How to test control where ownership sits below the threshold under OFSI

A trading house completes its standard name-screening checks before committing to a supply arrangement. The counterparty does not appear on the UK Consolidated List. The deal closes. Months later, a review surfaces a designated person who, through a chain of intermediate vehicles, exercises day-to-day authority over the counterparty's board and treasury. The question then is not whether the name was missed – it was not on the list – but whether control was established without a direct ownership stake large enough to trigger the bright-line test. That distinction, under OFSI, can be the difference between a clean transaction and a strict-liability breach.

The UK financial-sanctions regime, administered by OFSI under the Sanctions and Anti-Money Laundering Act and the relevant thematic regulations, catches non-listed entities not only through the ownership test (holding of 50 percent or more of shares or voting rights) but also through a separate control test that looks at actual authority over a company's decisions. As of January 2026, that control analysis is the more demanding part of due diligence for most cross-border B2B businesses, because it requires going beyond what a name-screening tool can show.

This guide sets out what you need to establish before you start the control analysis, then walks through the control-beyond-bright-line ownership test under OFSI step by step, closes with the key risk flags, and explains when to involve a sanctions lawyer.

What you need before you start the control analysis

The control-beyond-bright-line ownership test under OFSI begins not with a search but with assembling four categories of information; without them the analysis cannot run reliably. First, you need the full legal ownership structure of the counterparty – not only the ultimate beneficial owner but every intermediate vehicle through which shares or voting rights are held. Second, you need the governance documents: articles of association, shareholder agreements, board composition records, and any investment agreements that carry veto rights or reserved-matter provisions. Third, you need the operational picture: who in practice appoints and removes the chief executive and the finance director, who approves major transactions, and who controls the treasury and bank-account signatories. Fourth, you need the designation data for any person or entity that appears in that structure.

In our experience, the third category – the operational picture – is the one most frequently missing at the point when a matter is escalated to us. Companies often hold corporate-registry filings but have not asked the counterparty for its actual management arrangements. That gap is precisely where a control analysis under OFSI will fail, because the regulator looks at actual, not theoretical, authority.

A practical readiness check before you begin: do you hold the current beneficial ownership register, the full text of any shareholders' agreement, and a confirmed list of board members and their appointers? If the answer to any of these is no, the analysis cannot safely proceed.

Step 1 – Map the ownership chain and identify any designated persons in it

The first step is to establish who holds shares or voting rights in the counterparty at each layer of the structure, and to run every person and entity in that map against the UK Consolidated List, the OFAC SDN List (OFAC's list of Specially Designated Nationals and blocked persons), and the EU consolidated list. Even at the ownership-mapping stage, the cross-regime comparison matters: a person who is designated under OFAC but not yet listed by OFSI may still influence the control analysis where the transaction has a US-person nexus or where secondary-sanctions risk is live.

Record the percentage holding at each layer and the aggregate across layers. Where the aggregate reaches 50 percent or more, the ownership test is met and the entity is itself treated as subject to the asset-freeze regardless of whether it appears on a list. This is the OFSI position, consistent with the UK ownership-and-control test under SAMLA and the relevant thematic regulations. Do not stop there, however. An aggregate holding just below fifty percent – forty-eight percent, for instance – is not a safe harbour. It is the starting point for step 2.

Under EU rules, the ownership criterion for asset-freeze purposes also refers to more than fifty percent; the structure of the test is comparable. Under OFAC the fifty percent rule is the operational limit: below the line, the entity is not itself blocked as a matter of OFAC guidance, though other prohibitions (facilitation, dealing in the property of a designated person) may still apply depending on the facts. The divergence between regimes at the sub-threshold ownership level is where the control analysis becomes practically critical for a business with exposure to more than one jurisdiction.

Step 2 – Apply the control test: what OFSI actually examines

Where aggregate ownership by designated persons falls below the fifty-percent threshold, the UK regime requires you to ask whether a designated person nonetheless controls the counterparty. OFSI's published guidance on ownership and control – rooted in SAMLA and the relevant thematic regulations – makes clear that control is assessed by reference to actual authority over the entity's decisions, not by reference to the formal ownership share alone.

The test looks at several indicators. Does a designated person have the right to appoint or remove a majority of the board? Can they veto significant decisions through a shareholders' agreement, even without holding a majority of shares? Do they control the entity through a contract or other arrangement – a management agreement, for example, or a debt instrument with governance covenants? Is there evidence of informal but consistent direction: phone calls, written instructions, or documented operational reliance that bypasses the formal board process?

UK case law, as it has developed, distinguishes existing influence from a hypothetical ability to exert control. The leading authorities hold that control must be actual, not theoretical. That distinction is significant in practice: a minority investor who has a legal right to nominate one board observer but who has never exercised operational direction is not, on current authority, a controlling person. Conversely, a forty-nine percent shareholder who routinely instructs management on pricing, contracts, and cash movements may well be. The analysis is fact-intensive and does not resolve by reference to the ownership percentage alone.

Compare the position under EU law: an EU court ruling has held that control must be proved by objective and sufficiently weighty evidence, and that the character of a state's political system is not by itself sufficient proof that its leadership controls a given company. That is consistent with the UK principle that control must be actual. The US position, by contrast, stops at the bright-line ownership figure for the purpose of its fifty-percent rule; the control concept operates separately through the facilitation prohibition and through case-by-case licensing analysis. A business subject to both UK and US obligations should note that passing the US ownership screen does not resolve the UK control question.

Step 3 – Examine governance documents for reserved matters and veto rights

The governance documents gathered in the preparation stage now do the work. A shareholders' agreement that gives a minority holder the power to block an annual budget, approve a major acquisition, or remove the chief executive is a control indicator regardless of what the share register says. Reserved-matter provisions and investor-consent rights are standard in private-equity and joint-venture structures; they were designed for commercial protection but they can, where the minority holder is a designated person, bring the entity within OFSI's control test.

Work through the document in terms of the specific decisions it covers. Decisions about the entity's finances, banking relationships, and the appointment of senior management are the highest-weight indicators. Decisions about operational matters – product lines, marketing, day-to-day staffing – carry less weight in the control analysis, though they remain relevant context. Note whether the designated person's consent is required merely to protect their investment on a standard minority-investor basis, or whether the right extends to directing the entity's strategic and financial course. That is not always an easy distinction, and in our experience it is the question that most often requires a formal legal opinion before a transaction can proceed.

Loan agreements and debt instruments also require scrutiny. A lender who holds a significant debt with cross-default and governance covenants – the right to appoint a financial controller on a payment default, for example – may acquire control in an economic-stress scenario. The compliance question is whether that latent control right is itself sufficient to bring the entity within OFSI's test, or whether it requires activation. OFSI guidance does not draw a bright line here; the assessment is one of reasonable judgment applied to the specific facts.

Step 4 – Test for indirect and informal control arrangements

The formal documents do not exhaust the control inquiry. OFSI's approach, and the broader UK sanctions regime's design, is to look at the economic and practical reality of a transaction. That means informal arrangements – oral instructions, unwritten understandings, habitual deference to a principal's wishes – are within scope if the evidence supports them.

How do you surface indirect control where it has not been formally documented? The practical indicators include: a pattern of board minutes that record no deliberation but only unanimous approval of proposals submitted by a particular shareholder; banking arrangements in which a third party has signing authority over the counterparty's accounts; contract terms negotiated and signed by a person with no apparent formal authority; and supplier or customer relationships managed entirely through a controlling individual rather than through the counterparty's own management. None of these is conclusive in isolation. Together, they can establish the operational reality that OFSI's control test requires.

A diligence questionnaire directed at the counterparty and its management – covering decision-making processes, bank-account authority, and the origin of key contracts – is one practical tool. Enhanced due diligence interviews are another. Where the facts are ambiguous, the right course is to document the analysis fully and, where material risk remains, to seek a formal legal opinion before proceeding. There is no screening tool that can substitute for this exercise.

Step 5 – Record the analysis and establish the position before the transaction completes

The control-beyond-bright-line ownership test under OFSI is not a one-time check; it is a documented legal opinion on the facts as known at a given date. Record the ownership structure, the governance documents reviewed, the control indicators examined, and the conclusion reached. Where the conclusion is that no designated person controls the entity, state the evidential basis. Where the conclusion is uncertain, record the residual risk and the steps taken to manage it.

Timing matters. OFSI's strict-liability penalty regime – which can impose a monetary penalty up to the greater of £1,000,000 or 50 percent of the breach value (as currently in force, verify before reliance) – means that completing a transaction on an inadequate analysis, and later discovering a control relationship, leaves the business exposed without a knowledge or intent defence. The analysis must be done before the transaction closes, not after. Where facts change – a change of shareholder, a restructured loan, a new management agreement – the analysis must be refreshed.

Businesses with a pattern of transactions involving entities in complex ownership structures should embed the control-analysis checklist in their standard due-diligence process, not treat it as an exceptional step. Sanctions screening obligations attach on a risk basis, and "we screened the name" is not, by itself, a complete control for OFSI purposes. How to handle control beyond the bright-line ownership test under OFSI as a routine matter – not a crisis response – is the standard that OFSI's enforcement posture now effectively requires.

Risk flags: when to involve a sanctions lawyer before you proceed

Several fact patterns consistently indicate that the control analysis should be escalated to a sanctions lawyer rather than resolved in-house. The most common is a counterparty in a jurisdiction with significant ownership-transparency limitations, where the beneficial-ownership data cannot be independently verified. A second is a structure in which a minority designated shareholder holds a blocking right over any decision that materially affects the counterparty's finances. A third is a management agreement or service contract between the counterparty and an entity that is itself subject to ownership or control analysis.

A fourth risk flag – one that we see with increasing frequency in cross-border transactions – is where the ownership position is below the threshold but has moved in the recent past: a designated person sold down from fifty-three percent to forty-seven percent. That history is relevant to the control analysis and to the question of whether the reduction was a genuine commercial transaction or a restructuring designed to avoid the automatic consequences of the ownership test. We do not assist with structures designed to evade sanctions obligations; we do assist businesses in understanding whether a genuine historical transaction has left a residual control issue that requires resolution.

A fifth flag arises in multi-regime transactions. Where a business is subject to both OFSI and OFAC obligations, the two analyses run in parallel. A structure that passes the OFAC ownership screen may fail the OFSI control test, and vice versa. The interaction with EU obligations – including the EU Blocking Regulation, which can prohibit EU operators from complying with specified third-country measures – adds a further dimension for businesses with an EU-member-state component. Getting cross-regime clarity before the deal closes is significantly less costly than managing a post-completion enforcement enquiry.

There is a myth worth addressing directly: that name-screening alone is enough to meet the rules under OFSI. It is not. Screening catches listed persons. The control-beyond-bright-line ownership test under OFSI is designed precisely to catch unlisted entities that a designated person controls. A firm that relies only on its screening system and does not run the control analysis on sub-threshold structures has a gap in its sanctions-compliance programme – one that, in our practice, we regularly identify during compliance reviews and that OFSI's strict-liability regime means cannot be cured after the fact by pointing to a clean screen.

The point at which to involve a sanctions lawyer is not when a breach has occurred. It is when the ownership analysis raises a sub-threshold result in a structure with any of the flags above, when governance documents contain ambiguous control provisions, or when the counterparty is in a jurisdiction where independent verification of the beneficial-ownership data is limited. We regularly advise clients at that earlier stage – before the transaction, not after the notice.

Related practices

• Affiliate-level restrictions under BIS and the EAR – US export-control obligations for entities owned or controlled by listed parties.
• Foreign financial institution exposure under OFAC – assessing and managing FFI risk under the US sanctions regime.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.