A European trading business receives a due-diligence request from its bank. The bank wants confirmation that none of the business's suppliers is owned or controlled by a person designated under EU sanctions. The compliance officer pulls the ownership register and finds a sixty-percent shareholder whose name is close – but not identical – to a listed person. What now?
Under EU sanctions, the test is not ownership alone. The relevant Council regulations extend the prohibition to entities owned or controlled by a designated person – meaning that a non-listed company can be fully caught even where the listed person's direct equity stake falls below any mechanical threshold. As of July 2026, EU guidance and General Court jurisprudence both confirm that the control limb of the test is fact-specific, forward-looking, and requires active analysis rather than a simple list-check.
This guide sets out the EU ownership and control assessment step by step, compares the EU approach with the OFAC and OFSI positions, and identifies the risk flags that most often trip businesses in a cross-border supply chain.
Step 1: Establish which EU sanctions regime and instrument applies
The first step is to identify the specific Council Regulation and the associated Council Decision that govern the transaction or relationship you are reviewing. The EU maintains numerous distinct sanctions programmes, each adopted under a separate legal instrument. The prohibitions – and the scope of the ownership and control test within them – can differ between programmes, even though the general structure is broadly consistent across EU sanctions law.
In practice, the starting point is the EU Consolidated List of persons, groups, and entities subject to EU financial sanctions. That list is maintained and updated by the European Commission and the Council. Screening against the Consolidated List is necessary but not sufficient: the list captures designated persons, not automatically every entity they own or control.
Check which programme governs the counterparty's sector, geographic connection, or the nature of the goods or services involved. Some programmes apply to transactions by EU persons wherever they occur; others have a territorial dimension. The cross-border scope matters because a business operating between, say, Germany and Singapore will need to analyse whether the EU regulation applies to the transaction at all before deciding how deeply to run the ownership-and-control analysis.
We regularly advise clients at this threshold stage: identifying the correct legal instrument is not a formality. An incorrect programme identification can produce a false negative – a counterparty assessed against the wrong list, cleared, and then found later to be caught under a different regulation.
Step 2: Map the ownership chain in full
Once the applicable regime is identified, map every layer of the counterparty's ownership structure, from the legal entity you are transacting with up to the ultimate beneficial owner or owners at the top of the chain. Do not stop at the first-tier shareholder.
The EU ownership test focuses on whether a designated person holds, directly or indirectly, an ownership interest in the entity under review. Unlike the OFAC 50 percent rule (OFAC's mechanical rule treating entities owned 50 percent or more by blocked persons as themselves blocked), the EU regime does not set a single bright-line numerical threshold that operates as the sole determinant. The percentage of shares held is a relevant factor, but the EU analysis does not end there.
For the ownership mapping to be adequate, you need:
- The full shareholding structure at each level, with percentages held directly and indirectly;
- The identity of every shareholder holding a material interest, including nominees;
- The jurisdiction of incorporation of each intermediate holding entity;
- Any trust, foundation, or other vehicle that may hold shares on behalf of a third party;
- Historical ownership data covering any changes made in the period since the designated person was listed.
Incomplete ownership data is the single most common reason an assessment fails. Corporate registries in some jurisdictions are not current, and in some offshore structures the beneficial-ownership layer is concealed behind nominee arrangements. When registry information is insufficient, practitioners need to use other sources: commercial corporate-intelligence databases, regulatory filings, publicly available financial statements, and, where appropriate, direct requests to the counterparty for certified ownership documentation.
Have you reviewed ownership as it stands today, or only as it stood when you last ran a check? Ownership structures change. The EU General Court has made clear in several annulment actions that ownership is assessed at the time of a designation – but for compliance purposes a business must also assess the current position at the time of each transaction.
Step 3: Apply the EU control test – a broader and more demanding analysis
The EU control test extends the reach of sanctions beyond entities that a designated person formally owns. Control, in EU sanctions law, encompasses the ability of a designated person to direct or significantly influence the decisions of an entity, regardless of whether that influence derives from formal ownership.
This is where the EU regime diverges most sharply from OFAC. Under OFAC's mechanical ownership rule, a fifty-percent-or-more ownership stake triggers the prohibition automatically. Control, as a separate basis for captured-entity status, is less prominent in the OFAC framework than it is under EU law. The OFSI position in the United Kingdom, by contrast, sits closer to the EU: the ownership and control test under UK sanctions law expressly includes a control limb, and OFSI guidance has explained that control can arise through legal mechanisms short of majority ownership – board appointments, veto rights, contractual arrangements, and economic dependency.
Under the EU rules, indicators of control include:
- The right to appoint or remove a majority of the board of directors or supervisory board;
- A contractual right to direct the entity's commercial or financial policy;
- A dominant position in fact, evidenced by decision-making patterns in governance documents;
- Blocking rights or veto rights over fundamental decisions;
- Dependency on the designated person as the entity's primary or exclusive source of financing or revenue.
None of these indicators is individually determinative. The assessment is holistic in the sense that it requires a review of all available facts about how the entity is actually governed. In our cross-border practice, we find that businesses often underestimate this aspect. A counterparty with a clean ownership structure – no designated person above any threshold – can still be caught because a designated person controls the board or holds a blocking right under the shareholders' agreement.
The EU General Court has confirmed that the concept of control in sanctions law is autonomous: it is not tied to the definition of control under company law or accounting standards in any member state. That matters when advising a business accustomed to applying, for example, an accounting-consolidation test to determine group boundaries.
Step 4: Screen names against the EU Consolidated List with appropriate fuzzy logic
Once the full ownership chain is mapped and the control indicators assessed, screen every name identified against the EU Consolidated List, including alternative spellings, transliterations, and aliases. Designated persons are often listed under multiple name variants to address transliteration differences across alphabets.
A literal exact-match screen is not adequate for EU compliance purposes. The standard expected by competent authorities across the EU member states – and reflected in guidance from the European Banking Authority and national regulators – is that screening must accommodate reasonable variations in name spelling, date of birth, and identifying information. Fuzzy-logic screening tools are the baseline; manual review of close matches is required wherever an automated flag is generated.
The scenario in our opening illustration – a shareholder name that is close but not identical to a listed person – is exactly where exact-match screening breaks down. The correct response to a close match is not to clear the counterparty. It is to escalate for a human analyst review, gather additional identifying information (date of birth, nationality, identification document numbers, address), and compare against the identifying data attached to the listing. Only when the available information positively excludes identity with the listed person should the match be closed as a false positive.
In our experience, firms that run only automated screening without a defined escalation and human-review process face the greatest exposure when a close match later proves to be a true positive. The process – and its documentation – is what a competent authority will scrutinise in any enforcement inquiry.
Step 5: Document the assessment and record your reasoning
A completed ownership and control assessment has no evidential value unless it is documented. Competent authorities across the EU expect firms to be able to demonstrate not just the conclusion of the assessment but the reasoning behind it, the sources consulted, the date of the review, and the identity of the reviewer.
Documentation should include:
- A record of each ownership layer identified, with the source of the information;
- The date on which ownership and control information was retrieved or requested;
- The screening results for each name, including any close matches and the outcome of the human-review escalation;
- A written analysis of the control indicators reviewed, explaining why the conclusion was reached;
- The name and role of the person who approved the conclusion;
- A note of any information that was unavailable, and how that gap was addressed.
EU sanctions regulations place obligations of record-keeping on persons conducting regulated transactions. While the precise retention period varies by regime and by member state implementing measures, practitioners should plan for a minimum retention period consistent with standard financial-crime and AML requirements in the relevant jurisdiction and verify the current position before relying on it.
The documentation requirement is not bureaucratic formality. If a transaction is subsequently questioned by a competent authority – or if the counterparty is later designated – the contemporaneous record of the assessment is the primary means of demonstrating good-faith compliance. An assessment conducted but not documented is, for enforcement purposes, an assessment that cannot be proved.
Step 6: Reassess when ownership or circumstances change
An ownership and control assessment is a point-in-time determination. The EU sanctions environment changes, and so do corporate structures. A business that conducts an assessment at onboarding and never revisits it takes on accumulating risk.
Triggers for reassessment include:
- A new designation on the EU Consolidated List that touches any part of the counterparty's ownership chain;
- A report or publicly available information suggesting a change in ownership or governance;
- A significant increase in the value or volume of transactions with the counterparty;
- A change in the goods, services, or jurisdictions involved that brings a different EU regulation into scope;
- Any adverse media or intelligence suggesting that a previously cleared person may now be linked to a designated individual.
In our cross-border practice, we see this most acutely in M&A transactions and in long-term supply relationships. A target company acquired following a clean assessment may, six months later, become indirectly connected to a newly designated person through a change in its parent structure. The acquirer inherits that exposure. The same logic applies to a long-standing supplier where a new shareholder transaction was never reported to the buyer.
The question is not just whether you assessed the counterparty before signing. It is whether your ongoing monitoring programme is calibrated to catch these changes as they occur.
Risk flags and when to involve counsel
Certain patterns in an ownership-and-control review signal that the analysis has moved beyond routine compliance and requires specialist legal input. Recognising these patterns early preserves options that become narrower with delay.
The risk flags that most often appear in our practice include:
- Opaque layering: three or more intermediate holding entities, particularly where any are incorporated in low-transparency jurisdictions, without a clear commercial rationale;
- Nominee shareholders: shares held by a corporate nominee without disclosed beneficial ownership;
- Recent ownership transfers: a transfer of shares from a named individual shortly before or after a designation, particularly where the transfer was to a family member or associated entity;
- Contractual control indicators: a shareholders' agreement that gives an individual veto rights or board-appointment rights disproportionate to their equity stake;
- Gaps in registry data: a jurisdiction where the beneficial-ownership register is not publicly accessible or not current;
- A close name match: an automated screening flag that has not been positively excluded by reference to identification data;
- Conflicting information sources: a corporate registry showing one owner, and public reporting suggesting a different person exercises effective control.
When these flags are present, the risk is not simply that the counterparty may be caught. The risk is that an uninformed or inadequately documented decision to proceed generates a potential violation of the EU regulation and, in the context of a financial institution, a concurrent failure of AML controls.
One common myth in this area deserves direct correction: some businesses assume that because a counterparty is not directly listed on the EU Consolidated List, the transaction is automatically permissible without further analysis. That assumption is incorrect. The ownership and control test exists precisely because the prohibition extends to indirectly caught entities. A listed person's ownership or control of an unlisted entity brings that entity within the scope of the prohibition under the applicable regulation.
If a transaction has already been flagged – by a bank, a payment provider, or an internal screening hit – an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com to discuss an assessment of your position.
The cross-regime dimension: how EU compares with OFAC and OFSI
Businesses operating across multiple jurisdictions face a practical challenge: the major sanctions regimes do not apply a uniform ownership-and-control test, and a transaction cleared under one regime may still be prohibited under another.
Under OFAC, the analysis is primarily mechanical. The 50 percent rule means that any entity owned fifty percent or more in the aggregate by one or more blocked persons is itself treated as blocked, regardless of whether it is listed. OFAC guidance makes clear that this applies regardless of the number of blocked persons involved, provided their combined ownership reaches the threshold. Control, as a separate trigger, is less developed in the OFAC framework than in EU law.
Under OFSI in the United Kingdom, the test expressly covers both ownership and control. The control limb in UK sanctions law is broadly comparable to the EU position, though OFSI's published guidance provides somewhat more structured indicators than the EU regime offers in consolidated form. For a transaction caught by both OFSI and EU rules, the more restrictive analysis governs: a firm cannot proceed simply because it has cleared one regime's test.
The practical implication for a cross-border transaction – say, a payment chain passing through a US correspondent bank, a UK entity, and an EU payment processor – is that all three regimes apply simultaneously. A counterparty that falls below the OFAC fifty-percent threshold but is subject to effective control by an EU-designated person is caught by the EU prohibition regardless of the OFAC position. Competent authorities in different jurisdictions do not coordinate their enforcement timetables.
For businesses with exposure to multiple regimes, we advise running the assessment to the most demanding standard across the applicable regimes, then documenting which regime drove each element of the analysis. That approach produces a single assessment that defends adequately before any of the relevant authorities.
See also our guidance on the OFAC ownership and control assessment for the comparable analysis under the US regime, and our further EU ownership and control guidance for advanced scenarios involving trust structures and foundations.
Related practices
- Compliance audit and testing – structured review of screening programmes and ownership-analysis methodology against current regulatory standards.
- EU ownership and control: advanced scenarios – trust structures, foundations, and indirect control chains under EU sanctions law.