A mid-sized German chemicals distributor is finalising a supply agreement with a trading company incorporated in a third country. The compliance officer runs the counterparty through a standard screening tool. No direct list hit. The deal moves forward. Six months later, an EU Council regulation update re-designates the majority shareholder of that trading company. The distributor is now exposed to a prohibition it believed it had managed. Was the original due diligence adequate? Almost certainly not.
Counterparty due diligence under EU sanctions requires more than a name-check against the EU Consolidated List. Under the relevant Council regulations, the ownership and control test (the EU and UK rule treating a non-listed entity as caught when a designated person owns or controls it) extends prohibitions to entities that are owned or controlled by a listed person, even if that entity is not itself designated. As of July 2026, the EU Consolidated List covers thousands of designated individuals and entities across multiple thematic regimes, and the Council continues to add designations at pace.
This guide sets out how to conduct counterparty due diligence under the EU regime step by step, where that analysis diverges from the OFAC and OFSI approaches, what the most common risk failures look like, and when to bring in sanctions counsel.
Step 1: Identify the applicable EU sanctions regime and its legal basis
The first step in any EU counterparty review is to identify which Council regulation applies – because the EU operates multiple distinct thematic sanctions regimes, each with its own legal basis and scope of prohibited activity.
EU sanctions derive from Council Decisions adopted under the EU's Common Foreign and Security Policy and from directly applicable Council Regulations. The Council Regulations are binding in all EU member states without national implementing legislation. For cross-border businesses, this means that an EU-incorporated entity, or any entity conducting regulated activity within the EU, must comply with the applicable Council Regulation regardless of where the transaction itself is booked.
The EU also maintains an autonomous human rights sanctions regime – often described as the EU's "Magnitsky-style" instrument – alongside a range of country-specific and thematic instruments covering terrorism financing, weapons proliferation, and other designated concerns. Identifying which regime is engaged by a particular counterparty, transaction, or goods category is not always self-evident. A business operating across sectors – financial services, logistics, advanced manufacturing – may find that a single counterparty simultaneously engages two or more EU thematic instruments. In our experience, compliance programmes that treat EU sanctions as a single undifferentiated list routinely miss this layering risk.
Practitioners should also note: the EU Blocking Regulation, which restricts compliance with certain extraterritorial US sanctions measures by EU persons, operates in parallel to the EU autonomous regime. For businesses subject to both OFAC jurisdiction and EU jurisdiction, the interaction between these instruments is a live compliance question that requires careful analysis before a transaction is structured.
Step 2: Screen against the EU Consolidated List and understand what it covers
The second step is screening the counterparty and its ownership chain against the EU Consolidated List – but understanding precisely what that list does and does not capture is equally important.
The EU Consolidated List aggregates designations from all EU autonomous and UN-derived sanctions regimes into a single searchable instrument. A direct name-match against this list is the minimum threshold for any EU counterparty review. It is not the ceiling.
Several limitations of list-based screening matter in practice. First, the list uses transliterated names, aliases, and date-of-birth data that may not map cleanly to the name as it appears in a counterparty's registration documents. Phonetic and transliteration variants must be reviewed. Second, the list is updated at irregular intervals; a counterparty that cleared screening last quarter may be listed today. Third – and most significantly – a negative result on a direct name search does not confirm that the counterparty is clear. It confirms only that the counterparty itself is not designated. The ownership and control question is entirely separate.
What does adequate screening look like in practice? At a minimum: a search against the EU Consolidated List using the full legal name and all known aliases, a check against the UN Security Council Consolidated List (incorporated by reference into EU law), and a separate ownership and control analysis described in the next step. For higher-risk relationships, periodic re-screening at defined intervals is necessary, not optional.
For businesses with automated screening tools, a critical question is whether the tool is calibrated to the EU Consolidated List specifically, or whether it relies on a proprietary database that may lag official updates. We regularly advise clients on validating the accuracy and currency of their screening infrastructure – an underweighted part of most compliance audits. You can find further discussion of compliance audit and testing methodology in our compliance audit and testing service guidance.
Step 3: Apply the EU ownership and control test
The EU ownership and control test determines whether a non-listed entity is caught by EU sanctions because a designated person owns or controls it – and this step is where many EU counterparty reviews fail.
Under the applicable Council regulations, funds and economic resources belonging to, owned, held, or controlled by a designated person must be frozen. This extends to entities that a designated person owns or controls. The EU test has two distinct limbs: ownership and control. The ownership limb broadly tracks a majority-ownership threshold. The control limb is broader and more fact-specific: it encompasses entities over which a designated person can exercise decisive influence through voting rights, contractual mechanisms, board composition, or structural arrangements – even without majority ownership.
How does this differ from the OFAC 50 percent rule? The OFAC rule is mechanical: aggregate ownership of 50 percent or more by blocked persons triggers the prohibition, regardless of control. The EU and UK regimes go further. An entity may be caught under EU rules even where ownership sits below 50 percent, if the designated person demonstrably controls the entity through other means. This creates a more demanding due diligence obligation for businesses operating under EU jurisdiction.
Practically, this means a counterparty review must go beyond ultimate beneficial ownership percentages. It must examine: who holds voting rights and in what proportion; whether any designated person holds board seats or has approval rights over material decisions; whether contractual arrangements (loan agreements, option structures, supply agreements) vest effective control in a designated person; and whether the corporate structure has recently changed in a way that suggests ownership or control has been restructured. Beneficial ownership registers – where available and reliable – are a starting point, not a complete answer.
In a recent matter, a logistics business sought our advice on a joint-venture counterparty in which no individual shareholder exceeded 35 percent. The ownership screen was clear. The control analysis, however, revealed that one minority shareholder – a designated entity – held a contractual right of first approval over all material operational decisions. That contractual control right brought the joint-venture within the scope of the applicable EU prohibition. The business paused the transaction pending further analysis.
What are the risk flags that signal enhanced due diligence is required?
Certain counterparty characteristics should always trigger a deeper review, regardless of whether the initial screening returns a negative result.
Risk flags that warrant enhanced due diligence under the EU regime include:
- Counterparties incorporated in jurisdictions with elevated sanctions exposure, complex nominee ownership structures, or limited beneficial ownership transparency
- Ownership or management chains involving individuals from jurisdictions subject to EU thematic regimes, even where those individuals are not personally designated
- Counterparties active in sectors with heightened dual-use or proliferation risk – advanced manufacturing, aerospace components, electronics, chemical precursors – particularly where end-use documentation is absent or incomplete
- Newly incorporated entities, recently restructured ownership chains, or counterparties that have recently changed their registered jurisdiction
- Transactions structured through multiple intermediaries without a clear commercial rationale for the layering
- Counterparties that resist providing ownership and beneficial interest information when requested
- Payment routing through jurisdictions or financial institutions subject to EU restrictions or UN measures
None of these flags, individually, establishes a prohibition. Each is a prompt for deeper analysis. The appropriate response is proportionate enhanced due diligence: additional documentary verification, a deeper ownership-chain review, and where necessary, advice from sanctions counsel before the transaction proceeds.
What happens when enhanced due diligence surfaces an ambiguity rather than a clear answer? That is the point at which legal analysis of the applicable regulation becomes necessary. The EU regime does not provide a safe harbour for transactions that an ordinarily competent business person could identify as high-risk; regulators in member states assess the adequacy of a compliance review against an objective standard of reasonable care. An ambiguous result that was not escalated is unlikely to constitute a credible defence.
Step 4: Document the review and apply a proportionate risk rating
Documented, proportionate due diligence is the difference between a compliance defence and an enforcement exposure – and documentation is consistently the element that businesses underinvest in.
A counterparty due diligence file under the EU regime should contain, at minimum: the date and scope of the screening search, the version of the EU Consolidated List and UN Consolidated List checked, the name variants and aliases reviewed, the source materials used for the ownership and control analysis, the outcome of that analysis, the risk rating assigned, and the identity of the person who conducted and reviewed the file.
Proportionate risk rating reflects the actual exposure profile of the relationship. A one-off, low-value purchase from an established EU-based supplier warrants a different diligence depth than an ongoing relationship with a counterparty in a high-risk jurisdiction for goods with dual-use potential. Calibrating that depth – and recording the calibration rationale – is itself a compliance obligation, not merely good practice.
Record-keeping requirements under EU member state AML and sanctions rules commonly mandate retention for a defined period. While the exact period varies by jurisdiction and instrument, a standard benchmark is five years from the end of the business relationship or the date of the transaction. Compliance programmes should ensure that counterparty files are retained, retrievable, and sufficient to reconstruct the analysis if queried by a national competent authority.
The position above covers the standard review. Your specific transaction – the counterparty's jurisdiction, sector, ownership structure, and the goods or services in question – will change the analysis. For an assessment of your EU counterparty exposure, contact Calder & Vance at info@caldervance.com.
Step 5: Consider the cross-regime dimension
EU counterparty due diligence does not exist in isolation. For most businesses operating cross-border, the EU analysis runs alongside OFAC, OFSI, and potentially other national regimes – and those regimes do not always produce the same answer.
The divergence between the EU and OFAC tests is the most operationally significant for businesses with US nexus. As noted above, the OFAC 50 percent rule is mechanical; a counterparty owned below that threshold by a blocked person is not itself blocked for OFAC purposes, unless separately designated. Under the EU control test, the same counterparty might still be caught. A compliance programme calibrated only to OFAC will underperform in an EU context.
The UK regime under OFSI operates its own ownership and control test, which broadly parallels the EU approach but applies under the Sanctions and Anti-Money Laundering Act and the relevant thematic regulations. Post-2021, UK and EU sanctions lists have diverged: a person designated under EU law is not automatically designated under UK law, and vice versa. A business relying on EU-only screening to satisfy OFSI obligations will have a gap. Conversely, a business relying on UK screening for EU compliance will equally be exposed. Separate list checks are required.
For businesses with exposure to UN Security Council measures, the UN Consolidated List is incorporated by reference into both EU and UK sanctions law. A UN designation creates obligations under both regimes simultaneously; the EU and UK instruments then apply their own ownership and control tests to UN-listed persons in the same way as to autonomously designated persons.
Switzerland (through SECO), Canada (through Global Affairs Canada), and Australia (through DFAT) each maintain their own lists and their own tests. In our cross-border practice, we routinely see counterparty reviews that clear two or three regimes but fail on a fourth – particularly where a counterparty has connections to a jurisdiction subject to an autonomous regime that one list captures and another does not. Multi-regime mapping is not a luxury for large businesses; it is the baseline for any genuinely cross-border supply chain. Our counterparty due diligence guide for OFAC and our advanced OFAC counterparty diligence guide set out the US-side analysis that should run in parallel.
If a transaction has already been flagged by a bank, or a filing has been queried by a competent authority, early advice can preserve options that narrow with time. For a confidential review of a potential compliance gap, contact Calder & Vance at info@caldervance.com.
Common mistakes and how to address them
Most EU counterparty due diligence failures follow a recognisable pattern. Identifying them in advance is the most practical risk-reduction step a compliance team can take.
The most common mistake is treating a negative list hit as a clean result. It is not. A negative result on a direct name search confirms that the counterparty is not itself listed. It says nothing about whether a listed person owns or controls it. Businesses that stop at the list check routinely carry the exact exposure the list check was designed to identify.
A second recurring failure is static due diligence. A counterparty review conducted at onboarding and not revisited is a snapshot, not a compliance programme. The EU Council updates designations regularly; a counterparty that was clear at onboarding may have a designated beneficial owner added to the list months later. Periodic re-screening – at least annually for ongoing relationships, and triggered by any material change in the counterparty's ownership or the applicable designation regime – is a minimum standard.
Third: inconsistent standards across the supply chain. A business that applies rigorous diligence to direct contractual counterparties but no diligence to sub-contractors or logistics intermediaries creates a gap that a national competent authority will identify quickly. The EU regime prohibits making funds and economic resources available to designated persons, directly or indirectly. "Indirectly" is not a technicality.
A commonly held myth is that EU sanctions only apply to EU-incorporated businesses. This is incorrect. The applicable Council Regulations extend to EU persons wherever located and to transactions conducted within the EU or using EU financial infrastructure. A non-EU entity transacting through a euro-denominated payment or an EU-based clearing arrangement is within scope. Compliance programmes designed only for the EU headquarters of a multinational, and not for its non-EU subsidiaries transacting in EU currency, underestimate the reach of the regime.
Related practices
- Compliance audit and testing – independent review of your sanctions screening controls and programme design
- Counterparty due diligence under OFAC – step-by-step guide to the US regime's ownership test and screening obligations
- Advanced OFAC counterparty diligence – deeper analysis of complex ownership structures and secondary-sanctions risk under the US regime