A cross-border business operating under EU sanctions has just settled an enforcement matter with the competent national authority. The agreement includes a condition that compliance counsel had anticipated but the board had not: a monitorship. An independent monitor will assess, test, and report on the firm's sanctions-compliance programme for an agreed period. The clock is running. What happens next, and what does the business need to do before the first monitor review?
A compliance monitorship (an arrangement in which an independent expert appointed or accepted by the enforcing authority reviews a firm's sanctions controls and reports on remediation progress) under the EU regime is governed by the relevant Council regulation and the national transposing law of the member state conducting enforcement. As of March 2026, monitorships arise most commonly following a deferred-prosecution or settlement pathway in member states that permit such arrangements, or as a condition attached to a licensing outcome. The governing standard is the competent authority's own enforcement guidance, supplemented by the EU Council's position on proportionate sanctions enforcement.
This guide walks through the monitorship lifecycle in seven stages, comparing the EU position with the OFAC and OFSI approaches at each step, and identifying the practical risk flags that determine whether a monitorship ends on schedule or is extended.
Step 1: Understanding the legal basis for an EU compliance monitorship
An EU compliance monitorship draws its authority from the relevant Council regulation imposing the sanctions programme, the national enforcement law transposing the EU regime into domestic law, and the terms of the settlement or enforcement decision itself. No single pan-EU monitorship statute exists. Each competent national authority – whether a central bank, a finance ministry unit, or a dedicated sanctions office – applies its own procedural rules within the ceiling set by EU law.
This decentralised structure matters from day one. A monitorship imposed by a Dutch authority will differ procedurally from one imposed by a French, German, or Belgian equivalent. The substantive obligation – demonstrate that the compliance programme meets an agreed standard – is constant. The reporting format, the monitor's formal powers, and the appeal route against the monitor's findings are all governed by the applicable national regime.
In our cross-border practice, businesses are often surprised to find that the settlement agreement itself is the most important document in the monitorship. It defines the monitor's mandate, the metrics for satisfactory performance, and the conditions for early termination or extension. Reviewing that document with sanctions-specialist counsel before signing is not optional; it sets the contractual architecture for everything that follows.
How does this compare with OFAC? Under the US approach, OFAC's enforcement guidelines set out a federal standard for monitorships attached to civil-penalty settlements, and the monitor typically reports directly to OFAC on a defined schedule. The EU's national-authority model means the reporting line and the monitor's powers vary by jurisdiction. For a business operating across multiple EU member states, the applicable national regime governs even where the underlying sanctions regulation is uniform EU law. See also our companion guide on managing a compliance monitorship under OFAC for a direct comparison.
Step 2: How is the monitor selected, and what is the firm's role?
Monitor selection under the EU regime typically gives the firm a degree of participation: the competent authority either appoints the monitor directly or approves a candidate proposed by the firm from a shortlist of qualified experts. The authority retains veto power.
This is an important leverage point, and it is one that businesses frequently underuse. The monitor's professional background – whether they come from a financial-crime compliance, legal, or regulatory-affairs background – shapes the lens through which they assess programme adequacy. A monitor with deep transactional experience will assess screening logic differently from one whose background is policy or enforcement.
Before proposing or accepting a monitor, the firm should consider three questions. First, does the candidate have genuine experience with EU Council-regulation sanctions, or with OFSI/OFAC monitorships only? The ownership-and-control analysis under EU law differs materially from the OFAC 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked), and a monitor unfamiliar with EU specifics can generate disproportionate findings. Second, does the candidate have a conflict of interest – a prior relationship with a counterparty, a regulator, or a competitor? Conflicts must be declared and resolved before appointment. Third, is the proposed fee arrangement reasonable relative to the scope of the mandate?
We regularly advise businesses at this selection stage. Negotiating the monitor's charter – the written document that defines what the monitor may and may not examine, the format of interim reports, and the process for disputing a finding – is a distinct legal task that requires sanctions-specialist input alongside the firm's own compliance team.
Step 3: What does the monitor actually review?
The monitor's review scope is anchored to the deficiencies identified in the enforcement action and to the commitments made in the settlement agreement. A well-scoped charter limits the review to those areas; a poorly scoped charter can give the monitor licence to conduct a broad programme audit that goes far beyond the original breach.
Under the EU regime, the standard assessment typically covers five areas.
- Screening systems and data quality – whether the firm screens against the EU Consolidated List and relevant thematic programme lists, how frequently data is refreshed, and how alerts are adjudicated.
- Ownership-and-control analysis – ownership and control (the EU test for whether a non-listed entity is caught through a listed person's ownership or control) is assessed against the relevant Council regulation. The monitor will test whether the firm applies the control limb correctly, not only the ownership percentage.
- Transaction monitoring and escalation – how the compliance function identifies and escalates potentially sanctionable transactions, and whether escalation paths reach senior management and the board.
- Governance and accountability – whether there is a named senior officer with sanctions accountability, whether the compliance function has adequate resource, and whether policies are reviewed on a defined cycle.
- Training and awareness – whether staff whose roles touch sanctions risk receive appropriate training, and whether training records are maintained.
In a recent matter, a financial institution faced a monitorship following a settlement under the applicable national enforcement regime. We worked with the firm's compliance team to prepare a structured pre-assessment against each of these five areas before the monitor's first site visit. That preparation reduced the number of open findings at the first review and shortened the overall monitorship period. The outcome reflected the quality of preparation, not any commitment on timing.
How does the EU ownership-and-control test affect monitorship findings?
The EU ownership-and-control test is broader than OFAC's mechanical 50 percent ownership trigger. Under the applicable Council regulation, a non-listed entity is caught not only where a designated person holds a majority ownership stake, but also where the designated person effectively controls the entity – through contractual rights, board composition, voting arrangements, or other means – even without reaching a majority ownership threshold.
This matters for a monitorship because a monitor operating under EU standards will expect the firm's counterparty assessment process to capture both ownership and control. A screening programme calibrated solely to ownership percentages – sometimes adopted by firms used to the OFAC standard – will generate a finding under the EU regime. We have acted for clients where this exact gap was identified in the first monitor report, requiring a programme redesign mid-monitorship.
Practically, the control limb requires the firm to assess governance documents, shareholder agreements, loan covenants with control provisions, and management service arrangements. This is not purely a beneficial-ownership exercise; it demands a qualitative read of how the entity actually makes decisions. Does your current counterparty-review process capture contractual control, or only registered shareholdings?
The divergence between EU and OFSI positions on control is narrower – OFSI applies a comparable ownership-and-control standard under the Sanctions and Anti-Money Laundering Act – but the two regimes differ in procedural application. For businesses subject to both UK and EU sanctions, the OFSI and EU control tests should be mapped together to avoid gaps. See our overview of apparent violation assessment under the EU regime for the enforcement context in which these questions typically arise.
Step 4: Managing interim reporting and responding to monitor findings
Interim reports from the monitor are the heartbeat of the monitorship period. Each report identifies open findings, assesses progress against remediation commitments, and in some cases makes recommendations to the competent authority. The firm's response to each report is the formal record of its remediation effort.
Three disciplines are essential.
First, treat every open finding as a project with an owner, a deadline, and a documented completion standard. A finding logged as "in progress" across two consecutive reports signals to the monitor – and to the authority – that the firm lacks the governance capacity to deliver. Second, respond in writing to every finding, even those the firm disputes. If the firm believes a finding reflects a misunderstanding of the applicable EU rule, that view should be stated formally in the response and supported by a legal analysis. A monitor's findings are not legally binding in themselves; they are input to the authority's assessment. Third, keep the compliance function and the legal team aligned throughout. We regularly advise on framing written responses to monitor findings so that they are legally precise without being adversarial.
A common mistake is treating the monitorship as an internal compliance project rather than a legally significant process with external consequences. The monitor's reports are usually shared with the competent authority. A pattern of incomplete or delayed remediation responses can affect the authority's decision on monitorship extension, and in some member states it can affect the original penalty.
Step 5: Cross-regime coordination where OFAC and OFSI monitorships run concurrently
For a multinational subject to both EU and OFAC enforcement, concurrent monitorships under different regimes are a real possibility. The US and EU regimes share a commitment to the five-element compliance-programme standard, but the mechanics differ in ways that matter.
OFAC's monitorship model is federal and uniform; the reporting line runs directly to OFAC, and the monitor's findings are assessed against OFAC's framework for effective sanctions compliance. The EU national-authority model is distributed; findings are assessed against the standard of the member state authority that imposed the obligation. A firm running concurrent OFAC and EU monitorships may find that its US monitor reaches a different view of a screening gap than its EU monitor, because the applicable benchmarks diverge at the margin.
The practical response is to build a single remediation architecture that satisfies both standards. In our experience, the higher standard on any given point governs: if the EU control-test requirement exceeds the OFAC ownership trigger for a particular counterparty, the EU standard sets the firm's benchmark for that assessment. Where the stricter prohibition governs, compliance to the lower standard creates residual risk under the stricter regime. For businesses also subject to OFSI, the UK equivalent – with its own ownership-and-control tests under the relevant thematic sanctions regulations – adds a further layer that should be mapped to the same remediation architecture.
Coordinating across concurrent monitorships requires dedicated project management and clear communication channels with each monitor. Each monitor's mandate is specific to one regime; the firm must synthesise the findings across regimes without allowing one to fall behind.
Step 6: Risk flags that extend a monitorship or trigger a further enforcement step
A monitorship that begins as a defined-term obligation can extend, sometimes significantly, if the competent authority concludes that the firm has not met its remediation commitments. Several patterns reliably produce this outcome.
The first is document management failures. A monitor who cannot retrieve the records needed to test a control will record the control as unverified, not as adequate. Record-keeping obligations under the applicable EU regime – the requirement to maintain documentary records of screening decisions, ownership assessments, and licence applications – are assessed by the monitor as a standalone compliance element. Poor record-keeping is both a finding in its own right and an obstacle to demonstrating remediation of other findings.
The second is governance instability. If the named senior officer with sanctions accountability changes during the monitorship, or if the compliance function loses key staff, the monitor will treat continuity of accountable oversight as an open risk. Notifying the monitor and the authority promptly of material personnel changes, and demonstrating a robust transition process, mitigates this risk.
The third is a new apparent violation during the monitorship period. A breach identified during an active monitorship is viewed through the lens of the firm's remediation commitments. If the breach relates to the same programme area that the monitorship was imposed to fix, the authority will question whether the remediation has had any real effect. In that situation, early involvement of external sanctions counsel to scope the new matter and consider a VSD (voluntary self-disclosure to a regulator) is essential. Timing matters: the options available in the first days after identification narrow quickly.
The fourth is inadequate legal-analysis quality. Ownership-and-control determinations, and decisions to proceed with transactions that touch a grey-area counterparty, must be supported by documented legal reasoning. Where a firm relies on internal analysis that a monitor finds insufficiently rigorous, the finding is typically a governance failure rather than a technical error – and governance failures are harder to remediate quickly.
Step 7: Closing a monitorship and avoiding recurrence
A monitorship closes when the competent authority is satisfied that the firm has remediated the identified deficiencies and demonstrated that its compliance programme meets the agreed standard. In member states where the monitorship is a formal condition of a settlement, the authority issues a written determination. In other cases, the monitor's final report serves as the closing record.
Preparation for closing should begin at least one full reporting cycle before the expected end date. The firm should commission an internal pre-closing assessment against the same criteria the monitor will apply. Any gap identified in that internal review should be remediated before the monitor's final review, not after. Presenting a final report that contains open findings – even minor ones – resets the timeline.
Avoiding recurrence requires treating the monitorship's output as a permanent baseline for the compliance programme, not as a closed chapter. The monitoring period will have produced a granular map of the programme's weaknesses. Embedding the remediation into the programme's ongoing governance cycle – including regular independent testing, a defined policy-review schedule, and a programme of staff training – is what separates businesses that do not face a second enforcement action from those that do.
For businesses subject to the Japanese sanctions regime, which operates differently but with increasing alignment to G7 standards on programme expectations, our separate guide on managing a compliance monitorship under Japan's regime addresses the relevant national-authority requirements.
Related practices
- Apparent Violation Assessment – EU – assessing apparent violations under the EU Council-regulation enforcement model
- Compliance Monitorship – OFAC Guide – step-by-step guide to managing an OFAC-imposed monitorship and comparing it with the EU model