A payments firm in Amsterdam processes a transfer for a trade-finance client. Three days later, its compliance team identifies a link between the beneficiary and an entity that appears to fall within the scope of an EU Council regulation. No one acted in bad faith. The goods had already moved. The question now is not whether something went wrong – it is how to assess what went wrong, and what to do about it before the relevant national competent authority asks first.
An apparent-violation assessment (a structured internal review to determine whether a transaction or conduct may constitute a breach of EU sanctions) is the first procedural step every business should take when a potential sanctions issue surfaces. EU sanctions are enforced at Member State level under national implementing legislation, but the underlying prohibitions derive from Council regulations with uniform application across the Union. As of March 2026, the EU's enforcement architecture continues to evolve, with Directive 2024/1226 on criminal liability for sanctions violations now in the process of transposition across Member States.
This guide walks through the assessment in sequence – from the moment a potential issue is flagged, through the legal test, the cross-regime comparison, the risk-flag analysis, and the question of when to bring in external counsel.
What is an apparent-violation assessment, and why does the EU regime make it essential?
An apparent-violation assessment is the structured internal review a business conducts to determine whether a specific transaction, instruction, or course of conduct may constitute a breach of the applicable EU Council regulation. It is not a final legal conclusion; it is the disciplined process that produces the facts on which a legal conclusion can be made.
Under EU sanctions, the prohibitions flow from Council regulations that are directly applicable in every Member State without transposition. Making funds or economic resources available to a designated person, or engaging in a prohibited transaction, is unlawful from the moment the regulation takes effect. Crucially, many of the key prohibitions apply to conduct that occurs anywhere in the world where a Union nexus exists – through a EU-established entity, a euro-denominated payment, or a person who is a national of a Member State. That jurisdictional breadth means an apparent issue in one group entity can touch the regulatory perimeter of multiple others.
The assessment matters for a second, practical reason: Member State competent authorities – the national bodies responsible for enforcement – treat the quality of a firm's internal review as a direct signal of its compliance culture. A thorough, timely, documented assessment is the baseline. Its absence is itself an aggravating factor in penalty calculations. In our experience advising clients across multiple Member States, the firms that handle enforcement well are those that began the assessment within hours of a flag, not days.
What does "apparent" mean here? It means the issue has not yet been proven. The entity or transaction appears, on the information available, to engage a prohibition. The assessment tests whether that appearance holds under scrutiny – and documents the reasoning either way.
Step 1 – Identify and preserve the relevant record
The first action, taken immediately when a potential issue surfaces, is to secure the evidentiary record. This means preserving all documentation relating to the transaction or conduct in question: contracts, payment instructions, shipping documents, screening records, the alert itself, and any communications with the counterparty.
Under EU sanctions rules and the Council regulations, EU operators are required to maintain records of transactions and screening decisions. Many national implementing measures specify a retention period; verify the current obligation in the applicable Member State, but a five-year record-keeping standard is common across several EU jurisdictions and is consistent with the general anti-money-laundering rules with which sanctions obligations interact. Do not destroy, alter, or over-write any record once a potential issue has been identified.
Assign a single internal owner for the assessment. In larger institutions this is typically a senior member of the financial-crime compliance team, supported by legal. In smaller businesses, the appropriate person will often need external support from the outset. The owner logs every step, timestamps every decision, and keeps the record isolated from the ordinary document-management flow.
One discipline that is easily overlooked: freeze the relevant screening data at the point of the alert. Screening databases update continuously. The entry that flagged the counterparty today may look different tomorrow. Capture a screenshot or export the exact screening output that generated the flag, together with the date and time of the query.
Step 2 – Characterise the potential issue against the applicable prohibition
Once the record is secured, the assessment moves to legal characterisation: which prohibition, in which Council regulation, does the conduct potentially engage? EU sanctions are organised by programme – geographic and thematic – each governed by a distinct Council regulation and an associated Council Decision. The relevant regulation determines the scope of the prohibition, the definitions of "funds" and "economic resources", the ownership-and-control test, and the available derogations.
The ownership and control test (the EU and UK test for whether a non-listed entity is caught because a listed person owns or controls it) sits at the centre of most EU apparent-violation assessments. Unlike the US OFAC position, which applies a purely mechanical 50 percent or more aggregate ownership threshold, the EU test is two-limbed: it catches entities owned at that threshold AND entities controlled by a listed person, even where ownership is below the threshold. Control is assessed by reference to the ability to exercise a dominant influence over the management or direction of the entity.
In practice, this means the EU assessment is broader than an OFAC analysis of the same counterparty. A non-listed subsidiary in which a listed person holds forty percent but exercises board control may be caught by the EU regulation while sitting outside OFAC's 50 percent rule. Have you stress-tested your counterparty's ownership structure against the control limb, not just the ownership threshold?
The characterisation step should also identify whether any derogation or authorisation is available. EU Council regulations contain specific derogations – for humanitarian purposes, for legal costs, for diplomatic missions, and others. The availability of a derogation does not retroactively authorise a completed transaction, but it is relevant to the gravity of any breach and to any subsequent licence application.
Step 3 – Apply the cross-regime lens: where does EU diverge from OFAC and OFSI?
A cross-regime comparison is not optional for any business with transatlantic or multi-jurisdictional operations. The same underlying conduct may engage EU, US, and UK sanctions simultaneously, and the obligations – and enforcement consequences – can diverge materially.
Three divergences are particularly significant in an apparent-violation assessment.
First, the ownership-and-control test. As noted above, the EU and UK (OFSI) positions both include a control limb; OFAC's does not. A transaction involving a non-listed entity that a listed person controls – but does not own at 50 percent or more – may be a clear EU and OFSI apparent violation while presenting a cleaner picture under OFAC.
Second, enforcement architecture. OFAC is a single federal agency that assesses violations, issues findings, and imposes civil penalties directly. EU enforcement is decentralised: each Member State enforces through its own competent authority, applying national procedural law, national penalty ranges, and – in many cases – national criminal law as well as administrative sanctions. A transaction that touches France, Germany, and the Netherlands may therefore face three separate national enforcement processes, each with its own procedural calendar and penalty regime. Directive 2024/1226 addresses this by requiring Member States to criminalise certain sanctions violations, but the transposition window means the landscape remains uneven as of early 2026.
Third, voluntary disclosure. OFAC has a well-established voluntary self-disclosure (VSD) programme – the practice of proactively reporting a potential breach to the regulator before it is discovered – with a defined mitigating effect on penalty calculations. OFSI in the UK has a similar framework. In the EU, voluntary disclosure mechanisms exist in several Member States, but they are national in scope and vary considerably in their procedural requirements and mitigating weight. An assessment that identifies a cross-border apparent violation must therefore map the disclosure options – and their relative benefits – jurisdiction by jurisdiction, not as a single EU-level decision.
For matters that engage both EU and US sanctions, the cross-regime coordination question is acute. In our cross-border practice, we regularly advise on the sequencing of disclosures across OFAC, OFSI, and national EU authorities to ensure that a disclosure in one jurisdiction does not inadvertently prejudice the position in another.
Where a matter engages regimes beyond the EU – including Singapore, Japan, or the UAE, each of which maintains its own prohibitions and enforcement architecture – the analysis must extend further. A cargo routed through multiple jurisdictions may attract several parallel obligations; the stricter prohibition governs in each jurisdiction of connection.
What are the risk flags that elevate an apparent violation to a serious case?
Not every apparent violation carries the same risk profile. The assessment should identify the factors that determine where the matter sits on the severity spectrum, because that assessment drives the decision on whether to disclose voluntarily, how urgently to engage counsel, and what interim measures to implement.
The following factors consistently elevate severity:
- Wilful blindness or actual knowledge – Evidence that compliance staff were aware of a risk and did not act on it, or that due-diligence steps were deliberately avoided, is the single most serious aggravating factor across every enforcement jurisdiction.
- A pattern of conduct rather than an isolated incident – a single erroneous payment is a different matter from a course of dealing that repeated the same error over months.
- Involvement of a listed person directly, rather than through an owned or controlled entity – direct dealings sit at the most serious end of the prohibition hierarchy.
- Substantial value – the monetary value of the apparent violation is relevant to the penalty base in most enforcement regimes, including those of EU Member States.
- Failure to self-identify – a firm that discovered a potential violation only because a regulator, correspondent bank, or counterparty raised it is in a materially weaker position than one that found it through its own controls.
- Inadequate screening at the time of the transaction – if the apparent violation occurred because the screening programme was poorly configured, failed to apply the control test, or used an out-of-date database, that is a systemic compliance failure rather than an isolated error.
Mitigating factors include: prompt self-identification; immediate record preservation; a well-documented historical compliance programme; co-operation with the competent authority; and, in Member States that recognise it, a timely voluntary disclosure. The weight of each mitigating factor varies by jurisdiction.
The position above covers the standard case. Your facts – the counterparty, the goods, the route, the Member States in play, and the specific Council regulation engaged – change the analysis. If the assessment identifies any of the elevating factors above, seeking external sanctions counsel before taking any further step is the more prudent course.
Our EU apparent-violation assessment service is designed for businesses that need a structured external review at the point when an internal flag has been raised. For an early-stage assessment of your exposure, contact Calder & Vance at info@caldervance.com.
Step 4 – Document the assessment and reach a reasoned conclusion
A complete apparent-violation assessment produces a written memorandum. The memorandum is the record of the exercise. It is also, in any subsequent enforcement proceeding, the primary evidence of the firm's compliance culture and the seriousness with which it treated the issue when it arose.
The memorandum should set out:
- A factual summary of the transaction or conduct in question, referenced to the source documents preserved in Step 1.
- The applicable Council regulation and the specific prohibition engaged, described generically by instrument name rather than article number.
- The result of the ownership-and-control analysis, including the methodology applied and the data sources used.
- The cross-regime position: does the same conduct engage OFAC, OFSI, or any other sanctions regime? If so, note it and flag it for separate advice.
- The risk-factor analysis from Step 3 above: aggravating and mitigating factors identified.
- A reasoned conclusion: does the conduct constitute an apparent violation? If the analysis is genuinely uncertain, say so and explain why.
- Recommended next steps: voluntary disclosure, licence application, transaction unwinding, enhanced due diligence, or a combination.
The conclusion does not need to be definitive to be useful. A well-reasoned memorandum that identifies the issue, sets out the competing considerations, and recommends a specific course of action is precisely what a national competent authority will want to see if the matter progresses. In our experience, the absence of a contemporaneous written analysis – even where the firm ultimately concluded there was no violation – is regularly cited by enforcement teams as evidence of inadequate controls.
When should external sanctions counsel be involved?
External counsel adds most value at three moments in the apparent-violation timeline, and the most consequential of these is the earliest.
The first is at or before Step 2, when the legal characterisation question is genuinely difficult. The ownership-and-control analysis for a multi-layered corporate structure, or the interaction between two Council regulations covering overlapping programmes, are not always resolvable through internal resources. Getting the legal characterisation wrong at the outset compounds every subsequent decision.
The second is when the risk-flag analysis in Step 3 identifies any of the serious aggravating factors – wilful blindness, a pattern of conduct, or direct involvement of a designated person. These matters require careful handling. A voluntary disclosure that is poorly framed, or submitted to the wrong authority, can be worse than no disclosure at all.
The third is when the assessment reveals a cross-regime dimension. Coordinating disclosures or remedial action across OFAC, OFSI, and multiple EU Member State authorities requires an understanding of each regime's procedural calendar, mitigating-factor framework, and enforcement posture. We regularly advise on precisely this coordination, including matters where the EU apparent violation is the main exposure but a secondary US sanctions question requires a parallel OFAC assessment.
If a transaction has already been flagged by a correspondent bank, or a written query has arrived from a national competent authority, the window for voluntary disclosure may be closing. An early external review can preserve options that narrow quickly once a regulator is already in contact.
Contact Calder & Vance at info@caldervance.com to discuss a confidential assessment of your exposure. Our team can advise on EU sanctions characterisation, cross-regime coordination, and the voluntary-disclosure options available in the relevant Member States.
Correcting a common misconception: "The EU has no enforcement body, so the risk is lower"
One myth we encounter regularly is that EU sanctions enforcement is softer than OFAC or OFSI enforcement because there is no single EU-level sanctions authority. The reasoning runs: twenty-seven different Member State authorities means fragmented enforcement, lower penalties, and less regulatory attention.
This reasoning is flawed in three ways. First, the obligations themselves derive from directly applicable Council regulations, which carry the full force of EU law. The absence of a single enforcement agency does not reduce the prohibition; it multiplies the enforcement exposure. A transaction with connections to France, Germany, and the Netherlands is, in principle, exposed to three national enforcement actions simultaneously.
Second, Member States have significantly increased their enforcement activity in recent years. Several major EU jurisdictions now impose substantial financial penalties and, in serious cases, criminal sanctions. Directive 2024/1226 accelerates this trajectory by requiring harmonised criminal liability for the most serious violations across all Member States.
Third, the reputational consequences of a publicised EU sanctions enforcement action are equivalent to those that flow from an OFAC or OFSI action. Correspondent banks, counterparties, and investors apply the same scrutiny to an EU enforcement finding as to a US or UK penalty notice. The practical deterrent is the same.
The practical implication: treat the EU apparent-violation assessment with the same rigour you would apply to an OFAC or OFSI matter. The enforcement architecture is different; the stakes are not.
Related practices
- Apparent-violation assessment under Japan – comparable assessment guide for Japan's national sanctions regime
- Apparent-violation assessment under OFAC – step-by-step guide to the US sanctions assessment process, including VSD