How to map the perimeter for insurers and card networks under EU

A European insurer renews coverage for a fleet operator. A card network routes settlement for a payment processor with subsidiaries across three jurisdictions. Neither firm has flagged a problem – until a regulator writes. The failure was not a missed name on a list. It was a structural misreading of where the EU sanctions perimeter actually falls for financial intermediaries of this type. That misreading is the most expensive kind.

EU sanctions law imposes asset-freeze and dealing prohibitions directly on insurers and card networks as operators that provide financial services. The perimeter is set by Council Regulation, administered through national competent authorities, and is considerably wider than a name-screening exercise can capture. As of January 2026, insurers and card networks that have not mapped their exposure against the EU's ownership-and-control test, the prohibition on making economic resources available indirectly, and the interaction with the EU Blocking Regulation are operating with an incomplete picture of their legal exposure.

This guide works through a decision-tree structure: at each branch, we identify the legal question, state the EU test, and flag where the analysis diverges from the UK and US positions. Read through to the section that matches your firm's situation, then consult the FAQ for the concentrated version of the most common queries.

Branch one: does your firm fall within the scope of the EU prohibitions?

The first question is whether the EU sanctions regime reaches your firm at all – and for most insurers and card networks with any EU nexus, the answer is yes. EU Council Regulations apply to any legal or natural person within the territory of the EU, to EU nationals wherever they are located, to legal persons incorporated under the law of a Member State, and to business conducted in whole or in part within the EU. A card network that processes euro-denominated transactions through a Member State acquirer is within scope. An insurer that issues a policy governed by the law of a Member State, or that has a branch there, is within scope.

The prohibition is not confined to dealings with persons whose names appear on the EU Consolidated List. The asset-freeze prohibition extends to making funds or economic resources available, directly or indirectly, to or for the benefit of listed persons. That phrase – "directly or indirectly" – is what catches the insurer whose policyholder is controlled by a designated person, and the card network whose merchant is majority-owned through a chain of intermediary entities.

In our experience, the scope question is often decided quickly. The harder questions arise at the next branches.

Branch two: is the counterparty, or is its beneficial owner, within the perimeter?

The EU ownership-and-control test is the critical filter. Under the test applicable for asset-freeze purposes, a non-listed entity is within the perimeter if a listed person holds more than 50 percent of its ownership interests, or if a listed person controls it by other means. The control limb is broader than a percentage threshold – it asks whether the designated person can exercise decisive influence over the entity's decisions, including through contractual arrangements or through the structure of voting rights.

This is where EU law diverges materially from the US position. Under OFAC's 50 percent rule (the rule treating entities owned 50 percent or more in the aggregate by one or more blocked persons as themselves blocked), the test is predominantly mechanical and ownership-focused. The EU test adds the control analysis, which requires a qualitative assessment rather than a simple arithmetic check. For an insurer underwriting a corporate risk, this means that a policyholder owned 45 percent by a designated person may still be within the perimeter if that person exercises control through other means.

UK law under OFSI applies a broadly comparable ownership-and-control analysis, though the case law distinguishing existing influence from a hypothetical ability to exert control has been interpreted somewhat more narrowly than the EU position. The practical result is that a structure which clears the UK test may still require a closer look under EU law.

What does this mean for the perimeter-mapping exercise? At minimum, it means that name screening against the EU Consolidated List is a necessary but not sufficient control. The analysis must extend to: the ultimate beneficial owners of the counterparty; any designated person with a controlling stake, however structured; and any entity that appears to be acting on behalf of or at the direction of a listed person. We regularly advise clients that the ownership chain is the document most often missing from the compliance file when a regulator comes to examine it.

Branch three: does the transaction make funds or economic resources available, even indirectly?

The second dimension of the perimeter is transactional rather than entity-based. EU Council Regulations prohibit making funds or economic resources available directly or indirectly to or for the benefit of designated persons. For insurers and card networks, this prohibition catches more than a direct payment to a listed counterparty.

Consider a card network that routes settlement flows through a processor whose parent is designated. The network's transaction leg may be several steps removed from the designated entity, but if the economic benefit of that settlement flows to or for the benefit of the parent, the prohibition is engaged. The question is not how many intermediary steps sit between the network and the listed person. The question is whether the transaction benefits that person.

For insurers, the equivalent question arises on the claims side. An indemnity payment under a policy covering a vessel operated for the benefit of a designated person may be captured, even if the named insured is not itself on any list. Mapping the perimeter here requires understanding the flow of economic benefit, not just the name of the counterparty on the declaration page.

A cross-border business operating between EU and US-facing regulatory environments faces a compounding analysis. Under OFAC's rules, facilitation by US persons of transactions that would themselves be prohibited if conducted directly is itself prohibited. An EU insurer that reinsures with a US reinsurer must therefore consider whether the underlying risk would be prohibited on the US side, even where the EU perimeter question appears to be answered in its favour. Where two regimes both apply, the stricter prohibition governs – and the practical answer is usually to resolve the stricter question first.

Branch four: does the EU Blocking Regulation change the analysis?

A separate and frequently misunderstood dimension of EU law is the EU Blocking Regulation (the instrument that can prohibit EU operators from complying with specified third-country measures, principally certain US secondary-sanctions provisions). For EU-incorporated insurers and card networks, this creates a genuine tension where US and EU obligations point in opposite directions.

The Blocking Regulation does not override EU primary sanctions obligations. But where a US measure would require an EU operator to terminate a relationship that EU law does not prohibit, the operator faces a direct conflict. Is it the US prohibition or the Blocking Regulation that governs the conduct of your firm's branch in Frankfurt? The answer turns on the specific US measure in question, the specific EU entity involved, and the jurisdictional links between them.

In our experience, this is precisely the situation where early legal assessment avoids the worst outcomes. Acting precipitously in response to a US demand – for example, by terminating card-network access for a European financial institution – can itself constitute a compliance failure under EU law. The decision tree at this branch does not yield a clean answer without a complete jurisdictional analysis.

Branch five: what are the reporting and record-keeping obligations for financial intermediaries?

Identifying that a counterparty falls within the perimeter triggers obligations beyond blocking the transaction or relationship. EU sanctions regulations require operators who hold or control funds or economic resources belonging to designated persons to report that fact to the relevant national competent authority. The obligation sits with the operator, not the counterparty.

Record-keeping requirements attach to the compliance programme more broadly. Under OFAC standards, sanctions records must be kept for five years – and while EU regulations state the obligation at the national level, the practical standard for an internationally active insurer or card network is at least equivalent. Any file that may be relevant to a future regulator examination should be preserved from the moment the potential issue is identified.

For card networks, the reporting obligation can engage rapidly. A network that identifies a flagged transaction mid-process – where authorisation has been granted but settlement has not yet cleared – must decide, quickly, whether to reverse, block, or report. The transactional speed of card processing makes ex ante screening the only reliable control; ex post reversal is technically possible but may not fully remediate the position.

The interaction with the EU's transfer-of-funds rules adds a further layer for card networks. The EU regime requires that originator and beneficiary information accompany fund transfers, and the zero threshold for transfers between crypto-asset service providers illustrates the direction of travel for information-gathering obligations more broadly. Compliance counsel advising card networks should treat information-completeness as a core element of the sanctions compliance programme, not a separate anti-money-laundering obligation.

Branch six: which risk flags most commonly signal a perimeter problem in this sector?

Several indicators, taken together, should prompt an escalation to sanctions counsel before a transaction or relationship is approved. None is conclusive alone. In combination, they mark the situations where a structured perimeter-mapping exercise is most likely to surface an exposure that name screening alone would miss.

• Ownership opacity: a counterparty that cannot provide a complete beneficial-ownership structure, or whose ownership chain passes through jurisdictions with limited corporate transparency, requires enhanced investigation before a risk decision is taken.
• Settlement routing through uncommon jurisdictions: a card-network settlement that routes through a jurisdiction not connected to the merchant's stated place of business is a diversion red flag. A sharp change in transaction flows to a neighbouring or transit jurisdiction warrants the same attention.
• Insured risk linked to a designated sector: a policy covering assets – vessels, aircraft, infrastructure – associated with a sector subject to EU sectoral restrictions requires a check on whether the specific asset, operator, or end-use falls within those restrictions, not merely whether the named insured is listed.
• Correspondent-bank or reinsurer designation: a designation of a reinsurer or correspondent institution can cascade into loss of cover or processing capacity for operators who have not mapped that dependency. The designation of an insurer can itself affect vessels it covers, which is a compliance trigger for charterers and ports.
• Incomplete screening on the claims side: insurers that screen at inception but not on notification of a claim are leaving the back half of the transaction uncontrolled. A claimant that was clean at inception may be designated by the time a claim is paid.

We have acted for insurers and card networks who encountered each of these situations. The common thread is that the exposure became apparent only when the relationship was already established – precisely the screening gap that this guide is designed to help firms close before it becomes a breach.

The common objection: why is name screening not enough?

A persistent assumption in this sector is that a firm meets its obligations by screening the named counterparty against the EU Consolidated List and receiving a clean result. That assumption is incorrect – and it is the most common structural gap we see in compliance programmes built for speed rather than accuracy.

EU law prohibits making funds or economic resources available indirectly, which means the perimeter extends beyond the named counterparty to its beneficial owners and to any entity through which a designated person exercises control. A name-screening result reflects only what is on the list as of the moment of the search; it does not reflect ownership chains, indirect control, or the designation of entities that sit one or two layers above the counterparty in the corporate structure.

The EU General Court has consistently upheld designations on the basis of ownership and control evidence, and EU court case law confirms that control must be proved by objective and sufficiently weighty evidence. That evidentiary standard applies in both directions: an operator that claims it could not have known of an indirect designation will need to demonstrate what it actually did to investigate – not simply that it ran a name check. What did your screening programme actually examine beyond the counterparty's trading name?

The practical answer is a five-element programme: systematic name screening as the first filter; beneficial-ownership verification against the ownership-and-control test; transaction-flow analysis to identify indirect benefit; sector and asset checks where sectoral restrictions apply; and a documented escalation path for the flags described in the previous section. Name screening is element one. It is not the programme.

Related practices

• Affiliate-level restrictions under BIS and the EAR – assessing how US export-control affiliate restrictions interact with your group structure
• Mapping the perimeter for insurers and card networks under OFSI – the UK equivalent of this guide, covering OFSI's ownership-and-control test

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.