A trading company screens its new distribution partner against the UN Consolidated List. The partner itself does not appear. But one of its parent companies does. Is the distribution partner caught? Can the contract proceed? That question – whether a non-listed entity falls within the reach of a UN designation through ownership or control – is among the most consequential assessments a compliance officer makes.
Under the UN sanctions architecture, the Consolidated List identifies designated individuals and entities directly. Unlike OFAC's mechanical 50 percent rule (which treats any entity owned 50 percent or more in aggregate by blocked persons as itself blocked), the UN framework does not publish a single bright-line ownership threshold. The assessment turns on the terms of the relevant Security Council resolution, the practice of the administering sanctions committee, and – critically – on the domestic implementing legislation of the jurisdiction enforcing the designation. As of mid-2026, businesses must therefore conduct a layered analysis: UN-level designation, domestic implementation, and any stricter national threshold that applies.
This guide sets out that layered analysis step by step. It covers the governing authority, the ownership and control tests as applied by the major implementing regimes, the practical procedure for conducting the assessment, the key risk flags, and when to involve sanctions counsel.
Step 1: Understand the UN sanctions architecture and who administers it
The UN Consolidated List is the master list of individuals and entities designated by Security Council sanctions committees acting under Chapter VII of the UN Charter. The Security Council does not itself enforce sanctions against private parties; it creates the designation and imposes the obligation on member states to implement it. Enforcement is therefore downstream: it happens through the domestic legislation each member state enacts in response to the relevant resolution.
This architecture has a direct consequence for ownership and control assessments. When you assess whether a non-listed entity is caught through its relationship to a listed person, you are not applying a single UN rule. You are applying the domestic rule of each jurisdiction in which your business, your counterparty, or the transaction has a connection. Two businesses transacting across jurisdictions may be subject to different ownership-and-control tests simultaneously.
The administering bodies at the UN level include the Security Council committees responsible for each sanctions regime – such as the committee overseeing the ISIL (Da'esh) and Al-Qaida regime, which is the one programme with a dedicated Ombudsperson for de-listing. For other programmes, the Focal Point mechanism handles de-listing petitions from individuals who are not nationals of a designating state. Understanding which committee governs the designation at issue is the starting point for any assessment.
In our cross-border practice, we regularly see compliance teams treat the Consolidated List as if it were a single enforcement instrument. It is not. It is the source of an obligation that domestic legislators translate into enforceable rules – and those translations differ materially.
Step 2: Identify the implementing jurisdictions and their ownership tests
Once you know which Security Council designation is at issue, the next step is to map every jurisdiction whose rules could apply to your transaction or your entity. For each jurisdiction, the question is: what test does the domestic legislation use to catch entities that are owned or controlled by a designated person?
The major implementing regimes approach this differently, and the differences matter.
Under OFAC's rules implementing UN-mandated programmes, the 50 percent rule applies: any entity owned, directly or indirectly, in aggregate 50 percent or more by one or more designated persons is treated as itself designated. The test is mechanical. Ownership percentage is determinative; control, management, and intent are irrelevant to the threshold. Aggregation across multiple designated shareholders is required.
Under OFSI in the United Kingdom and under the relevant EU Council regulations, the test for whether a non-listed entity is caught extends beyond ownership to ownership and control (the test for whether a non-listed entity is caught because a listed person holds a controlling interest or exercises significant influence). The UK and EU tests ask whether a designated person owns or controls the entity. "Control" in this context can arise through shareholding below 50 percent, through contractual rights, through board appointment powers, or through other mechanisms that give a designated person effective authority over the entity's decisions. This is a wider test than the US ownership threshold alone.
Australia's autonomous sanctions regime, administered by DFAT, and Canada's regime under SEMA, similarly implement UN designations through domestic instruments. Each has its own formulation of the control concept. Singapore's MAS-administered regime and Japan's regime under the applicable national instruments also give effect to Security Council resolutions, with the ownership and control analysis shaped by each country's implementing rules.
The practical implication: the stricter prohibition governs. Where a transaction touches both a US nexus and a UK nexus, the EU's wider control test and the UK's ownership-and-control approach may catch an entity that OFAC's 50 percent rule would not. A business that clears a counterparty under only one regime's test is not managing its exposure across all relevant jurisdictions.
Step 3: Conduct the ownership-chain mapping
Mapping the ownership chain is the operational core of the assessment. It requires more than a search of the Consolidated List against the counterparty's registered name. It requires a structured walk up and across the counterparty's ownership structure.
Start with the counterparty itself and its immediate registered owners. Confirm the percentage held by each owner, and check each owner against the Consolidated List and the relevant domestic designated-persons lists. Where an owner is itself a corporate entity, repeat the exercise for its owners. Continue until you reach natural persons or entities with no further corporate parents.
Several specific issues arise at this stage that our practice regularly encounters.
First, aggregation. Where two or more designated persons each hold a minority stake, their holdings must be aggregated for the US 50 percent threshold test. A counterparty where one designated person holds 30 percent and another holds 25 percent reaches the threshold together. Screening tools that check individual holders but do not aggregate across multiple designated persons will miss this.
Second, indirect ownership. A designated person may hold their interest through one or more intermediate holding companies that are not themselves designated. The intermediate companies do not absorb the designation risk; the look-through principle requires you to trace the beneficial interest to its source.
Third, control short of ownership. Under the UK and EU tests, a designated person who holds, say, 35 percent of a company but also controls a majority of its board seats may be treated as controlling the entity, even without majority ownership. Documentary evidence – shareholder agreements, articles of association, board appointment rights – is necessary to assess this.
Fourth, stale data. Corporate ownership structures change. A beneficial owner who was not designated at the time of onboarding may have been designated since. Periodic review of the ownership chain is not optional; it is part of the ongoing compliance obligation.
How does the UN control test differ from OFAC, OFSI, and the EU?
This question sits at the centre of every cross-border ownership assessment, and the answer is that the UN framework itself does not prescribe a single control test – it delegates that determination to domestic implementing regimes, which diverge significantly.
OFAC's approach is the narrowest in one sense and the most mechanical. The 50 percent threshold is a bright line. If aggregate designated-person ownership reaches it, the entity is blocked. Below that line, OFAC's standard ownership rule does not itself capture the entity, though OFAC may take a different view if a designated person is found to act for or on behalf of the entity through other means.
OFSI and the EU apply what practitioners describe as an ownership-and-control test. The ownership limb looks at shareholding. The control limb asks whether a designated person can, directly or indirectly, exercise decisive influence over the entity's activities. The EU's approach, embedded in the relevant Council regulations, expressly includes control through management roles, contractual arrangements, and influence over financial policy. The UK's approach under SAMLA and the relevant thematic regulations is broadly similar.
Why does this divergence matter? Consider a counterparty where a designated person holds 40 percent of the shares and is also the sole executive director. Under OFAC's ownership threshold alone, the entity is not automatically blocked. Under OFSI and the EU, the control limb of the test could capture the entity regardless. A business with US and European operations must apply both tests.
Switzerland (SECO), Canada (GAC), Australia (DFAT), Singapore, Japan, and the UAE each give domestic effect to UN designations. Their ownership-and-control tests vary. In our experience, the most common analytical gap is failing to check the control position under the jurisdiction whose rules are most likely to apply to the specific transaction, and defaulting instead to the most familiar regime.
Step 4: Document the assessment and apply risk calibration
A completed ownership-chain mapping is only as useful as the record that supports it. Documentation serves two purposes: it demonstrates due diligence if the assessment is challenged, and it creates a baseline for periodic review.
The documentation should record the date of the assessment, the sources used (official corporate registry data, the Consolidated List, relevant domestic designated-persons lists, and any enhanced due-diligence sources used for complex or opaque structures), the ownership percentages and control indicators found at each level, the conclusion reached under each applicable regime, and any residual uncertainty.
Risk calibration is the process of deciding what to do with the result. Where the assessment is clean – no designated-person ownership or control found under any applicable regime – the record supports proceeding, subject to ongoing monitoring. Where the assessment identifies a designated person in the ownership chain below the applicable threshold or control threshold, the decision is not binary. Three factors shape the response.
First, the proximity of the designated person. A 2 percent holding by a designated individual in a widely held publicly listed company presents a different risk profile from a 35 percent stake in a closely held counterparty.
Second, the nature of the transaction. A goods delivery to a counterparty with marginal designated-person ownership raises different questions from a capital investment into the same entity or a credit facility that is governed by the counterparty's board.
Third, the jurisdiction of enforcement. A transaction with a clear UK nexus and a counterparty that passes the US threshold but may fail the UK control test requires OFSI analysis before proceeding.
Where the assessment does not produce a clear result, the appropriate response is escalation to sanctions counsel before the transaction proceeds. Proceeding on an unresolved assessment is not a defensible position.
Step 5: Identify risk flags and escalation triggers
Certain patterns in the ownership-chain analysis should trigger escalation regardless of whether a designated-person match is confirmed. These are not circumvention indicators; they are structural features that increase the probability that an assessment is incomplete or that the ownership data does not reflect the true beneficial position.
Nominee shareholders are a significant flag. Where the ownership chain includes entities or individuals described as nominees without disclosure of the underlying principal, the assessment cannot be completed on the available data. The beneficial owner must be identified before any regime's test can be applied.
Frequent recent changes to ownership structure, particularly where they post-date a designation event in a connected jurisdiction, warrant enhanced scrutiny. This is not an evasion assessment; it is a data-completeness assessment. The point is that where ownership data is recent and the change has not yet been reflected in all registry sources, the documented position may not be current.
Complex multi-jurisdictional holding structures with intermediate companies in jurisdictions with limited corporate-registry disclosure make the look-through analysis harder. The answer is enhanced due diligence through reliable commercial data sources and, where necessary, counterparty enquiries.
Sectors with heightened UN sanctions exposure – such as arms and related materiel, financial services in certain markets, and entities involved in the supply of listed goods under specific Security Council commodity prohibitions – warrant a higher baseline standard for the assessment.
Does your current screening procedure catch aggregated ownership? Does it apply the control test required by each jurisdiction in which the transaction has a nexus? If the answer to either question is uncertain, that is the escalation trigger.
Step 6: Ongoing monitoring and periodic reassessment
An ownership-and-control assessment is not a one-time exercise. The Consolidated List is updated as Security Council committees act; domestic designated-persons lists are updated more frequently and sometimes independently of the UN list. Ownership structures change. An entity that passed the assessment at onboarding may not pass it twelve months later.
The monitoring obligation under most implementing regimes is continuous. OFSI's enforcement guidance notes the obligation to report dealings with designated persons, and a failure to report that arises from inadequate monitoring – rather than from deliberate evasion – remains an enforcement risk. The EU and UK positions are similar. Verification of the current position before completing any significant transaction is the minimum standard.
In practice, ongoing monitoring should include automated name-screening against updated lists at a defined frequency, a trigger-based review when a material change in counterparty structure is identified or reported, and a periodic scheduled reassessment of higher-risk counterparties regardless of whether a trigger event has occurred.
We advise clients to treat the reassessment cycle not as a compliance cost but as a risk-management investment. A designation of a counterparty's parent that is identified within days of listing is a manageable situation. The same designation identified months later, after further transactions have occurred, is a materially harder enforcement position to defend.
Common mistakes and objection: "we already screen against the list"
A prevalent assumption in cross-border compliance teams is that screening the counterparty's legal name against the Consolidated List – or against a consolidated commercial screening database – is sufficient for the ownership-and-control assessment. It is not.
List screening identifies direct matches. Ownership-and-control analysis identifies indirect exposure. The two procedures are related but not interchangeable. A counterparty that does not appear on any list may still be owned or controlled by an entity or individual that does. The assessment of indirect exposure requires a separate, structured procedure that goes beyond the automated name-match.
A second common error is applying only the most familiar regime's test. Many compliance teams in European businesses apply the EU ownership-and-control standard and proceed without asking whether OFAC's 50 percent rule would also apply. Many US-centric businesses apply the 50 percent threshold and do not analyse whether the UK or EU control limb catches the counterparty in a transaction with a European nexus. Both errors leave exposure unmanaged.
A third error is treating the assessment as complete when the direct corporate parent is clear. The obligation extends to the full ownership chain, including ultimate beneficial owners. In our experience, the gap between the immediate parent and the ultimate beneficial owner is where the risk sits most often.
The objection – "our screening tool covers this" – is understandable. Commercial screening tools provide excellent first-line filtering. They are not substitutes for the analytical judgement that the ownership-and-control test requires, particularly for the control limb, which requires reading shareholder agreements and governance documents, not just running a name through a database.
Related practices
- Sanctions compliance audit and testing – Australia – assessing programme robustness and closing ownership-analysis gaps under the Australian regime.
- Payment processing controls – Australia guide – applying ownership and control analysis at the transaction-screening stage for payments.
- Payment processing controls – BIS/EAR guide – managing export-control and sanctions intersections in payment flows subject to US jurisdiction.