A technology distributor operating across three continents closes a supply agreement, ships the first consignment, and only then discovers the end-user appears on the US Commerce Department's Entity List (the list of foreign parties subject to specific licence requirements under the Export Administration Regulations, administered by the Bureau of Industry and Security). The shipment has already moved. The question is no longer whether to screen – it is what the exposure looks like and whether voluntary self-disclosure can limit the damage.
Effective entity list and denied-party screening cross-border requires a business to check counterparties against multiple lists simultaneously: the BIS Entity List, the OFAC SDN List (Specially Designated Nationals and blocked persons), the EU Consolidated Sanctions List, the UK OFSI financial-sanctions list, the UN Security Council Consolidated List, and the relevant national lists for any other jurisdiction in the transaction chain. As of May 2026, a single-list approach is no longer adequate for any business with a cross-border footprint.
This guide sets out the step-by-step process for building a screening programme that works across the major regimes, explains where the tests diverge, identifies the risk flags that most compliance teams miss, and tells you when to bring in external counsel. The guide follows a decision-tree structure: at each step, the right path depends on your firm's facts.
Step 1 – Identify which lists apply to your transaction
Before any name is run against a database, you must map the lists that govern the transaction. The lists that apply turn on three factors: the nationality of your business, the nature of the goods or technology, and the route the transaction takes.
US jurisdiction attaches when the exported item is subject to the Export Administration Regulations (the EAR, the primary US export-control instrument), when a US person is involved, or when the item passes through US financial infrastructure. That jurisdiction triggers the BIS Entity List and, separately, the Denied Persons List and the Unverified List. OFAC's SDN List operates in parallel: it is not a BIS instrument, but it governs the same transaction if the counterparty is a designated party under any OFAC programme. The two regimes are legally distinct, maintained by different agencies, and can produce different results on the same name.
EU jurisdiction attaches through the nationality of the exporting entity, the location of goods within the EU, or the re-export of EU-origin controlled items. The EU Dual-Use Regulation and the relevant thematic Council Regulations each produce separate list obligations. UK businesses face an analogous split between the ECJU export-licensing regime and OFSI's financial-sanctions lists under the Sanctions and Anti-Money Laundering Act.
The practical consequence is that a shipment from a German subsidiary of a US parent, carrying items with both US-origin components and EU-classified dual-use status, may require simultaneous checks against five or more lists. Map the nexus points first, then build the list set. Skipping this step is the single most common driver of incomplete screening.
Step 2 – Understand what each list actually prohibits
Each list carries a different legal consequence, and conflating them creates both under-compliance and over-compliance problems.
The BIS Entity List is not a prohibition list in the same sense as OFAC's SDN List. Appearance on the Entity List means that exports, re-exports, or in-country transfers of EAR99-designated items (items subject to the EAR but not listed on the Commerce Control List) that would otherwise require no licence now require a specific licence. For controlled items already requiring a licence, the Entity List imposes additional review criteria. BIS will typically apply a presumption of denial when reviewing applications for listed parties.
Appearance on the OFAC SDN List means that all property and interests in property of the listed person subject to US jurisdiction are blocked, and US persons are generally prohibited from dealing with them. The scope is broader and the prohibition more absolute. There is no automatic licence pathway.
The EU and UK lists operate differently again. Both apply an ownership and control test (the test for whether a non-listed entity is caught because a listed person owns or controls it), which means that a non-listed counterparty can still be subject to restrictions if it is owned or controlled by a listed person. The EU and UK tests on "control" are more expansive than the US 50 percent or more ownership rule under OFAC, which is mechanical. Under OFSI and the EU, a listed person exercising decision-making influence without majority ownership can still bring a company within scope.
Understanding which prohibition attaches to which list determines what action a hit actually requires. A compliance team that treats every list hit as a hard block will refuse lawful transactions. One that treats the Entity List as equivalent to a minor advisory flag will miss genuine export violations.
Step 3 – Build the screening logic correctly
Screening logic is where most cross-border programmes fail in practice. The common errors are not failures of intent; they are architectural. In our experience, the three most frequent structural problems are: too narrow a name-matching threshold, an entity set limited to direct counterparties only, and a refresh cycle that does not match the pace of list updates.
Name-matching requires fuzzy logic calibrated for transliteration variants, name reversals, alternative spellings, and known aliases. OFAC's SDN List carries alias data explicitly; BIS entity entries are less consistent. A matching threshold set too tight will miss aliases; set too loose, it floods the team with false positives that erode confidence in the system. The right calibration depends on the volume of your transactions and the nature of your counterparty pool. There is no universal setting.
Entity scope must extend beyond the direct buyer. The EAR's restrictions follow the item to the end-user, not just the immediate purchaser. This means the freight forwarder, the consignee, the ultimate end-user stated in the export documentation, and any intermediate party with a known role in the transaction all require screening. Have you screened the freight forwarder as well as the buyer?
Refresh cycles matter because list updates are continuous and unpublished in advance. OFAC publishes updates without notice. BIS amends the Entity List through a Federal Register notice, but the effective date can follow a short publication window. A screening programme that runs checks only at onboarding and not at transaction execution will miss designations that occur between those points. Best practice is to screen at onboarding, at transaction execution, and on a periodic basis for existing relationships.
If your counterparty is in a high-risk jurisdiction – what changes?
Where the counterparty is located in, or is routing goods through, a jurisdiction subject to a comprehensive or near-comprehensive sanctions regime, the screening obligation intensifies. The lists that apply multiply, and the risk of secondary sanctions (restrictions that apply to non-US parties engaging in transactions with sanctioned jurisdictions or persons, not just to US persons) becomes a live consideration.
BIS maintains country-level controls in addition to the party-specific Entity List. Items classified on the Commerce Control List carry licence requirements that vary by destination. The existence of a country-level control does not replace the obligation to screen the specific party; both apply simultaneously.
The EU and UK regimes also maintain transaction-level prohibitions for certain destination jurisdictions that operate independently of whether a specific counterparty is listed. A transaction might pass every party-screening check and still require a licence or be prohibited because of the destination-country regime.
For businesses operating between, for example, the United States and the European Union, the divergence between the regimes is manageable if screened systematically. For businesses with supply chains extending into markets subject to overlapping national restrictions – including those administered by Singapore's MAS, Japan's METI, or the UAE – the list set expands further. Each of those jurisdictions maintains its own denied-party or restricted-party controls alongside its adoption of UN Security Council measures. We regularly advise clients on assembling the correct multi-regime list set before a new market entry, rather than retrofitting it after a problem arises.
Step 4 – Handle a hit correctly
A screening hit is not a confirmed violation. It is a signal requiring a structured response. The process for handling a hit differs depending on which list produced it and what the match quality is.
The first task is match assessment: is the entity in the transaction the same legal or natural person as the listed party? Name, jurisdiction of incorporation or nationality, address data, and identification numbers should all be cross-referenced. A false positive resolved promptly, with documentation, is a closed matter. An unresolved hit that proceeds to transaction execution without documentation is a potential violation.
If the match is confirmed, the next step depends on the list. For an OFAC SDN match, the transaction is blocked and the property may need to be reported to OFAC within a short statutory window. For a BIS Entity List match, the transaction requires a specific licence before it can proceed. For an EU or UK match, the financial-sanctions rules and any applicable export-licensing requirement must be assessed in parallel. The regimes do not share a unified process.
In our practice, the decision that matters most at the hit stage is whether to stop unilaterally, to seek a licence, or to make a voluntary report. Each path has a different risk profile and a different timeline. Stopping without documentation leaves no record of compliance intent. Proceeding without a licence, even under honest uncertainty, can constitute a violation. A voluntary self-disclosure – VSD (a report to the regulator disclosing a potential violation before the agency detects it) – is a mitigating factor in enforcement proceedings under both OFAC and BIS frameworks, but the timing and content of a VSD are legally significant and should not be prepared without counsel.
Step 5 – Document the programme and maintain records
A screening programme that functions correctly but leaves no audit trail provides limited protection when an agency asks for evidence of compliance intent. Documentation is not a formality; it is substantive evidence of the programme's existence and operation.
Records should capture the search undertaken (the lists checked, the tool used, the date and time), the result (hit or no hit), any match-assessment process for a positive result, and the decision taken. Under the EAR, records related to export transactions must be retained for five years from the date of the export, re-export, or other regulated activity. OFAC's record-keeping expectation under its compliance guidance aligns with that period. UK and EU record-keeping requirements under the relevant thematic instruments are broadly comparable, though each regime should be verified against the current instrument.
A programme that cannot demonstrate its own operation – that has no logs, no decision memos, and no escalation records – is difficult to defend in an enforcement context. Conversely, a well-documented programme that uncovers and reports a violation voluntarily is treated materially differently from a programme that has no records and a discovered violation. Documentation is the practical difference between the two outcomes.
Where do the major regimes diverge, and why does it matter?
The most important divergence across regimes is the standard for what makes a non-listed entity subject to restrictions. Under the US OFAC regime, the test is mechanical: 50 percent or more aggregate ownership by blocked persons triggers blocked status in the owned entity, whether the holding is direct or indirect. Control is not the primary test; ownership is.
Under OFSI and the EU Council regulations, the ownership threshold captures majority ownership, but a separate "control" limb extends the analysis. A company can be subject to restrictions because a listed person exercises decisive influence over its decisions, even without a majority shareholding. This is the ownership-and-control test, and it operates as a genuine extension of the listed-person's reach into corporate structures that the mechanical US test would leave outside scope.
The practical implication for a cross-border screening programme is that a counterparty cleared under a US-only OFAC ownership analysis may still be caught under OFSI or an EU Council Regulation. A screening decision taken only with reference to OFAC methodology is incomplete for transactions with UK or EU nexus. We have seen this gap produce real exposure for businesses that assumed one regime's clearance served for all.
A second divergence is the reach of secondary sanctions. US law creates restrictions that can apply to non-US persons engaging in certain transactions involving designated parties or jurisdictions. EU and UK regimes do not currently operate secondary-sanctions regimes of equivalent breadth, though both have mechanisms to restrict facilitation by EU or UK persons. The secondary-sanctions exposure is primarily a US-law risk, but it attaches to non-US businesses with any US nexus – including dollar-clearing, US-origin goods, or US-person involvement in the transaction chain.
A third divergence concerns the speed of list updates. OFAC can designate a party and simultaneously identify new blocked property without prior notice. BIS amendments to the Entity List follow a published Federal Register process, but can take effect quickly. EU Council designations require a Council decision and publication in the Official Journal, which typically introduces a short but real notice period. UK designations under SAMLA can take effect on publication, without the Council mechanism. A cross-border screening system must be calibrated to the fastest-updating regime in the set, not the slowest.
The position above covers the general case. Your facts – the goods, the parties, the jurisdictions, the ownership structure – change the analysis materially. If a transaction involves parties in multiple regimes simultaneously, or if a hit has already occurred, an early review by export-control counsel can preserve options that close quickly.
Common risk flags and when to involve counsel
Several fact patterns recur as sources of screening failure in cross-border operations. Recognising them early is the most efficient form of risk management.
The first flag is a corporate structure with multiple tiers of holding companies in different jurisdictions. The screening of the immediate counterparty's name will not reveal a listed person two or three layers up. An ownership-chain mapping exercise – verifying the beneficial ownership through to natural persons or clearly non-listed institutional investors – is required for any counterparty where the ownership is not transparent from public sources.
The second flag is a change in the counterparty's ownership after onboarding. A party screened and cleared at the beginning of a commercial relationship may subsequently acquire a listed shareholder. Without a periodic refresh of the screening exercise against existing counterparties, the change is invisible until a transaction is already in progress.
The third flag is a freight or logistics intermediary that routes shipments through a jurisdiction subject to country-level controls. The item may be licensed for the stated destination but not for an intermediate stop. End-use and end-user documentation – the statement by the ultimate recipient of the item, its intended use, and the undertaking not to re-export without authorisation – is part of the compliance record and should be collected for all controlled items.
The fourth flag is a counterparty requesting changes to documentation, payment routes, or shipping arrangements that obscure the transaction's actual end-user. This is a red-flag indicator under the EAR's Know Your Customer guidance and under equivalent guidance issued by OFSI and the ECJU. It does not require the compliance team to conclude that evasion is occurring; it does require escalation and documented review before the transaction proceeds.
Involve counsel when: a hit is confirmed and the path forward is unclear; a transaction has proceeded with an unresolved hit; a request for a BIS-specific licence or an OFSI authorisation is required; an internal audit identifies a historical gap in the screening programme; or a regulator has made contact regarding a transaction. Early involvement allows the options to be preserved; late involvement often means the only available option is a VSD in constrained circumstances.
If a transaction has already been flagged, or a filing has been refused, a prompt confidential review can preserve options that narrow with time. For an assessment of your screening programme or a specific transaction issue, contact Calder & Vance at info@caldervance.com.
Related practices
- Deemed export and technology controls under BIS/EAR – advice on US technology-transfer controls and licence requirements
- Entity List screening: EU regime guide – step-by-step analysis of EU dual-use and sanctions list obligations
- Entity List screening: EU advanced guide – ownership-and-control analysis and enforcement considerations under EU law