A multinational treasury team receives a payment instruction and its screening tool returns an alert. A counterparty name is a close match to a listed entity on the EU Consolidated List. The compliance officer escalates to the legal team. Three days pass. The payment window closes. Was the freeze obligation triggered? Was the competent national authority notified in time? These questions are not hypothetical – they surface in cross-border businesses every week, and the answers turn entirely on whether a disciplined escalation and reporting procedure was in place before the alert fired.
Under EU sanctions law, a person or entity that holds funds or economic resources belonging to a designated person, or that has information relevant to a possible breach, is required to act promptly: freeze the assets, refrain from making them available, and notify the competent national authority. The obligation arises under the relevant Council regulation and is enforced at Member State level through national competent authorities whose response windows and penalty structures differ across the Union. As of July 2026, the EU's drive toward a harmonised sanctions enforcement directive sharpens the urgency of having a tested escalation path already documented before an alert arises.
This guide walks through the escalation and reporting procedure step by step – from the first screening alert through the freeze decision, the internal escalation chain, the notification to the competent authority, and the record-keeping that follows. It also maps the key differences between the EU procedure and the approaches taken by OFAC and OFSI, so that cross-border businesses can calibrate a single integrated escalation protocol.
Step 1 – Recognise the trigger: what activates the escalation obligation?
The escalation obligation activates the moment a business has reasonable grounds to suspect that funds or economic resources are owned, held, or controlled by, or for the benefit of, a designated person – and the procedural clock starts there, not at the point of certainty. Waiting for absolute confirmation before escalating is the single most common error we see in cross-border compliance programmes.
Triggers take several forms. A direct name match against the EU Consolidated List is the clearest. Less obvious triggers include a partial name match that falls within a defined fuzzy-match band, information received from a correspondent bank or a due-diligence provider indicating a possible designation, and the discovery that a counterparty is owned or controlled by a listed person – even if that counterparty is not itself listed. That last category requires a separate analysis of the ownership and control test (the EU test for whether a non-listed entity is caught because a designated person holds or controls it), and it should be built into the escalation checklist as a distinct step, not an afterthought.
In our experience, businesses with mature programmes distinguish between a "potential hit" and a "confirmed hit" at the trigger stage, and they assign different escalation timelines and decision-makers to each. A potential hit goes to the first-line compliance officer with a documented deadline to resolve the alert – typically measured in hours, not days. A confirmed hit goes immediately to the designated escalation officer and triggers the freeze and notification sequence.
One practical question to test your procedure: does your escalation checklist cover information received from a third party, or does it only respond to your own screening output? EU obligations do not limit reporting to cases where your own screening detected the issue. If a business counterpart flags a concern to you, the clock runs from that notification.
Step 2 – The immediate freeze decision: who decides, and on what basis?
Once a potential match is confirmed or cannot be ruled out within the defined resolution window, the business must freeze the relevant funds or economic resources immediately – meaning without further transaction activity on those assets pending final determination. The freeze decision is not a legal team privilege reserved for complex matters; it must be taken by whoever in the escalation chain holds the freeze authority for that asset class, and that person must be identifiable in advance.
The freeze obligation covers funds and economic resources owned, held, or controlled by a designated person. "Economic resources" is broader than cash: it covers assets of every kind that could be used to obtain funds, goods, or services. In our cross-border practice, we regularly advise businesses that a freeze obligation can extend to a contractual right, a security interest, or a real-property holding – not just a bank balance. If the item of value could be converted into funds or otherwise benefit the designated person, the freeze analysis must be run.
EU regulation also prohibits making funds or economic resources available to or for the benefit of a designated person. This is a separate limb from the freeze obligation. A business that does not itself hold the assets but is about to transfer value to someone who does – through a payment, a goods delivery, or a service – faces a "making available" analysis. Both limbs must appear in the escalation checklist.
At this step, the competent national authority question becomes live. Each EU Member State has designated one or more competent authorities to receive notifications and grant exemptions. The identity and procedural requirements of that authority depend on the Member State in which the business is established and, in some cases, where the funds are held. A cross-border group operating in several Member States may face parallel notification obligations – a point that the escalation procedure must address explicitly.
Step 3 – Internal escalation: building a chain that actually works
Internal escalation moves the confirmed or probable hit from the front-line detection layer to the decision-makers who hold the authority and the information to act correctly. A well-designed chain has three properties: it is fast, it is documented at each step, and it specifies who can override a freeze decision and on what authority.
The standard escalation path for an EU financial-sanctions matter runs: screening analyst → sanctions compliance officer → Head of Compliance or Legal → General Counsel → Board or Audit Committee (where material). That path should be reduced to a single-page flowchart and tested at least annually through a simulated alert. If the escalation test reveals that the legal team is not reachable out of hours, or that the freeze authority sits with a single individual who may be unavailable, those are gaps that must be closed before a live incident occurs.
Documentation at each escalation step is not optional. The relevant Council regulations require that businesses retain records of all measures taken in relation to a designation. In our practice, we recommend that each step in the escalation chain produces a timestamped written record: who received the alert, what analysis was performed, what decision was made, and at what time. That record supports the notification to the competent authority and, if the matter later attracts regulatory scrutiny, demonstrates that the business acted promptly and in good faith.
A related consideration: if the escalation reveals that the alert was a false positive – meaning the counterparty is confirmed not to be the designated person – the resolution of that determination must also be documented, with the reasoning set out. Regulators examining a compliance programme look not only at how confirmed hits were handled, but at how potential hits were resolved and on what basis.
The position above covers the standard escalation path. Your facts – the asset type, the Member State, the nature of the relationship with the counterparty, and the number of jurisdictions in play – will change the analysis. For a review of your escalation procedure against current EU requirements, contact Calder & Vance at info@caldervance.com.
Step 4 – Notification to the competent national authority: timing, form, and content
Notification to the competent national authority must follow the freeze without undue delay – and in several Member States the regulatory expectation is measured in days, not weeks. The notification obligation covers information about funds and economic resources frozen and, separately, information that a business holds which might be useful to the competent authority in enforcing the regulation, including information about attempted transactions that were blocked.
The form and content of the notification vary by Member State. Some competent authorities provide prescribed forms; others accept written notification by secure email. At a minimum, the notification should identify: the designated person (or the entity caught through ownership and control), the nature and estimated value of the frozen assets, the basis for the freeze, the date on which the freeze was applied, and the contact details of the compliance officer responsible for the matter. Where the competent authority has a prescribed form, using it is strongly advisable – deviating from it can delay acknowledgment and, in some Member States, triggers a follow-up request that restarts the clock.
A practical risk: businesses sometimes delay notification pending internal legal sign-off on whether the freeze was correctly applied. That delay creates a separate exposure. The better approach is to notify promptly on the basis that a freeze has been applied and that the legal analysis is ongoing, with a commitment to update the authority as the position develops. Most competent authorities are accustomed to receiving initial notifications in this form.
Cross-border groups face the additional question of which Member State's authority to notify, and in what sequence, when assets are held across borders or when the business has establishments in several jurisdictions. In our cross-border practice, we advise that the lead notification should go to the authority of the Member State where the frozen assets are held, with parallel notifications to any other Member State authority that has jurisdiction over the business's activities in that state. A co-ordinated notification strategy should be mapped in the escalation procedure before it is needed.
If a transaction has already been flagged, or if a freeze has been applied and the competent authority has not yet been notified, early legal review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential assessment.
How does the EU procedure differ from OFAC and OFSI?
The EU procedure and the US OFAC procedure share the same structural logic – freeze, refrain from dealing, report – but diverge in three material respects that cross-border businesses must understand and build into a unified escalation protocol.
First, the enforcement architecture is different. OFAC is a single federal authority; a business operating across the United States has one regulator to notify and one set of procedural requirements to satisfy. Under EU sanctions law, enforcement is carried out by Member State competent authorities, and there are as many sets of procedural requirements as there are Member States with jurisdiction over the business's assets and activities. A group with banking relationships in several Member States may face several parallel notifications on a single incident, each with its own form requirements and timelines.
Second, the ownership and control test differs between the regimes. OFAC applies the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) as a mechanical threshold. The EU applies a test that combines ownership of more than 50 percent of the proprietary rights of an entity with a separate control test. The control test means that an entity owned below 50 percent by a designated person can still be caught if that person exercises dominant influence over the entity through board composition, contractual rights, or other means. OFSI in the United Kingdom applies a similar combined ownership-and-control test. A screening programme that applies the OFAC threshold mechanically to EU and UK exposures will under-capture entities that are controlled but not majority-owned by a listed person.
Third, the voluntary self-disclosure (VSD) culture and its procedural mechanics differ. At OFAC, a well-prepared VSD is a significant mitigating factor in a civil penalty determination, with a defined process and a recognised impact on penalty quantum. At OFSI, voluntary disclosure is a mitigating factor in enforcement, but the process and weight differ. In the EU, the position varies by Member State: some competent authorities have published guidance recognising voluntary disclosure as a mitigant; others have not. Businesses planning a cross-border VSD strategy must map the position in each relevant Member State before filing, not after.
Switzerland, under the SECO regime, and Canada, under SEMA, follow broadly similar structural logic to the EU – freeze on designation, report to the competent authority, maintain records – but their ownership and control thresholds and their competent authority procedures are set by their own national instruments. When a business has exposure in those jurisdictions alongside EU exposure, the escalation procedure must specify the authority and the notification format for each.
Record-keeping and ongoing obligations after notification
Notification to the competent authority does not end the compliance obligation. A business that has frozen assets must maintain them in a frozen state, keep records of all measures taken, and respond to further requests from the competent authority for information or documentation. The record-keeping obligation under the relevant Council regulations extends for a defined period after the designation is lifted or the relationship is otherwise terminated – verify the current period in force before designing your retention programme.
Ongoing obligations include monitoring for changes in the designation status of the counterparty. A designation can be amended, extended, or removed by Council Decision. If a designation is removed, the business must determine whether the freeze is released, and on what basis, before restoring normal dealings. Acting prematurely on the assumption that a designation has been lifted – without confirming the position on the Official Journal of the European Union – is an enforcement risk that is avoidable with a straightforward monitoring step built into the procedure.
Businesses should also track guidance issued by their competent national authority and by the European Commission on the interpretation of the sanctions regulation. The Commission publishes frequently asked questions and best-practice notes that are not legally binding but are treated by competent authorities as indicators of correct practice. Incorporating updates to that guidance into the escalation procedure is part of the ongoing maintenance obligation for a compliant programme.
A further consideration: the EU Blocking Regulation creates a procedural overlay for businesses that are also subject to certain third-country sanctions measures. The Blocking Regulation prohibits compliance with specified extraterritorial laws of third countries and requires reporting of conflicting obligations to the European Commission. Businesses facing a dual obligation – for example, an EU-established entity also subject to US secondary-sanctions pressure – must route that conflict through legal counsel before acting on either regime's requirements. The escalation procedure should flag this as a distinct escalation pathway, not a standard freeze-and-notify sequence.
Common risk flags and when to involve external counsel
Certain fact patterns in an escalation require external counsel to be involved from the outset, rather than at the point where an internal process has already produced a decision that may be difficult to undo. Recognising those patterns is itself a compliance skill.
The most consistent risk flags we see in our practice include: a counterparty ownership chain that includes entities in jurisdictions with limited corporate transparency; a potential hit involving a correspondent banking relationship rather than a direct customer; an alert that involves both EU and US exposure simultaneously, creating a risk of conflicting obligations; and a situation where the freeze affects a material contract or a time-sensitive trade-finance instrument, generating immediate commercial pressure to release the funds.
Commercial pressure to release frozen funds is the condition under which the highest proportion of procedural errors occurs. A treasury head instructed by a trading counterpart that the funds must move today, or a deal will collapse, is not in a position to apply dispassionate legal analysis to the freeze decision. Counsel should be involved before that pressure reaches the compliance officer, not after.
A persistent myth among businesses new to EU sanctions compliance is that a partial name match that is resolved as a false positive at the screening-tool level does not need to be escalated or documented. In practice, the regulatory expectation – reflected in competent-authority guidance in several Member States – is that any match that reached the threshold for review should be documented, even if resolved quickly. An undocumented resolution is the most common finding in a compliance programme audit, and it is also the easiest gap to close with a straightforward record-keeping step.
Related practices
- Sanctions compliance audit and testing – stress-test your programme against current regime requirements and identify escalation gaps.
- Escalation and reporting under OFAC – step-by-step guide to the US procedure and how it compares to the EU.
- Escalation and reporting under OFAC: advanced issues – secondary-sanctions exposure, VSD strategy, and cross-regime co-ordination.