How to map the perimeter for insurers and card networks under OFSI

An insurer discovers mid-claim that its policyholder's reinsurer sits on the UK sanctions list. A card network processes a recurring payment only to learn the merchant's ultimate parent has been designated. Both scenarios share a common failure: the sanctions perimeter was drawn too narrowly, and the gap went undetected until a transaction had already moved. As of January 2026, OFSI's enforcement posture has sharpened, and the consequences of a misfiled perimeter now carry significant monetary weight.

Mapping the sanctions perimeter for insurers and card networks under OFSI means identifying every point at which a designated person or a controlled entity can touch a transaction – as policyholder, beneficiary, cedant, reinsurer, payment originator, merchant, or processor. OFSI's asset-freeze prohibitions extend to making funds or economic resources available, directly or indirectly, to or for the benefit of listed persons. The phrase "directly or indirectly" is the operative test, and it runs far wider than a name-screening check on the immediate counterparty.

This guide walks through a step-by-step perimeter-mapping exercise for insurers and card-network operators, identifies the controls that must be in place before a new product or counterparty relationship goes live, and sets out the risk flags that most commonly indicate a gap. It covers OFSI as the primary regime and draws comparisons with OFAC and the EU where the positions diverge.

What you need before you start: the legal foundation under OFSI

Before mapping the perimeter, every compliance team must understand the legal test it is applying. Under the UK financial-sanctions regime, administered by OFSI under the Sanctions and Anti-Money Laundering Act ("SAMLA") and the relevant thematic regulations, the prohibition covers not only direct dealings with listed persons but also indirect dealings – meaning any arrangement through which value flows to or for the benefit of a designated party, however many steps removed. The ownership and control test (the UK rule by which a non-listed entity that is owned or controlled by a designated person is itself caught) extends this further still.

The key legal preparatory materials are therefore threefold. First, a current copy of the UK Consolidated List – the live record of all designated persons under each UK sanctions regime. Second, OFSI's published guidance on licensing grounds and enforcement, which sets out how it reads the "for the benefit of" language in practice. Third, a working understanding of the distinction between asset-freeze obligations (prohibiting dealing with funds or economic resources belonging to, owned, held, or controlled by a designated person) and the separate prohibition on making funds available to or for the benefit of that person.

For insurers, "economic resources" is a critical term. A policy that pays a claim to a designated person has made an economic resource available. A policy that pays into a trust or account that the designated person can benefit from raises the same issue. Card networks face the equivalent question on the payment side: settling a transaction in which the ultimate recipient is a designated person can trigger the "making available" prohibition even where the network never directly identifies the counterparty as listed.

One common misconception is that the obligation only bites at the point of explicit identification. It does not. OFSI operates on a strict-liability basis for civil penalties, meaning that knowledge of the designation is not required to establish a breach – only the fact of the transaction. Starting with a clear understanding of this test is not preliminary work; it is the foundation on which every subsequent step rests.

Perimeter checkpoint one: direct counterparty screening

The first checkpoint in any perimeter-mapping exercise is the most familiar: direct counterparty screening against the UK Consolidated List and, for firms with extraterritorial exposure, the OFAC SDN List (OFAC's list of Specially Designated Nationals and blocked persons) and the EU consolidated asset-freeze list. For an insurer, direct counterparties are the policyholder, the named insured, the loss payee, the cedant, the broker, and the reinsurer. For a card network, direct counterparties are the issuer, the acquirer, the merchant, and the cardholder.

The mechanics here are well established, but execution gaps are common. We regularly advise firms that their screening tools flag the legal entity name but do not catch transliteration variants, name changes that post-date the initial onboarding check, or listings published between periodic re-screen cycles. A real-time alert feed from OFSI is therefore not optional; it is the minimum standard for any firm whose transaction volumes make periodic batch screening inadequate.

Under OFSI's enforcement guidance, blocked-property reports must reach OFSI promptly following identification – verify the current reporting window before relying on it. That reporting obligation is itself a perimeter item. A firm that identifies a potential match and does not report because it concludes internally that the match is "low confidence" may still be in breach if OFSI later concludes that a reasonable person would have treated the match as credible.

The cross-regime comparison matters here. OFAC's blocking obligation attaches immediately on identification of blocked property, with reports due within 10 business days. OFSI's reporting trigger is knowledge or reasonable cause to suspect, and the relevant firms must report under the specific thematic regulations that apply to their sector. Compliance counsel should verify which reporting trigger applies to the firm's regulatory category: the obligations are not identical, and conflating them produces a gap in one direction or the other.

Perimeter checkpoint two: ownership and control chain analysis

The second checkpoint is where most perimeter failures originate. A direct counterparty may not appear on any list. Its parent, a subsidiary, or a significant shareholder may. The UK ownership and control test can catch a non-listed entity that is owned or controlled by a designated person, and it does so without any further listing step being required.

For insurers, this means tracing the ownership chain of every policyholder and every cedant back to ultimate beneficial ownership. A commercial property insurer writing a policy for a company that is majority-owned by a designated person may have an asset-freeze obligation in respect of the policy proceeds, even if the company itself is not listed. The policy document will not say so. The compliance programme must find it.

For card networks, the equivalent analysis applies at the merchant level. An acquirer that onboards a merchant controlled by a designated person and then settles transactions through the network creates a "making available" exposure for every subsequent settlement. The card network's exposure turns on what it knew or should have known – which is precisely why the compliance programme cannot stop at the acquiring bank's own screening.

In our experience, the critical practical step at this checkpoint is distinguishing between ownership and control. Ownership is mechanical: does a designated person hold, directly or indirectly, more than 50 percent of the entity in question? Control is qualitative: can the designated person direct the affairs of the entity in practice, even with a minority stake? UK case law holds that control must be actual, not theoretical – meaning a genuine assessment of governance documents, shareholder agreements, and board composition is required, not merely a register search. The EU applies a parallel control concept; OFAC's 50 percent rule is ownership-only, which is where the regimes begin to diverge in a way that produces real cross-border compliance asymmetry.

Have you mapped the ownership chain to ultimate beneficial ownership, or only to the first corporate layer? The answer to that question will determine whether this checkpoint passes or fails.

Perimeter checkpoint three: indirect benefit and flow-of-funds analysis

The third checkpoint addresses the "for the benefit of" limb of the prohibition. This is the most analytically demanding part of the exercise and the one most often reduced to a checkbox. The question is not merely whether the immediate counterparty is listed or controlled by a listed person, but whether anyone further along the value chain benefits from the transaction in a way that OFSI would characterise as making funds available to a designated person.

For insurers, the scenario arises most acutely in three product lines. Marine and aviation hull cover involves cargo interests, port agents, and reinsurance chains that can span six or seven counterparties. Trade credit insurance involves receivables whose obligor may be a designated entity. Life and protection insurance involves beneficiaries who may be identified long after the policy was written, including through assignment or trust arrangements.

For card networks, indirect benefit exposure arises where the payment flow includes a sub-merchant, a payment facilitator, or a wallet provider that is itself subject to an asset-freeze. A card network that relies entirely on its acquirer's compliance programme has outsourced its risk but not its liability. OFSI will assess whether the network had adequate controls in place independently of what its acquirer did.

The practical tool at this checkpoint is a transaction-flow map. For each product category or payment corridor, the compliance team should trace the movement of funds from the point of premium payment or transaction initiation to the point of final settlement or claim payment, and mark every node at which a designated person could sit. This is not the same as a legal-entity diagram. It follows the money, not the corporate structure, and it will surface exposures that a counterparty-screening exercise does not.

At this stage, the cross-border comparison becomes operationally important. The EU asset-freeze prohibition uses language substantially parallel to OFSI's on "making available" – meaning an EU-regulated subsidiary of the same group faces a materially similar analysis. OFAC's prohibition, by contrast, turns primarily on US-person nexus; a UK insurer that is not a US person and whose transaction has no US touchpoint may sit outside OFAC's reach even where OFSI's "for the benefit of" test is engaged. Compliance counsel must therefore map the regime footprint as part of mapping the sanctions perimeter: not every transaction triggers every regime, and conflating them adds cost without reducing risk.

Perimeter checkpoint four: the designation-cascade risk for insurers

A designation of an insurer can cascade into loss of cover for vessels it insures, which is itself a compliance trigger for charterers and ports. This principle, which originates in maritime sanctions practice, has broader application. When a significant reinsurer or Lloyd's syndicate is designated, the cedants that rely on that cover face an immediate question: does continuing to receive the benefit of the cover amount to receiving funds or economic resources indirectly from a designated person?

The answer will depend on the structure of the reinsurance arrangement and whether any payment flows between the parties following the designation. Receiving the benefit of a policy already in place before the designation, where no fresh premium or settlement payment needs to pass to the designated reinsurer, may fall within the scope of an OFSI general licence or may require a specific licence application. Neither is a matter of inference; each requires a deliberate legal analysis before the cedant concludes it can continue operating under the cover.

We act for multinationals, financial institutions, and exporters on sanctions and export-control matters across the major regimes, and in our cross-border practice the designation-cascade point is one of the most frequently overlooked elements of an insurer's perimeter review. Firms that have mapped their direct counterparties conscientiously often have no process for monitoring the designated status of their reinsurance panel on an ongoing basis. That is a perimeter gap.

The parallel for card networks is a designation of a card scheme participant – a processor, an issuer, or an acquirer. Depending on the scheme rules and the technical architecture, a designation of a single participant can affect the network's ability to process any transaction that routes through that participant's infrastructure. The network's operational response to that event is a separate question from its legal obligations, but the two must be designed in sequence.

Perimeter checkpoint five: the reporting obligation and when to involve counsel

There is a legal obligation on "relevant firms" – a category that encompasses financial institutions including insurers and, in practice, card-network operators and their participants – to report knowledge or suspicion that a person is a designated person to OFSI. This is not a discretionary step. It is a statutory obligation under the relevant thematic regulations, and it runs parallel to, but is distinct from, the obligation to freeze.

The compliance checklist at this stage has three items. First, has the firm identified the correct legal trigger for its reporting obligation under the specific regulations that govern its sector? The trigger differs between the financial-sanctions regulations applicable to different regimes, and conflating them can result in either under-reporting or over-reporting. Second, does the firm have a documented escalation path that takes a potential match from the screening tool to the compliance officer to a legal review and, if appropriate, to OFSI, within a timeframe that OFSI would regard as prompt? Third, is the reporting obligation tracked to resolution? A match that is escalated, reviewed, and concluded not to be a designated person should be documented as such; a match that is flagged and then lost in an approval queue is indistinguishable, from OFSI's perspective, from a match that was never reported.

When should counsel be involved? In our experience, four situations warrant early legal input regardless of the firm's in-house capability. First, where a potential match cannot be resolved by the firm's standard screening and due-diligence process within a short operational window. Second, where a match involves a counterparty with whom the firm has a long-standing and financially material relationship, making the business impact of a freeze significant. Third, where the designation is of a reinsurer or scheme participant whose loss affects not just one policy or transaction but a portfolio. Fourth, where the firm is considering whether to apply for a specific licence to continue a transaction that would otherwise be frozen.

For businesses with cross-border operations, a fifth trigger applies: where the transaction has a US or EU nexus in addition to its UK dimension. In that scenario, OFSI compliance does not stand alone. A transaction that is licensable under OFSI may nonetheless be prohibited under OFAC or require a separate authorisation under the EU regime, and a decision to proceed based on UK analysis alone can create exposure in another jurisdiction.

Readiness check: testing whether the perimeter holds

A perimeter-mapping exercise is not complete when the initial mapping is done. The perimeter must be tested. In our cross-border practice, we apply a four-question readiness test before advising a client that its current controls are adequate for the product line or corridor under review.

First: does the screening tool cover all counterparty roles, not just the named insured or the primary cardholder? For insurers, this means policyholder, named insured, loss payee, cedant, reinsurer, and broker. For card networks, this means issuer, acquirer, merchant, sub-merchant, payment facilitator, and cardholder. If any of those roles is screened differently – less frequently, against fewer lists, or with a higher match threshold – the perimeter is uneven.

Second: does the ownership and control analysis run to ultimate beneficial ownership, with a documented methodology for resolving the control question where it is not answered by the ownership percentage alone? A firm that resolves ownership questions by reference to registers only, without reviewing governance documents, may produce a technically correct answer that misses the practical control reality.

Third: is there a transaction-flow map for each material product category, and does it identify every node at which a designated person could sit? A map that exists but has not been updated to reflect a new product launch, a new corridor, or a new reinsurance arrangement is a stale map. The perimeter shrinks with every undocumented change to the operating model.

Fourth: is the reporting pathway tested? A compliance programme that has never generated a report to OFSI is either operating in a segment with zero sanctions exposure – which is rare – or it has a gap in its detection logic. Testing should include a simulated match exercise at least annually, with the result documented. Firms that cannot demonstrate a live and tested reporting pathway are exposed not only to enforcement risk but to the additional finding that their compliance programme was inadequate, which is a factor OFSI weighs in setting any monetary penalty.

The myth that name screening alone meets the rules is precisely that: a myth. OFSI expects a programme that is commensurate with the nature, size, and risk profile of the business. For an insurer writing marine risks or a card network processing cross-border payments, a programme limited to name screening at onboarding is not commensurate. The standard is a screening gap that surfaces only after a breach – and by that point the range of available options has already narrowed.

Related practices

• Affiliate-level restrictions under BIS and the EAR – how entity-level controls affect affiliated companies and operating subsidiaries
• Mapping the perimeter for insurers and card networks under the UAE regime – regime-specific guidance for UAE-nexus transactions

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.