A private equity house has agreed terms on a continental European target. The acquisition vehicle is registered in the United Kingdom. Its financing partner is a French bank. The target has a subsidiary in Frankfurt and a distribution arm in Warsaw. Three days before signing, a routine ownership-chain search surfaces a minority shareholder whose name appears on both the OFSI Consolidated List and the EU asset-freeze list. The deal team asks: does that mean the target itself is blocked? Is the answer the same in London as in Brussels? And who bears the risk if the parties get it wrong?
Sanctions due diligence in M&A diverges materially between the OFSI regime and the EU framework on three decisive questions: the ownership-and-control test that determines whether a non-listed entity is caught; the reporting and disclosure obligations that arise when blocked property is identified; and the licensing routes available to a buyer who needs to proceed despite a sanctions hit. Getting the wrong answer on any one of these can expose the acquirer, its advisers, and its financing bank to significant civil – and potentially criminal – liability under the applicable regime.
This analysis maps each point of divergence in turn, examines the cross-border risk that arises when a single transaction touches both regimes simultaneously, and sets out the practical steps a cross-border M&A team should take before it signs.
How do OFSI and the EU define ownership and control – and why does the difference matter?
The OFSI ownership-and-control test determines whether a non-listed entity is caught by the UK asset-freeze, and it is materially broader than a pure percentage threshold. Under the relevant thematic UK sanctions regulations made under SAMLA, a designated person's assets include any entity that the designated person owns or controls. Ownership is typically treated as engaging when a designated person holds more than 50 percent of the shares or voting rights, directly or indirectly. But the control limb extends beyond equity: it can be satisfied by the right to appoint or remove a majority of the board, by contractual influence over strategic decisions, or by any other arrangement that gives the designated person the practical ability to direct the entity's affairs. OFSI's published guidance confirms this layered approach.
The EU test, set out in the applicable Council regulations, follows a structurally similar two-part design. Ownership at 50 percent or more – directly or indirectly – makes the entity subject to the freeze without further analysis. The control test then asks whether a listed person can exercise dominant influence through voting agreements, board rights, or other means. In our experience advising on cross-border transactions, the two tests produce the same result in most straightforward cases. The divergences emerge at the edges: intermediate holding structures, nominee arrangements, and distributed minority blocks where no single listed person reaches 50 percent alone but where aggregate or concerted holdings might be read differently by OFSI and by the competent EU authority.
What does that mean for an M&A team? It means that a clean bill of health from an EU national competent authority does not guarantee that OFSI reaches the same conclusion – and vice versa. The ownership-chain analysis must be run twice, against each regime's own guidance, using each regime's own threshold and control criteria. A deal structure that routes an acquisition through a UK holding vehicle while the target and its subsidiaries sit in EU member states will therefore engage both frameworks simultaneously. Have you mapped the chain to the level of each regime's control test, or only to the 50 percent line?
Where do the regimes diverge on the reporting obligation when a sanctions hit is found?
When an M&A search surfaces blocked property or a designated counterparty, OFSI and the EU impose distinct reporting obligations that operate on different timelines and carry different addressees. Under the UK regime, a person who knows or reasonably suspects that they are holding blocked funds or economic resources belonging to a designated person must report that to OFSI. The obligation bites on financial institutions and, depending on the transaction structure, on professional advisers and other parties who come into possession of relevant information. The window for reporting is short, and the obligation is not contingent on completing the transaction – it arises the moment the suspicion is formed.
The EU regime distributes the reporting obligation among the competent national authorities of each member state. A French bank financing the deal reports to the French authority; a German subsidiary that holds affected assets reports to the German authority. There is no single EU-level filing point. The practical consequence for a cross-border M&A team is that the reporting chain must be identified on a country-by-country basis, and the obligations do not aggregate into a single action. In a transaction that involves parties in five EU jurisdictions, the team may be managing five parallel reporting lines simultaneously.
The OFSI reporting obligation also carries a knowledge-or-suspicion trigger that places a premium on the quality of the diligence itself. If a party should have discovered the connection – if a reasonably thorough ownership-chain analysis would have surfaced it – the absence of actual knowledge is unlikely to be a complete defence. We regularly advise acquirers that the diligence process must therefore be designed to the standard the regulator will apply in hindsight, not to the standard that was commercially convenient at the time of signing. That standard is considerably higher for a complex, multi-layered target structure than for a straightforward bilateral acquisition.
Does the EU stricter-prohibition principle change the calculus for a dual-regime transaction?
A key cross-cutting rule in the EU regime is the principle that, where the applicable country regime is stricter than the EU baseline, the stricter prohibition governs. Several EU member states have implemented domestic measures that go beyond the minimum required by Council regulations. A transaction that passes the EU baseline test may still be prohibited under the domestic rules of the member state in which the target, its assets, or its counterparties are located. This layering of national and EU-level obligations creates a diligence task that cannot be completed by reference to the Council regulation alone.
OFSI does not operate within a comparable federal structure. The UK regime is a single national framework, and OFSI is the sole competent authority for UK financial-sanctions matters. There is no sub-national layer. That structural simplicity is an advantage in some respects: there is one authority to consult, one set of guidance to apply, and one licensing route to pursue. For a transaction that is primarily a UK matter, this concentration of authority makes the compliance pathway more predictable. For a transaction with material EU exposure, the dispersal of authority across member states introduces a layer of jurisdictional analysis that must be completed before the diligence scope is even set.
In our cross-border practice, we see this play out most acutely in transactions where the target group operates through subsidiaries in multiple EU member states, the acquirer is a UK entity, and the financing involves one or more EU-regulated banks. In that configuration, the diligence must address the UK ownership-and-control test, the EU baseline test, and the domestic rules of each relevant member state – a scope that is substantially larger than any single-regime analysis. The additional complication is that the EU's stricter-prohibition principle is not always transparently documented at the member-state level; identifying the applicable domestic rules requires jurisdiction-specific legal input. For those situations, we work with local counsel in the relevant jurisdiction to complete the mapping.
How do OFSI and the EU licensing routes compare for an M&A transaction?
Where a sanctions hit cannot be resolved by restructuring the transaction or excising the affected party, a licence from the competent authority may allow the deal to proceed. OFSI and the EU offer licensing routes, but the procedural architecture and the practical timelines differ in ways that directly affect deal certainty.
OFSI issues specific licences (case-by-case authorisations to conduct an otherwise prohibited transaction) against a defined set of licensing grounds set out in the applicable thematic regulations. The grounds most relevant to M&A include provisions for the winding down of a prior contractual position and, in some regimes, provisions for transactions that are in the public interest. OFSI's published guidance sets out the information required to support an application. The processing time is not fixed by statute, but the authority publishes indicative timelines; in our experience, complex applications involving multiple parties and a layered target structure take considerably longer than standard cases. Deal teams that discover a licensing requirement at the point of signing will generally find that the statutory window does not accommodate the commercial timetable, and that the application should have been filed as soon as the ownership analysis indicated a risk of prohibition.
The EU licensing route is distributed in the same way as the reporting obligation: the application goes to the competent authority of the member state in which the relevant transaction is to be performed. If the transaction involves parties in multiple EU member states – as most substantial M&A deals do – the question of which authority has jurisdiction to grant a licence is not always straightforward. The applicable Council regulations specify the licensing grounds and, in some regimes, impose procedural requirements on the competent authority, but the administrative practice varies between member states. A licence granted by one national authority does not automatically authorise the transaction as performed in another member state; in some cases, parallel applications to multiple authorities are required. That is a significant structural difference from the OFSI route, where a single licence from a single authority covers the UK dimension of the transaction.
What does this mean for deal structuring? It means that identifying the licensing need early – ideally during the initial ownership-chain analysis rather than at the point of conditions satisfaction – is critical to preserving the option of proceeding. A licensing application filed two weeks before a long-stop date is, in most circumstances, too late.
What are the principal risk flags in a dual-regime M&A sanctions review?
Sanctions due diligence in M&A is not a single task. It is a sequence of linked analytical steps, and the most serious errors in our practice arise not from failures at any individual step but from failures in the sequence – steps that are omitted, performed in the wrong order, or not updated when new information arrives before signing.
The first risk flag is incomplete ownership-chain analysis. Screening the target at the entity level, without tracing the full direct and indirect ownership chain to the level of natural persons or sovereign entities, will miss the designation that sits two layers up. Both OFSI and the EU apply their ownership-and-control tests to indirect holdings. A diligence process that stops at the first or second layer of the ownership chain is not adequate for either regime.
The second risk flag is failure to re-screen between signing and closing. Sanctions lists change. A counterparty that was clean at the date of signing may be designated by the time of closing. The OFSI and EU lists are updated without advance notice. A closing-day re-screen is not optional; it is a basic element of a sanctions-compliant M&A process. In our experience, this step is most frequently omitted in deals where the interval between signing and closing is short and the compliance team has moved on to the next matter.
The third risk flag is the financing dimension. Where the acquisition is debt-financed by an EU-regulated bank, that bank carries its own sanctions obligations independently of the buyer's compliance programme. A bank that identifies a sanctions issue the buyer has not flagged will typically freeze the financing while it conducts its own review. That creates a closing risk that is not controlled by the buyer's diligence alone. Aligning the buyer's diligence scope with the bank's compliance requirements – and sharing the analysis early enough to allow the bank's own review to complete – is a practical step that materially reduces closing risk.
The fourth risk flag is the interaction between sanctions status and competition clearances. A target or a counterparty that is designated under an applicable regime may also trigger a separate filing obligation or a notification requirement under the merger-control rules of the relevant jurisdiction. Managing the sequencing of sanctions analysis and competition filings is a coordination task that is often underweighted in deal timetables.
In a recent matter, an industrial conglomerate was acquiring a mid-market engineering business with manufacturing sites in two EU member states and a UK-registered holding company. The initial screening was clean. A second-layer ownership-chain analysis conducted by our team identified a minority shareholder in the UK holding company whose affiliates appeared on the OFSI Consolidated List under a concerted-holdings analysis. We assessed eligibility under the applicable licensing grounds, prepared the OFSI application, and managed the regulator's queries. The matter completed, but the licensing window added six weeks to the original timetable. The lesson – which we see repeated in cross-border deals – is that the ownership-chain analysis should be sized to the deal's complexity, not to the deal's urgency.
The myth that one clean screen is enough
A persistent misconception among deal teams is that a single pass through a commercial screening database, conducted at the outset of due diligence, discharges the sanctions obligation for the transaction. It does not.
Commercial databases aggregate list data, but they do not perform the ownership-and-control analysis that OFSI and the EU require. They will flag a directly listed entity. They will not, without additional configuration and manual review, identify a non-listed entity that is caught because a listed person owns more than 50 percent of it through an intermediate holding structure. The database result is the starting point for the analysis, not the conclusion.
Furthermore, the obligation under both the OFSI and EU regimes is not a point-in-time obligation. It is a continuing one. The question is not only "was this party clean when we first looked?" but "is this party clean at every point at which the transaction is performed?" That includes closing, post-closing steps such as the transfer of regulated assets, and, in some structures, ongoing commercial arrangements that continue after the acquisition is complete.
We regularly advise compliance teams that the programme design question – how to embed a continuing sanctions obligation into the post-closing governance of an acquired business – is one of the most consequential and most frequently deferred tasks in M&A sanctions compliance. Deferring it past closing substantially increases the risk that the acquiring group inherits a sanctions exposure that it cannot rapidly remediate.
Related practices
- Correspondent banking and de-risking – OFAC-focused sanctions risk for financial institutions in cross-border transactions
- OFSI vs EU: M&A sanctions diligence (part 2) – extended analysis on post-closing integration and continuing obligations
- Maritime and shipping sanctions: EU vs SECO – comparative analysis for transactions with a shipping or commodity-trading dimension