A trading company in Birmingham is finalising a distribution agreement with a partner it has worked with for three years. The relationship is established. The paperwork is ready. Then a junior compliance analyst notices that a name in the partner's corporate structure looks familiar. The firm pauses. Is this a match? Is the partner itself restricted? Does the transaction need a licence? The deal is worth more than a year's margin – and the answer has to come before signing.
Counterparty due diligence under OFSI (the Office of Financial Sanctions Implementation, the UK authority responsible for administering and enforcing financial sanctions) is a structured process: identify all relevant persons in the ownership and control chain, screen them against the UK Consolidated List and all applicable UN designations, apply the ownership-and-control test under the relevant thematic sanctions regulations, assess the transaction type, and document the analysis. As of July 2026, OFSI's enforcement posture is active and the civil monetary penalty regime operates on a strict-liability basis for financial sanctions breaches, meaning intention is not a defence to liability.
This guide walks through each step of the process, explains where the UK regime diverges from OFAC and EU approaches, and identifies the risk flags that most commonly produce enforcement exposure.
Step 1: Identify exactly who and what you are screening
Effective counterparty due diligence begins before any database is queried: the first task is to define the complete population of persons and entities whose sanctions status is relevant to the proposed transaction.
For most commercial transactions, the population includes the direct counterparty, any entity that is a party to the contract or a beneficiary of payment, the ultimate beneficial owner or owners of each of those entities, and any intermediary through whom funds will pass. For trade transactions, it extends to freight forwarders, agents, and consignees. The UK rules impose obligations not just on the direct counterparty relationship but on the funds flow: a payment routed through a restricted person's account, even innocently, may constitute a dealing in funds or economic resources.
In our experience, the most consistent gap at this stage is the failure to identify the full beneficial ownership chain. A corporate structure with two or three intermediate holding companies, one of which is in a jurisdiction with limited company disclosure, requires active investigation – not just a search of the primary entity name.
Collect, at minimum: the full legal name of each entity, any trading names or previous names, company registration numbers, jurisdiction of incorporation, registered and principal place of business, and the names, dates of birth, and nationalities of all natural persons with a direct or indirect ownership or control interest above the applicable threshold. Where corporate disclosure is incomplete, request documentation directly from the counterparty.
Step 2: Apply the UK ownership and control test
Under UK financial sanctions, an entity is caught as a designated person if a listed person owns more than 50 percent of it, directly or indirectly, or if a listed person otherwise controls it – and control under the UK rules is a broader, more judgment-intensive test than the mechanical OFAC threshold.
This is the point at which the UK regime diverges most sharply from US practice. Under OFAC's approach, the ownership test is binary: 50 percent or more in aggregate by one or more blocked persons triggers designation-equivalent status, regardless of how the ownership is held or whether actual control is exercised. The UK ownership and control test (the test applied by OFSI under SAMLA and the relevant thematic regulations) adds a control limb: a listed person who holds less than 50 percent but can nonetheless direct the activities of the entity, or veto its decisions, may still bring that entity within the prohibition.
The EU position is similar to the UK in this respect: the EU ownership and control test also includes a control limb, assessed against criteria such as the ability to appoint the board majority or to determine strategic decisions. The practical consequence for a cross-border business is that an entity cleared at 35 percent ownership under a strict OFAC analysis may still require further diligence under OFSI or EU rules if there is any evidence of operational influence by the listed person.
Work through the analysis in two stages. First, aggregate direct and indirect ownership interests held by all listed persons and assess whether, in aggregate, they reach the threshold. Second, consider the control question: review any shareholders' agreement, constitutional documents, or known governance arrangements for indicators that a listed person can direct, veto, or significantly influence decisions.
Document both stages. The control question is fact-specific and the documentation of your reasoning matters if a query later arises. OFSI expects to see that the analysis was conducted, not merely that the conclusion was reached.
Step 3: Screen against all applicable lists
Once the population of persons is defined and the ownership analysis is complete, each person in scope must be screened against the applicable sanctions lists with sufficient rigour to produce a reliable result.
For a UK-established business, the primary list is the UK Consolidated List, which is published and updated by OFSI and available via the UK Government website. That list must be searched for every person in scope, including natural persons and entities. Where the counterparty has UN-listed persons in its structure, the UN Consolidated List maintained by the Security Council is separately relevant: UN designations are implemented in UK law but checking the UN list directly is good practice where there is any UN nexus.
Screening must account for name variations, transliterations, and aliases. A counterparty whose principal shareholder's name appears in a non-Latin script requires both the transliterated form and any registered Latin-script variants to be checked. Many missed matches in our experience arise from inadequate alias handling, not from a failure to search at all.
The cross-regime dimension matters here too. Where the transaction has a US nexus – the goods are US-origin, the payment is routed through a US correspondent, or a US-person counterpart is involved – the OFAC SDN List and the Entity List maintained by BIS (the US Bureau of Industry and Security) are also relevant. An entity that is clean on the UK Consolidated List may carry a restriction on the OFAC list that blocks the payment leg of the transaction. We regularly advise clients who have managed the OFSI question carefully but have not considered the concurrent BIS exposure.
Where the transaction also has an EU dimension – a counterpart in a member state, or goods transiting through EU territory – the EU Consolidated List must also be checked. Designations do not automatically map one-for-one between regimes: the UK, US, and EU lists have diverged following the UK's departure from the EU, and a designation on one list does not guarantee designation on another.
Step 4: Assess the transaction type and the applicable prohibition
A clean screening result does not end the analysis. The next step is to assess whether the proposed transaction engages a prohibition that operates independently of designation status – a territorial, sector-based, or goods-based restriction.
UK financial sanctions prohibitions fall broadly into three categories: asset freezes against designated persons and entities; restrictions on making funds or economic resources available to or for the benefit of a designated person; and, in some thematic regimes, specific prohibitions on particular categories of transaction regardless of counterparty designation status. The last category requires separate assessment against the specific sanctions regulations applicable to the relevant country or thematic programme.
The transaction type also determines the identity of the regulated person. Financial institutions, payment processors, and currency exchanges are subject to obligations that attach to the movement of funds. Businesses providing non-financial services must consider whether those services constitute economic resources and whether the recipient could be a designated person or a controlled entity. A law firm, for instance, must consider whether its legal services constitute making economic resources available.
Consider the goods or services being transferred. Where the transaction involves items subject to UK strategic export controls – controlled under the Export Control Order and licensed by ECJU (the Export Control Joint Unit) – a dual-use or military classification may engage an additional licensing requirement that operates alongside the OFSI sanctions analysis. The question "is this a controlled item?" runs in parallel with, not instead of, the sanctions screen.
Step 5: Manage matches, near-matches, and uncertain results
A potential match on screening must be evaluated and resolved before the transaction proceeds. The procedure for doing so is not the same as the procedure for clearing a false positive, and treating them identically is a common source of risk.
A false positive is a match generated by a name coincidence with no substantive connection to a listed person. Resolving a false positive requires documented evidence – typically identity documents, company filings, or other primary source data – that the match is not the listed person. The resolution must be recorded. An undocumented clearing decision is not a clearing decision for compliance purposes; it is simply a decision that cannot be proved.
A true match or a situation where doubt remains requires a different response. Where a transaction involves a designated person, the UK financial sanctions prohibition engages immediately. The business must not proceed with a prohibited transaction. It must also consider its reporting obligations: OFSI expects that firms which identify or suspect a sanctions breach report that to OFSI. Timing matters. A delayed report, particularly after a transaction has proceeded in uncertain circumstances, substantially affects OFSI's assessment of good faith.
Where there is genuine uncertainty – the match is plausible but the evidence is inconclusive – the appropriate step is to pause, escalate to senior compliance or legal counsel, and if necessary seek confirmation from OFSI or advice from sanctions counsel before proceeding. OFSI has mechanisms for informal engagement and, in some circumstances, provides written confirmation of its position. That route is not fast, but it is available and it is preferable to proceeding on a doubtful basis.
In a recent matter, a financial services business identified a near-match on a payment instruction. The name and jurisdiction were consistent with a listed entity but several identifiers were different. We reviewed the ownership structure, cross-checked the identifying data against company filings in the relevant jurisdiction, and documented a reasoned conclusion that the match was a false positive. The matter was closed with a full written record that would withstand subsequent scrutiny.
Step 6: Document the analysis and maintain the record
Documentation is not an administrative formality. Under UK sanctions law, the ability to demonstrate a thorough, contemporaneous analysis is the principal defence available if the transaction is later questioned by OFSI.
The record should capture: the date and scope of the screening, the lists searched and the versions used, the ownership analysis and the evidence gathered, the resolution of any matches or near-matches, the transaction type assessment, and the conclusion reached. Where a decision involved judgment – on control, on whether an entity is caught, on how to resolve a near-match – the reasoning should be recorded, not just the conclusion.
Record-keeping requirements under UK sanctions and related AML obligations are demanding. Businesses should maintain sanctions due diligence records for a period consistent with the applicable regulatory requirements and their own record-management policies. Our practice consistently finds that records maintained for less than five years create risk in investigations or enforcement reviews, which may look back over an extended period.
Periodic refresh matters too. An initial screen at the point of onboarding is necessary but not sufficient. Counterparty status can change: a designation may be added to the list after the relationship is established. In our practice we recommend a documented refresh at a frequency that reflects the risk profile of the counterparty – more frequently for high-value or higher-risk relationships.
The cross-border dimension of documentation should not be overlooked. Where the business operates under multiple regimes – OFSI, OFAC, and EU rules, for instance – the due diligence file should reflect each applicable analysis separately. A single consolidated record that addresses only one regime will not satisfy regulators in other jurisdictions if the transaction is examined.
Common risk flags and when to involve counsel
Several patterns consistently produce the most serious sanctions exposure in counterparty due diligence, and recognising them early is the most effective way to manage the risk.
The first is complexity of ownership. A counterparty with a multi-jurisdictional corporate structure, a high number of intermediate entities, or significant shareholdings held through nominees or trusts should receive more intensive diligence than a simply structured business. The more layers there are, the greater the risk that a designation is present at a level the initial screen did not reach.
The second is geographic concentration. Where a counterparty operates primarily in, or its principals are nationals of, a jurisdiction subject to a thematic or country-specific sanctions programme, the analysis must extend beyond name-matching to cover the full transaction structure.
The third is unexplained payment routing. A request to route payment through a jurisdiction unconnected to the commercial relationship, or through a third-party account, should be treated as a risk indicator requiring explanation before the transaction proceeds. It does not automatically indicate a sanctions problem – but it requires examination.
What about the myth that counterparty due diligence is only required for new relationships? That view misreads the regime. The obligation to avoid dealing with designated persons is continuous, not transactional. Existing relationships that pre-date a designation become prohibited once the designation is made, and a business that continues to service an established relationship without checking against new designations is not protected by the prior history of the relationship. The correct approach is a maintained screening programme, not a one-off gateway check.
Involve counsel when: the ownership analysis produces an uncertain result on the control question; a near-match cannot be resolved through publicly available information; the transaction involves a regulated item under export controls as well as a sanctions question; you are considering seeking an OFSI licence to authorise an otherwise prohibited transaction; or a transaction has already proceeded and a subsequent match has been identified. Each of those situations involves a judgment that goes beyond the operational screening function.
Related practices
- Sanctions compliance audit and testing – assessing the effectiveness of your screening programme and controls across jurisdictions.
- Counterparty due diligence under OFSI: advanced topics – deeper analysis of control tests, licensing, and enforcement response.
- Counterparty due diligence under Singapore sanctions rules – how the Singapore regime applies to a cross-border counterparty screen.