Entity List and denied-party screening under EU: a practical guide

A manufacturing exporter based in the EU wins a major components contract with a new distributor in South-East Asia. The compliance team runs a quick name-check. The distributor clears. The shipment proceeds. Two months later, an internal audit surfaces a subsidiary of that distributor on the EU's own list of restricted parties – a party whose inclusion was updated three weeks before the shipment date. The question is not academic. Under the relevant EU dual-use regulations, the exporter may have completed a prohibited transaction without ever knowing it.

As of May 2026, denied-party screening (the process of checking counterparties, end-users, and intermediaries against official lists of restricted or prohibited parties) under the EU regime is governed by the Council Regulation on dual-use item controls and the relevant thematic financial-sanctions regulations, administered by the European Commission and national competent authorities. The EU does not operate a single consolidated "Entity List" in the US sense; instead, exporters must check several overlapping lists – the EU Consolidated Financial Sanctions List, the EU Common Foreign and Security Policy restriction lists, and the dual-use end-user and end-use provisions of the applicable dual-use regulation. Compliance counsel with cross-border export-control experience will confirm that missing any one of those sources can invalidate an otherwise careful screening run.

This guide walks through the legal basis for EU screening obligations, the lists that matter and where they diverge from their US and UK equivalents, the step-by-step screening procedure a compliance team should follow, the common points of failure, and the situations that call for specialist advice.

What is the EU legal basis for denied-party screening?

EU denied-party screening obligations arise from two distinct bodies of law that operate simultaneously. The first is the EU dual-use regulation, which controls the export, transit, brokering, and technical assistance for items that have both civilian and military applications. The second is the body of EU financial-sanctions regulations enacted under the Common Foreign and Security Policy, each covering a specific geographic or thematic programme. Both impose obligations on exporters, but the legal trigger, the list to be checked, and the competent authority differ between them.

Under the dual-use regulation, the core obligations attach to the exporter at the moment of export or, in some cases, at the moment of providing technical assistance. The regulation requires the exporter to check not only the direct consignee but also the end-user, the end-use, and intermediaries in the supply chain who may re-export the goods. This is a broader obligation than many exporters realise. A customs-declaration-only check misses the end-use control entirely.

Under the financial-sanctions regulations, the obligation is different in character. An EU-incorporated entity – or any person conducting business within the EU – must not make funds, economic resources, or services available to a designated person or entity. The designated party does not need to be the buyer; it can be any party to the transaction, including a freight forwarder, a paying bank, or an intermediate holding company. The EU's ownership and control test (the rule that a non-listed entity controlled or owned at a significant threshold by a designated person can itself be treated as restricted) extends the reach of financial-sanctions screening beyond the names on the list itself.

The position above covers the standard case. Your facts – the goods, the counterparty, the jurisdictions involved, the potential for re-export to a third country – change the analysis materially.

For an initial assessment of your EU screening obligations, contact Calder & Vance at info@caldervance.com.

Which lists must EU exporters check – and how do they differ from the US Entity List?

The EU does not have a single instrument equivalent to the US Commerce Control List (CCL) or the BIS Entity List (the BIS-maintained list of foreign parties subject to specific licence requirements under the Export Administration Regulations). Instead, EU exporters must consult multiple overlapping sources, each with a different legal basis and a different set of consequences.

The primary sources are:

• The EU Consolidated Financial Sanctions List – maintained by the European Commission's Directorate-General for Financial Stability, Financial Services and Capital Markets Union (DG FISMA). It consolidates all designations made under all active EU sanctions regulations. This is the baseline check for financial-sanctions purposes.
• The UN Security Council Consolidated List – incorporated into EU law by the relevant Council Regulation implementing Security Council resolutions. EU operators are bound by UN-listed designations directly through EU implementing measures.
• The end-user and end-use provisions of the EU dual-use regulation – these are not a named list but a series of case-by-case obligations. If an exporter knows or has reason to believe that items will be used in a prohibited end-use (such as weapons of mass destruction programmes), the export is prohibited regardless of whether any party appears on a formal list. This catch-all is the most frequently overlooked element.
• The national lists of competent authorities – several EU member states publish additional national guidance on parties of concern that supplements the EU-level instruments. The legal weight and the practical consequences of these national lists vary by member state.

By contrast, the US Entity List is a single, publicly searchable instrument administered by BIS. It imposes specific licence requirements on exports, re-exports, and in-country transfers to listed parties, and it carries a defined licence review policy for each listed party. The US also operates the SDN List (OFAC's list of Specially Designated Nationals and blocked persons), the BIS Denied Persons List, and the BIS Unverified List, each with distinct consequences.

For UK exporters, OFSI administers the UK financial-sanctions list under SAMLA, while the ECJU administers export-licensing obligations under the Export Control Order. Post-Brexit, the UK list is distinct from the EU Consolidated Financial Sanctions List, and divergences between the two have grown. A business screening for EU obligations must run a separate check for UK purposes if any part of its group, supply chain, or distribution network has a UK nexus.

The practical implication of the multi-list structure is that a screening tool calibrated only to the EU Consolidated Financial Sanctions List will miss dual-use end-use obligations and any relevant national guidance. We regularly advise exporters who have screened only one layer and assumed that a clean result covered their entire obligation.

Step-by-step: how to run a compliant EU denied-party screening process

A compliant EU denied-party screening process has seven distinct stages, and each stage addresses a different source of legal risk. Missing a stage does not merely create a gap in the paperwork – it can expose the exporter to criminal or civil liability under the national law implementing the EU regulations.

1. Identify all parties to the transaction. This means the buyer, the end-user, any intermediate distributor or agent, the freight forwarder, the paying bank, and any known re-export destination. Financial-sanctions obligations attach to any of these parties, not only the buyer named on the purchase order.
2. Classify the goods or technology. Before checking lists, confirm whether the item is listed under the EU dual-use regulation's control lists (Annex I). Unlisted items are not exempt from end-use controls; they may still be subject to catch-all provisions. Where the item has an ECCN (Export Control Classification Number under the US Commerce Control List) from a previous US classification exercise, use it as a starting point but do not assume it maps directly to the EU classification.
3. Check all parties against the EU Consolidated Financial Sanctions List. Use the official Commission screening tool or an integrated compliance system that draws from the same source. Record the date and result of the check. The record is your compliance evidence if the transaction is later reviewed.
4. Check against the UN Consolidated List. Many screening tools incorporate this automatically, but verify. A party can be UN-listed without yet appearing on the EU Consolidated Financial Sanctions List if the EU implementing regulation has not yet been adopted.
5. Apply the ownership and control test. If no direct hit is found, consider whether any party is owned or controlled by a designated person. The EU ownership and control test is not purely mechanical in the way OFAC's 50 percent or more rule operates; it also encompasses effective control through other means. In our experience, this is the test most frequently skipped, and it is the test that produces the most unexpected exposure.
6. Apply the end-use and end-user check. This is separate from the list check. Ask whether the stated end-use is plausible given the buyer's sector and geography. Apply the red-flag indicators published by the relevant dual-use authorities. If any red flag is present, the export may require an individual licence even if no party is on any list.
7. Record and retain the screening results. Under the EU dual-use regulation and the financial-sanctions regulations, record-keeping obligations apply for a defined period after the transaction. Ensure that the records cover not only the final result but the methodology, the data sources used, and any risk assessment performed. A well-maintained record can be the decisive factor in an enforcement inquiry.

Each of these stages should be documented in a written procedure that is reviewed and updated at least annually, and whenever the applicable regulations change materially.

What are the most common risk flags and points of failure in EU screening?

The most common point of failure in EU denied-party screening is over-reliance on a single list and a single check at the time of contract. Screening is not a one-time event. Designations are added between the date of contract and the date of shipment, between the date of shipment and the date of payment, and at any point during an ongoing supply relationship. A party that was clean at the point of contracting can be designated before the funds are transferred.

Other persistent risk flags include:

• Indirect routing. A consignment that passes through a third-country intermediary before reaching the end-user creates re-export risk. If the intermediary is in a jurisdiction with weaker controls, the exporter's EU obligations may still attach if the exporter knows or has reason to believe the ultimate destination involves a restricted party.
• Name and transliteration variation. Official lists carry names in varying transliterations and scripts. A screening tool that checks only a single spelling will miss phonetically identical variations. This is a known limitation of basic name-match screening.
• Legal-entity layering. Designated persons frequently hold interests through multiple layers of corporate ownership. The EU ownership and control test requires the exporter to look through the structure, not merely at the immediate counterparty.
• Technology and software transfers. Exports of dual-use technology – including software uploaded to a cloud platform accessible in a restricted jurisdiction – may trigger licensing obligations that a physical-goods screening process does not capture.
• Trade finance and payment channels. Banks processing payments for dual-use transactions are themselves subject to screening obligations. A payment that routes through a bank in a jurisdiction that applies its own screening rules may trigger additional requirements that the exporter's compliance team is not monitoring.

What happens when one of these flags surfaces mid-transaction? The answer depends on the specific regulation and the nature of the flag. Some situations call for a voluntary disclosure to the national competent authority; others require the transaction to be suspended pending a licence application. In our practice, early identification of a flag – before the goods move or the funds transfer – gives the widest range of options. Waiting for a regulator to inquire narrows those options significantly.

If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential review.

How does the EU screening regime differ from OFAC and BIS – and why does it matter for cross-border businesses?

For a business operating across the EU and the United States, the question is not which regime applies but how to manage simultaneous obligations that follow different logics. The EU and US screening regimes share the same policy objectives but diverge in structure, list architecture, and enforcement posture in ways that create practical compliance gaps.

Three divergences matter most in practice.

First, the list structure. BIS administers a dedicated Entity List with a specific licence review policy per listed party; OFAC administers the SDN List with a general prohibition on dealings. The EU, as described above, uses overlapping lists without a single "Entity List" equivalent. A party on the BIS Entity List may not appear on the EU Consolidated Financial Sanctions List, and vice versa. A business that calibrates its screening to one regime and assumes the other is covered will miss parties that appear on only one list.

Second, the ownership and control test. OFAC applies its mechanical 50 percent or more rule: if blocked persons own 50 percent or more in aggregate, the entity is blocked, regardless of control mechanisms. The EU and UK tests extend to effective control even below an ownership threshold. A counterparty that clears the OFAC 50 percent test may still be caught under the EU or UK test if a designated person exercises board-level control. In our cross-border practice, this divergence is one of the most frequent sources of compliance gaps for multinationals that use a US-designed screening protocol for EU operations.

Third, the extraterritorial reach. The US exercises significant extraterritorial jurisdiction, particularly in relation to US-origin technology under the EAR and through the secondary-sanctions framework. EU financial-sanctions obligations, by contrast, apply primarily on the basis of territorial nexus (EU establishment or EU-currency transactions). However, the EU dual-use regulation imposes controls on brokering and technical assistance even where the goods are outside the EU, if certain conditions are met. A UK exporter relying on post-Brexit OFSI and ECJU obligations must maintain a separate check against both the UK list and the EU list where any part of the transaction chain has an EU nexus.

Does your current screening programme account for all three of these divergences? If the answer is uncertain, the programme carries residual risk that may not be visible until a transaction is reviewed.

Related practices

• Deemed export and technology controls under BIS/EAR – classification, licence requirements, and end-use controls for US-origin technology
• Entity List and denied-party screening: EU guide (part 3) – deeper analysis of the ownership and control test and enforcement trends

When should a business involve sanctions and export-control counsel?

A common assumption is that specialist counsel is only needed after a problem has surfaced – an enforcement notice, a failed transaction, or a customs hold. That assumption is understandable, but it is wrong in the EU export-control context, where the cost of reactive advice almost always exceeds the cost of preventive work.

The situations that call for early involvement of compliance counsel include:

• Setting up or reviewing a screening programme for the first time, or after a material change in the business's product range, customer geography, or supply chain.
• A transaction involving end-users in jurisdictions where the dual-use regulation's catch-all provisions are most likely to apply, or where re-export risk is elevated.
• A merger, acquisition, or joint venture that introduces new counterparties, new supply chains, or new technology streams that have not previously been screened.
• An apparent hit on a screening check – where a party's name matches a listed party or a known related entity – that the internal team cannot resolve to a clear pass or a clear fail.
• A request from a counterparty for technology, software, or technical assistance that may fall within the scope of the dual-use regulation's brokering or transit controls.
• Any indication that a past transaction may have involved a restricted party, including an unsolicited inquiry from a national competent authority.

We regularly advise compliance teams who have identified a potential issue and need an independent assessment of whether the facts require a voluntary disclosure, a licence application, or – in some cases – neither. The analysis is fact-specific and regime-specific, and the window for taking the most favourable action can be short.

The myth worth correcting here is that EU enforcement is uniformly less aggressive than OFAC enforcement, and that EU-only businesses therefore carry lower sanctions risk than their US counterparts. EU financial-sanctions enforcement powers have been strengthened materially in recent years, and member states implement those powers with varying levels of activity. A business that has structured its compliance programme on the assumption that EU regulators will not pursue a case is taking a risk that the current enforcement environment does not support.