EU designations that produce divergent results.
How does the ownership and control test work – and where do the regimes diverge?
Both OFSI and the EU apply an ownership and control test that extends sanctions prohibitions to non-listed entities through their connection to listed persons. The two tests are similar in structure but differ in threshold and application, and that difference can decide whether a transaction is prohibited.
Under OFSI, an entity is caught if it is owned or controlled by a designated person. Control is assessed broadly: it includes legal ownership, the ability to appoint a majority of directors, the right to direct the entity's activities, and any other means by which a designated person can exercise decisive influence. Ownership at 50 percent or more is a standard marker, but OFSI's control limb is wider and does not require majority ownership.
The EU applies a comparable test under the relevant Council Regulation. The EU position also encompasses control through other means, including voting rights, contractual rights, and structural arrangements. Where the EU and UK analyses part company is in the weight given to factual control versus formal ownership. In our experience, EU practitioners and the European Commission's guidance place slightly more emphasis on the totality of the factual relationship; OFSI's published guidance is also fact-specific, but the documentation it expects differs in scope and framing.
For an M&A transaction, the implication is direct. A target whose shareholder register shows no designation can still be a prohibited counterparty if a listed person exercises control through a shareholders' agreement, a debt instrument with governance rights, or a contractual veto. Have you reviewed the governance documents, not just the cap table?
Aggregation compounds the problem. Two listed persons each holding a minority interest can together reach the ownership threshold. Screening tools that process shareholders individually, without aggregating co-holders who are both designated, will miss this. We have seen this pattern produce a missed hit in an otherwise well-resourced diligence exercise.
What are the reporting and notification obligations in each regime?
Both OFSI and the EU regime impose reporting obligations when a person knows or reasonably suspects that a counterparty is a designated person or is owned or controlled by one. These obligations are not limited to the completion of a transaction; they attach on knowledge or suspicion, which means they can be triggered during a diligence exercise before any deal proceeds.
Under the UK regime, OFSI expects a report where a person in the course of business knows or has reasonable cause to suspect a sanctions breach or holds frozen assets. The reporting obligation is a live compliance requirement, not a post-deal formality. Failure to report is itself an offence under the applicable thematic regulations.
The EU regime imposes parallel reporting obligations, enforceable through the national competent authority of the relevant member state. The enforcement posture of national competent authorities varies across the EU, but the legal obligation is uniform across member states under the Council Regulation. A UK-based acquirer with a target in Germany and France must satisfy both OFSI and the relevant national competent authorities in those member states, each potentially requiring a separate notification.
Record-keeping obligations also apply in both regimes. Practitioners should ensure that the diligence file documents the screening steps taken, the lists consulted, the date of consultation, and the conclusions reached. This documentation serves two purposes: it demonstrates due diligence if a question arises later, and it forms the evidentiary foundation for any licence application or voluntary report.
The position above covers the standard case. Your facts – the counterparty, the nature of the interest held, the jurisdiction of the target, and the specific thematic regime in play – change the analysis materially. For a deal-specific assessment, contact Calder & Vance at info@caldervance.com.
How do licensing routes compare between OFSI and the EU?
Where a transaction is caught by a prohibition, a specific licence (a case-by-case authorisation to conduct an otherwise prohibited transaction) may authorise it. Both OFSI and the EU licensing architecture offer routes for M&A-related transactions, but the processes differ in important respects.
OFSI grants licences under statutory grounds set out in the relevant thematic regulations. The grounds vary by regime but typically include humanitarian purposes, legal fees, winding-down activity, and case-by-case transactions that serve a legitimate purpose and do not undermine the objectives of the sanctions programme. OFSI assesses applications on the merits; there is no automatic right to a licence, and the outcome depends on the factual and legal case presented. OFSI has published guidance on what a well-prepared licence application requires, and the standard is substantive: a thin application will not succeed.
On the EU side, licensing is handled by the national competent authority of the member state in which the applicant is established or the transaction is to be performed. There is no single EU-wide licensing authority for financial sanctions. A cross-border deal touching multiple EU jurisdictions may therefore require parallel licence applications in more than one member state, with each national competent authority applying the EU grounds through its own administrative process.
The divergence in timing and administrative style between OFSI and the leading EU national competent authorities is a practical constraint that M&A timetables must accommodate. Licence applications take time. A deal with a contractual long-stop date that does not build in sufficient margin for a licence application can fail on timing alone, even where the legal case for a licence is strong. In our practice, we advise acquirers to identify potential licence needs at the earliest stage of diligence – not after heads of terms are signed.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact us at info@caldervance.com to discuss the position.
What secondary-sanctions risk do US designations add to a UK or EU deal?
A transaction that is clean under both OFSI and the EU regime may still carry US secondary-sanctions exposure if a counterparty has a meaningful connection to US OFAC programmes. Secondary sanctions operate extraterritorially: they can apply to transactions between non-US parties, in non-US currency, involving no US-origin goods or technology, where one party is a person the US has designated or has a significant relationship with a designated person.
For an M&A deal, the relevant exposure arises where the target has operations, customers, or suppliers connected to an OFAC-administered programme. The SDN List (OFAC's list of Specially Designated Nationals and blocked persons) captures individuals and entities that US persons are prohibited from dealing with. Non-US acquirers transacting with SDN-listed parties, or entities substantially owned by them, risk designation themselves or the loss of US correspondent-banking relationships – a significant deterrent for businesses with US dollar flows.
The interaction between the UK, EU, and OFAC programmes creates a risk matrix that requires a coordinated analysis. In our cross-border practice, we run the three analyses simultaneously for deals above a certain risk threshold. The rule of thumb is simple: where OFSI or the EU flags a connection, assume the OFAC position also requires checking. The reverse is equally true – an OFAC flag may not appear on UK or EU lists, but the secondary-sanctions exposure remains.
For businesses with correspondent-banking relationships or payment flows through the US financial system, the OFAC dimension is not optional. See our related analysis on correspondent banking and de-risking under OFAC for the financial-institution dimension of this exposure.
What do M&A teams most consistently miss in cross-border sanctions diligence?
In our experience advising on cross-border transactions, the gaps in sanctions diligence are predictable. They are not the result of negligence; they are the result of processes designed for one regime being applied, without adaptation, to a multi-regime transaction.
The most common errors we see:
- Screening only the direct counterparty, not the full ownership chain to the level of beneficial ownership. The ownership and control test in both regimes requires tracing through intermediate layers.
- Using a single consolidated screening database without verifying that it captures both the UK Consolidated List and the current EU designations list, updated to the same date.
- Treating a clean first-layer screen as a complete diligence exercise. The control limb of both the OFSI and EU tests is not satisfied by a list-check alone.
- Failing to review governance documents – shareholders' agreements, board nomination rights, veto provisions, debt terms – for control indicators that do not appear on a share register.
- Not building licence-application time into deal timetables where a potential hit is identified at diligence stage.
- Missing the US secondary-sanctions dimension entirely, on the assumption that a non-US deal with non-US parties has no OFAC exposure.
- Failing to document the diligence process adequately for the purposes of a potential voluntary report or regulatory inquiry.
A common objection is that sanctions diligence is a box-ticking exercise that a compliance team can run with a standard screening tool. That is the myth. The ownership and control test is a legal analysis, not a database query. The control limb requires a reading of corporate documents and a judgment about influence. A screening tool that returns "no match" on the direct counterparty's name has not completed the analysis. The tool starts it.
Related practices that connect to this analysis:
Related practices
- Correspondent banking and de-risking under OFAC – financial-institution exposure to secondary-sanctions risk in payment flows
- Maritime and shipping sanctions: EU vs SECO – cross-border trade-sanctions analysis for exporters and shipping operators
When should a cross-border business involve counsel on M&A sanctions diligence?
Counsel should be involved at the earliest point at which a potential sanctions connection is identified – not after the deal has been structured. Early involvement allows the ownership and control analysis to inform deal structure, pricing, and timetable. It also preserves the option of a proactive approach to the relevant authority where a licence or a voluntary disclosure may be appropriate.
In a recent matter, a financial-services business acquiring a target in a jurisdiction with significant listed-person exposure asked us to review the ownership structure of the target's three main trading counterparties. The direct counterparties were clean. One counterparty's parent company held a minority interest alongside a person subject to UK and EU designations. The aggregate interest crossed the ownership threshold under both regimes. We mapped the control position under the governance documents, assessed the licensing options under both OFSI and the relevant EU national competent authority, and advised on the reporting position. The acquirer was able to restructure the transaction to address the exposure before completion.
The decision matrix for M&A sanctions diligence is broadly as follows. Where the target is a purely domestic business with no exposure to designated persons and no operations in high-risk jurisdictions, standard screening with adequate documentation is likely sufficient. Where the target has complex ownership, operations in multiple jurisdictions, or counterparties with connections to high-risk regimes, a full legal analysis of the ownership and control position – across all applicable regimes – is required. Where a potential hit is identified, a licence application or voluntary report may be necessary, and the deal timetable must allow for it.
For further analysis on the maritime and trade dimension of cross-border sanctions exposure, see Maritime shipping sanctions: EU vs SECO and Maritime shipping sanctions: OFAC vs Canada.
Frequently asked questions: sanctions due diligence in M&A – OFSI vs EU
Where do the regimes diverge on sanctions due diligence in M&A?
The UK and EU regimes diverge in three principal areas. First, the two sanctions lists are no longer identical: each regime has made autonomous amendments since divergence, so a person designated by one may not be designated by the other. Second, OFSI's licensing process is centralised, while EU licensing operates through national competent authorities in each member state, creating parallel processes for cross-border deals. Third, the weighting of ownership versus control in the non-listed entity test differs in application, with EU guidance placing somewhat more emphasis on the totality of the factual relationship. Both regimes operate alongside OFAC secondary-sanctions risk, which requires a separate analysis.
Which regime is stricter on sanctions due diligence in M&A?
Neither regime is uniformly stricter. The relevant principle is that where the obligations differ, the stricter prohibition governs for the party subject to it. A business subject to both OFSI and EU jurisdiction must satisfy both regimes. Where the EU autonomous list captures a person not yet on the UK list, the EU prohibition applies to the EU-connected part of the transaction; OFSI obligations apply to the UK-connected part. The practical consequence is that a cross-border M&A deal requires a dual-regime analysis run in parallel, not a single consolidated check. Verify the current position on both lists before relying on a prior screening.
What should a cross-border business do about sanctions due diligence in M&A?
A cross-border business should run parallel screenings against the current UK Consolidated List and the current EU designations list on the same date, trace the full ownership chain to the level of beneficial ownership, review governance documents for control indicators not visible on a share register, assess the US secondary-sanctions position where there is any OFAC-relevant connection, document the process adequately for reporting purposes, and build time for a licence application into the deal timetable if a potential hit is identified. Where the ownership and control analysis is non-trivial, involve sanctions counsel before the deal is structured.
About the author
Henry Ashworth advises on UK financial sanctions and export controls, including OFSI licensing and enforcement, and judicial-review challenges to designations. His cross-border practice covers the intersection of the UK sanctions regime with EU and US obligations in M&A, trade, and financial-institution matters. Calder & Vance – International Sanctions & Export Control Counsel.
About Calder & Vance
Calder & Vance is an independent international sanctions and export-control boutique. We advise multinationals, financial institutions, exporters, and individuals on the major regimes – OFAC and BIS in the United States, OFSI and ECJU in the United Kingdom, the EU Council regulations and the EU General Court, the United Nations Consolidated List, and the regimes of Switzerland, Canada, Australia, the UAE, Singapore, and Japan. Our work is limited to lawful compliance, licensing, delisting, enforcement defence, and due diligence. To discuss a matter, contact info@caldervance.com.
Disclaimer: This material is general information, not legal advice, and is not a substitute for advice on your specific facts. Sanctions and export-control rules change frequently and differ by regime; verify the current position before relying on anything stated here. Calder & Vance does not advise on circumventing or evading sanctions. For advice on your situation, contact info@caldervance.com.