A logistics business operating between the EU and a third market signs a service agreement with a counterparty whose ultimate beneficial owner appears, three weeks later, on the EU Consolidated List. The transaction is now frozen. The question is not whether the business knew – it is whether the programme it had in place was adequate to catch this before signature. Under the EU sanctions regime, adequacy is judged against what the business should have done, not only what it did.
EU sanctions compliance programmes must be designed to address the specific prohibitions set by Council regulations, the ownership and control tests applied by Member State competent authorities, and the screening requirements that flow from those rules. As of July 2026, EU sanctions law does not prescribe a single compliance-programme standard in the way a consolidated code might, but competent authorities assess adequacy against a de facto five-element model – risk assessment, policies and procedures, screening and monitoring, training, and audit. A programme that cannot demonstrate all five elements creates enforcement exposure under the relevant Council regulation and, in several Member States, under national criminal law.
This guide walks through each phase of building or testing an EU-standard sanctions compliance programme, addresses the points where the EU regime diverges from the OFAC and OFSI positions, and identifies the risk flags that most frequently trigger competent-authority scrutiny.
Step 1: Understanding the governing authority and legal basis for EU sanctions
EU sanctions derive their force from Council regulations adopted under the Treaty on the Functioning of the European Union, binding directly across all Member States without national transposition. Each programme – thematic or geographic – is enacted by a separate Council regulation and an accompanying Council Decision. The practical implication is that a business operating in multiple EU Member States is subject to the same prohibitions, but enforcement, licensing, and penalty decisions are taken at national level by designated competent authorities.
This split structure is the first complexity that any compliance programme must address. The Council sets the rules. National competent authorities – financial intelligence units, ministries of finance, or dedicated export-control bodies, depending on the Member State – enforce them. Penalty regimes differ materially between Member States. A payment firm licensed in one Member State but clearing transactions that touch another may face parallel scrutiny from two competent authorities applying different penalty frameworks. In our experience, programmes that treat EU sanctions as a single unified enforcement environment underestimate this risk significantly.
The EU General Court provides the primary judicial-review route for designation challenges. Understanding that route – and its procedural preconditions – is relevant not only to listed persons but to any business seeking to understand the durability of a designation against a key counterparty. A well-designed programme notes which designations are subject to live challenge and adjusts its transaction-screening logic accordingly.
The position above covers the standard architecture. Your facts – the Member States in which you operate, the sector, the goods or services, the counterparty network – change where the risk is concentrated.
For a confidential assessment of your exposure under the EU regime, contact Calder & Vance at info@caldervance.com.
Step 2: Conducting the sanctions risk assessment
A sanctions risk assessment identifies where, in a business's operations, the EU sanctions prohibitions are most likely to be triggered, and allocates the programme's controls accordingly. It is the foundation on which every other element of the programme rests. Without it, policies and procedures address generic risk rather than the business's actual exposure profile.
The assessment must cover four dimensions. First, customer and counterparty risk: who the business deals with, where they are incorporated, who ultimately owns or controls them. Second, product and service risk: what the business provides, whether it falls within a sectoral restriction, and whether any component or technical data could be captured by a dual-use or sector-specific measure. Third, geographic risk: which countries, territories, or regions the business's transactions touch, including transit, intermediary, and financing points. Fourth, channel risk: how transactions are executed – correspondent banking chains, trading platforms, freight routes, or digital-asset transfer protocols each carry different screening and monitoring obligations.
The EU ownership and control test is broader than the OFAC 50 percent rule. Under the EU regime, a non-listed entity can be caught not only where a listed person holds 50 percent or more of the ownership interests but also where a listed person exercises control through other means – board appointment rights, veto powers, contractual dominance. A risk assessment that maps only direct shareholding will miss a significant category of EU-law exposure. We regularly advise businesses that have screened clean at the entity level but failed to map control structures behind the registered ownership.
Document the assessment. Competent authorities expect to see a record that the analysis was done, by whom, on what basis, and when. An undocumented risk assessment is, from an enforcement perspective, effectively no assessment at all.
Step 3: Designing policies, procedures, and the ownership and control test
Policies translate the risk assessment into operational instructions: what must be checked, by whom, at what point in a transaction lifecycle, and what happens when a check returns a positive or potential match. Procedures are the step-by-step implementation of those instructions. The gap between the two – a policy that says "screen all counterparties" but no procedure specifying which list, at what frequency, and with what escalation path – is where enforcement cases are made.
The EU ownership and control test must be embedded at the procedure level. Where a counterparty is held through a corporate structure, the procedure must specify how far up and across the ownership chain the business will look, what sources it will consult, and how it will document a conclusion that no listed person owns or controls the entity. In our cross-border practice, we see the most frequent gaps at the second and third level of indirect ownership, where public registry data is incomplete and manual verification is required.
Policies must also address the interaction between EU sanctions and other regimes to which the business is subject. The EU Blocking Regulation creates an additional layer: it restricts compliance with certain listed third-country sanctions by EU-incorporated entities and persons, creating a direct conflict for businesses that are simultaneously subject to EU law and the listed third-country measures. Any procedure that does not acknowledge this conflict and contain a documented escalation path is inadequate.
How granular should procedures be? Granular enough that a new member of the compliance team can execute them correctly on day one, without calling a supervisor. That is a practical test, not a theoretical one.
How does the EU ownership and control test differ from OFAC and OFSI?
The EU ownership and control test diverges from both the OFAC 50 percent rule and the OFSI ownership-or-control test in ways that matter operationally for any cross-border business. Understanding the divergence is not an academic exercise – it directly affects which transactions require further diligence and which screening alerts require escalation.
OFAC's test, set under IEEPA, is mechanical: a non-listed entity is treated as blocked where blocked persons own 50 percent or more in the aggregate, directly or indirectly. The control dimension is not part of OFAC's standard ownership rule (though OFAC retains the ability to designate a controlled entity separately). OFSI, under the Sanctions and Anti-Money Laundering Act, applies an ownership or control test that captures entities owned or controlled by a designated person, but the control limb is assessed differently from the EU position. OFSI guidance addresses control through governance rights and contractual arrangements, but the analytical starting point and the sources of authority differ from the Council regulation position.
Under the EU regime, the relevant Council regulations define ownership and control in ways that can capture minority stakes where additional control features are present. A listed person holding thirty-five percent of a target but appointing a majority of its board may trigger the EU control test while sitting below the OFAC ownership threshold and arguably below the OFSI threshold, depending on the facts. A compliance programme that applies a single ownership screen across all three regimes will produce false negatives on EU matters.
The practical consequence for programme design is that the EU diligence procedure must run a two-stage check: ownership first, then control. The control check must be documented separately and must address governance rights, not only registered shareholding. Where the business is subject to both EU and OFAC obligations – as most multinationals are – the programme should specify which test applies to which entity and flag where the analyses diverge.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential assessment.
Step 4: Screening, monitoring, and transaction controls
Screening is the operational core of an EU sanctions compliance programme. It encompasses list-based name screening against the EU Consolidated List and the lists maintained by individual Member State competent authorities, transaction-monitoring for behavioural patterns consistent with sanctions circumvention, and periodic re-screening of the existing customer and supplier base as lists are updated.
The EU Consolidated List is maintained and updated by the European External Action Service. Updates can occur with no advance notice, and the obligation to freeze assets arises at the moment of designation, not at the moment of screening. A business that screens only at onboarding and not at regular intervals throughout a relationship is exposed to the gap between its last screen and the designation date. In our experience, the interval between scheduled screens is the single most common gap identified in compliance audits of mid-sized businesses.
Screening technology must be calibrated. A system set to require an exact name match will miss transliteration variants, aliases, and corporate-name changes – all of which are common in the EU Consolidated List entries. A system with an overly permissive fuzzy-match threshold generates alert volumes that paralyse the compliance function. The calibration decision should be documented, with the business's rationale for the threshold chosen. Competent authorities have, in enforcement proceedings, examined screening-tool calibration records as part of assessing programme adequacy.
Transaction monitoring goes beyond name screening. It looks for patterns: payments routed through multiple intermediaries in a way that obscures the ultimate beneficiary; shipments to third countries with historically high re-export rates to sanctioned destinations; payments in currencies inconsistent with the stated commercial relationship. The monitoring rules must be designed against the business's specific risk profile, as identified in the risk assessment. Generic transaction-monitoring rules are rarely adequate for a business with concentrated exposure to a particular geographic corridor or sector.
Record-keeping obligations apply throughout. The relevant Council regulations require businesses to retain records of transactions and screening decisions for a defined period. Ensure that screening logs, match-disposition records, and escalation decisions are preserved in a retrievable format for the duration required by the applicable instrument.
Step 5: Training, governance, and audit – the elements that determine adequacy under competent-authority scrutiny
Training, governance, and internal audit are the elements that most frequently separate a programme that survives enforcement scrutiny from one that does not. A well-documented risk assessment and a robust screening tool are necessary but not sufficient: competent authorities will ask who was responsible, what they knew, and whether the organisation tested whether its controls were working.
Training must be role-differentiated. The front-office relationship manager who first onboards a counterparty needs different training from the treasury officer approving a payment, the logistics manager booking a freight leg, or the legal counsel reviewing an acquisition target. Generic annual sanctions training satisfies a documentation tick-box. It does not produce the operational awareness that prevents a breach at the point of transaction.
Governance requires a clear ownership structure: who owns the sanctions compliance programme, who reports to the board, and what the escalation path is when a potential match cannot be resolved at desk level. Several Member State enforcement decisions have cited the absence of a clear governance structure – no named owner, no board-level reporting, no escalation path – as an aggravating factor. The programme should designate a senior responsible officer and document that the board has received and understood a regular compliance report.
Internal audit of the sanctions programme should be independent of the first-line compliance function. It should test whether procedures are being followed, whether screening is calibrated correctly, whether training has been completed, and whether escalation decisions are documented. The audit cycle should be risk-based: more frequent for high-risk business lines and less frequent for lower-risk ones. The output – findings, remediation actions, and closure evidence – must be documented and retained.
When does the programme need external review? When the business enters a new market, acquires a new entity, launches a product in a new sector, or faces a material change in the designations relevant to its counterparty base. We regularly advise businesses on programme reviews triggered by acquisition due diligence, and the most common finding is that the acquired entity's programme was designed for a simpler risk profile than the combined group will carry post-closing.
Risk flags and when to involve counsel
Certain patterns in a business's operations should prompt an immediate escalation to legal counsel rather than desk-level resolution. Identifying these flags in advance – and building the escalation instruction into the programme's procedures – is as important as the controls themselves.
A screening match that cannot be resolved by reference to available public information requires counsel. Apparent-match resolution that relies on the compliance team's own judgment, rather than a documented analysis against the applicable ownership and control test, creates residual enforcement exposure even if the conclusion is ultimately correct. The decision-trail matters as much as the decision.
A transaction that has already been partially executed when a counterparty appears on the EU Consolidated List is a critical escalation point. The obligation to freeze arises immediately, but the steps required to unwind a partially executed transaction, report the frozen assets, and engage with the competent authority on next steps are procedurally specific. Missing the reporting window – which is set by the relevant Council regulation and may be short – can independently constitute a breach. Have you mapped what your business would actually do in the first twenty-four hours after a live designation of a counterparty?
A voluntary self-disclosure – a VSD (a proactive notification to the competent authority of an apparent violation) – is a potentially significant mitigating factor in enforcement proceedings across most EU Member States, but the timing, content, and scope of the disclosure affect how it is received. Counsel should be involved before a VSD is submitted, not after.
The myth worth correcting here is that EU sanctions compliance is primarily a large-bank problem. Competent-authority enforcement records across Member States show that mid-sized trading companies, specialist payment firms, and logistics businesses account for a material share of enforcement proceedings. The exposure is not proportional to size; it is proportional to the degree of engagement with counterparties and markets in which listed persons operate.
Related practices
- Compliance audit and testing – Australia – independent audit of sanctions programme controls against Australian regime standards
- Sanctions compliance programme design – OFAC guide – step-by-step guide to building an OFAC-standard compliance programme
- Sanctions compliance programme design – OFAC advanced guide – advanced OFAC compliance programme considerations for complex cross-border structures