Corporate liability and attribution across regimes: a compliance guide

A multinational receives a letter from a regulator. The subject line references a transaction completed eighteen months ago by a subsidiary in another jurisdiction. The subsidiary has since been wound up. Back at group headquarters, the general counsel's first question is not about the subsidiary – it is about the parent company itself. Could group-level decisions, systems, or approvals expose the corporate as a whole? That question is exactly what this guide addresses.

Corporate liability for sanctions and export-control violations does not stop at the legal entity that executed the transaction. Across the major regimes – OFAC, OFSI, the EU Council regulations, and BIS – regulators attribute conduct upward through corporate groups, outward across affiliates, and downward through subsidiaries. Understanding how attribution works under each regime, where the tests diverge, and what a cross-border compliance programme must do to manage that exposure is the substance of this guide.

The steps below take a compliance officer or general counsel from the initial liability question through to the decisions that protect the corporate position before and during a regulatory inquiry.

Step 1: Establish which regimes apply to the corporate group

The first step in any cross-border corporate liability analysis is to map which regimes have jurisdiction over the group and on what legal basis. A group that believes it operates outside the United States may still be within OFAC's reach if any entity in the chain is a US person, if any transaction routes through a US financial institution, or if the conduct facilitates a transaction that a US person is prohibited from executing directly.

The concept of facilitation is worth pausing on. Regulators describe a facilitation prohibition (the rule that a US person may not approve, finance, guarantee, or otherwise facilitate a transaction that would be prohibited if the US person conducted it directly) as one of the most frequently misunderstood liability vectors for non-US subsidiaries of US parents. In our experience, a headquarters-level approval workflow – even a routine one – can constitute facilitation where the approved transaction would have been prohibited had a US-person entity executed it.

OFSI and the EU impose liability on persons subject to their jurisdiction, which includes entities incorporated in the UK or an EU member state and, in some circumstances, conduct that occurs within those territories. A group with operating companies in multiple jurisdictions therefore faces overlapping but not identical liability perimeters. The critical first-step output is a jurisdiction map: for each entity in the group, which regime applies, on what basis, and which transactions are in scope.

As of January 2026, the EU has also deployed an anti-circumvention instrument that can extend measures to operators in third countries. This makes the assumption that a non-EU entity is automatically outside the EU regime increasingly unreliable. The jurisdiction map must be reviewed each time the group's structure or a relevant regime changes.

Step 2: Understand the attribution tests in each regime

Attribution – the legal mechanism by which a regulator fixes liability on a corporate entity for conduct it did not itself execute – varies materially between regimes, and the differences are consequential for a cross-border group.

Under OFAC, the civil-penalty regime is one of strict liability. Knowledge and intent are irrelevant to whether a violation occurred; they are relevant only to penalty calculation and to the distinction between egregious and non-egregious cases. OFAC attributes conduct through the corporate structure using agency principles: where a subsidiary or employee acts within the scope of their authority, that conduct is attributed to the principal entity. The result is that a parent company that establishes a compliance system, approves a transaction type, or operates shared-services functions for a subsidiary that later violates a prohibition can find itself in the penalty calculation.

OFSI operates on a strict-liability basis as well. The £1,000,000 maximum penalty – or 50 percent of the breach value, whichever is greater – applies without proof of knowledge, as currently in force, verify before reliance. Attribution under UK law follows company-law and agency principles. The compliance significance is that acts of directors and senior managers are routinely attributed to the corporate body, and a holding company that directs or controls the affairs of a subsidiary can be held responsible for that subsidiary's violations.

Under EU Council regulations, the prohibition extends to making funds or economic resources available directly or indirectly to or for the benefit of listed persons. This framing means that liability does not require the corporate entity to be the transacting party. A corporate that provides operational support, treasury facilities, or shared infrastructure to an entity that uses those resources for a prohibited purpose can itself be within scope. EU enforcement practice has developed at the member-state level, which means the attribution standard can differ between France, Germany, the Netherlands, and others, even though the underlying regulation is directly applicable across all.

BIS applies its own attribution logic in the export-control context: a deemed export (the release of controlled technology to a foreign person inside the United States) can create liability for the company in whose facilities the release occurs, regardless of whether that company was the intended exporter. A corporate group with shared R&D facilities, secondment programmes, or common IT infrastructure must map deemed-export exposure as part of its attribution analysis.

The practical upshot for a cross-border group: there is no single attribution test. Where two or more regimes both apply, the stricter prohibition governs the conduct of a person subject to both. A group that anchors its attribution analysis in only one regime's standard will have blind spots in every other.

Step 3: Map the corporate structure against the ownership and control tests

Attribution risk is amplified by the 50 percent rule (OFAC's rule treating entities owned 50 percent or more in the aggregate by one or more blocked persons as themselves blocked) and its analogues under OFSI and the EU. The step of mapping the corporate structure is separate from the jurisdiction map completed in Step 1: here the question is whether any entity in the group is itself treated as a designated or blocked party by operation of law, without a formal listing.

Under OFAC, the test is mechanical. Aggregate direct and indirect ownership by one or more blocked persons that reaches 50 percent or more triggers the rule. Intent is irrelevant; the structure at the time of the transaction is what matters. A corporate group that acquires a target, or that accepts a new investor, must assess whether the post-transaction ownership chain crosses that threshold for any entity.

OFSI and the EU both apply an ownership and control test (the test for whether a non-listed entity is caught through a listed person's ownership or control of it). Under UK law, control goes beyond a mechanical percentage: case law has established that control must be actual rather than merely theoretical, and that an existing ability to direct must be demonstrated. The EU control test looks at more than 50 percent ownership, but also at whether a listed person can determine the behaviour of a corporate entity through other means.

What this means operationally is that a group may face one conclusion under the OFAC ownership test and a different conclusion under the EU or OFSI control test for the same structure. We regularly advise clients who have correctly identified that a target clears the OFAC 50 percent threshold but have not worked through whether a listed shareholder's governance rights would satisfy the EU or OFSI control analysis. The two analyses must be run side by side.

Step 4: Assess where the compliance programme has attribution gaps

Once the applicable regimes and attribution tests are understood, the next step is a structured assessment of the group's compliance programme against each. The question is not whether a programme exists, but whether it would be recognised as a genuine mitigating factor by each relevant regulator.

OFAC's Enforcement Guidelines set out the factors that bear on penalty calculation, including voluntary self-disclosure and the existence of an effective compliance programme. Sanctions screening obligations attach on a risk basis; a name match at the point of onboarding is not by itself a complete control. A group that screens at entry but does not monitor post-onboarding ownership changes, does not apply the facilitation prohibition to its approval workflows, and does not train non-US subsidiaries on the extraterritorial reach of the regime has a programme with structural gaps.

OFSI expects relevant firms to report knowledge or suspicion of designated persons, as currently in force. That obligation runs alongside any voluntary disclosure consideration. A group's compliance programme must identify which legal entities within it are "relevant firms" for OFSI purposes and ensure those entities have a reporting pathway that functions independently of the group's centralised compliance team.

In our cross-border practice, the attribution gaps we find most frequently are: approval authorities that grant sign-off on transaction types without a sanctions screen at the approval stage; shared-services arrangements where the entity providing the service is subject to a more restrictive regime than the entity receiving it; and M&A integration periods during which a newly acquired entity continues to operate under its prior programme while the group's controls are in the process of being extended.

The EU's approach to compliance as a mitigating factor is administered at the member-state level. This means the weight a genuine compliance programme carries in a French investigation may differ from the weight it carries in a German or Dutch one. A group with EU entities should seek advice on the enforcement posture of the specific member state where exposure has arisen, rather than relying on a single EU-level assessment.

Step 5: Decide on voluntary disclosure – the question regulators most want answered

If the assessment in Steps 1 to 4 identifies what may be an apparent violation, the group faces one of the most consequential decisions in sanctions enforcement: whether to make a voluntary self-disclosure (VSD – a proactive report to the relevant regulator, disclosing an apparent violation before the regulator independently identifies it).

The myth that staying silent is safer than disclosing is precisely that – a myth. In practice, across OFAC, OFSI, and the major EU member-state enforcement authorities, voluntary disclosure is a recognised mitigating factor. OFAC's Enforcement Guidelines explicitly distinguish between voluntary and non-voluntary disclosures in the penalty calculus, and the consequence of a regulator discovering a violation independently – without a prior VSD – is a materially less favourable starting position.

The decision is not simply whether to disclose but how, when, and to which regulator. A cross-border group that has a potential violation touching the US and UK regimes simultaneously must consider whether disclosures are made independently to OFAC and OFSI, or whether there is a sequencing advantage in one disclosure over the other. The facts relevant to each regulator's assessment are not identical, and the disclosure package prepared for one should not be submitted verbatim to another.

A VSD to OFAC is subject to a strict record-keeping backdrop: sanctions records must be kept for five years, as currently in force. The disclosure package should draw on records that have been preserved from the date the issue was identified. A group that has not preserved relevant documentation from the moment the issue was flagged internally has a weaker disclosure position than one that has. That is why disclosure strategy cannot wait until the group has completed its full internal investigation.

Timing matters in a second sense: a regulator that receives a VSD before it has begun an investigation of the same conduct will treat the disclosure as voluntary. Where the regulator has already signalled awareness of the issue, the voluntariness of the disclosure is potentially lost. Acting early – and taking legal advice before the first communication with the regulator – preserves options that narrow with time.

Step 6: Prepare the enforcement response and manage the ongoing exposure

Whether or not a VSD is made, a group under regulatory inquiry must manage the live exposure and prepare its enforcement response. The steps here are distinct from the internal investigation steps, though they run in parallel.

The first task is to stop any ongoing conduct that may extend the period of violation. An apparent violation that is continuing at the point of regulatory engagement is materially worse in terms of penalty exposure than a historical breach. A group that identifies through its Step 4 assessment that a transaction type is ongoing must obtain legal advice on whether to halt it immediately or whether a licence application is the appropriate route.

The second task is to establish the perimeter of the apparent violation accurately. Regulators assess penalties per violation, and the number of transactions within the violation period is directly relevant. An under-inclusive internal review that produces a narrow number of transactions is a significant risk: if the regulator subsequently identifies transactions the group missed, the credibility of the entire disclosure is damaged.

The third task is to address the root cause. OFAC's Enforcement Guidelines place weight on the existence of a genuine compliance programme and on remediation. A group that presents a regulator with a credible root-cause analysis and a concrete remediation plan is better positioned in penalty negotiations than one that presents only the historical facts.

Cross-regime coordination is essential at this stage. A group addressing a US enforcement matter may simultaneously face an OFSI inquiry, an EU member-state investigation, or a BIS enforcement referral. Privilege considerations, document-production obligations, and the sequencing of communications with each authority must be managed carefully. What is produced to one regulator can, in some circumstances, reach another. Taking cross-border legal advice from the outset – rather than managing each regulatory relationship in isolation – is a practical necessity, not a counsel of caution.

We have acted for multinationals and financial institutions working through exactly this pattern: an apparent violation identified internally, disclosed in a coordinated way across jurisdictions, and managed through to resolution. The path is more manageable when it is planned, not reactive.

Risk flags that signal the position is more serious than it appears

Not every compliance issue carries the same enforcement risk. Several factors, across all major regimes, indicate that a matter requires immediate external legal advice rather than an internal compliance-team response.

The first is any indication that the conduct was not a process failure but a deliberate decision. Where internal communications disclose that a sanctions issue was identified and set aside rather than resolved, the position moves from a strict-liability civil matter toward potential criminal referral. The criminal exposure exists in parallel with the civil regime under IEEPA, and BIS coordinates with the Department of Justice on export-control criminal matters.

The second is involvement of a financial institution. Where a bank, payment firm, or virtual-asset business is the entity with the apparent violation, the regulatory stakes are higher. US authority allows measures against foreign financial institutions that conduct or facilitate significant transactions for designated persons. Correspondent-account restrictions are a principal consequence. An institution facing that risk needs specialist advice, not a generalised compliance review.

The third is an EU criminalisation dimension. EU rules on the criminalisation of sanctions violations set minimum penalties at the member-state level, including terms of imprisonment and corporate fines expressed as a proportion of worldwide turnover for serious offences, as currently in force. A group with EU entities must assess whether the conduct is criminal under the applicable member-state transposition, not merely civil.

The fourth is the anti-circumvention concern. A group that routed transactions through a third-country entity, used a transit jurisdiction, or structured arrangements in a way that changed the trade-flow pattern should expect the regulator to look at that conduct carefully. A sharp change in trade flows to a neighbouring or transit jurisdiction is treated as a diversion red flag. Regulators document this pattern; transit through a third country does not change an item's controlled status, and origin and end-use analysis follows the item, not the route.

Finally, where the group has not preserved records from the point the issue was identified – or where records have been destroyed in the ordinary course after the issue arose – the forensic position is significantly more difficult. Sanctions records must be kept for five years under the US regime; comparable obligations apply under OFSI and EU rules. A gap in the record after a known compliance event creates an inference problem that no disclosure narrative can fully repair.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.