A payments team at a mid-sized trading company receives an automated alert: a wire destined for a supplier in a third market has been held by the correspondent bank. The reason given is a possible sanctions match. The compliance officer pulls up the screening record. The supplier is not itself listed. But one of its parent entities appears on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons), and a parallel EU Council designation appears to cover a different entity in the same corporate group. Two regulators. Two different tests. One blocked payment. Which authorisation route applies – and are they the same?
Payment authorisations under OFAC and under EU sanctions law share the same surface logic – a prohibited transaction may be permitted by licence – but the procedural architecture, the applicable tests, and the enforcement consequences diverge in ways that consistently catch cross-border businesses unprepared. As of mid-2026, the regimes differ on who may apply, what standard the regulator applies, how long a decision takes, and what conditions attach to an approved authorisation. A business that applies the OFAC framework to an EU-governed payment, or vice versa, risks either an unlicensed transaction or an unnecessarily blocked one.
This analysis compares the payment-authorisation regimes of OFAC and the EU across six dimensions: legal basis, who may apply, the applicable standard, procedure, conditions and reporting, and enforcement exposure. It closes with a cross-border decision matrix and a risk checklist practitioners can apply before any payment instruction is submitted.
What is the legal basis for payment authorisations under each regime?
A specific licence (a case-by-case authorisation to conduct an otherwise prohibited transaction) under OFAC rests on the authority granted by IEEPA and the relevant thematic sanctions regulations administered by the Office of Foreign Assets Control. OFAC's licensing power is broad: the agency may authorise any transaction that would otherwise be prohibited, subject to the conditions it imposes. The legal instrument is an executive-branch regulatory power, not a court order or a parliamentary measure. This matters because OFAC can adjust its licensing policy quickly and without legislative change.
Under EU law the position is structurally different. Each EU sanctions programme is established by a Council Regulation – a directly applicable legal act binding across all member states. The licensing (or "authorisation") power sits with the competent authority of each member state, not with a single central body. A French business seeking an authorisation for a payment involving a designated person applies to the French competent authority; a German business applies to its own. The Council Regulation sets the categories of authorisation available and the conditions that must be satisfied, but the procedural rules, timelines, and decision-making culture vary between member states.
This structural divergence has a direct practical consequence. A cross-border payment involving a US nexus – a US correspondent bank, a US-dollar settlement leg, or a US-incorporated counterparty – engages OFAC. The same payment, if it involves EU-established parties or EU-incorporated entities, engages the relevant member state competent authority under the applicable Council Regulation. Both can apply simultaneously. We regularly advise clients who have focused exclusively on one of the two regimes and have either failed to apply for the second authorisation or have assumed that an OFAC general licence covers the EU position. It does not.
Who may apply, and to whom?
Under OFAC, either party to the proposed transaction may apply for a specific licence: the US person seeking to make a payment, the foreign person seeking to receive it, or a third party with a sufficient interest. The application goes to OFAC directly, regardless of where the applicant is incorporated. OFAC's extraterritorial reach means that a non-US bank processing a dollar payment through a US correspondent bank is exposed to OFAC jurisdiction and may itself seek or rely on an authorisation.
The EU position is more fragmented. The applicant is typically the party established in a member state that is directly subject to the prohibition – the EU-incorporated payer or the EU bank processing the instruction. The application goes to the competent authority of the member state in which that party is established. A non-EU party cannot apply to an EU competent authority in its own name; it must work through an EU counterparty. This creates a gap for transactions where the EU nexus is the correspondent or intermediary rather than the originator or beneficiary.
There is also a general licence (a standing authorisation that permits a defined category of transactions without a separate application) dimension. OFAC issues general licences under specific programmes that pre-authorise defined categories of payment – for humanitarian goods, for personal remittances, for diplomatic missions, for wind-down periods. An EU programme may include equivalent standing authorisations, but they are set out in the Council Regulation itself or in implementing measures, not in a separate OFAC-style general-licence instrument. In our experience, clients often scan OFAC's general-licence register and assume it is the complete picture, without checking whether the relevant Council Regulation contains an equivalent standing authorisation with different scope or conditions.
How do the applicable standards differ?
OFAC applies a policy-based standard when evaluating specific-licence applications for payment transactions. The agency weighs the foreign-policy and national-security purpose of the sanctions programme against the humanitarian, commercial, or legal justification advanced by the applicant. There is no statutory right to a licence. OFAC may decline without detailed reasons. Decisions are administrative and not routinely subject to judicial review on the merits, though constitutional challenges have been raised in US courts under the applicable legal frameworks.
The EU standard is different in a formally important respect. The Council Regulation typically sets out specific grounds under which an authorisation must or may be granted – for example, to satisfy a prior contractual obligation, to meet a legal obligation, to preserve the interests of an innocent third party, or to address urgent humanitarian needs. Where the statutory ground is satisfied, the competent authority has limited discretion to refuse. This is closer to a legality test than a pure policy test. An applicant who can demonstrate that the transaction falls within a defined ground has a stronger legal position under the EU regime than an equivalent applicant before OFAC.
Does this mean EU authorisations are easier to obtain? Not necessarily. The defined grounds can be narrow, and member state competent authorities interpret them with varying levels of strictness. A member state with a conservative practice may apply the statutory grounds in a restrictive way that effectively mirrors OFAC's policy-based discretion. The formal difference in standard does not always translate into a practical difference in outcome.
Where do the regimes diverge on payment authorisations?
The divergences that most frequently cause difficulty in cross-border payment transactions fall into four categories: procedural timelines, the treatment of indirect ownership, the scope of standing authorisations, and the conditions and reporting obligations attached to a granted authorisation.
Procedural timelines. OFAC does not publish binding statutory decision deadlines for specific-licence applications. In practice, straightforward applications for payments in humanitarian or wind-down contexts are processed more quickly than complex commercial applications; the latter can take a substantial period. EU member state competent authorities operate under varying procedural rules. Some publish indicative timelines; others do not. A cross-border business that plans a payment instruction assuming both authorisations will arrive simultaneously is likely to be wrong. Sequencing the applications – and planning for the possibility that one arrives well before the other – is operationally necessary.
Indirect ownership and the 50 percent rule. OFAC's 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked, directly or indirectly) is mechanical. A payment to an entity that is 50 percent or more owned by a blocked person is a payment to a blocked person, regardless of whether that entity is itself listed. The EU and UK apply an ownership and control test (the UK and EU test for whether a non-listed entity is caught through a listed person) that looks beyond strict ownership percentages to effective control. An entity not caught by the OFAC 50 percent rule may still be caught under the EU ownership-and-control analysis, or vice versa. A payment instruction that passes OFAC screening may still require an EU authorisation.
Scope of standing authorisations. OFAC's general licences are published, programme-specific, and frequently amended. An EU Council Regulation may contain standing authorisations that differ in scope: some are broader than the OFAC equivalent, some narrower. The relevant comparison must be done at the level of the specific programme, not at the level of the regime as a whole. A practitioner advising on a payment in a sector covered by a specific programme – energy, food, medicine, diplomatic activity – must check both the OFAC general licence position and the Council Regulation standing authorisation position independently.
Conditions and reporting. OFAC-specific licences for payment transactions routinely carry conditions: transaction-reporting obligations, record-keeping requirements, restrictions on onward payments, and requirements to confirm end-use. EU authorisations carry equivalent conditions, but the specific requirements vary by member state and by programme. A business that receives both an OFAC licence and an EU authorisation for the same payment may face overlapping – and in some cases inconsistent – reporting obligations. Managing those obligations requires a single tracking system, not two parallel ones.
Which regime is stricter on payment authorisations?
The question of which regime is stricter has no single answer: the correct analysis is that where two regimes apply to the same payment, the stricter prohibition governs, and both authorisations are required. A business that obtains only the OFAC authorisation and proceeds without the EU authorisation has not complied with EU law, regardless of OFAC's position. The reverse is equally true.
That said, there are meaningful differences in enforcement posture that affect the practical risk calculus. OFAC has a well-documented enforcement programme, publishes penalty guidance, and has issued penalties across a wide range of payment-related violations. The agency's guidelines describe the factors it considers in calculating a civil monetary penalty – the egregiousness of the violation, the presence or absence of a VSD (voluntary self-disclosure to a regulator), the compliance programme in place, and whether the violation was wilful or reckless. OFAC's penalty regime applies to US persons and, under its extraterritorial rules, to non-US persons who cause US persons to engage in prohibited transactions.
EU enforcement is national. Each member state competent authority enforces within its territory, under its own procedural rules and with its own penalty scales. Enforcement activity is not uniform across the EU. Some member states have active enforcement programmes with significant penalties for payment violations; others have brought fewer cases. The absence of a centralised EU enforcement body means that the practical risk of a penalty for an unlicensed EU payment depends partly on which member state's law applies. A business operating across multiple EU jurisdictions faces a differentiated enforcement landscape that a single OFAC compliance policy does not address.
In our cross-border practice, the pattern we see most often is not deliberate non-compliance but structural oversight: the OFAC team has a process for licence applications; the EU process is less systematically managed; and payments that require both authorisations fall through the gap between the two systems.
Risk flags that payment teams miss
Six risk flags recur in matters we review. Each reflects a gap in the typical payments-compliance operating model rather than a deliberate decision to proceed without authorisation.
Flag 1: Relying on an OFAC general licence to cover the EU position. An OFAC general licence operates within the OFAC regime only. It has no legal effect under EU law. A payment pre-authorised by an OFAC general licence still requires a standalone EU authorisation if the transaction involves a person subject to EU sanctions.
Flag 2: Treating a correspondent bank's compliance clearance as a licence. A correspondent bank that processes a payment after its own compliance review has satisfied itself that it is not in violation of the rules applicable to it. That review does not constitute an authorisation for the originating business. The originator's own obligations are separate.
Flag 3: Assuming that a payment to a non-listed counterparty is outside the regime. The 50 percent rule and the EU ownership-and-control test both extend prohibitions to non-listed entities. A payment instruction that passes a direct-list screen may still be prohibited if the counterparty is owned or controlled by a listed person. Screening tools that check only the direct counterparty miss this.
Flag 4: Missing the concurrent filing obligation. Some OFAC programmes require that the payment be reported to OFAC even when it is processed under a general licence. A failure to file the required report is itself a violation, separate from the underlying transaction. We have acted for businesses that made every substantive compliance decision correctly but received a notice of apparent violation for failing to file the concurrent report.
Flag 5: Failing to check the EU position on secondary-sanctions risk. The EU Blocking Regulation imposes obligations on EU persons in respect of certain US secondary sanctions. A payment by an EU-established business that is structured primarily around OFAC compliance may create Blocking Regulation exposure if it involves a third-country counterparty subject to US secondary-sanctions measures. The interplay between OFAC compliance obligations and EU Blocking Regulation obligations requires explicit legal analysis, not a default assumption that OFAC compliance satisfies all applicable requirements.
Flag 6: Record-keeping gaps. Both OFAC and the EU impose record-keeping obligations on parties that process payments under authorisations. The periods differ by programme and by member state. A business that cannot produce the required records – the authorisation itself, the transaction documentation, any reports filed – in response to a regulatory enquiry faces a compliance deficit that is difficult to remedy after the fact.
What should a cross-border business do about payment authorisations?
A cross-border business that regularly processes payments with potential sanctions exposure should treat OFAC and EU authorisation requirements as two parallel but independent compliance tracks, not as a single combined process. The practical steps follow a clear sequence.
First, map the nexus. For any payment instruction, identify which regimes apply: does the transaction have a US nexus (US person, US dollar, US correspondent bank, US-incorporated counterparty)? Does it involve an EU-established party or an EU-incorporated entity? Does it involve a person subject to a UK, UN, Swiss, or other regime that may also require authorisation? A nexus map determines which regimes are engaged before the question of authorisation is reached.
Second, check the ownership chain. A direct-list screen of the counterparty is a starting point, not a complete check. The OFAC 50 percent rule and the EU ownership-and-control test both require a review of the full ownership structure, including indirect holdings and control relationships. Where the ownership chain is opaque or the counterparty is incorporated in a jurisdiction with limited corporate-disclosure requirements, enhanced due diligence is warranted before the payment instruction is submitted.
Third, assess the standing-authorisation position. Before applying for a specific licence, confirm whether an OFAC general licence and an equivalent EU standing authorisation are available. If both are available and the transaction falls within their terms, the payment may proceed without a separate application – but the conditions (reporting, record-keeping, scope restrictions) must be satisfied. If one is available and the other is not, a specific-licence application for the uncovered regime is required.
Fourth, file concurrently and sequence the applications. If specific-licence applications are needed under both regimes, file them at the same time and track both separately. Do not submit the payment instruction until both authorisations are in hand, unless a standing authorisation covers one regime and a specific licence covers the other. Maintain a single record of both authorisations, all conditions, and all reports filed.
Fifth, review the Blocking Regulation position. If the business is EU-established and the payment involves a counterparty subject to US secondary-sanctions measures, assess whether the Blocking Regulation imposes obligations that are inconsistent with OFAC compliance. This is a specialist analysis that requires knowledge of both the OFAC programme in question and the current scope of the Blocking Regulation's coverage.
The position above covers the standard case. Your facts – the counterparty, the payment route, the correspondent bank, the corporate structure on both sides, and the specific programme in play – change the analysis materially. For an assessment of your exposure under OFAC or the applicable EU regime, contact Calder & Vance at info@caldervance.com.
A cross-border payment scenario: two regimes, one payment
In a recent matter, a European financial institution was processing an interbank payment on behalf of a corporate client. The beneficiary was a trading company incorporated in a third market. Screening flagged a potential connection between one of the beneficiary's ultimate shareholders and both an OFAC-designated entity and a separately designated EU entity. The two designations were not co-extensive: the OFAC designation covered the individual shareholder; the EU designation covered a different but related holding company.
We assessed the nexus. The payment had a US-dollar leg processed through a US correspondent bank, engaging OFAC. The originating institution was EU-established, engaging the relevant EU Council Regulation. The OFAC 50 percent rule required analysis of the shareholder's aggregate indirect ownership of the beneficiary; the EU ownership-and-control test required a separate analysis of whether the designated holding company exercised effective control. The two tests produced different intermediate conclusions: the beneficiary was not captured by the OFAC 50 percent rule on the facts, but the EU control analysis was not resolvable on available corporate-disclosure information.
We advised the institution to seek an EU authorisation as a precautionary measure, to file a concurrent report under the applicable OFAC general licence covering the payment category, and to obtain enhanced beneficial-ownership disclosure from the beneficiary before processing any further payments in the series. The matter illustrates the core operational challenge: two regimes, applied to the same payment, require independent analysis and independent procedural steps. A system designed around one regime will not catch the issues raised by the other.
Related practices
- Frozen account management and BIS/EAR licensing – managing blocked-asset obligations and BIS export-licensing requirements across US regimes
- OFAC vs EU payment authorisations: further analysis – a deeper comparative review of authorisation conditions and enforcement divergence
Common misconceptions about payment authorisations
A widely held belief among treasury and payments teams is that sanctions compliance for cross-border payments is primarily an OFAC matter, and that EU authorisation requirements are either less consequential or effectively handled by the OFAC process. This is inaccurate and has produced enforcement exposure in matters we have reviewed.
EU sanctions are directly applicable across all member states. An EU-established business that processes an unlicensed payment involving a designated person violates EU law regardless of whether OFAC has issued a general licence or a specific authorisation for the same transaction. The two regimes are legally independent. OFAC's decision to authorise a transaction has no legal effect on the EU competent authority's assessment of whether that transaction is permissible under the applicable Council Regulation.
A second misconception is that the EU authorisation process is slower and less predictable than OFAC's, and that this procedural uncertainty justifies proceeding without EU authorisation where OFAC clearance is in hand. Timeline uncertainty is a legitimate operational concern. But it does not constitute a legal basis for proceeding without authorisation. The correct response to procedural uncertainty is to build longer lead times into the payment process, not to proceed on the assumption that the EU competent authority will ratify the decision after the fact.
If a payment has already been processed without the required EU authorisation, an early review can identify the best path forward – including whether a retrospective disclosure or voluntary engagement with the competent authority is appropriate. Options narrow with time. Contact us at info@caldervance.com for a confidential review.