A trading company in Singapore closes a supply agreement with a distributor in the Gulf. Three weeks later, the compliance team discovers that a recently added shareholder in the distributor's holding structure appears on OFAC's SDN List (OFAC's list of Specially Designated Nationals and blocked persons). The contract is already signed. Payments are scheduled. Does the deal need to stop?
Counterparty due diligence under OFAC is the structured process of screening a prospective business partner – and every layer of its ownership chain – against US sanctions lists before a transaction is entered into or funds are transferred. The governing authority is the Office of Foreign Assets Control, acting under IEEPA and related statutes. Where a counterparty is owned 50 percent or more in the aggregate by one or more blocked persons, OFAC treats it as blocked even if it does not itself appear on any list. This is the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked), and it is the single most consequential test in counterparty screening.
As of July 2026, OFAC administers more than thirty active sanctions programmes spanning dozens of jurisdictions. This guide walks through every step of a defensible OFAC counterparty screening process, flags the points at which OFSI and the EU apply a materially different test, and identifies the risk signals that call for specialist counsel.
Step 1: Establish who you are screening – and why jurisdiction matters
The first step is to define the screening universe correctly: every legal entity, individual, and intermediary that will touch the transaction, the payment flow, or the goods. OFAC's reach extends beyond the obvious counterparty to freight forwarders, financial intermediaries, beneficial owners, and, in certain programme contexts, end-users. Getting the perimeter wrong at the outset means every subsequent step is incomplete.
OFAC jurisdiction turns principally on whether the transaction involves a US person, US-origin goods or technology, or a US dollar clearing leg. Any one of those three triggers is sufficient. A company incorporated in the Netherlands, owned by a Swiss parent, paying in US dollars through a correspondent bank, is squarely within OFAC's reach for that payment leg. In our experience, non-US companies routinely underestimate this exposure – particularly the US dollar correspondent risk, which survives even where neither party to the underlying contract is American.
The cross-border implication is immediate. If the same transaction also involves a UK-incorporated entity or a UK branch, OFSI's rules apply concurrently. OFSI uses an ownership and control test (the UK and EU test for whether a non-listed entity is caught through a listed person) that goes beyond the mechanical 50 percent calculation. Control – including informal or contractual control – can capture a counterparty that passes the OFAC threshold screen. EU Council regulations apply the same dual-track ownership-and-control analysis. Mapping the jurisdictional triggers before screening begins prevents the compliance team from running the wrong test on the right data.
Step 2: Screen against the correct lists – SDN, Consolidated List, and beyond
OFAC screening begins with the SDN List, but that is not the end of the exercise. The SDN List identifies blocked persons; a separate Consolidated Sanctions List maintained by OFAC covers entities subject to non-blocking restrictions, sectoral sanctions, and other programme-specific prohibitions. Both lists must be checked. Checking only one gives a false clean result.
For a transaction with a UN nexus – or where the counterparty operates in a jurisdiction whose regime derives from Security Council resolutions – the UN Consolidated List maintained by the Security Council committees is a third required check. It operates independently of OFAC's lists, and a person or entity can appear there without appearing on the SDN List, or vice versa.
Name-matching quality determines the reliability of the screen. Transliterated names, name variants, and aliases appear frequently on sanctions lists. A phonetic-only match engine will miss variant spellings; a loose fuzzy-match engine will produce so many false positives that the compliance team begins overriding alerts without proper review. The practical standard is a matching engine calibrated to the specific lists and entity types in scope, with a documented alert-review process that distinguishes confirmed hits, possible matches requiring enhanced review, and clear non-matches.
The UN Consolidated List, OFSI's asset-freeze list, and the EU's consolidated list must also be checked wherever those regimes are triggered. In a cross-border transaction touching US, UK, and EU interests simultaneously, a clean OFAC screen is a necessary condition – but it is not sufficient.
Step 3: Trace ownership to apply the 50 percent rule
The 50 percent rule is where counterparty due diligence most often fails. Screening the named counterparty against the SDN List and finding no match is not the end of the analysis. OFAC's rule requires tracing every layer of ownership to determine whether, in the aggregate, blocked persons own 50 percent or more of the entity. A company 100 percent owned by a non-listed holding company that is in turn 60 percent owned by an SDN is itself treated as blocked – even though neither the immediate counterparty nor its direct parent appears on any list.
The aggregation point deserves particular attention. If two separately listed persons each hold 30 percent of the same target entity, neither crosses the threshold alone. Together they reach 60 percent and the entity is blocked. Screening tools that process shareholders in isolation miss this pattern entirely. The correct approach is to aggregate all listed-person holdings at each level of the chain before applying the threshold test.
How deep must the ownership trace go? OFAC does not prescribe a fixed number of levels, but the standard applied in enforcement is practical: go as deep as the available ownership information reasonably permits, and document the reasoning where information runs out. For listed entities operating in jurisdictions with limited corporate registry disclosure, that documentation – explaining what was available, what was searched, and what could not be confirmed – is part of the defensible record.
OFSI's and the EU's ownership-and-control test adds a further dimension. Under those regimes, even a minority holding can capture an entity if a listed person exercises control – through board rights, contractual arrangements, or effective direction of commercial decisions. A counterparty that clears the OFAC 50 percent screen but is subject to a listed person's effective control may still be prohibited under OFSI or EU rules. In a transaction with UK or EU nexus, both tests must be run in parallel.
What risk flags require enhanced due diligence?
Standard list-screening identifies direct exposure. Enhanced due diligence is warranted when specific risk indicators suggest that exposure may be indirect, obscured, or newly created. Identifying those indicators before they materialise into a compliance failure is the purpose of this step.
The most common flags in our cross-border practice include: ownership structures with nominee shareholders or bearer interests in jurisdictions that limit registry transparency; counterparties that have recently restructured shareholdings without an obvious commercial rationale; payment instructions routed through a third country or third-party account not identified in the contract; end-use declarations that do not match the goods being supplied; and counterparties incorporated in jurisdictions that appear prominently in OFAC programme scopes. None of these flags is conclusive. Each is a reason to pause and investigate further rather than to proceed on the basis of the initial screen.
Geographic risk is a distinct category. Certain jurisdictions appear as high-risk indicators under multiple OFAC programmes. Transactions involving parties incorporated, registered, or operationally present in those jurisdictions call for a higher level of scrutiny across the ownership chain, not just at the counterparty level. The question is not whether the counterparty is itself listed; it is whether the transaction, viewed as a whole, presents a pattern consistent with sanctions exposure.
A practical cross-border note: BIS's Entity List and Denied Persons List, maintained by the US Bureau of Industry and Security under the Export Administration Regulations, are separate instruments. Neither maps directly onto OFAC's SDN List. A counterparty can be clean against OFAC screening and still be a restricted party under the EAR. For transactions involving controlled technology or dual-use goods, both sets of lists are required reading.
The position above covers the standard case. Your facts – the counterparty's ownership chain, the goods or funds in question, the clearing route, and the regimes that are triggered – change the analysis materially.
To discuss a specific counterparty screening question, contact Calder & Vance at info@caldervance.com.
Step 4: Document the process and maintain the record
A defensible counterparty due diligence process is one that was done correctly and can be shown to have been done correctly. The documentation record serves two distinct functions: it supports an internal audit trail, and it provides the foundation for any voluntary self-disclosure or enforcement defence if a potential violation is subsequently identified.
The minimum record for each counterparty screen should capture: the date of the screen and the lists checked; the version of each list used (lists are updated frequently, and a screen against a list that was already superseded carries limited weight); the search methodology and threshold settings; the outcome of each alert reviewed; and the identity of the person who conducted and approved the review. Where enhanced due diligence was triggered, the record should also capture the risk flags identified, the additional steps taken, and the conclusion reached.
Record retention matters. OFAC's regulations specify a record-keeping period; in our practice we advise maintaining counterparty screening records for a minimum of five years from the date of the transaction, consistent with the standard period applied across the major US sanctions and export-control regimes. Where a UK or EU nexus exists, OFSI's and the EU's own record-keeping standards apply in parallel and should be checked against the applicable country regime.
A VSD (voluntary self-disclosure to a regulator) – should a potential violation come to light – is a significant mitigating factor in OFAC enforcement. A well-maintained record is the prerequisite for preparing an effective VSD. The absence of documentation, conversely, removes the ability to demonstrate that the apparent violation was isolated, promptly identified, and not the product of a systemic failure.
Step 5: Re-screen at material changes and build a monitoring programme
Initial screening at onboarding is necessary but not sufficient. Sanctions lists change – sometimes daily. A counterparty that was clean at the time of contracting can become a blocked entity at any point during a long-term commercial relationship. Periodic re-screening, and re-screening triggered by specific events, is an integral part of a defensible OFAC compliance programme.
Event-based triggers should include: a change in the counterparty's ownership or control structure; a change in the counterparty's jurisdiction of incorporation or operation; any public-domain information suggesting a connection to a listed person or a programme-relevant jurisdiction; and any change in the nature of the goods or services being supplied that alters the export-control classification or end-use risk. The monitoring obligation is not passive; it requires the compliance team to remain attentive to signals across the relationship's lifespan, not only at the point of onboarding.
Financial institutions face an additional layer of ongoing obligation. Correspondent banking arrangements, trade finance facilities, and payment processing functions all create recurring exposure to counterparties and underlying obligors who may post-date the initial screen. In our experience, the institutions most exposed to OFAC enforcement action are those whose monitoring programmes were built for static lists and have not been updated to reflect the current pace of designations.
For virtual-asset service providers, the monitoring challenge is compounded by the pseudonymous nature of blockchain addresses. OFAC has published guidance on screening obligations for VASPs, making clear that the general programme obligations apply. Wallet-address screening against OFAC's published cryptocurrency addresses is a distinct requirement, separate from entity-name screening.
A common misconception: "we are not a US company, so OFAC does not apply to us"
This is the most persistent myth in cross-border compliance work, and it creates significant exposure. OFAC's jurisdiction extends extraterritorially in several important respects. Any transaction cleared in US dollars through the US correspondent banking system is within OFAC's reach for the duration of that clearing leg, regardless of the nationalities of the parties. US-origin goods, software, and technology are subject to US export-control and sanctions restrictions wherever they travel. Secondary sanctions – which do not require a US nexus in the transaction but penalise non-US persons for certain dealings with designated parties – extend OFAC's practical reach further still.
The practical consequence is that a European, Asian, or Gulf-based business with no US office, no US shareholders, and no US customers can nonetheless face OFAC enforcement exposure if it processes US dollar payments, handles US-origin technology, or engages in activity targeted by OFAC's secondary sanctions authority. The specific scope of secondary sanctions varies by programme and is subject to change; verify the current position in the relevant programme before relying on any general statement about extraterritorial reach. What is consistent across programmes is that the question "does OFAC apply to us?" cannot be answered by reference to nationality or domicile alone.
In a recent matter, a manufacturing business headquartered in a non-US jurisdiction had operated for several years on the assumption that its US dollar payments were a logistical detail rather than a jurisdictional trigger. A counterparty review prompted by a proposed acquisition revealed that one of the business's long-standing suppliers had a listed shareholder at the second level of ownership. We assessed the ownership chain, advised on the steps required to remediate the position, and assisted in preparing the documentation to support the business's compliance posture. The matter was resolved without a referral, and the acquisition proceeded on an adjusted timeline.
If a transaction has already been flagged, or a potential issue has been identified in an existing relationship, an early review preserves options that narrow with the passage of time. Contact Calder & Vance at info@caldervance.com for a confidential initial review.
Related practices
- Sanctions compliance audit and testing – stress-testing screening programmes against major regime standards
- Counterparty due diligence: advanced ownership tracing – deeper analysis of layered structures and nominee arrangements
- Counterparty due diligence: OFSI and EU comparisons – how the UK and EU control tests diverge from the OFAC rule