A European bank providing correspondent services to a respondent in a third market receives an internal alert: the respondent's ownership chain includes a shareholder whose name is close to one on the EU's consolidated sanctions list. The compliance team escalates. The relationship manager wants to preserve revenues. Legal asks whether a formal de-risking decision triggers any notification obligation. Within days, three separate functions are pulling in different directions – and none of them is certain what the applicable EU rules actually require.
Correspondent-banking de-risking (the termination or restriction of a correspondent account to reduce exposure to sanctions or financial-crime risk) is not directly prohibited under EU law, but it intersects with the EU's ownership-and-control test for sanctions exposure, the relevant Council regulations, and the anti-money-laundering rules that sit alongside them. As of January 2026, EU sanctions apply the ownership and control test (the rule that a non-listed entity can be caught through a listed person who owns or controls it) rather than the mechanical 50 percent threshold used under US rules, meaning the analysis requires qualitative judgment about control, not merely a percentage count. That distinction drives nearly every difficult case this practice sees.
This guide walks through the EU de-risking procedure step by step, identifies the points where correspondent banks most commonly err, and sets out when to involve specialist counsel.
Step 1: Understand what EU sanctions actually prohibit – and what they do not
EU sanctions law does not prohibit a bank from terminating a correspondent relationship for commercial or risk reasons; it prohibits transacting with designated persons and entities caught by the ownership-and-control test. The first and most important step is to separate those two questions.
Under the relevant Council regulations, the core prohibitions are: making funds or economic resources available to a designated person or entity; dealing in assets held by or for such a person; and satisfying claims in ways that benefit them. A correspondent account that routes a payment to a designated person violates those prohibitions. An account terminated because the respondent sits in a high-risk jurisdiction does not, in itself, engage them – unless the termination is itself structured to benefit a designated person (an exotic edge case in practice).
Why does this matter operationally? Because many correspondent banks conflate the two questions and apply the de-risking decision before completing the ownership analysis. That inversion creates its own risks. If the respondent is not in fact caught by EU sanctions, the bank has exited a relationship it could lawfully maintain, potentially exposing itself to claims for wrongful termination. If the respondent is caught, the bank needs to know whether it holds blocked assets – triggering a reporting obligation – before it can exit cleanly.
In our cross-border practice, we see this confusion most often in banks that have calibrated their procedures to OFAC's mechanical ownership test and then apply the same binary logic to EU positions. The EU regime asks a different question.
Step 2: Apply the EU ownership-and-control test to the respondent
The EU ownership-and-control test treats a non-listed entity as caught by sanctions when a listed person owns or controls it; ownership alone at any percentage can be sufficient if it confers control, and control without majority ownership can also suffice. This is a qualitative test, not a percentage trigger.
The practical analysis proceeds in three layers.
First, screen the respondent against the EU Consolidated Sanctions List and all relevant thematic lists (the lists maintained under the applicable Council regulations for the regime in question). This is the baseline and is non-negotiable.
Second, map the ownership chain to identify whether any listed person holds a direct or indirect ownership interest. Where an interest of 50 percent or more exists, the entity will ordinarily be treated as caught under both the EU rules and, for cross-border transactions, the OFAC 50 percent rule – convergence that simplifies the analysis at that level.
Third, and most distinctively for EU purposes, assess whether a listed person exercises control by other means: board appointment rights, veto rights over material decisions, contractual control, operational dependency, or patterns of direction. The EU General Court has, in its case-law on annulment actions, confirmed that control is a functional concept and is not exhausted by formal ownership. Practitioners need to look at the constitutional documents, the shareholder or partnership agreement, and any ancillary arrangements.
Does your screening process stop at layer two? That is the single most common gap in correspondent-bank de-risking procedures we assess.
Step 3: Determine whether blocked assets are held and whether reporting is required
If the analysis in Step 2 establishes that the respondent is caught by EU sanctions – or if a reasonable suspicion exists that it may be – the correspondent bank is, under EU law, required to freeze funds and report. The reporting obligation runs to the competent national authority of the EU member state in which the institution is established or operating.
The specific timeframe for reporting is set by the relevant national transposition rules and the applicable thematic regulation; it is typically short, measured in days rather than weeks. Verify the current deadline in the applicable member state before relying on any general statement of timing.
Critically, de-risking by exiting the account does not discharge the freeze-and-report obligation. A bank that terminates a correspondent relationship and returns funds to the respondent without first completing the freeze analysis may have unblocked assets in a way that violates the sanctions prohibition. This is one of the most serious procedural errors in practice. The sequence matters: assess, freeze if required, report, then determine the exit route under any available authorisation or derogation.
The cross-border dimension is acute here. Where the correspondent relationship involves a US dollar component or a US nexus, OFAC rules may run in parallel. OFAC's blocking requirement and reporting window (currently 10 business days after a US person blocks property) applies to US persons and to transactions clearing through the US financial system. An EU-headquartered bank with a US affiliate or a US-dollar nostro account needs to assess both regimes simultaneously – and the obligations do not always align.
The position above covers the standard analysis. Your facts – the respondent's jurisdiction, the ownership chain, the currency, the specific EU thematic regulation in play – will change the conclusion. For a preliminary assessment of your exposure, contact Calder & Vance at info@caldervance.com.
Step 4: Assess whether a licence or derogation is required or available
Where blocked assets are held, the correspondent bank cannot simply return them to the respondent without authorisation. The exit from the relationship requires either a specific licence (a case-by-case authorisation from the competent authority permitting a defined transaction that would otherwise be prohibited) or a general derogation under the applicable regulation.
EU thematic sanctions regulations typically contain a set of standing derogations covering humanitarian payments, certain judicial proceedings costs, maintenance obligations, and similar categories. Whether one applies to the winding down of a correspondent account will depend on the specific regulation and the nature of the funds held.
Where no derogation is available, the institution must apply for a specific licence. The competent authority in the relevant EU member state administers licensing. Processing times vary between member states and between regimes; a well-prepared application with a complete supporting file moves considerably faster than an incomplete one. In our experience before several competent authorities, the quality of the evidence pack – the ownership analysis, the corporate tree, the supporting documents, and the legal argument for why the derogation or licence ground applies – is the single largest driver of processing speed.
Contrast this with the UK position. Under OFSI licensing rules, the applicant submits directly to OFSI, which applies its own licensing grounds under the relevant UK thematic regulations. The grounds do not always mirror the EU derogations, and the procedural steps differ. A bank unwinding a correspondent relationship that spans both EU and UK counterparties may need to pursue parallel licensing processes with different authorities, on different grounds, under different timelines. That dual-track demand is something compliance teams frequently underestimate.
Step 5: Document the decision and manage the record-keeping obligation
Under EU sanctions rules and the parallel anti-money-laundering regime, institutions are required to retain records of their screening decisions, the information obtained, and any actions taken. Record-keeping is not a procedural formality; it is the evidential foundation of any enforcement defence.
A de-risking decision that is not documented risks being treated by a competent authority as an unexamined exit rather than a reasoned compliance determination. That distinction matters when the authority reviews the institution's conduct. The record should capture: the screening results and the version of the list checked; the ownership-and-control analysis and the information relied upon; the determination on whether blocking applies; any communications with the competent authority; and the legal basis for any licence or derogation relied upon.
The EU's general data-protection rules interact here, particularly where the record contains personal data about individuals identified in the ownership chain. Institutions should ensure that their retention and access controls satisfy both the sanctions record-keeping requirement and the applicable data-protection obligations. These two regimes pull in different directions on retention periods and data minimisation; working through the tension requires a deliberate policy position.
Record-keeping should also cover the post-exit period. If the competent authority later investigates the account relationship, it will examine the full lifecycle of the decision – not only the exit. Gaps in the pre-exit file can be as damaging as gaps in the exit documentation itself.
How does the EU de-risking procedure compare with OFAC and OFSI?
The EU, OFAC, and OFSI approaches to correspondent-bank de-risking share a common structure – screen, assess, freeze if required, report, exit through an authorisation – but diverge on several points that matter significantly in practice.
On the ownership-and-control test, as noted in Step 2, OFAC applies a mechanical 50 percent aggregation rule. EU and OFSI both apply a qualitative control assessment that goes beyond ownership percentages. Where a listed person owns 40 percent of the respondent and exercises board control through a shareholders' agreement, EU and OFSI analysis may treat the entity as caught; OFAC analysis, on its own terms, would not. That divergence can produce a situation in which a transaction is blocked under EU rules but not under US rules – a genuine compliance asymmetry that banks operating across both regimes must manage.
On reporting, the EU member-state notification routes differ from OFSI's reporting to HM Treasury and from OFAC's requirement to report blocked property. The form of the report, the competent recipient, and the information required are all distinct. A bank filing under one regime cannot treat that filing as satisfying the others.
On licensing, EU licensing is decentralised to member states, which creates variation in process and timeline across the single market. OFSI licensing is centralised. OFAC licensing is centralised through OFAC's licensing division. That structural difference has practical consequences: an institution operating in multiple EU member states may face multiple licensing processes for what is substantively the same transaction.
The "stricter prohibition governs" principle applies across these regimes. Where EU rules are more restrictive than OFAC rules on a given transaction, an institution subject to both must comply with the stricter standard. Compliance counsel must always identify the most restrictive applicable requirement and build the procedure to that level.
If a transaction has already been flagged by a counterpart bank, or if the respondent has contested the exit, an early review can preserve options that narrow with time. Write to Calder & Vance at info@caldervance.com to discuss your position.
Common mistakes and risk flags in EU de-risking
Correspondent banks most frequently encounter difficulties in EU de-risking situations because of five recurring errors. Each is avoidable with the right analytical sequence.
- Applying the OFAC 50 percent rule as a proxy for EU analysis. The EU control test asks different questions. An entity below the 50 percent threshold can still be caught; an entity above it may not be if the structural analysis shows the listed person exercises no real control. Transplanting the OFAC procedure produces false negatives and false positives in equal measure.
- De-risking before completing the freeze analysis. Returning funds to a respondent that turns out to be caught by EU sanctions can constitute a prohibited transfer of economic resources. The sequence – assess, then decide on exit – is not optional.
- Treating the exit as the end of the file. Competent authorities have reviewed institutions' conduct years after the relationship ended. The documentation obligation does not terminate on exit.
- Failing to identify the applicable thematic regulation. The EU operates a range of distinct thematic sanctions regimes, each under its own Council regulation, each with its own prohibited activities, derogations, and designated persons lists. Screening against the wrong list – or against a consolidated list that has not been updated – is a systematic vulnerability.
- Underestimating the interaction with anti-money-laundering rules. The EU's AML directives and their national transpositions impose their own enhanced due-diligence requirements and reporting obligations. A de-risking analysis that satisfies the sanctions rules but omits the AML analysis is incomplete. Competent authorities increasingly assess both together.
Related practices
- Correspondent-banking de-risking – OFAC – US sanctions analysis, blocking determinations, and OFAC licence applications for correspondent banks
- Correspondent-banking de-risking – Japan guide – procedure under Japan's applicable sanctions regime, screening obligations, and cross-border comparison
- Correspondent-banking de-risking – OFAC guide – step-by-step guide to the OFAC ownership test, blocking, reporting, and licensing for correspondent institutions