A private equity fund is three weeks from signing on a mid-market acquisition. The target operates across four jurisdictions. Screening has been run on the named directors. Then a junior analyst flags a question: two of the target's operating subsidiaries are domiciled in jurisdictions where a locally-registered shareholder holds a minority stake – and that shareholder's ultimate beneficial owner does not appear by name on any list. Should the deal proceed? The answer depends on whether the diligence process has actually been completed, or merely begun.
Sanctions due diligence in M&A under OFAC means mapping the full ownership and control chain of every material counterparty, screening each node against the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) and other OFAC-administered lists, and applying the 50 percent rule (OFAC's rule treating any entity owned 50 percent or more in the aggregate by one or more blocked persons as itself blocked, regardless of whether it is named on any list) before the transaction closes. As of January 2026, an acquirer that inherits blocked assets at closing faces strict-liability exposure under OFAC's civil-penalty authority – and ignorance of the underlying ownership structure is not a mitigating factor.
This guide walks through the diligence process step by step, from initial scoping through post-closing obligations, and notes where OFSI, the EU, and other regimes impose additional or divergent requirements that a cross-border deal team must address in parallel.
Step 1: Scope the diligence universe before you begin screening
The first task in any M&A sanctions diligence exercise is defining precisely which entities, individuals, and relationships must be examined – because an incomplete universe produces a false clean result. The diligence universe should include the target entity itself, every direct and indirect subsidiary in which it holds a material interest, any joint-venture partners, the top-tier beneficial owners of the target (not merely the registered shareholders), and any counterparties whose contracts will transfer by operation of the acquisition.
In our experience, deal teams frequently scope only the entities named in the share-purchase agreement. That approach misses two categories of exposure. First, subsidiaries incorporated in third jurisdictions that are not listed in the data room disclosure schedule. Second, contractual counterparties – long-term supply agreements, distribution arrangements, offtake contracts – where the counterparty itself is not the target but would become a direct contractual partner of the acquirer post-closing. Both categories can carry OFAC exposure.
What does a properly scoped universe look like in practice? For a mid-market deal, it typically runs to between fifteen and forty discrete entities, depending on the target's footprint. For a large-cap cross-border transaction with operations in multiple higher-risk markets, the universe can be substantially larger. The scoping decision should be documented: a written record that the acquirer understood the boundaries of the exercise – and why those boundaries were drawn – will matter in any subsequent OFAC enforcement analysis of whether the buyer exercised due caution.
Step 2: Map ownership and control to apply the 50 percent rule correctly
The 50 percent rule is the single most consequential concept in OFAC-focused M&A diligence, and it is also the concept most often applied incompletely. OFAC treats any entity as blocked when blocked persons own, directly or indirectly, 50 percent or more of it in the aggregate – even if that entity does not appear on any OFAC list by name. The rule operates automatically, without any additional designation step by OFAC.
The aggregation point is where diligence breaks down. Consider two named SDNs each holding 28 percent of a target's parent. Neither individually reaches the threshold. Together, they hold 56 percent. The target's parent is blocked. Any subsidiary in which the parent holds 50 percent or more is also blocked. The acquirer who screens only named individuals – and not the combined holdings of associated listed persons – will miss this entirely.
Mapping for the 50 percent rule therefore requires three parallel steps: identifying all direct shareholders of each entity in the universe; identifying the ultimate beneficial owners behind nominee or holding-company layers; and then aggregating the holdings of any persons who appear – or whose associates appear – on OFAC-administered lists. The threshold is ownership, not control: a blocked person who controls an entity through contractual means but holds only 30 percent of its equity does not, on that basis alone, trigger the rule. Control matters separately under OFSI and the EU – a critical divergence addressed in Step 6 below.
Ownership structures in higher-risk jurisdictions are often layered through multiple intermediate holding entities. In a recent matter, a manufacturing-sector acquirer discovered during diligence that a target subsidiary was held through three intermediate companies across two jurisdictions, with the ultimate beneficial owner – an SDN – holding the majority position only at the fourth layer. Standard CDD tools did not surface the connection. A purpose-built ownership-trace exercise, using company registry data and transaction records, identified it. The deal structure was adjusted before closing.
Step 3: Screen systematically against OFAC-administered lists and the Consolidated List
Once the universe is mapped and ownership is charted, screening must be run against every relevant list – not only the SDN List. OFAC administers several lists, including the Sectoral Sanctions Identifications List (the SSI List, which identifies persons subject to sector-specific restrictions rather than full blocking), the Foreign Sanctions Evaders List, and lists maintained under specific programme-related regulations. Each carries different legal consequences, and a counterparty appearing only on the SSI List is not blocked in the same way as an SDN – but transacting with it in specified sectors is still prohibited.
In a cross-border deal, OFAC screening alone is insufficient. The UN Security Council Consolidated List (the master list of persons and entities subject to UN sanctions, maintained by the Security Council committees) applies as a floor in virtually every jurisdiction. EU Council Regulations impose their own asset-freeze lists. OFSI maintains a separate UK Consolidated List. Depending on the target's geography, the Swiss SECO list, the Australian DFAT list, and the Singapore and Japanese national lists may all require separate review. We regularly advise deal teams that run OFAC screening rigorously but treat the other regimes as optional – they are not.
Screening quality matters as much as coverage. Name matching against sanctions lists is imprecise: transliteration variations, common names, and deliberate spelling alterations all reduce the reliability of automated tools. A screening programme that produces only binary outputs – "match" or "no match" – without human review of near-hits is not adequate for a transaction. The standard practice in our cross-border diligence work is to review all fuzzy matches above a defined confidence threshold, document the reasoning for clearing each one, and retain the records.
Step 4: Assess sector and secondary-sanctions risk beyond list screening
List screening tells you whether a known person or entity is designated. It does not tell you whether a transaction involving an unlisted entity is nonetheless prohibited by reason of the sector it operates in, or whether the transaction creates secondary-sanctions risk (the risk that a non-US person or entity engages in conduct that, while not prohibited under primary US law, exposes it to OFAC designation or other adverse US action under secondary-sanctions authorities). These are distinct analyses, and both matter in M&A.
Sector-based restrictions under certain OFAC programmes prohibit transactions in defined sectors of a country's economy – energy, financial services, defence, construction, and others – regardless of whether any individual counterparty is listed. An acquisition of a target that operates substantially in a restricted sector can therefore be prohibited even if the target and all its owners clear every list. The acquirer must identify the primary sectoral nexus of the target's revenue and assess it against the active OFAC programme restrictions for each relevant jurisdiction.
Secondary-sanctions exposure is a separate question. For a non-US acquirer, a target with substantial trade flows through markets subject to comprehensive OFAC programme restrictions may create exposure for the acquirer's group simply by virtue of post-acquisition ownership. The acquirer inherits not just the entity but the ongoing commercial relationships. Whether any of those relationships fall within conduct that OFAC would treat as a secondary-sanctions concern requires a legal assessment, not merely a list check. This is one of the points where engaging sanctions counsel before signing – rather than after – changes the outcome.
The position above covers the standard screening exercise. Your facts – the target's geography, its sector, the ownership structure at the point of closing, and the applicable OFAC programme authorities – change the analysis materially.
For a preliminary assessment of your transaction's exposure under OFAC and the other major regimes, contact Calder & Vance at info@caldervance.com.
Step 5: Identify contractual risk flags and pre-closing remediation options
Where diligence surfaces a potential OFAC issue, the deal team faces a structured set of options – and the choice among them must be made before signing, because post-closing options are substantially narrower. The primary options are: (a) obtain a specific OFAC licence authorising the transaction; (b) restructure the deal to exclude the affected entity or asset; (c) require a pre-closing remediation by the seller (typically, a divestiture of the problematic subsidiary or counterparty); or (d) walk away from the transaction.
A specific licence is a case-by-case authorisation that OFAC grants to permit an otherwise prohibited transaction. Applying for one is not a matter of simply filing a form: the application must set out the factual basis for the request, address the policy considerations that apply to the relevant programme, and demonstrate that the transaction is consistent with US foreign-policy and national-security objectives. Timelines for specific-licence applications are not fixed; they can be short or extend to many months, and there is no guarantee of approval. An acquirer who needs a licence in order to close a transaction must build that timing uncertainty into the deal structure, typically through a long-stop date that accommodates the licensing window.
Contractual protections – representations, warranties, covenants, and conditions precedent – are a second line of risk management. An OFAC-focused representations clause should require the seller to confirm that the target and each subsidiary is not, and has not within a defined lookback period been, the subject of any OFAC investigation, designation, or enforcement action. A condition precedent should make closing conditional on no material sanctions issue arising between signing and closing. Indemnities should address the acquirer's exposure for pre-closing conduct of the target. These are not boilerplate provisions: their drafting requires input from sanctions counsel who understand what OFAC's enforcement standards would require the acquirer to have known and done.
If a transaction has already been flagged or a filing has been challenged, an early legal review preserves options that narrow with time. Contact us at info@caldervance.com for a confidential assessment.
Step 6: Apply the cross-regime comparison – OFSI, the EU, and divergences that change the deal
For a cross-border M&A transaction, OFAC compliance is necessary but not sufficient. OFSI (the UK Office of Financial Sanctions Implementation) and the EU Council both administer asset-freeze regimes that apply to transactions touching UK or EU parties, and their ownership-and-control tests diverge from OFAC's in ways that can change whether a given structure is permissible.
Under OFSI and the EU, the test is not solely ownership: it extends to control. An entity that is not majority-owned by a designated person can still be subject to the asset-freeze if a designated person controls it – through contractual rights, through board composition, through veto rights over material decisions, or through other means. The OFAC rule, by contrast, is triggered by 50 percent or more of ownership in the aggregate. This divergence means that a structure which passes the OFAC ownership test can still fail the OFSI or EU analysis if a designated person retains functional control. In our cross-border practice, we see this gap cause real problems in deals that have been cleared on the US side without a parallel EU or UK review.
The general principle that applies across regimes is that whichever regime imposes the stricter prohibition governs for a party subject to that regime. For a transaction structured between a US entity and a UK entity, both the OFAC ownership test and the OFSI ownership-and-control test must be satisfied. Neither clears the other. Similarly, EU parties must apply the EU test independently, even if OFAC has issued a specific licence. These are parallel, not hierarchical, regimes.
For the equivalent guide focused on OFSI, see our sanctions due diligence in M&A under OFSI guide. For Swiss SECO-focused diligence considerations, see our M&A sanctions diligence under SECO guide.
Step 7: Manage post-closing obligations and ongoing monitoring
Closing the transaction does not end the sanctions analysis. An acquirer who has completed thorough pre-closing diligence and satisfied itself that the target is clean on the day of signing still faces ongoing obligations once it owns the business.
The first obligation is to maintain and update the screening programme for the acquired entity. The SDN List and other OFAC-administered lists are updated frequently – sometimes multiple times per week. A counterparty that was clean at signing can be designated after closing. The acquirer must integrate the acquired entity's counterparty base into its own screening programme promptly after closing, and the programme must run on a cadence that reflects the risk profile of the acquired business. For a business with a high-risk jurisdictional footprint, a monthly batch screen is not sufficient.
The second obligation arises if the acquirer discovers, after closing, that the target was involved in prior conduct that may constitute an apparent violation of OFAC sanctions. At that point, the question of voluntary self-disclosure – a VSD, which is a voluntary report to OFAC of a potential violation – becomes live. OFAC's penalty framework treats a timely VSD as a significant mitigating factor in determining the civil monetary penalty. The decision to file a VSD is consequential in both directions: it affects the penalty base and the trajectory of the regulatory relationship. It requires careful assessment, not a reflexive decision, and it should involve sanctions counsel from the point of discovery.
Record-keeping is the third post-closing requirement. OFAC expects that businesses maintain records sufficient to demonstrate their compliance posture. For an acquirer, this means preserving the diligence workpapers, the screening records, the ownership-trace documentation, and any counsel advice obtained in connection with the transaction. These records are the evidence base for any future enforcement inquiry or penalty-mitigation argument.
Common misconceptions in sanctions due diligence in M&A
The most persistent myth in this area is that sanctions diligence is equivalent to running the target's name through a screening tool. It is not. List screening is one component of a multi-stage analytical process that also requires ownership mapping, sector analysis, cross-regime review, contractual risk allocation, and post-closing integration planning. A deal team that treats a clean list-screen result as a completed sanctions review is exposed – and in an enforcement context, that exposure is not mitigated by the fact that the tool produced a negative result.
A second common misconception is that OFAC will not pursue an acquirer for conduct that pre-dated the acquisition and was unknown to the buyer at closing. OFAC's civil-penalty regime is strict-liability: knowledge of the violation is not a prerequisite for liability. What the acquirer's pre-acquisition diligence process looked like is directly relevant to the penalty calculation – specifically to whether OFAC will treat the violation as egregious or non-egregious, and to whether voluntary self-disclosure will be credited as a mitigating factor. Due diligence matters to the penalty outcome, not to whether liability exists.
A third misconception is that an OFAC-specific clean result automatically satisfies the requirements of other regimes. As set out in Step 6, it does not. EU, UK, UN, and other national regimes must be addressed independently.
Related practices
- Correspondent banking and de-risking under OFAC – sanctions exposure management for financial-institution counterparty relationships
- Sanctions due diligence in M&A under OFSI – the parallel UK regime analysis for cross-border transactions