A trading firm in Europe closes a distributor agreement with a counterparty registered in a third jurisdiction. Two weeks later, an internal alert flags a partial name match against the SDN List (OFAC's list of Specially Designated Nationals and blocked persons). The contract is signed. Funds have moved. The compliance team now faces a question that no screening dashboard can answer by itself: is this the same person, and if so, what is the firm's exposure under OFAC?
Counterparty due diligence under OFAC is the structured process of confirming that a business partner, beneficial owner, or transaction counterparty is not a blocked person or entity – and that no blocked person owns 50 percent or more of the counterparty, directly or through intermediary layers. It is governed by OFAC's authority under IEEPA and the applicable programme regulations. The consequence of getting it wrong is not merely reputational: OFAC civil penalties are calculated per transaction, and a single blocked transfer can trigger a significant enforcement action.
This guide walks through each step of a defensible OFAC counterparty due-diligence process, addresses the ownership-and-control analysis that most screening tools miss, and explains where the UK and EU regimes diverge in ways that matter for cross-border transactions. As of mid-2026, OFAC's enforcement posture remains demanding, and the volume of complex ownership structures presented to compliance teams continues to grow.
Step 1: Identify who you are actually screening
The first step is to define the full population of persons and entities that require screening – not only the named contractual counterparty, but every beneficial owner, controlling natural person, and intermediate holding company in the ownership chain. OFAC's 50 percent rule (the rule treating entities owned in the aggregate 50 percent or more by blocked persons as themselves blocked) means that a clean-named legal entity can still be a prohibited counterparty if its ownership structure is examined one layer deeper.
In practice, this means gathering corporate registration documents, shareholder registers, and – where available – beneficial-ownership filings from the relevant jurisdiction. For privately held counterparties, that information is rarely complete in a single public source. The compliance team must cross-reference commercial data providers, local registry filings, and any publicly available financing or government-contract disclosures.
Who counts as a "beneficial owner" for this purpose? OFAC does not prescribe a single percentage threshold for beneficial-ownership collection; the question is whether a natural person's ownership stake, combined with any co-owned holdings by other SDN-listed persons, could aggregate to or above 50 percent. A 10-percent shareholder is irrelevant in isolation. The same 10-percent shareholder becomes immediately relevant if a listed person holds the other 40 percent. Aggregation is the step that manual reviews most often skip.
Step 2: Run the screening search correctly
A compliant OFAC screening search covers the SDN List, the Consolidated Sanctions List, and any relevant programme-specific lists – and it must be run against all name variations, transliterations, and known aliases of every person and entity identified in Step 1. Running the legal entity name alone is not sufficient.
Name-matching logic matters enormously here. The sensitivity setting on a commercial screening tool determines both the false-positive rate and the miss rate. Set too tight, the tool returns no alerts on a name that differs by one character from a listed entry. Set too loose, the compliance team drowns in alerts it cannot resource, which produces its own risk: a busy team that clicks through false positives without reading them will eventually click through a true positive.
The position above covers the standard case. Your facts – the counterparty, the jurisdiction, the ownership structure, the goods or services in question – change the analysis materially. For an initial review of your screening configuration, contact Calder & Vance at info@caldervance.com.
Screening should also cover date of birth and place of incorporation or registration. SDN entries for natural persons include identifying information precisely because common names produce high false-positive rates. An alert on a common surname is not resolved by noting that the name is common; it is resolved by confirming or excluding the identifying data.
Step 3: Apply the 50 percent rule to the ownership chain
Once the entity structure is mapped, the 50 percent rule requires aggregating the ownership interests of all SDN-listed persons across direct and indirect holdings. If listed persons own, in total, 50 percent or more of an entity – even if no single listed person reaches that level alone – the entity is treated as blocked. This is not a matter of degree; the threshold is binary.
Indirect ownership must be traced through each layer. A listed person holding 80 percent of a holding company, which itself holds 70 percent of an operating subsidiary, gives the listed person an effective indirect interest of 56 percent in the subsidiary. The subsidiary is blocked. The fact that neither the holding company nor the subsidiary appears on any list is irrelevant.
We regularly advise businesses that discover this issue mid-transaction, after a corporate chart has been submitted to a financing institution that identifies the ownership chain. The earlier the ownership analysis is completed, the broader the options remain.
A practical point: the 50 percent rule applies to ownership. It does not automatically capture control exercised without ownership. But OFAC has made clear – and this is where the cross-border comparison becomes important – that its guidance does address control in certain circumstances. Under OFSI (the UK financial sanctions authority) and the relevant EU Council regulations, the test is explicitly framed in terms of ownership or control. A business operating across both OFAC and EU/UK regimes must apply both tests to the same counterparty structure. The stricter prohibition governs.
Step 4: Assess the transaction against programme-specific prohibitions
Passing the ownership screen does not end the analysis. Many OFAC programmes impose prohibitions that extend beyond dealing with blocked persons. Sectoral sanctions (restrictions on specific categories of transactions – typically certain debt or equity dealings – with entities in designated sectors of a particular economy) may apply to a counterparty that is not on the SDN List at all. Secondary sanctions risk (the risk that a non-US person's conduct outside US jurisdiction triggers OFAC designation or other adverse action) is a separate and increasingly significant concern for non-US businesses.
The programme-specific analysis requires counsel to identify which OFAC programme is relevant, what its operative prohibitions are, and whether any activity by the counterparty in a designated sector creates exposure. This analysis cannot be automated by a list-screening tool, because sectoral designations attach to transaction types – not to names.
Does your counterparty have a subsidiary or parent entity operating in a sanctioned sector, even if the counterparty itself is clean? That question is not resolved by the SDN check. It requires a substantive review of the corporate group's activities.
Step 5: Apply the cross-border overlay – UK, EU, and UN
A US sanctions compliance programme does not replace the need to assess UK, EU, and UN obligations. Many counterparties that are clean under OFAC are listed on the UK OFSI consolidated list or the EU's asset-freeze lists. The reverse is also true: some OFAC-listed persons are not designated by the EU or UK. The lists are not coextensive.
For a business with a UK nexus – a UK subsidiary, a UK-incorporated entity in the chain, a transaction cleared through a UK financial institution – OFSI's rules apply independently of OFAC. The same logic applies to EU-incorporated entities or transactions touching EU-regulated institutions. The UN Security Council Consolidated List sits beneath all major national regimes; any person listed there is effectively listed everywhere that has implemented the relevant Security Council resolution.
In our cross-border practice, the most common gap is the business that runs a thorough OFAC check and skips the EU and UK lists entirely. A transaction cleared under OFAC can still be prohibited under EU or UK law. The multi-regime screen must be simultaneous, not sequential.
If a transaction has already been flagged under one regime, or a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential review.
Step 6: Document the analysis and retain the record
Documentation is not an administrative afterthought. A well-documented OFAC due-diligence file is the primary evidence of good-faith compliance in an enforcement inquiry. OFAC assesses whether a business maintained a sanctions compliance programme (a formal internal control system for identifying and managing sanctions risk) when deciding whether to bring an enforcement action and at what level to set a civil monetary penalty.
The record should capture: the date of the search, the databases searched, the names and aliases run, the result of each search, the ownership analysis conducted, any alerts generated and how they were resolved, the identity of the person who performed and approved the review, and the basis on which the transaction was cleared or referred for escalation. Record-keeping obligations under the applicable US export-control and sanctions rules extend for a significant period after the transaction; verify the current retention requirement before relying on any specific figure.
Escalation procedures must be defined before they are needed. A compliance team that encounters a potential match and has no escalation path is likely to make a decision at the wrong level, or delay until the commercial pressure resolves the question for it – which is exactly the wrong outcome.
Step 7: Decide on escalation, counsel, and voluntary self-disclosure
Not every alert requires external counsel. But several circumstances should prompt an immediate referral: where a confirmed or probable match has been identified; where a transaction has already been executed and a potential violation is suspected; where a counterparty has disclosed new ownership information that changes the prior analysis; or where the transaction involves a jurisdiction, sector, or goods category that carries elevated risk.
Voluntary self-disclosure (VSD – the act of reporting an apparent violation to OFAC before the agency initiates contact) can significantly affect the outcome of an enforcement action. OFAC's published guidance treats a timely and comprehensive VSD as a significant mitigating factor. But a poorly structured VSD – one that is incomplete, inaccurate, or untimely – can make matters worse rather than better. VSD decisions should be made with counsel.
We have acted for businesses at every stage of this process: from pre-transaction due diligence through to enforcement defence and VSD submissions. In a recent matter, a manufacturing business identified a potential ownership-chain match mid-transaction. We assessed the ownership structure, confirmed the applicable OFAC programme's scope, and structured the escalation to OFAC. The matter was resolved without a penalty finding. No outcome of that kind is guaranteed, but structured early action consistently improves the position.
Common risk flags in counterparty due diligence
Certain fact patterns appear repeatedly in sanctions-related enforcement actions. Each is a prompt to conduct deeper diligence rather than to proceed on the standard screen alone.
- Counterparty registered in a high-risk jurisdiction but with no apparent business presence there.
- Ownership structure that is unusually complex, involving multiple offshore holding layers with no clear commercial rationale.
- Beneficial owners who are natural persons not identified in the contract documentation or corporate filings provided voluntarily.
- Counterparty that recently changed its name, jurisdiction of incorporation, or ownership structure.
- Transaction that involves a third-party payment instruction – a request that funds be paid to an account held by a different entity from the named counterparty.
- Goods or services that have known dual-use applications in restricted sectors or regions.
- Counterparty that resists or delays providing ownership information when asked.
None of these flags is individually determinative. Each requires a decision on whether the level of risk justifies enhanced diligence, referral to counsel, or a decision not to proceed. Risk appetite cannot substitute for legal analysis where a hard prohibition is in play.
Related practices
- Sanctions compliance audit and testing – structured review of screening logic, programme design, and gap analysis across major regimes.
- Counterparty due diligence: advanced ownership analysis – deeper treatment of layered ownership structures and the 50 percent rule in practice.
- Counterparty due diligence: multi-regime screening – running UK, EU, and UN checks alongside OFAC in a single workflow.