A procurement team in Singapore finalises a supply agreement with a European distributor. The distributor's parent company appears on an OFAC screening alert. Three compliance officers in three time zones reach three different conclusions about whether the deal can proceed. As of mid-2026, this is not an unusual situation – it is the daily reality for businesses operating across the major sanctions regimes simultaneously.
A cross-border sanctions compliance programme (a structured set of policies, controls, and review processes designed to prevent, detect, and report sanctions violations across multiple jurisdictions) must satisfy the core demands of each applicable regime without creating internal contradictions. The United States, United Kingdom, European Union, and United Nations regimes each impose distinct obligations, and a programme built for one will leave gaps in another. Getting the architecture right from the outset is materially less expensive than correcting a breach after the fact.
This guide walks through the key stages of designing a programme that holds up across the principal regimes: from governance and legal-basis mapping through screening, ownership analysis, and licensing, to audit and incident response. Each stage identifies where the regimes diverge and what that divergence means operationally.
Step 1: Map the regimes that actually apply to your business
The first step is to identify, precisely, which regimes govern your business – because jurisdiction is not determined by where you are incorporated but by where you operate, what currency you use, who your customers and counterparties are, and what goods or technology you handle.
A company incorporated outside the United States can still fall squarely within OFAC's reach if it processes US dollar transactions, uses US financial infrastructure, employs US persons, or re-exports US-origin goods. That is the extraterritorial dimension that catches cross-border businesses off guard. Similarly, the EU's regime applies to any transaction that has a nexus with EU territory, EU persons, or goods of EU origin – irrespective of where the contracting parties are domiciled.
The UK regime, administered by OFSI (the Office of Financial Sanctions Implementation), applies to persons and entities in the United Kingdom and to UK persons wherever they are located. Post-2020, OFSI operates its own consolidated list and its own licensing framework, distinct from the EU. Businesses that previously treated UK and EU requirements as equivalent now manage two separate regimes with meaningful differences in list content, ownership thresholds, and licensing criteria.
The mapping exercise should answer four questions for each legal entity in your group. Which regimes apply as a matter of law? Which regimes apply as a matter of commercial reality (banking relationships, supplier agreements, customer locations)? Where do those regimes conflict or create compliance tension? And which regulators have enforcement capacity over your business? Document the answers. The mapping document is the foundation on which every later element of the programme is built.
In our experience, this mapping is the step most frequently abbreviated. Businesses assume their primary jurisdiction of incorporation defines their exposure. It does not. We regularly advise clients who discover, mid-transaction, that a second or third regime applies in ways they had not anticipated.
Step 2: Establish governance and assign accountability
A sanctions compliance programme requires a named owner at senior level and a clear governance line from that owner to the board. The regulatory expectation – consistent across OFAC, OFSI, and the EU – is that compliance is not a function that sits in a middle-office silo but one that has genuine authority to stop or modify transactions.
What does that mean in practice? It means the compliance function must have a direct escalation route that does not run through the commercial team whose deal is at risk. It means the board or audit committee receives a regular, substantive sanctions-risk report – not a green-light dashboard. And it means the programme has a written mandate that specifies who can approve exceptions, under what conditions, and at what seniority level.
For a group with entities in multiple jurisdictions, the governance question has an additional layer: where is the designated authority for each regime? The OFAC-facing function, the OFSI-facing function, and the EU-Council-facing function may sit in different legal entities. That is permissible, but the programme must document the coordination mechanism. Regulators reviewing an apparent failure expect to see that someone was responsible, that they had the tools and authority to act, and that the escalation path worked.
Accountability documentation – including appointment letters, terms of reference, and records of senior review meetings – should be retained for at least as long as the applicable record-keeping period. The specific periods differ by regime; verify the current position before relying on any single figure. What is common across regimes is that a gap in the governance record is treated as a gap in the programme itself.
Step 3: Build screening that covers the lists you are actually obliged to check
Screening is the most operationally visible part of any sanctions compliance programme, and it is the area where cross-border complexity is felt most acutely. A business that screens only against OFAC's SDN List (the Specially Designated Nationals and Blocked Persons list) and ignores the EU Consolidated List, the UK Consolidated List, the UN Security Council Consolidated List, and any applicable bilateral regime is materially under-screened.
The lists are not identical. Persons designated by the EU are not always simultaneously designated by OFAC, and vice versa. A counterparty that clears the SDN List may still be on the EU list, triggering a prohibition for your EU-nexus transactions. Post-Brexit, the UK list has diverged from the EU list in a number of designations. Screening tools must be calibrated to pull all applicable lists, not just the highest-profile one.
Beyond list-matching, effective screening requires an ownership and control analysis. Under OFAC, the 50 percent rule (the rule that treats any entity owned 50 percent or more in the aggregate by one or more blocked persons as itself blocked, even if not separately listed) means that a clear list result for the counterparty itself is not a clean bill of health if its ownership chain has not been checked. The EU and UK regimes use a combined ownership-and-control test that can capture entities where no single listed person holds a majority stake but where control is effectively exercised through other means.
Three common screening failures appear repeatedly across the businesses we advise. First, screening only the direct counterparty and not its beneficial owners or parent entities. Second, failing to re-screen at regular intervals after the initial onboarding check – lists change, and a counterparty that was clean at contract signing may be designated before settlement. Third, applying match thresholds that are set too loosely (generating unmanageable false-positive volumes) or too tightly (missing genuine partial-name matches). Calibration is an ongoing discipline, not a one-time configuration.
Step 4: Apply the correct ownership and control test for each regime
The ownership and control test is where the major regimes diverge most sharply, and where a single-regime programme fails most visibly when applied cross-border.
Under OFAC, the test is, at its core, mechanical: aggregate blocked-person ownership of 50 percent or more triggers blocked status, regardless of whether any single blocked person holds a majority. The test is ownership-focused; control, in the sense of operational influence, is separately relevant but does not substitute for the ownership calculation.
The EU and UK regimes go further. Both apply a combined test that captures entities that are owned or controlled by a designated person. Control, in the EU and UK context, can be established through means other than a majority share stake – through board representation, veto rights, contractual dependency, or the ability to direct the entity's activities in a material way. An entity where a listed person holds, say, 30 percent of the voting rights but effectively controls the board may be captured under the EU or UK test even though it clears the OFAC 50 percent threshold.
What does this mean for a cross-border business? It means that a transaction cleared under OFAC analysis may still be prohibited under EU or UK law. A programme that applies only the OFAC ownership test to all counterparties will miss that gap. The ownership and control analysis must be regime-specific – and where a business has nexus to both the US and EU or UK regimes, it must apply both tests to the same counterparty before proceeding.
In our practice, the control element of the EU and UK test is the one that generates the most difficult advisory questions. There is no bright-line percentage. The analysis requires a review of the counterparty's constitutional documents, shareholder agreements, and board composition – not just its share register. We regularly advise clients that the relevant question is not "who owns the shares?" but "who can determine the outcome?"
Step 5: Build the licensing and authorisation process into the programme
A well-designed compliance programme anticipates that some transactions will not be straightforwardly permissible – and has a documented process for what happens in those cases. That process is the licensing and authorisation pathway.
Each major regime has its own licensing architecture. OFAC issues general licences (standing authorisations that permit defined categories of transaction without a separate application) and specific licences (case-by-case authorisations for transactions that fall outside any general licence). OFSI operates a similar framework under UK law. The EU regime issues authorisations through competent authorities of the relevant member state. The criteria, the application routes, and the timelines differ materially across these regimes, and an applicant who applies to one authority expecting another's timeline will be managing stakeholder expectations incorrectly.
The licensing process should sit within the compliance programme as a defined workflow, not an ad hoc escalation. That workflow should specify: who identifies that a licence may be required; who prepares the application; what documentation standards apply; how long the process is expected to take under the applicable regime; and what interim controls apply during the period between application and decision. The interim controls matter. A business that continues a transaction on the assumption that a licence will be granted is taking a compliance position that is difficult to defend if the licence is refused or the transaction structure changes before authorisation is received.
The position above covers the standard licensing pathway. Your specific facts – the transaction type, the counterparty, the goods or services involved, and the regime in play – change the analysis significantly. If your business is assessing whether a transaction requires a licence, early legal advice before submission is materially more cost-effective than remediation after a refused application or an enforcement inquiry.
Contact Calder & Vance at info@caldervance.com to discuss a licensing question or to have your current authorisation process reviewed.
Step 6: Design the audit, testing, and incident-response architecture
A compliance programme that is not tested regularly is a document, not a control. The audit and testing element is the mechanism by which a business demonstrates – to itself and to regulators – that the programme operates as designed rather than merely as written.
Effective testing covers three levels. Transaction testing checks whether specific high-risk deals were processed through the correct screening and approval workflow and whether the records reflect that. Process testing examines whether the controls operate as described in the programme documentation – for instance, whether a screening alert actually triggers the escalation process the policy specifies. Programme-level review assesses whether the overall design remains fit for purpose given changes in the business, in the counterparty portfolio, and in the regulatory environment.
The frequency of each level of testing should be calibrated to the business's risk profile. A financial institution with high transaction volumes across multiple regimes requires more frequent and more granular testing than a manufacturer with a small, stable counterparty base. The key is that the calibration is documented and defensible – a regulator reviewing a post-breach programme expects to see a risk-based rationale for the testing frequency chosen, not a calendar-based cycle adopted without analysis.
Incident response – the procedure that activates when a potential violation is identified – is the complement to testing. The programme should specify: the trigger for activating the procedure; the immediate containment steps (such as blocking a payment or suspending a shipment); the internal escalation chain; the obligation to assess whether a report must be made to the relevant regulator; and the record-keeping requirements that apply from the moment the incident is identified. Voluntary self-disclosure (a VSD – the voluntary reporting of a potential violation to the regulator before the regulator identifies it) can carry significant weight in enforcement proceedings under OFAC, OFSI, and the EU framework. A programme that has a clear, practised VSD process is in a meaningfully better position than one that has to assemble a response under time pressure.
If a transaction has already been flagged, or an internal review has surfaced a potential violation, early legal review can preserve options that narrow as time passes. Contact Calder & Vance at info@caldervance.com for a confidential initial review.
Step 7: Train, update, and maintain the programme as regimes change
Sanctions regimes change at a pace that most compliance programmes are not built to absorb. New designations can appear with no advance notice. Amending regulations modify the scope of prohibitions. New general licences are issued; existing ones expire or are amended. A programme that reflects the regulatory position at the point it was designed, and has not been systematically updated, is a historical document – not a live control.
What does a maintenance regime look like in practice? It has three components. First, a regulatory-change monitoring function: someone in the business – or an external adviser – is responsible for tracking changes across all applicable regimes and assessing their impact on the programme. Second, a documented update process: when a change is identified, the programme documentation, screening configuration, and staff guidance are updated within a defined timeframe. Third, a training cycle: staff who interact with sanctions risk – which in a cross-border business extends well beyond the compliance team to procurement, sales, treasury, and logistics – receive regular, substantive training that reflects the current state of the regimes, not the position at the point of the last exercise.
Training is the element of the programme most frequently treated as a one-off obligation. A sanctions awareness course completed at onboarding and never refreshed does not constitute a functioning training programme. The standard that regulators expect – and that practitioners advising on OFAC, OFSI, and EU matters observe – is training that is role-specific, regularly updated, and tested for retention.
A common myth in this area is that a strong screening tool is a substitute for staff training. It is not. Screening tools flag names on lists; they do not assess context, interpret the scope of a prohibition, or identify red flags in transaction documentation that fall short of a list match. The human judgement that sits alongside the automated screen is only as good as the training that informs it. A business that has invested heavily in screening technology but underinvested in training is exposed on the dimension that enforcement investigations most commonly turn on: did the business know, or should it have known, that a transaction raised sanctions concerns?
Addressing a common misconception: one compliance programme is not enough
The most persistent misconception we encounter among cross-border businesses is that a single, consolidated compliance programme – typically an OFAC-centric one, given the perceived severity of US enforcement – is sufficient to manage exposure across all applicable regimes.
It is not. The OFAC ownership test and the EU/UK ownership-and-control test apply different criteria to the same counterparty. The list of prohibited persons differs across OFAC, the EU, and the UK. The licensing criteria and application routes are regime-specific. The reporting obligations differ. An OFAC-centric programme applied to EU-nexus transactions will systematically miss EU-specific prohibitions; and the reverse is equally true.
The practical answer is not to maintain entirely separate programmes for each regime – that creates coordination failures and version-control risk. The answer is a programme that has a common architecture and governance structure, but regime-specific modules that address the distinct requirements of each applicable authority. The common spine covers governance, training standards, incident-response procedure, and audit methodology. The regime-specific modules cover screening-list configuration, ownership-and-control analysis, licensing pathways, and reporting obligations for each applicable regime.
In our cross-border practice, the programme-design work most frequently involves helping a business that has outgrown its initial compliance structure. A business that began with a single primary market, and built its programme for that market, then expanded into EU, UK, or Asian counterparty relationships without updating the architecture, is operating with genuine regulatory risk. The update is not a ground-up rebuild; it is a structured extension of what already exists, mapped against the requirements of each newly applicable regime.
Related practices
- Sanctions compliance audit and testing (Australia) – assessing programme effectiveness against the Australian autonomous sanctions regime
- Designing a sanctions compliance programme under the EU regime – regime-specific guide for EU Council regulation obligations
- Designing a sanctions compliance programme for OFAC – US-focused guide covering the SDN List, the 50 percent rule, and OFAC licensing