A compliance officer at a mid-sized trading house receives a new counterparty referral. The name clears the firm's automated screening tool. The deal moves forward. Three months later, a correspondent bank flags a beneficial owner buried two layers down the corporate chain – a person who has been on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) for over a year. The transaction is now a potential sanctions violation. The question is not whether the screen failed; the question is whether the process was ever adequate in the first place.
Counterparty due diligence under OFAC is the structured process of establishing whether a business partner, beneficial owner, or affiliated entity is blocked, designated, or otherwise caught by a US sanctions programme. The legal basis lies in IEEPA and the relevant programme regulations administered by the Office of Foreign Assets Control. A US person – and any non-US person touching US-dollar payments, US-origin goods, or US financial institutions – must conduct diligence that is proportionate to the counterparty's risk profile before transacting.
As of July 2026, OFAC administers more than thirty active sanctions programmes, and the SDN List carries tens of thousands of entries. This guide walks through the diligence process in seven practical steps, identifies the points where firms most frequently fall short, and explains how the OFAC test compares with the parallel regimes operated by OFSI in the United Kingdom and the EU Council.
Step 1: Establish who is actually involved in the transaction
The first step in any OFAC counterparty due diligence exercise is to identify every natural person and entity that has a meaningful role in the transaction – not merely the counterparty named on the contract.
That means the contracting entity, its direct shareholders, its ultimate beneficial owners, any guarantors, the financial institutions routing payment, the vessel or carrier (for trade transactions), and the end-user of goods or services. In our experience, firms that confine their identification exercise to the counterparty name on the invoice miss the majority of the exposure that actually materialises in enforcement.
Practically, this requires the collection of corporate documentation: certificates of incorporation, shareholder registers, beneficial-ownership declarations, and – where available – registers maintained under the applicable country regime. For higher-risk counterparties, a commercial registry search in the counterparty's home jurisdiction is the baseline. Where a jurisdiction does not maintain a public beneficial-ownership register, alternative sources include banking references, audited accounts, and third-party due-diligence databases. The identification exercise is not a one-time gate; it must be refreshed whenever material information changes or a periodic review cycle triggers it.
Step 2: Screen against the correct list set
Once the relevant persons and entities are identified, each must be checked against OFAC's published list infrastructure – and against the lists maintained by the other regimes that apply to your business.
OFAC maintains the SDN List, the Consolidated Sanctions List (a consolidated feed covering multiple sub-lists), and the Non-SDN Menus, which include the Non-SDN Chinese Military-Industrial Complex Companies List and other programme-specific inventories. A search confined to the SDN List alone will miss entries on the programme-specific sub-lists. Most enterprise screening tools ingest the full consolidated feed, but configuration drift – where an organisation's tool is not refreshed against the latest OFAC data – is a recurrent source of error. We regularly advise firms that discover their screening configuration has been running on a stale dataset for weeks or months.
Beyond OFAC, a US-nexus transaction typically also triggers parallel screening obligations. The UK's OFSI Consolidated List, the EU's Consolidated Financial Sanctions List, the UN Security Council Consolidated List, and – depending on the transaction's route and counterparty location – the lists maintained by SECO (Switzerland), DFAT (Australia), or the Singapore MAS may all apply. A single integrated screening event covering all applicable lists is more reliable than sequential checks run at different times.
The position above covers the standard case. Your facts – the goods, the payment route, the jurisdictions touched, and the counterparty's ownership structure – determine which lists are operative for your transaction. For a tailored assessment, contact Calder & Vance at info@caldervance.com.
Step 3: Apply the 50 percent rule to the ownership chain
The 50 percent rule (OFAC's rule treating any entity owned 50 percent or more in the aggregate by one or more blocked persons as itself blocked, regardless of whether that entity is listed) is the single most misunderstood element of OFAC counterparty due diligence.
The rule is mechanical. If the aggregate ownership stake held by blocked persons in the counterparty reaches or exceeds 50 percent – directly, indirectly, or through intermediate holding companies – the entity is treated as blocked. The analysis does not turn on control, on whether the blocked owner exercises voting rights, or on whether the blocked person is passive. Two blocked persons each holding 28 percent of the same entity together exceed the threshold, even if neither does so individually.
Applying the rule requires mapping the ownership chain layer by layer. Most standard screening tools evaluate direct ownership. Indirect ownership through intermediate vehicles – including trusts, nominee arrangements, and chains of holding companies in multiple jurisdictions – requires a manual or enhanced investigation step. This is where a proportionate risk-based approach to depth of investigation matters: a counterparty in a high-risk jurisdiction, or in a sector with known exposure to designated persons, warrants a deeper ownership trace than a counterparty in a transparent jurisdiction with public registry data available.
Under OFSI's regime in the United Kingdom and under the EU Council regulations, a similar ownership threshold applies – broadly 50 percent or more – but both regimes also extend the prohibition to entities that are controlled by a designated person, even without majority ownership. Control can be established through contractual rights, board appointment powers, or operational influence. This divergence between OFAC's mechanical ownership test and the broader ownership-and-control tests applied under OFSI and the EU is a live risk for businesses that operate across these regimes simultaneously. An entity might not be blocked under OFAC but could still be caught under the EU or UK rules, or vice versa.
How does the OFAC ownership analysis differ from OFSI and EU tests?
OFAC's ownership test is binary and threshold-based: the 50 percent rule triggers at or above 50 percent aggregate ownership by blocked persons, with no separate control analysis required. OFSI and the EU apply an ownership and control test – a compound standard that captures entities where a designated person holds a majority stake or exercises control through other means.
In practice, the EU and UK tests are wider. A company owned 40 percent by a designated person but whose board is effectively directed by that same person may well be caught under EU and UK rules, even though the 50 percent threshold is not met. OFAC would not block that entity on the basis of ownership alone, though separate specific-licence requirements might still arise from the transaction's nature.
For a business with US-dollar payment flows and EU or UK operations, this divergence creates a coordination problem. A transaction might be cleared as unblocked under an OFAC analysis but refused by a UK or EU counterpart bank applying OFSI or EU standards. We have acted for clients who cleared their own OFAC screen, only to find that their correspondent bank – applying OFSI or EU rules – declined the payment leg of the transaction. Aligning the diligence analysis across regimes from the outset is more efficient than resolving the conflict once it materialises at the payment stage.
If a transaction has already been flagged, or a payment has been refused by a correspondent bank citing a sanctions concern, early legal review can preserve options that narrow with time. Contact us at info@caldervance.com for a confidential review.
Step 4: Risk-rate the counterparty and calibrate the depth of review
A risk-based approach to OFAC counterparty due diligence does not mean applying a uniform standard regardless of profile; it means calibrating the depth of investigation to the risk signals present.
The factors that elevate a counterparty's risk profile include: its jurisdiction of incorporation or operation (particularly jurisdictions subject to comprehensive or sectoral OFAC sanctions programmes); its sector (financial services, defence, energy, shipping, and advanced technology manufacturing carry elevated inherent risk); the volume and pattern of transactions; the counterparty's ownership transparency; and the nature of the goods or services involved. A first-time transaction with a newly incorporated entity in a high-risk jurisdiction warrants significantly more scrutiny than a renewal of a long-standing relationship with a transparent, publicly listed company in a low-risk jurisdiction.
The output of the risk-rating exercise is a decision on investigation depth. For standard-risk counterparties, automated list screening supplemented by a corporate registry check and a basic public-source review is typically adequate. For elevated-risk counterparties, enhanced due diligence should include a full beneficial-ownership trace, adverse media research, transaction-pattern analysis, and – for the highest-risk cases – an on-the-ground third-party investigation.
Risk ratings should be documented and retained. OFAC's enforcement programme takes a dim view of undocumented decisions, even where the underlying analysis was sound. Five years is the standard record-retention benchmark applied by OFAC under the relevant programme regulations; verify the current requirement for the specific programme in question before relying on this figure.
Step 5: Identify red flags and escalate appropriately
Certain facts, when encountered during diligence, should trigger escalation rather than a simple pass-or-fail call. Red flags are not blockers in themselves, but they demand documented investigation before a decision is made to proceed.
Common red flags include: an ownership chain that terminates in a jurisdiction with no public beneficial-ownership disclosure; a counterparty that is newly incorporated with no trading history or website presence; payment routing through an unrelated third-party payer; a request to alter the currency or bank routing of payments close to transaction close; mismatch between the counterparty's stated business and the nature or value of the goods being purchased; and a counterparty that is reluctant to provide corporate documentation or to disclose beneficial owners.
None of these is conclusive. Each requires proportionate investigation. What an OFAC enforcement review will scrutinise is not whether a red flag was present, but whether – once identified – it was investigated thoroughly, documented accurately, and either resolved or escalated. The failure mode that most frequently features in enforcement is the red flag that was logged but not acted upon.
Escalation routes should be defined in advance. For most businesses, a red flag at the counterparty identification or screening stage should escalate to the sanctions compliance officer or to external counsel. For financial institutions, the escalation path will typically also involve the AML/KYC function and, where a potential blocked-property interest is identified, a legal assessment of reporting obligations.
Step 6: Manage ongoing monitoring and the periodic review cycle
Counterparty due diligence is not a one-time gate at onboarding. Designations are made and amended throughout the year, and a counterparty that was clean at onboarding may become blocked or sanctionable at any subsequent point in the relationship.
Ongoing monitoring means, at a minimum, running existing counterparties against updated list data on a regular cycle and triggering a review whenever a material event occurs – a change of ownership, a news report indicating designation risk, a correspondent bank alert, or a change in the counterparty's jurisdiction of operation. The frequency of the monitoring cycle should match the counterparty's risk rating: monthly or more frequent for high-risk counterparties; quarterly or semi-annually for standard-risk relationships.
In our practice, we regularly advise firms that have robust onboarding diligence but weak ongoing monitoring. The gap between onboarding and the next review is precisely the window in which a designation can occur and go undetected. Closing that gap requires both a technical configuration – ensuring the screening tool processes the full list feed on the cycle required – and an operational one: ensuring that ownership and profile information for existing counterparties is kept current rather than relying on the original onboarding data indefinitely.
Where a counterparty's circumstances change materially – a merger, an acquisition, a new shareholder, or a relevant regulatory event in its home jurisdiction – a full refresh of the diligence exercise is appropriate, not merely a re-screen of the existing name set.
Step 7: Document every stage and know when to escalate to counsel
Documentation is not an administrative formality. In an OFAC enforcement context, the quality and completeness of a firm's diligence record is a material factor in the assessment of whether a voluntary self-disclosure (VSD – a proactive notification to OFAC of an apparent violation) is appropriate and, if made, in the regulator's assessment of the penalty base.
A well-constructed diligence file should record: the identification methodology used; the data sources consulted; the list versions searched; the ownership analysis applied; the risk rating assigned; the basis for any red-flag determination and the investigation steps taken; and the ultimate decision with its rationale. Where external counsel or a specialist due-diligence provider was engaged, their outputs should be retained alongside the internal analysis. The five-year record-keeping benchmark referenced in Step 4 applies here as well; check the applicable programme requirement.
Counsel involvement is warranted at several points in the process. Before a high-risk transaction closes, an independent legal review of the diligence package and the ownership analysis can identify gaps before they become enforcement exposure. Where a screen produces a potential match – a name or identifier that may correspond to a listed person – legal advice on the resolution process is advisable before the transaction proceeds. And if a potential violation is identified after the fact, the question of whether to file a VSD, and on what terms, is a matter for qualified sanctions counsel, not for internal compliance alone.
What does a defensible OFAC counterparty diligence file look like? In our experience, the files that withstand enforcement scrutiny share three characteristics: they document the identification universe explicitly, not just the results; they show the ownership analysis at each layer, not just the conclusion; and they record how red flags were investigated and resolved.
Related practices
- Sanctions compliance audit and testing – stress-test your screening programme against live regime standards
- Counterparty due diligence under OFAC: advanced topics – deeper analysis of ownership chains, complex structures, and high-risk sectors
- Counterparty due diligence under OFSI – the UK ownership-and-control test and how it diverges from the OFAC standard