A European trading company signs a distribution agreement with a counterparty registered in a third country. The local compliance team runs the name through a screening database. No direct hit appears. Six months later, a routine audit reveals that a listed entity holds an indirect stake in the counterparty through a chain of intermediate holding companies. The transaction has been running throughout. That is the moment when the question of what EU counterparty due diligence actually requires becomes urgent – and expensive.
Counterparty due diligence under EU sanctions requires a business to identify whether any party to a transaction is listed on the EU Consolidated Sanctions List or is owned or controlled by a listed person, applying the ownership and control test (the EU standard for determining when a non-listed entity is caught because a listed person holds it or directs it). As of July 2026, that test looks beyond direct shareholding to indirect chains and management influence, and no single screening tool automatically resolves it. Negligence is not a defence under the relevant Council regulations.
This guide walks through the procedure step by step: identifying the governing authority, building the ownership picture, applying the control test, handling the grey zones where EU rules diverge from those of OFAC and OFSI, and recognising the risk flags that signal when specialist counsel should be involved.
Step 1: Identify the governing authority and legal basis
The starting point is always to establish which EU instrument applies to your counterparty and transaction. EU sanctions are imposed through Council Decisions and the corresponding Council Regulations, and each programme – whether targeting specific geographic situations, thematic designations, or sectors – operates under its own instrument. The prohibitions vary: some programmes freeze assets and prohibit funds being made available; others impose trade restrictions or sectoral limitations. Identifying the right instrument is not optional. The obligations it carries, the licensing routes it opens, and the defences it recognises all depend on which programme is engaged.
The EU Consolidated Sanctions List, maintained and regularly updated by the European External Action Service, is the central published reference. It consolidates designations across all active programmes into a single searchable format. However, the list is a summary, not the instrument itself. Where a listing raises a question – for instance, about the scope of the asset freeze or whether an associated entity is captured – practitioners should check the underlying Council Regulation directly, not only the consolidated record.
In our cross-border practice, we see a recurring error at this stage: a compliance team concludes that because the counterparty is not on the consolidated list, no EU sanctions issue arises. That conclusion misses the ownership and control question entirely. The governing instruments expressly extend prohibitions to entities owned or controlled by listed persons, regardless of whether those entities are themselves named.
For businesses operating in multiple jurisdictions, the picture is more complicated still. EU measures may apply not only to EU-established entities but also, in certain configurations, to conduct within EU territory, to EU citizens and residents acting abroad, and to transactions cleared or settled in euro. Mapping the full reach of the applicable Council Regulation against your corporate footprint is the first procedural step, and it should happen before any other diligence work begins.
Step 2: Screen the counterparty name – and its owners
Screening the counterparty's registered name against the EU Consolidated Sanctions List is necessary, but it is only the first layer of a properly constructed diligence process. The critical question is whether any person in the ownership or control chain above the counterparty appears on the list.
A structured screening process for EU purposes should proceed in at least four layers:
- Direct name screening: run the counterparty's legal name, trading names, and known aliases against the EU Consolidated Sanctions List and, where relevant, other lists maintained by the United Nations, OFAC, and OFSI.
- Beneficial ownership mapping: obtain the ownership register, corporate filings, or other authoritative sources to identify all shareholders holding a material stake, typically taken as 25 percent or more as a starting point for investigation, though no fixed EU threshold automatically resolves the ownership question in the sanctions context.
- Indirect chain tracing: follow each intermediate holding company up the chain until you reach natural persons or entities whose ultimate status is clear.
- Control screening: separately from ownership, identify directors, senior managers, and persons with significant influence over the counterparty's strategic or operational decisions, and screen each of them.
How far up the chain must you go? The EU instruments do not prescribe a fixed numerical depth. The standard is whether, applying a reasonable and proportionate investigation, you would have identified a connection to a listed person. In practice, we advise clients to trace at least three corporate layers in standard commercial transactions and to extend that investigation whenever red flags appear – unusual ownership structures, holding companies in low-transparency jurisdictions, nominee arrangements, or beneficial owners whose identity is obscured.
The position above describes the standard case. Your facts – the sector, the counterparty's jurisdiction, the nature of the goods or services, and the regime in play – change the scope of the required investigation.
For an early assessment of your EU screening procedures, contact Calder & Vance at info@caldervance.com.
Step 3: Apply the EU ownership and control test
The EU ownership and control test determines whether a non-listed entity is nonetheless subject to an asset freeze because a listed person owns or controls it. Understanding how this test works – and how it differs from the OFAC 50 percent rule – is essential for any compliance programme covering EU-exposed transactions.
Under the relevant Council Regulations, an entity is treated as subject to the asset-freeze if a listed person owns it, directly or indirectly. Unlike the OFAC rule, which sets a mechanical 50 percent or more aggregate threshold, the EU test does not rely solely on a numerical ownership figure. Control can arise independently of ownership. A listed person who directs the strategic decisions of a non-listed entity, who holds veto rights over its board, or who otherwise exercises a determining influence over its conduct, may cause that entity to be treated as within scope even where the ownership percentage would not trigger the OFAC rule.
This divergence matters practically. A compliance team trained on OFAC methodology may see a counterparty with a listed person holding forty-two percent and conclude – correctly under OFAC's rule – that the entity is not itself blocked. Under EU analysis, the same facts require a further inquiry into whether that forty-two percent stake is accompanied by control rights, board representation, or contractual influence that amounts to a determining influence. The answer may be different.
The UK position under OFSI also applies an ownership and control analysis, and in broad outline it tracks the EU approach. However, the evidential weight each authority gives to particular forms of control can differ, and practitioners advising on transactions with both EU and UK dimensions should analyse each regime separately rather than assuming that a clear EU conclusion resolves the UK question.
In our experience, the most difficult cases are those involving joint ventures, contractual rights that are economically equivalent to ownership, and listed persons who hold minority stakes but occupy foundational management positions. Each of these fact patterns requires a considered analysis of the control question, not a mechanical counting exercise.
What is the difference between the EU and OFAC approach to counterparty diligence?
The EU and OFAC approaches share the same objective – preventing prohibited persons from accessing resources through intermediaries – but they reach it through different legal mechanisms, and the practical gap between them creates risk for businesses that apply a single global methodology.
OFAC's 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) is mechanical. Aggregate ownership at or above the threshold by one or more Specially Designated Nationals (SDN List) (OFAC's list of Specially Designated Nationals and blocked persons) means the entity is blocked. Below the threshold, the entity is not blocked by the rule alone, though OFAC may still act against it on other grounds. The simplicity of the rule makes it relatively straightforward to apply where ownership data is clear.
EU law does not replicate this mechanism. The relevant Council Regulations require an assessment of both ownership and control, without fixing a numerical threshold as conclusive either way. An entity can be subject to an EU asset freeze at ownership levels below fifty percent if control is demonstrated, and the analysis of control requires qualitative judgment rather than arithmetic. The EU General Court has addressed these questions in annulment actions brought by listed persons and entities, confirming that the standard requires genuine assessment rather than formality.
A further practical divergence is the treatment of partial ownership. Under the OFAC rule, if two SDNs each hold twenty-four percent of an entity, the aggregate is forty-eight percent and the entity is not blocked by the rule alone. Under EU analysis, those same two twenty-four percent stakes may warrant a further control inquiry, particularly where the two listed persons act in concert or where the entity's governance is structured to give effect to their preferences.
For businesses with cross-border supply chains exposed to both regimes, we regularly advise on the design of a unified diligence methodology that applies the more demanding standard where the two tests diverge. That approach reduces the risk of a transaction that clears OFAC screening but creates EU exposure.
If a transaction has already been flagged under either regime, or if screening has returned an uncertain result, early specialist review preserves options that narrow with time. Contact Calder & Vance at info@caldervance.com to discuss the position.
Step 4: Identify and document risk flags
A well-designed counterparty diligence process does not only ask whether a counterparty is listed or controlled by a listed person today. It also asks whether the transaction, the ownership structure, or the counterparty's conduct exhibits features that raise the probability of unlisted exposure or future designation risk. These risk flags are the difference between a compliance process that protects a business and one that merely archives a decision.
The following features consistently appear in EU sanctions enforcement and should prompt enhanced investigation or escalation:
- Opaque ownership structures: counterparties where beneficial ownership cannot be confirmed through public filings, notarised registers, or third-party verification. Nominee shareholding and bearer-instrument arrangements are particular concerns.
- Jurisdictional indicators: ownership chains passing through jurisdictions identified by the Financial Action Task Force as high-risk, or jurisdictions that maintain limited corporate-disclosure requirements.
- Sector indicators: industries that are subject to EU sectoral restrictions under the applicable programme – energy, finance, defence, and technology sectors are frequently relevant across multiple active programmes.
- Transactional anomalies: pricing inconsistent with market rates, payment routes involving jurisdictions without an obvious commercial rationale, or insistence on cash or bearer instruments.
- Changes in ownership: recent transfers of shares or control interests, particularly where a previous owner was listed or has been investigated, and where the transfer appears designed to distance the counterparty from the listed person.
- Adverse media: credible reporting linking the counterparty, its owners, or its senior management to designated persons, programme-restricted sectors, or sanctions evasion allegations.
Each flag should be documented, investigated, and resolved. Where a flag cannot be resolved through available information, that fact should itself be documented – as a statement of residual risk – and escalated to the appropriate level within the business. An undocumented decision is an undefended decision if enforcement follows.
Document retention matters here. EU Member State enforcement authorities and the European Commission expect businesses to maintain records sufficient to demonstrate the diligence conducted. Record-keeping obligations under EU anti-money-laundering rules and under the relevant sanctions instruments can require documentation to be held for a material period; verify the specific requirement under the applicable national implementing legislation in each relevant Member State.
Step 5: Handle uncertain results and escalate appropriately
Not every counterparty diligence review yields a clear result. Some of the most significant risk decisions a business faces arise precisely where the answer is uncertain: where ownership data is incomplete, where control is disputed, where a listing is recent and the downstream entity's relationship to the listed person is not yet publicly documented, or where a general licence or derogation may apply but its scope is not obvious.
Uncertain results require a structured escalation path, not an ad hoc judgment by the screening officer. In our experience, businesses that perform well in enforcement investigations are those whose procedures clearly specify: who receives an uncertain result; what additional investigation is required; within what time window a decision must be made; and who has authority to approve, reject, or halt a transaction.
Where the uncertain result involves a potential match against the EU Consolidated Sanctions List, the business should consider whether it is required to report. EU Member State authorities have their own reporting obligations for asset freezes and matches, and some Member States require notification to the competent authority even where the match is subsequently resolved as a false positive. The relevant national implementing legislation sets out the reporting mechanics; do not assume that resolution of the false positive extinguishes the reporting obligation without verifying the position under the applicable Member State rules.
Where a transaction may be permitted under a general derogation or a specific licence under the applicable Council Regulation, obtaining that authorisation before proceeding is always preferable to proceeding and later claiming that a licence would have been granted. Regulators assess conduct as it occurred, not as it might have been structured.
Is your escalation path clearly defined in your written procedures, and does it reach the right decision-maker within the time available? That question is worth asking before a match arrives, not after.
Common misconceptions and genuine risk flags
A persistent misconception in counterparty diligence under EU sanctions is that a clean screening result – no hit against the EU Consolidated Sanctions List – is equivalent to a clean compliance result. It is not. The screening result answers only one question: whether the counterparty's name appears on the list. It does not answer whether the counterparty is owned or controlled by a listed person, whether the transaction is subject to a sectoral prohibition, or whether the goods involved are export-restricted under EU dual-use rules.
A related misconception is that commercially available screening software, however sophisticated, performs the full EU ownership and control analysis automatically. It does not. Software screens names. The ownership and control analysis is a legal and factual judgment that requires human review of corporate documentation, governance arrangements, and the applicable instrument's control definition. Software is a tool for the first layer of the process; it is not a substitute for the analysis that follows.
A third misconception is that EU sanctions exposure arises only for EU-established entities. The relevant Council Regulations extend in scope to conduct within EU territory, to EU nationals and residents acting outside the EU in certain circumstances, and to transactions involving EU currency. A non-EU business that clears payments through the EU banking system, employs EU nationals, or routes goods through EU ports is not automatically outside the reach of EU measures merely because it is incorporated elsewhere.
In our practice, we also see businesses conflate the EU standard with the OFAC standard and apply whichever is more familiar. As noted in Step 3, the two standards diverge materially on the control question. A methodology designed for one regime is not a reliable substitute for a properly designed methodology for the other.
Related practices
- Sanctions compliance audit and testing – assessing and strengthening screening and diligence programmes against the applicable standards.
- Counterparty due diligence under EU: advanced ownership questions – extended analysis of indirect chain tracing and control assessment in complex ownership structures.
- Counterparty due diligence: multi-regime comparison – comparing EU, OFAC, and OFSI diligence standards for cross-border transactions.