A payment firm processing a cross-border transaction runs its standard name check. The system returns a partial-name match on a counterparty listed only on the EU Consolidated List – a list the firm's US-configured tool does not query. The transaction settles. Six months later, a regulator enquiry lands. This is not an edge case. It is the routine failure mode for businesses that treat screening as a single-regime task.
Name and entity screening across a cross-border footprint requires simultaneous interrogation of multiple official lists – including the OFAC SDN List (the list of Specially Designated Nationals and blocked persons maintained by the US Treasury's Office of Foreign Assets Control), the OFSI Consolidated List, the EU Consolidated List, the UN Security Council Consolidated List, and the relevant national lists of each jurisdiction where the business operates. No single tool covers all of them by default, and the tests for who is caught differ meaningfully between regimes. As of July 2026, businesses operating across major trading corridors face overlapping and sometimes divergent obligations from at least four principal regulatory authorities.
This guide walks through the practical steps: how to build a screening architecture that works across regimes, where the ownership and control tests diverge, what the most common failures look like, and when to bring in specialist sanctions counsel.
Step 1: Map your regime exposure before you configure a tool
The first step in any cross-border screening programme is to identify which regimes actually apply to your business – because each regime reaches further than most compliance teams assume.
OFAC's jurisdiction is not limited to US persons and US entities. It extends to any transaction that touches US dollars, US financial institutions, or US-origin goods and technology. A business headquartered outside the United States can trigger OFAC obligations simply by processing a USD payment through a US correspondent bank, or by shipping an item that contains US-controlled components. OFSI's reach, under the relevant UK thematic sanctions regulations made under the Sanctions and Anti-Money Laundering Act ("SAMLA"), covers all persons and entities in the United Kingdom and all UK persons and UK-incorporated entities wherever they operate. The EU Council regulations bind EU-incorporated entities and their branches globally, and any person physically within the EU at the relevant moment. The UN Security Council Consolidated List sits beneath all of them as the baseline multilateral layer.
In our experience, the mapping step is where programmes most often fail at the design stage. A business defines its primary regulatory home – say, the United Kingdom – and builds a screening tool around OFSI's list. It then discovers, after a transaction has cleared, that the counterparty appeared only on the OFAC SDN List, which it did not query because it assumed OFAC was a US-only concern. The USD payment route made OFAC fully applicable. The tool had a blind spot because the regime map was incomplete.
The practical output of this step is a written regime matrix: each jurisdiction where you operate, each currency in which you transact, the goods or technology you export, and the resulting list of regulators whose lists you must query. That matrix drives every subsequent configuration decision.
Step 2: Understand the ownership and control tests – and why they differ
The single most consequential divergence between the major regimes is how they define whether a non-listed entity is caught because of its relationship to a listed person.
Under OFAC, the answer is mechanical. The 50 percent rule (OFAC's rule treating any entity owned 50 percent or more in the aggregate by blocked persons as itself blocked) is the primary test. Intention is irrelevant. If the ownership arithmetic reaches the threshold, the entity is treated as blocked even if it never appears on the SDN List by name. Aggregation is critical: two listed persons each holding twenty-six percent of the same company together cross the threshold even though neither does individually. Screening tools that flag only direct, named holdings routinely miss this aggregation pattern.
Under OFSI and the EU, the test is broader in one important respect: it extends to ownership and control (the combined test under which a non-listed entity is caught if a listed person owns it at the relevant threshold or exercises control over it, including through legal arrangements or informal influence). The EU position, reflected in the relevant Council regulations, applies a 50 percent ownership threshold but adds a distinct control limb that can capture entities owned below that line where a designated person directs or controls the entity's actions. OFSI takes a comparable approach under its guidance, and the practical effect is that the EU and UK tests can catch structures that OFAC's purely arithmetic rule would not – and vice versa in complex multi-layered arrangements.
For a business operating across both regimes, this means that an entity cleared under an OFAC-only ownership analysis may still be caught under the EU or UK test. Have you tested your ownership mapping against both the mechanical threshold and the control limb? Most screening tools address the ownership arithmetic. They rarely address control without supplementary manual analysis.
The UN Consolidated List, administered through the Security Council committees, operates as a baseline layer. Member states are required to implement the UN list designations into their domestic regimes, but the domestic implementing measures – and the additional designations added autonomously by the US, UK, and EU – sit on top of that baseline. Screening against only the UN list is insufficient for any business operating in a major trading jurisdiction.
Step 3: Configure your lists, match thresholds, and transliteration logic
Once the regime map is settled and the ownership tests are understood, the third step is technical configuration – and it is more consequential than most compliance programmes acknowledge.
List coverage is the starting point. Each relevant list must be queried: the OFAC SDN List (and the broader OFAC Non-SDN lists where applicable), the OFSI Consolidated List, the EU Consolidated List, the UN Consolidated List, and any additional national lists required by the regime matrix produced in Step 1. Where the business operates in or with counterparties in Singapore, Japan, the UAE, Australia, Canada, or Switzerland, the relevant national lists – published by MAS, METI/MFA, the relevant UAE authority, DFAT, Global Affairs Canada, and SECO respectively – must be added. Each list is maintained and updated on its own schedule, and the data formats differ. A tool that ingests only one list's format without adaptation will produce unreliable results on others.
Match-threshold calibration is the second configuration variable. A fuzzy-match threshold set too high generates unmanageable false-positive volumes; set too low, it misses the variant spellings and transliterations that designated parties routinely appear under. Names transliterated from Arabic, Russian, Farsi, Chinese, and other non-Latin scripts produce dozens of plausible Latin variants for a single individual. An SDN-listed person's name may appear in twelve different transliterations across different documents. The threshold must be calibrated against the scripts and naming conventions relevant to your counterparty base – not against a generic setting.
In our cross-border practice, we regularly advise clients whose tools are technically connected to the correct lists but misconfigured on thresholds, producing either alert floods that overwhelm review teams or gaps that allow through names that a properly calibrated tool would have escalated. Both failure modes create regulatory exposure. The former creates the operational pressure to dismiss alerts without proper investigation; the latter creates direct screening failures.
Alias and linked-entity coverage is the third variable. OFAC's SDN entries include "a.k.a." fields for aliases and "f.k.a." fields for former names. OFSI and EU entries similarly carry aliases. Screening only against the primary listed name misses a large proportion of how designated individuals and entities present in commercial documentation. The tool must query all alias fields, and the match logic must apply to each alias independently.
Step 4: Design the alert investigation workflow
A screening tool that generates alerts is not a compliance programme. The alert investigation workflow is where the programme either functions or fails.
Each alert requires a documented disposition: a match determination (true positive, false positive, or escalation pending further information) and a record of the evidence reviewed and the reasoning applied. Under OFSI's enforcement guidance, where a firm identifies that it holds funds or economic resources of a designated person, a reporting obligation arises within a short statutory window – and the window is measured from the point the firm knows or has reasonable cause to suspect the position, not from when it chooses to investigate. The EU regulations and OFAC's enforcement framework similarly impose reporting and record-keeping requirements. Records must be retained for a defined period under each applicable regime; verify the current period required under each applicable law before configuring your retention settings.
The workflow must also address the escalation path for complex cases. An alert on a counterparty that triggers the ownership and control analysis – where there is a potential indirect link to a designated person through an intermediate holding company – cannot be resolved at the first-line review level without access to corporate registry data and, in many cases, legal input. The workflow should define, in advance, the criteria that trigger escalation to a sanctions-specialist review, and the timeline within which that review must complete.
Practical experience before OFSI and in OFAC licensing and enforcement matters confirms that the absence of a documented escalation path is consistently cited in enforcement findings as an aggravating factor. A firm that can show a structured, documented decision process – even if the underlying determination was wrong – is in a materially stronger position than one that cannot demonstrate any process at all.
What are the most common failures – and when do they create legal exposure?
The failures that produce regulatory exposure in name and entity screening programmes are largely consistent across regimes and sectors. Understanding them as a pattern, rather than as isolated incidents, is the most effective way to stress-test a programme.
The first is list coverage gaps, addressed above. The second is static screening – running a counterparty once at onboarding and not rescreening periodically or on list updates. Designations are added continuously. A counterparty that was clean at onboarding may be designated six months into the relationship. The screening obligation is ongoing, not point-in-time. All major regimes treat this as a continuing duty.
The third failure is beneficial-ownership blindness. The customer or counterparty presented for screening is the named legal entity. The designated person may sit two or three ownership layers above it, at a threshold that crosses the 50 percent rule or the control test. Screening only the presented name, without looking through the ownership chain, is not compliant screening under any major regime. This is the practical implication of the ownership and control tests described in Step 2: they require the screener to investigate, not merely to query a list against a name.
The fourth is inadequate handling of partial matches and name variants. A system that generates a partial-name alert and the reviewing officer dismisses it as a false positive without documented analysis creates an evidentiary record that is difficult to defend in an enforcement context. If the dismissed match later turns out to be a genuine hit, the absence of a documented reasoning process is read as evidence that the dismissal was not genuinely considered.
A common misconception – and one we address regularly in the context of this practice – is that screening is a technology problem, solvable by purchasing the right software. The AUDIENCE_MYTH here is real: the tool is a necessary condition, not a sufficient one. Regulators assess the programme, not the product. A well-configured tool operated within a flawed workflow, or a well-configured tool and workflow applied only to a partial list set, is not a compliant programme. Calder & Vance regularly audits programmes where the technology is sophisticated and the underlying legal architecture is structurally defective.
Cross-regime divergence: where the positions are genuinely different
Beyond the ownership-and-control distinction addressed in Step 2, several other points of genuine divergence between the major regimes require deliberate management in a cross-border programme.
The de-risking response – where a financial institution exits a customer relationship or product line to avoid sanctions exposure without conducting a proper analysis – is viewed differently by regulators across regimes. OFSI and the Financial Conduct Authority have issued guidance discouraging blanket de-risking as a substitute for proper screening and due diligence. OFAC's enforcement framework is less prescriptive on this point, but OFAC's guidance on the risk-based approach similarly recognises that disproportionate de-risking may itself reflect a compliance programme weakness rather than a strength. The practical point is that an exit decision, if it is to stand as a legitimate compliance outcome, must be documented as a considered determination – not simply a reflex response to an alert.
The EU Blocking Regulation creates a specific tension for EU-incorporated entities and EU persons that is not replicated in the UK or US regimes. Where the EU Blocking Regulation applies, certain EU operators may face legal constraints on complying with non-EU sanctions – most relevantly, certain US sanctions measures listed in the Regulation's annex. The result, in some transaction structures, is that an EU entity faces compliance obligations pointing in opposite directions under EU law and under US law. Managing this tension requires legal analysis, not screening-tool configuration; it is one of the clearest examples of a cross-border conflict that escalates a compliance question into a legal-advice question.
Licensing routes also differ. Where a true-positive match is identified and the transaction cannot proceed without authorisation, the relevant licensing authority and the applicable test differ by regime. OFAC specific licences (case-by-case authorisations from OFAC to conduct an otherwise prohibited transaction), OFSI specific licences, and EU member-state derogation licences each operate on different procedural timelines and evidentiary requirements. A business operating across regimes may need separate authorisations from more than one authority for a single transaction. In our experience, businesses that have not pre-mapped their licensing routes before a transaction is stopped lose significant time at the most critical moment.
The position under the regimes of Singapore, Japan, the UAE, Australia, Canada, and Switzerland shares the UN baseline but adds autonomous designations and – in some cases – distinct procedural requirements for freezing, reporting, and licensing. A cross-border programme must confirm, for each jurisdiction in the regime matrix, whether the national implementation adds autonomous designations beyond the UN list, and whether it imposes independent reporting and record-keeping obligations.
When should you involve a sanctions lawyer?
Specialist counsel should be involved at four points in particular: programme design, a potential true-positive identification, receipt of a regulatory enquiry, and a transaction with a genuinely ambiguous ownership or control question.
Programme design is the stage where the investment in legal input has the highest leverage. A screening architecture built on a correct regime map, the right list set, properly calibrated thresholds, and a documented alert workflow is substantially less likely to produce a regulatory incident than one that is retrofitted after an incident has occurred. The cost of design-stage advice is, in practice, a fraction of the cost of enforcement-stage defence.
A potential true-positive identification is an immediate legal question, not a compliance-operations question. If a reviewed alert produces a credible determination that a counterparty is designated or is caught through the ownership and control test, the firm's obligations – to freeze, to report, and to refrain from further dealing – arise immediately under the applicable regime. The window for acting is short. Acting correctly requires knowing which regime's obligations apply, in which order, and within what timeframe. That determination requires sanctions-lawyer input, not a screening-tool query.
If a regulator contacts you – whether with an enquiry, a request for information, or a formal notice – early legal involvement changes the range of outcomes available. A VSD (voluntary self-disclosure to a regulator) opportunity, where it exists and is appropriate on the facts, narrows with delay. In our practice, we have acted for clients at each of these stages. The matters that reach the best outcomes are consistently those where counsel was involved before the regulatory relationship became adversarial.
Related practices
- Compliance audit and testing (Australia) – independent programme testing against the Australian autonomous sanctions regime and DFAT list obligations
- Name and entity screening: cross-border guide (part 3) – advanced screening considerations including crypto and VASP exposure across multiple regimes
- Name and entity screening: EU guide – detailed analysis of EU list obligations, the control test under EU regulations, and EU General Court practice