How to map the perimeter for insurers and card networks across regimes

A payment-card network settles a transaction for a policyholder whose insurer has just been designated. The network's compliance team had screened both names at onboarding. Neither matched. Six months later, an updated list entry captures the insurer, and the network discovers that its settlement rails have been processing funds to and for the benefit of a newly listed entity for weeks. That gap – between the designation date and the next scheduled re-screen – is where significant civil exposure can crystallise.

Mapping the sanctions perimeter for insurers and card networks across a cross-border footprint means more than screening counterparty names. As of January 2026, the definition of a "financial institution" under US authority explicitly extends beyond banks to insurers and card-network operators, and a designation of an insurer can cascade into loss of cover for vessels it insures – itself a compliance trigger for every other party in the chain. The procedure spans six steps: classification, list mapping, transaction-flow analysis, designation-cascade tracing, cross-regime reconciliation, and programme embedding. Each step is distinct; skipping one creates a gap the next enforcement cycle will find.

This guide walks each step in sequence, identifies where the major regimes diverge, and sets out the risk flags that should trigger external counsel before a breach rather than after.

Step 1: Classify your entity type and determine which regimes apply

The first step is to establish precisely how your entity is characterised under each regime in your cross-border footprint – because the sanctions perimeter is drawn differently depending on whether the authority treats you as an insurer, a card-network operator, a settlement institution, or a hybrid. That classification drives every downstream obligation.

Under OFAC, the definition of a financial institution for foreign financial institution risk (the risk of correspondent-account restrictions arising from transactions with designated persons) reaches beyond banks to insurers and card-network operators. The authority to impose measures on a foreign financial institution that conducts or facilitates significant transactions for designated persons or specified sectors is well established in US practice. For these purposes, insurers writing marine, aviation, or political-risk cover are within scope when those policies touch sanctioned destinations or counterparties. Card networks that settle transactions denominated in US dollars process through US correspondent banks and are thereby subject to OFAC jurisdiction regardless of where the network itself is incorporated.

The EU and UK draw the perimeter by reference to the prohibited acts: making funds or economic resources available, directly or indirectly, to or for the benefit of a listed person. An insurer collecting a premium from a policyholder who is a designated person, or settling a claim on a policy covering a designated asset, falls squarely within that prohibition. OFSI's strict-liability basis – which has applied since 2022 – means knowledge is not a precondition for a monetary penalty. The maximum OFSI penalty is the greater of £1 million or 50 percent of the breach value, as currently in force – verify this figure before relying on it, since revised guidance is under active consideration. The EU's asset-freeze prohibition similarly extends to indirect benefit, which catches premium flows routed through intermediaries.

In cross-border practice, we regularly advise clients to run this classification step as a jurisdiction-by-jurisdiction matrix rather than a single global determination. An entity that qualifies as a payment institution in one jurisdiction may be a credit institution in another – and the applicable sanctions obligations differ accordingly. Does your current compliance architecture reflect those distinctions, or does it apply a single label to a multi-regime entity?

Step 2: Build a complete map of the lists to which you are exposed

Once entity type is established, the second step is to map every list that can touch your operations – not only the obvious primary lists, but also the secondary and derivative lists that are commonly missed.

The core lists for a cross-border insurer or card network are: OFAC's SDN List (the list of Specially Designated Nationals and blocked persons), the OFAC Non-SDN lists including the Sectoral Sanctions Identifications List, the UK OFSI consolidated list, the EU consolidated list, and the UN Consolidated List which member states implement into national law. For a network with operations in Switzerland, Canada, or Australia, the SECO ordinances, SEMA-based Canadian measures, and DFAT autonomous sanctions add further layers. Singapore, Japan, and the UAE each operate their own national lists and implementation frameworks.

What practitioners often underestimate is the derivative dimension. A designation of an insurer does not affect only that insurer's own counterparties. Under the 50 percent rule (OFAC's rule treating entities owned 50 percent or more in the aggregate, directly or indirectly, by blocked persons as themselves blocked), any subsidiary of the designated insurer is automatically treated as blocked – without a separate listing. The UK and EU apply an ownership-and-control test that can similarly catch non-listed entities where a designated person exercises control. Mapping "the lists" therefore requires mapping the ownership chains above and below every direct counterparty.

In our experience, firms conducting this step for the first time find that their existing counterparty data holds only the top-level legal entity. Beneficial-ownership information, especially for insurers operating through Lloyd's syndicates or card networks processing via programme managers, is frequently absent at the point of onboarding. That gap is where the perimeter becomes porous.

Step 3: Analyse transaction flows and identify where prohibitions bite

The third step moves from lists to money: trace each category of transaction flow through your operations and identify the point at which a sanctions prohibition could attach.

For insurers, the relevant flows are premium collection, reinsurance placements, claims settlement, and salvage proceeds. Each flow can constitute "making funds available" or "making economic resources available" to a listed person if the counterparty, the insured asset, or the insured risk connects to a designated person or a prohibited territory. A marine cargo policy covering a shipment that originates from a sanctioned port creates exposure even if the policyholder itself is not listed. This is the transaction-level analysis that name-screening alone cannot perform.

For card networks, the relevant flows are authorisation, clearing, and settlement. A network that only screens merchant names at onboarding will miss the cardholder who becomes listed after onboarding, the merchant that is acquired by a designated entity mid-relationship, and the transaction that is routed through a correspondent bank in a sanctioned jurisdiction. OFAC's facilitation prohibition – which bars US persons from facilitating transactions that a US person would be prohibited from conducting directly – means that a network whose rails touch US persons or US-dollar clearing is within scope for the full chain of the transaction, not only its own link in it.

The cross-regime comparison matters here. The EU prohibition on making funds available "directly or indirectly" is broader in one respect: it does not require a US-person nexus. An EU-incorporated card scheme that processes a transaction benefiting a designated person violates the EU measure regardless of whether any US-dollar clearing is involved. Where both OFAC and EU rules apply, the stricter prohibition governs – and in cross-border practice the two layers rarely produce exactly the same answer on which transactions are prohibited.

Step 4: Trace designation cascades and assess secondary exposure

The fourth step addresses cascade risk: a single designation can spread through an insurer's or card network's counterparty base faster than a standard re-screening cycle can detect.

When an insurer is designated, two cascades run simultaneously. First, the 50 percent rule captures the designated insurer's subsidiaries, so all policies, claims, and investments held through those subsidiaries become blocked property or are prohibited transactions. Second, a designation of an insurer can trigger the loss of cover for vessels or assets it insures – and that loss of cover is itself a compliance trigger for the shipowner, the charterer, the port authority, and any other party that relied on that cover as a condition of an agreement. Card networks that provide payment infrastructure to the now-uninsured vessel operator inherit that exposure. This cascade through the insurance-to-payment-to-cargo chain is the defining cross-sector risk for cross-border compliance programmes.

What is the practical test for a card network assessing cascade exposure from an insurer designation? We advise a four-question check: (a) Is the designated insurer a direct counterparty? (b) Does the network process transactions for any merchant or cardholder whose principal risk-cover is from the designated insurer? (c) Does the network process transactions for any vessel, platform, or asset for which the designated insurer was the loss-payee? (d) Does any reinsurance chain connecting one of the network's own institutional counterparties run through the designated insurer? A "yes" to any question opens a line of inquiry that must be resolved before the next settlement cycle.

Secondary-sanctions exposure adds a further dimension for networks with US-dollar processing. Under US authority, measures can target foreign financial institutions that conduct or facilitate significant transactions for designated persons or specified sectors. Correspondent-account restrictions are the principal consequence. For a non-US card network, losing US correspondent access effectively ends US-dollar settlement globally – a systemic consequence that a single designated counterparty can trigger.

Step 5: Reconcile divergent regime positions and identify the binding constraint

Where an insurer or card network is subject to more than one sanctions regime – as every cross-border operator is – step five is to reconcile positions across regimes and identify, transaction by transaction, which obligation is the binding constraint.

The governing principle is straightforward: where two regimes both apply, the stricter prohibition governs. In practice, identifying which regime is stricter requires a comparison across three dimensions: scope of the prohibition (what acts are prohibited), scope of the list (which persons are designated), and licensing headroom (what authorised carve-outs exist).

Consider the EU Blocking Regulation, which can prohibit EU operators from complying with specified third-country – including US – extraterritorial measures. An EU-incorporated insurer may face a formal legal conflict between an OFAC obligation (not to process a claim) and a Blocking Regulation obligation (not to refuse the claim on that ground). This conflict is genuine and not resolved by the "stricter prohibition governs" rule; it requires a legal analysis of which jurisdiction's authority takes precedence on the specific facts, and usually the involvement of local counsel in the relevant jurisdiction alongside a US-qualified sanctions adviser. In our cross-border practice, this conflict arises most often in the context of reinsurance and letter-of-credit transactions.

For card networks, the equivalent pressure point is divergence between OFAC's list and the EU or UK lists on specific designated persons. A transaction may be prohibited under OFAC but not under the EU measure, or vice versa. Automated screening that applies only one regime's list will produce a false "clear" against the other. A well-constructed cross-regime screening matrix maps each list separately, runs them in parallel, and applies the stricter outcome.

The anti-circumvention dimension is also live in 2026. The EU has applied its anti-circumvention instrument – which allows restrictions to be directed at operators in third countries where measures are being circumvented – for the first time. A sharp change in transaction flows routed through a transit or intermediary jurisdiction is treated by regulators as a diversion red flag. Card networks and insurers whose data shows unusual routing concentrations should treat that pattern as a compliance trigger, not an anomaly to be explained away.

Step 6: Embed the controls and set the monitoring cadence

The final step converts the perimeter map into operational controls and a sustainable monitoring rhythm. The perimeter analysis is worthless if it is a one-time exercise; designations are issued without notice, ownership chains change, and the lists across regimes are updated on different schedules.

The core controls for an insurer are: pre-bind screening of policyholders and insured assets against all applicable regime lists; periodic re-screening at a frequency proportionate to the risk rating of the portfolio; a claims-hold procedure that pauses payment pending sanctions review when a name or asset matches; and a reinsurance-chain audit that maps counterparty exposure at the cedant and retrocessionaire level. Sanctions records must be kept for five years under OFAC requirements, as currently in force.

For card networks, the equivalent controls are: onboarding screening of merchants and programme managers; real-time or near-real-time transaction screening with a threshold logic that captures partial-name matches and transliteration variants; a transaction-hold and manual-review queue with defined resolution timeframes; and a correspondent-bank exposure assessment that maps which US relationships would be at risk from a given cascade. Where blocked property is identified, OFAC requires reporting within 10 business days of the blocking event.

The monitoring cadence is a function of risk. A card network with a high volume of cross-border transactions in regions with active designation activity should re-screen its full counterparty base more frequently than once per quarter. OFSI's mandatory reporting obligation – which requires relevant firms to report knowledge or suspicion of designated persons – means that a UK-regulated insurer cannot wait for the next scheduled re-screen cycle; actual or constructive knowledge triggers an immediate reporting obligation. Structuring the monitoring to generate documented, time-stamped evidence of each screen is itself a compliance control: it is also the foundation of any voluntary self-disclosure argument if a breach is subsequently discovered. Voluntary self-disclosure (a disclosure to the regulator made before enforcement action is initiated) is a recognised mitigating factor in OFAC's Enforcement Guidelines, and equivalent treatment applies under OFSI and EU member-state enforcement regimes.

The common myth is that name screening alone is enough to meet the rules. It is not. Screening a name at onboarding, against a single list, without re-screening, without transaction-level analysis, and without cascade tracing, is the baseline that most enforcement cases reveal as having been in place. The perimeter mapping described in this guide is the control that sits above that baseline.

Related practices

• Affiliate-level restrictions under BIS and the EAR – how entity-list exposure cascades through corporate groups
• Mapping the perimeter for insurers and card networks: EU guide – detailed EU Council-regulation analysis for this sector

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.