A UK-based distributor is finalising a sale of precision components to a Middle Eastern trading house. The compliance team has screened the buyer against OFSI's consolidated list of financial-sanctions targets. The buyer is clear. But no one has checked the US Entity List. No one has verified whether the end-user is an OFSI-designated party under a sectoral regime rather than an asset-freeze programme. The deal closes. Months later, a secondary review surfaces two concerns – and the window for voluntary disclosure has narrowed considerably.
Screening against the Entity List (the US Bureau of Industry and Security's list of parties subject to licence requirements under the Export Administration Regulations) and against OFSI's financial-sanctions targets are distinct obligations that operate under different legal regimes. As of May 2026, a business exporting dual-use goods from the United Kingdom must address both: the denied-party screening (the process of checking counterparties against all relevant restricted-party lists before a transaction proceeds) covers not only OFSI-administered UK financial sanctions but also, for goods with US-origin content or US-controlled technology, the BIS Entity List. The interaction between these two regimes is where screening failures most commonly occur.
This guide walks through the screening process in six steps, identifies the lists that matter, explains where the UK and US regimes diverge, and sets out the risk flags that should trigger a call to sanctions counsel.
Step 1: Understand which lists are in scope for your transaction
Effective denied-party screening starts by mapping every list that applies to the specific transaction – not just the one the compliance team happens to know best.
For a UK-based exporter, the primary domestic obligation arises under the Sanctions and Anti-Money Laundering Act (SAMLA) and the relevant thematic sanctions regulations made under it. OFSI administers UK financial sanctions. It publishes a consolidated list of designated persons subject to asset freezes and related prohibitions. A UK person must not deal with funds or economic resources belonging to, or for the benefit of, a designated person. That prohibition is broad: it captures payments, trade credit, advance payments, and the release of goods held in a counterparty's account.
But the OFSI consolidated list is not the only list in play. A UK exporter of dual-use goods must also consult the Export Control Joint Unit's (ECJU) control lists and, critically, must assess whether any US-origin content or US-controlled technology in the goods triggers extraterritorial obligations under the Export Administration Regulations (EAR). The Entity List, maintained by BIS, identifies parties for whom a licence is required before a US-origin item – or an item containing a threshold proportion of US-controlled content – can be exported, re-exported, or transferred. Ignoring the Entity List on the assumption that a UK business is not subject to US rules is one of the most consistent errors we see in cross-border compliance programmes.
Other lists may also be in scope. The UN Consolidated List applies to all UN member states. The EU sanctions lists – still relevant for UK businesses with EU affiliates, EU-euro-denominated transactions, or EU-flagged shipping – impose parallel but not identical obligations. Canada, Australia, Switzerland, and Singapore each maintain autonomous lists. The starting point for any screening exercise is a written list-scope determination: which lists apply, and why.
Step 2: Identify all the parties that require screening
Denied-party screening captures more than just the named buyer. A structured screening programme covers the full counterparty population relevant to a transaction.
In practice, that means: the buyer or importer of record; the ultimate consignee (the party that will actually receive the goods or technology); the end-user (the entity that will use the goods in operation); any intermediary, freight forwarder, or logistics provider in the chain; and the financial institutions involved in settling the transaction. For transactions involving corporate counterparties, the screening obligation extends to beneficial owners. Under the UK ownership and control test (the rule by which a non-listed entity can be caught through a designated person who owns or controls it), any entity owned or controlled by a designated person is itself subject to the financial-sanctions prohibition – even if that entity does not appear on the consolidated list by name.
The OFSI ownership and control test differs in an important respect from the OFAC 50 percent rule (OFAC's rule treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked). OFAC's test is ownership-only and the threshold is mechanical: 50 percent or more aggregate ownership by blocked persons triggers the rule. OFSI and EU regimes also look at control – the ability to direct the decisions of an entity even without majority ownership. That means a minority-stake counterparty that a designated person controls operationally may be within scope for OFSI but not, on a purely mechanical ownership analysis, for OFAC. Compliance teams must run both analyses where US and UK obligations co-exist.
What about the Entity List? BIS applies its own concept of a "party to the transaction". That concept is broader than just the buyer. It includes the purchaser, the intermediate consignee, the ultimate consignee, and the end-user. Each must be screened against the Entity List before any US-origin item leaves, is re-exported, or is transferred in-country.
Step 3: Run the screening and evaluate the match
Running the screening query is the mechanical step. Evaluating the result is where judgment is required – and where false negatives and false positives both carry risk.
Denied-party screening tools query names, aliases, addresses, and identifiers against the relevant lists. Transliteration variants, romanised aliases, and partial-name matches generate false positives. A hit is not a confirmed match. The compliance team must assess: does the name match? Does the address or nationality match? Does the date of birth or registration number match? The stronger the alignment across multiple identifiers, the more likely the match is genuine.
A false positive – a match that is not a real match – must be documented with a written disposition: why the team concluded the hit did not correspond to the counterparty. That documentation is an essential part of the compliance record. OFSI's enforcement guidance makes clear that documented, reasoned decision-making is a material factor in the assessment of any apparent breach.
A potential true positive – a genuine possible match – should not be resolved by the compliance analyst alone. It requires a lawyer's review. The questions shift: is this party designated under a financial-sanctions programme that prohibits the transaction? Is this party on the Entity List for reasons that affect the goods in question? Does a licence or authorisation exist that would permit the transaction to proceed? What is the risk of proceeding without one?
In our experience, the teams that handle true positives well have pre-agreed an escalation path before they run screening. They do not improvise the decision under commercial pressure. Have you documented your escalation procedure, or is it informal?
Step 4: Understand the differences between OFSI, the Entity List, and related regimes
OFSI administers financial sanctions; BIS administers export controls. The two regimes overlap but are not the same, and treating them as equivalent creates gaps in either direction.
OFSI's prohibitions are financial in character. They prevent UK persons from making funds or economic resources available to a designated person. A sale of goods to a designated person's company is caught because goods are economic resources. OFSI can issue specific licences (case-by-case authorisations to conduct an otherwise prohibited transaction) and, in limited circumstances, general licences (standing authorisations for defined categories of transactions). The licensing criteria, timelines, and the evidential burden vary by programme.
The Entity List is an export-control measure, not a sanctions list in the traditional sense. A party appearing on the Entity List is not necessarily a sanctioned person. The listing means that a BIS-administered licence requirement applies to exports, re-exports, and in-country transfers of items subject to the EAR to that party. The restriction is item-specific: it depends on what is being exported and what Export Control Classification Number (ECCN – the designation under the US Commerce Control List indicating an item's control parameters) the item carries. Some Entity List entries apply across all EAR-controlled items; others apply only to specific ECCNs. The operative text of the listing itself specifies the licence requirement and any licence-review policy.
For a UK exporter, the extraterritorial reach of the EAR is the critical complication. Under the de minimis rule and the foreign direct product rule, items that fall below a certain threshold of US-controlled content, or items produced abroad using controlled US technology or equipment, can still be subject to BIS jurisdiction even if the exporter is not a US person. The threshold varies by destination and by the nature of the item. Where US-origin content or technology is present in the goods being exported, the Entity List screening obligation follows.
The practical consequence: a UK exporter shipping components that contain qualifying US-origin parts to a party on the Entity List requires a BIS licence, regardless of what OFSI's list says. Conversely, a party may be on OFSI's consolidated list – and thus subject to the full range of UK financial-sanctions prohibitions – but not appear on the Entity List at all. The two regimes address different legal questions. Screening must address both.
Where the UK and US positions diverge on the same counterparty, the stricter prohibition governs the relevant leg of the transaction. A party cleared under the Entity List may still be prohibited under OFSI; a party not on OFSI's list may still require a BIS licence for a specific shipment.
The position above describes the standard case. Your facts – the counterparty's ownership structure, the goods' classification, the route, and the regimes in play – change the analysis materially. For a review of your specific screening programme or a transaction-level assessment, contact Calder & Vance at info@caldervance.com.
Step 5: Address red flags and risk-escalation triggers
A clean screening result does not end the compliance obligation. Denied-party screening is one layer of a broader due-diligence process, and several patterns consistently indicate elevated risk even where no direct list hit appears.
Red flags that warrant enhanced review include: a buyer or end-user in a jurisdiction subject to comprehensive or sectoral sanctions under either the UK or US regime; a request to divert a shipment to a different destination after the original order is placed; a freight forwarder or intermediary with no apparent commercial rationale for its role; an end-user whose stated business is inconsistent with the goods ordered; payment routing through a jurisdiction with a high-risk financial-sector profile; and an end-user that declines to provide an end-use statement or certificate.
The Entity List itself contains an explanatory note for each listed party. That note identifies the basis for the listing – typically a concern about diversion, weapons-related activity, or a connection to a designated entity. Reading the listing note is a basic step that is nonetheless frequently skipped. A party listed for proliferation-related reasons raises a fundamentally different risk profile from a party listed for export-control violations involving commercial goods.
OFSI's enforcement posture is relevant here. OFSI has a monetary penalty power and can impose civil penalties for breach without proof of criminal intent where the breach involves a prescribed circumstance. The fact that a business did not know a counterparty was designated does not of itself remove liability; what matters is whether reasonable and proportionate due diligence was carried out. Documented screening records, escalation procedures, and contemporaneous decision-making are the primary evidence of that diligence.
We regularly advise clients on how to structure escalation triggers so that the compliance team is not left making commercial-risk judgements that belong with legal counsel. If a transaction involves dual-use goods, a counterparty in a restricted destination, and any unresolved screening alert, those three factors together should automatically route the matter to specialist review.
If a transaction has already been flagged, or a filing has been refused, an early legal review can preserve options that narrow with time. Contact us at info@caldervance.com to discuss a specific concern.
Step 6: Record, retain, and review your screening programme
A screening exercise that is not documented has limited value as a compliance defence. Retention of records is both an operational discipline and a legal obligation.
Under the EAR, exporters are required to retain records related to controlled transactions for a period of five years from the date of the transaction or the date of any application, whichever is later. The records must be sufficient to demonstrate compliance: screening queries, match dispositions, escalation decisions, licence copies, end-use certificates, and shipping documentation. BIS has the authority to inspect these records, and gaps in the record are themselves an aggravating factor in any enforcement review.
OFSI's approach to record-keeping does not prescribe a single retention period in the same form, but its enforcement guidance treats documented due diligence as a key mitigating factor in penalty determinations. In practice, a five-year retention period aligned to the EAR standard is a sensible benchmark for exporters managing both UK and US obligations.
Periodic review of the screening programme itself is as important as individual transaction screening. Lists change frequently: OFSI, BIS, and other authorities add and remove parties with little notice. A counterparty that was clean at the time of contract may be added to a relevant list before delivery or payment. Screening at contract stage only is insufficient; the obligation runs through to shipment and, for ongoing commercial relationships, should be a standing process.
In our cross-border practice, we find that the most common programme failure is not the absence of screening but the absence of a documented review cycle: a periodic audit that tests whether the tool is querying all relevant lists, whether aliases and transliterations are covered, and whether the escalation path is understood and used. That audit should be performed at least annually and after any material change to the lists or the business's trade profile.
What businesses most often get wrong – and a common misconception corrected
The single most consistent error in denied-party screening programmes is treating UK financial-sanctions screening and US export-control screening as alternatives rather than cumulative obligations.
A widespread misconception holds that because a business is incorporated in the UK and sells under UK-law contracts, US export controls are someone else's concern. This is incorrect. The de minimis and foreign direct product rules under the EAR apply regardless of the nationality of the exporter. Where goods contain qualifying US-origin content, or where they are produced using controlled US technology, the EAR follows the goods. A UK exporter that has not assessed whether its products engage these rules has an incomplete compliance programme, irrespective of how thorough its OFSI screening is.
A related error is over-reliance on automated screening without human review of the underlying listing. Screening tools identify potential matches; they do not interpret the scope of an Entity List entry, assess whether a specific licence exception applies, or weigh whether a control test under OFSI's ownership rules reaches a minority-stake counterparty. Those are legal judgements. Automated tools are a necessary starting point, not a complete answer.
We have acted for businesses that discovered a screening gap during internal audit rather than through regulatory contact. Early discovery, properly handled, creates options. A structured review of the programme, a documented remediation record, and – where an apparent breach exists – a carefully considered voluntary self-disclosure (VSD – the process of proactively reporting an apparent violation to the relevant authority before it is otherwise discovered) to OFSI or BIS can each affect the outcome of any subsequent enforcement review, though no specific outcome can be guaranteed.
Related practices
- Deemed export and technology controls under BIS and the EAR – classification, licence requirements, and end-use controls for dual-use technology
- Entity List screening: ownership-chain analysis – mapping beneficial ownership and control across complex corporate structures
- Denied-party screening programme design – building and auditing a cross-regime screening function