A Canadian mining group agrees terms with a commodities trader whose ultimate beneficial owner sits in a jurisdiction subject to both US and Canadian sanctions. The compliance team flags two overlapping regimes: the US Office of Foreign Assets Control (OFAC) and Canada's sanctions administered by Global Affairs Canada (GAC). Both regimes bite. But the ownership test, the prohibition structure, the licensing route, and the penalty exposure differ in ways that change the transaction calculus. Which regime governs? And does satisfying one automatically satisfy the other?
A cross-border sanctions risk assessment (a structured analysis of whether a contemplated transaction, counterparty, or asset triggers a prohibition under one or more sanctions regimes) must treat OFAC and the Canadian regime as independent. Compliance with one does not produce compliance with the other. As of mid-2026, both regimes are active and diverge on ownership tests, secondary-sanctions reach, licensing procedures, and the practical penalty exposure for non-US persons.
This analysis maps the key divergences – ownership and control, extraterritorial reach, licensing, reporting, and enforcement posture – and sets out a practical decision sequence for businesses operating between the two jurisdictions.
Governing Authorities: How OFAC and GAC Approach Sanctions Risk Differently
OFAC administers US sanctions under IEEPA and TWEA; GAC administers Canadian sanctions under the Special Economic Measures Act (SEMA) and related instruments. Both authorities publish consolidated lists, but the lists are maintained independently and do not mirror each other in real time.
The structural difference matters from the outset of any sanctions risk assessment. OFAC is a regulatory and enforcement authority with civil-penalty powers and extraterritorial reach that extends far beyond US persons and US-origin goods. GAC operates as both the policy setter and the licensing authority, with enforcement relying on the Royal Canadian Mounted Police and federal prosecution. The two models produce different incentive structures for regulated parties – and different risk profiles for the same counterparty.
OFAC's SDN List (the list of Specially Designated Nationals and blocked persons) and its various programme lists carry global effect for US persons and, through secondary-sanctions authorities, practical effect for non-US persons who transact in US dollars or touch the US financial system. The Canadian Consolidated Autonomous Sanctions List covers persons designated under SEMA and the Freezing Assets of Corrupt Foreign Officials Act. A person may appear on one list but not the other. In our experience, this gap is where cross-border compliance programmes most commonly fail: teams run one list and assume coverage of both.
The legal basis for each regime's list-maintenance process also diverges. OFAC designations are administrative decisions subject to challenge before the US courts. Canadian designations under SEMA require a Governor in Council order and are subject to review through the Federal Court of Canada. The procedural route, the evidentiary standard, and the realistic timeline for any successful challenge differ substantially – a point that matters when a counterparty is designated in one jurisdiction but not the other and the business needs to understand its exposure on each side of the border.
The Ownership and Control Test: Where the Regimes Diverge Most Sharply
The ownership test is the sharpest practical divergence between the two regimes. Under OFAC, the 50 percent rule (the rule treating any entity owned 50 percent or more in the aggregate by one or more blocked persons as itself blocked) operates mechanically: once the aggregate ownership threshold is met, the entity is blocked regardless of operational independence or managerial control.
Under Canadian sanctions, the relevant test under SEMA looks at whether a person is "owned or controlled" by a designated person. The control limb is broader in scope than the OFAC 50 percent rule in one sense – it can capture entities below the 50 percent ownership line if a designated person exercises effective control – but it is narrower in another: it requires a factual assessment of control rather than a purely arithmetic aggregation. A compliance team assessing the same target under both regimes may reach different conclusions about whether the entity is caught, depending on the ownership structure.
Aggregation is the OFAC-specific trap. Two designated persons each holding 30 percent of a target entity aggregate to 60 percent, catching the entity under OFAC even if neither designated person alone holds a majority. Canadian law does not apply the same arithmetic aggregation rule in the same way. A counterparty that clears the Canadian control test may still be blocked under OFAC. In our experience, businesses that run a single ownership analysis for both regimes almost always undershoot the OFAC standard.
What does this mean for a practical sanctions risk assessment? It means the ownership and control analysis must be run twice, against two independent legal standards, using the primary sources for each regime. A single UBO trace is not sufficient. Does your programme record the conclusion reached under each regime separately, or does it collapse them into one determination?
Extraterritorial Reach: The Asymmetry That Changes the Risk Calculus
OFAC's extraterritorial reach – through secondary-sanctions authorities and the US dollar's role as a settlement currency – means that non-US businesses, including Canadian businesses, face real OFAC exposure for transactions that have no US person involvement and no US-origin goods or technology, provided the transaction touches the US financial system or involves conduct that triggers a secondary-sanctions authority.
Canadian sanctions under SEMA do not carry the same extraterritorial reach. SEMA applies primarily to Canadian persons and to transactions conducted in Canada. A Canadian company transacting entirely outside Canada with no Canadian-origin goods or technology will not, in most cases, trigger a SEMA prohibition. The same transaction may trigger OFAC if it is settled in US dollars through a US correspondent bank, if a US person is involved anywhere in the chain, or if a secondary-sanctions authority applies.
This asymmetry has a direct consequence for risk assessment. A Canadian business that has assessed its transaction as compliant under Canadian law should then ask: does this transaction touch the US financial system? Does it involve US-origin goods or technology, even in a minor way? Does it involve a sector, a jurisdiction, or a counterparty that is subject to an OFAC secondary-sanctions authority? If the answer to any of those questions is yes, the OFAC analysis is not optional – it is a legal requirement for the US-connected element.
For cross-border B2B clients, in our cross-border practice, the US dollar settlement question is the most common trigger. A trade structured between Canadian and third-country parties, denominated in US dollars, and cleared through a US correspondent bank is subject to OFAC scrutiny on that settlement leg alone. Canadian compliance satisfies only the Canadian legal obligation. OFAC exposure remains live.
The position above covers the standard case. Your facts – the counterparty, the goods, the route, the settlement currency, the intermediary banks, and the regime in play – change the analysis in ways that a general assessment cannot capture.
For a tailored review of your cross-border exposure under OFAC and Canadian sanctions, contact Calder & Vance at info@caldervance.com.
Licensing and Authorisation: Two Separate Applications, Two Different Standards
A specific licence (a case-by-case authorisation from the relevant regulator to conduct an otherwise prohibited transaction) must be obtained separately from OFAC and from GAC. There is no mutual recognition, no treaty-based alignment, and no mechanism by which a licence granted by one authority satisfies the other.
OFAC-specific licences are reviewed against OFAC's licensing policy for the relevant programme. The review period varies by programme and by the volume of applications in the queue; it can range from a matter of weeks to many months for complex matters. GAC issues authorisations under SEMA, and the process and timeline differ from OFAC's. A business that needs to proceed with a transaction involving both a designated Canadian person and US-connected elements must apply to both authorities, manage two separate review processes, and ensure that neither licence contains conditions that create compliance problems for the other.
OFAC also publishes general licences (standing authorisations that permit a defined category of transactions without a separate application) for specific programmes and transaction types. Canadian general authorisations under SEMA exist for a narrower range of transaction types. A transaction that falls within an OFAC general licence does not automatically fall within a Canadian authorisation – again, the check must be run against each regime's published authorisations independently.
For exporters and traders, the interaction between the licensing regime and the goods classification question adds a further layer. Export-controlled goods touching both the EAR (administered by BIS) and any applicable Canadian export-control instrument require classification and licence-exception analysis under both systems. The EAR and the Canadian export-control regime do not align perfectly in their commodity classifications. A dual-use item that falls within a licence exception under one regime may require a licence under the other.
Reporting, Record-Keeping, and the Voluntary Self-Disclosure Question
OFAC requires blocked property to be reported and held in a blocked account. The reporting obligation arises promptly on the blocking event. Record-keeping obligations under OFAC extend across the relevant period for enforcement purposes. OFAC's enforcement process includes the option of a VSD (voluntary self-disclosure to the regulator), which, if complete and timely, is a significant mitigating factor in the penalty calculation.
Canada's reporting obligations under SEMA are structured differently. A person in Canada who holds property of a designated person must report that holding to the Commissioner of the Royal Canadian Mounted Police. The obligation applies to every person in Canada, not only to Canadian citizens or residents. The reporting deadline and the scope of the obligation differ from OFAC's blocking and reporting rules.
The VSD question is where enforcement strategy can diverge most sharply. OFAC's VSD programme is well-documented and has a material effect on the settlement of apparent violations; it reduces the base penalty range and is a factor OFAC weighs explicitly in its penalty matrix. Canada does not operate an equivalent programme in the same form. A business that discovers a potential breach of both regimes must assess the VSD question for OFAC independently from the question of how to manage any Canadian enforcement exposure.
If a transaction has already been flagged, a filing has been refused, or a potential violation has been identified, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential review of your position.
Penalty Exposure and Enforcement Posture: Reading the Risk Correctly
OFAC civil penalties can be very substantial, running to many millions of US dollars for significant violations, with the statutory maximum tied to the transaction value or to a fixed per-violation ceiling under the applicable programme. Criminal penalties for wilful violations are available under IEEPA and TWEA and are prosecuted by the Department of Justice. OFAC's published enforcement actions and its penalty matrix provide the clearest public record of how OFAC weighs aggravating and mitigating factors.
Canadian penalties under SEMA are also significant, though the penalty structure differs. Prosecution must be brought in the federal courts, and the criminal standard of proof applies. The practical enforcement record in Canada differs from OFAC's in volume and in the type of matter typically prosecuted. Neither the OFAC nor the GAC enforcement posture should be treated as a reliable guide to the other's approach.
For a business assessing its exposure under both regimes simultaneously, the penalty-risk analysis must consider: which regime carries the greater civil exposure on the facts; whether OFAC secondary-sanctions risk applies even if the primary conduct is Canadian; and whether the VSD option under OFAC should be exercised before any Canadian regulatory contact is made. The sequencing of those steps matters and can affect the outcome in each jurisdiction.
A common misconception is that satisfying the home-country regime – in this case, Canadian sanctions – provides a defence to OFAC enforcement. It does not. OFAC applies US law to US-connected conduct regardless of what another jurisdiction's regulator has accepted. Conversely, a business that has obtained an OFAC general licence for a transaction cannot assume that the same transaction is permitted under Canadian law. The two regimes are legally and operationally separate. Each must be satisfied independently.
Practical Risk-Assessment Decision Sequence for Cross-Border Operations
A structured sanctions risk assessment for a business with exposure to both OFAC and Canadian sanctions should work through the following decision sequence before any transaction is approved or any counterparty relationship is established.
First, run a list check against both the OFAC SDN List and the Canadian Consolidated Autonomous Sanctions List, and against any applicable programme lists maintained by either authority. A hit on one list is not a hit on both; a clean result on one does not clear the other.
Second, run the ownership and control analysis twice: once against the OFAC 50 percent rule (using an aggregation approach across all known blocked-person shareholders), and once against the Canadian ownership and control test under SEMA. Record the conclusion reached under each regime separately. Where the UBO chain includes any person on either list, trace the chain to completion before approving the transaction.
Third, assess the US-nexus question: is the transaction settled in US dollars; does it involve US-origin goods, technology, or software; does it involve a US person at any point in the chain; and does any OFAC secondary-sanctions authority apply to the counterparty, the jurisdiction, or the sector? If yes to any of these, the OFAC analysis is mandatory regardless of the transaction's structural nexus to the United States.
Fourth, check applicable general licences and general authorisations under each regime independently. Do not assume that a general licence under one regime covers the same conduct under the other.
Fifth, if the transaction does not fall clearly within a general licence or authorisation, assess the specific-licence route under each regime. Consider whether the two applications can be filed simultaneously or whether one jurisdiction's process should be completed first.
Sixth, assess the reporting and record-keeping obligations triggered by the transaction under each regime. If blocked property has already been identified, ensure compliance with OFAC's reporting obligation and the Canadian reporting obligation under SEMA before taking any further steps.
Seventh, if a potential violation has been identified, assess the VSD question under OFAC and the equivalent question under Canadian law, considering the sequencing implications for each jurisdiction's enforcement process.
This sequence is a starting framework. Complex transactions – particularly those involving layered ownership structures, multiple jurisdictions, dual-use goods, or secondary-sanctions-sensitive sectors – require legal analysis at each stage, not a checklist.
The Common Mistakes: Where Cross-Border Assessments Go Wrong
In our experience advising businesses with OFAC and Canadian sanctions exposure, the most common failure points in a sanctions risk assessment are structural, not technical. Teams that understand each regime individually often fail at the interface between them.
The first failure is running a single list check and treating a clean result on one list as clearance for both. The lists diverge. A person can be on the Canadian list without appearing on the OFAC SDN List, and vice versa. The check must be run against both authorities' primary sources.
The second failure is applying the OFAC 50 percent rule without the aggregation step. A counterparty with two minority blocked-person shareholders, neither of whom individually holds 50 percent, is still blocked under OFAC if their combined holding reaches the threshold. Most screening tools do not perform this aggregation automatically; it requires a manual ownership-chain review.
The third failure is assuming that a transaction settled in Canadian dollars, between Canadian parties, with Canadian goods, is outside OFAC's reach. If the transaction is cleared through a correspondent bank that uses the US financial system, or if US-origin technology is embedded in the goods, OFAC analysis applies.
The fourth failure – and the one we see most often in enforcement contexts – is treating a general licence obtained under OFAC as a green light for the Canadian element of the transaction, or vice versa. A general licence is jurisdiction-specific. It does not travel.
What distinguishes businesses that manage this risk effectively from those that do not? Operational discipline: separate records for each regime's assessment, a clear escalation path when the analysis is uncertain, and legal review before approval rather than after a problem has surfaced.
Related practices
- Compliance audit and testing – structured programme testing across OFAC, OFSI, and comparable regimes
- Sanctions risk assessment: OFSI analysis – how OFSI's ownership and enforcement approach compares with OFAC
- OFSI vs EU: sanctions risk assessment divergences – key differences between UK and EU ownership tests and licensing routes