A bank receives a payment instruction for a trade counterparty in a third market. The beneficiary is not on any list. But one correspondent in the chain is subject to blocking measures under a second regime – a regime the sending institution does not primarily monitor. The payment stalls. The clock runs. And the compliance team must determine, under at least three separate legal regimes, whether any authorisation route exists and which application should go first.
Payment authorisations across regimes require a firm to identify the correct licensing authority for each jurisdiction whose rules are engaged, meet divergent procedural standards, and manage the risk that approval under one regime does not extinguish liability under another. As of June 2026, the major regimes – OFAC, OFSI, and the EU Council – each operate distinct authorisation mechanisms with different evidentiary thresholds, different timelines, and different legal effects. No single authorisation provides universal clearance.
This guide walks through the authorisation procedure at each major regime, identifies the most common points of failure in cross-border payment matters, and explains when the complexity of concurrent applications justifies early involvement of specialised sanctions counsel.
Why does a single payment engage multiple regimes?
A cross-border payment can engage several regimes simultaneously because each regime's jurisdictional reach depends on different connecting factors – the currency, the location of the parties, the nationality of the intermediary, and the location of the property involved.
US dollar clearing is the clearest example of jurisdictional overlap. Any payment cleared in US dollars passes through a US correspondent bank, which brings it within the reach of OFAC regardless of where the payer and payee are incorporated. A UK-headquartered firm making a sterling payment to a European counterparty may simultaneously face obligations under OFSI (because the UK entity is a UK person) and under the relevant EU Council regulation (because the beneficiary is established in a member state). The payment is one transaction; the legal questions are at minimum two, and often three.
In our cross-border practice, firms routinely underestimate jurisdictional scope at the point of transaction screening. The question is not only whether the direct counterparty is listed. It is also whether the currency, the correspondent, or the routing of the payment independently brings a second or third regime into play. Have you mapped each connecting factor before submitting a single authorisation application?
The consequence of missing a connected regime is significant. Authorisation granted by OFSI does not authorise a US dollar payment that OFAC has not also licensed. The regimes are parallel, not hierarchical. Where the rules diverge, the stricter prohibition governs the transaction.
What is the OFAC specific-licence procedure for restricted payments?
A specific licence (a case-by-case authorisation from OFAC to conduct an otherwise prohibited transaction) is the primary route where a general licence (a standing authorisation that permits a defined category of transactions without a separate application) does not cover the payment in question.
The applicant must submit the request through OFAC's online licensing system. The application must identify the parties, the nature of the transaction, the legal basis for the request, and the purpose served. OFAC will assess whether the transaction falls within a recognised licensing policy – such as authorisation for certain humanitarian transactions, certain legal fees, or transactions that serve the national interest – and whether the facts as presented meet that policy.
Processing times vary and are not guaranteed. In our experience, complex payment matters involving multiple blocked entities or contested ownership structures take considerably longer than straightforward humanitarian requests. The application should be complete at the point of filing: an incomplete submission that draws a request for supplemental information extends the timeline materially.
A critical point for cross-border payment matters: OFAC's grant of a specific licence authorises the conduct of the US person or the US dollar transaction within its scope. It does not address whether a separate UK or EU authorisation is required for the same payment. A client who secures OFAC approval and then routes the payment through a UK correspondent has not resolved the OFSI position.
How does the OFSI licensing procedure compare?
OFSI issues licences under the relevant thematic sanctions regulations made under the Sanctions and Anti-Money Laundering Act. The licensing grounds are statutory and differ by regime; a ground available under one set of regulations may not be available under another.
The applicant submits a licence application identifying the parties, the proposed transaction, the specific licence ground relied upon, and supporting documentation. OFSI publishes guidance on the information it requires. The evidentiary standard is practical: OFSI will want to understand the ownership and control position of any non-listed party that has a connection to a listed person, the commercial purpose of the payment, and why a relevant licence ground is met.
OFSI's ownership and control test (the UK test for whether a non-listed entity is caught through a listed person) is not purely mechanical. Where a listed person owns less than fifty percent but exercises control through contractual rights, board representation, or effective management authority, OFSI may still treat the entity as subject to the financial sanctions. This is a material divergence from OFAC's 50 percent ownership trigger, which does not turn on control. We regularly advise clients on the difference: a counterparty cleared under OFAC's threshold test may still be caught by OFSI's control analysis.
For payments held pending an OFSI licence, an important practical consideration is that funds may be held in a frozen account pending resolution. The interaction between the frozen account position and the licensing timeline requires active management. Our colleagues' work on frozen account management and licensing covers the procedural aspects of that position in detail.
What is the EU authorisation procedure and where does it diverge?
EU authorisations for restricted payments are issued by the competent authority of the relevant member state – typically the national authority designated under the applicable Council regulation. There is no single EU-level licensing office for financial sanctions; the applicable authority depends on which member state has jurisdiction over the applicant or the transaction.
This decentralised structure is a source of genuine procedural complexity. A transaction involving parties in two member states may theoretically engage two competent authorities. In practice, the applicant typically applies in the jurisdiction where it is established, but the licensing ground must be available under the relevant Council regulation – and the interpretation and application of those grounds can vary across member states.
The EU ownership and control standard under the relevant Council regulation aligns more closely with OFSI's approach than with OFAC's. A non-listed entity that a listed person controls – even below majority ownership – may be treated as caught by the prohibition. The EU General Court has considered this question in a series of actions, and the analysis turns on whether the listed person can effectively direct the entity's conduct.
For firms operating across the EU and UK simultaneously, the risk is procedural as well as substantive. An authorisation granted by a member state's competent authority operates within that Council regulation. It does not constitute OFSI authorisation for the same payment. Post-Brexit, the UK and EU regimes have diverged in scope, designation lists, and licensing grounds – sometimes substantially. A payment that an EU competent authority has authorised may still require a separate OFSI licence if a UK person or UK-based correspondent is in the chain.
For detailed guidance on the EU authorisation procedure, including the required documentation and applicable grounds, see our dedicated EU payment authorisation guide. An extended analysis of the EU competent authority process is also available in our supplementary EU guide.
What are the most common pitfalls in cross-border payment authorisations?
The most common point of failure is sequential rather than parallel filing: applicants secure one authorisation, assume the matter is resolved, and then discover a second regime was engaged throughout.
The practical consequence is not merely delay. If a payment has been made under a first authorisation while a second regime's prohibition remained in force, the payment may constitute a violation of the second regime. The fact that the first regime had authorised it provides no defence under the second. Firms that act on the first approval without completing the cross-regime analysis expose themselves to enforcement risk.
A second common pitfall is incomplete ownership and control analysis at the pre-application stage. Each regime has its own threshold and control test. A firm that relies on a single screening tool set to flag only SDN-listed entities will not catch:
- entities owned 50 percent or more by a blocked person in the aggregate under the OFAC ownership rule;
- entities that a listed person controls under the OFSI or EU control test even below that threshold;
- counterparties that are not themselves listed but hold contractual relationships with listed persons that make the payment indirectly prohibited.
A third pitfall is the failure to manage the application as a live file. OFAC, OFSI, and EU competent authorities can request additional information after submission. A slow response to that request does not pause the clock on any transaction timeline the business is managing; it simply extends the period of uncertainty. We regularly advise compliance teams on the importance of assigning a named owner to each open licensing file and treating every regulator query as time-sensitive.
Fourth, applicants sometimes identify a general licence that appears to cover the payment and proceed without confirming that all conditions of that general licence are satisfied. General licences carry conditions: they may require specific record-keeping, they may exclude certain classes of counterparty, and they may have expiry dates or require a filing or notification. Acting on a general licence whose conditions are not met is not authorised conduct; it is an apparent violation.
When should a business involve sanctions counsel in a payment authorisation?
Sanctions counsel should be involved at the earliest point where the payment has been flagged by screening, not after a first application has already been submitted to one regime.
This is not merely an efficiency point. The sequencing and coordination of applications across OFAC, OFSI, and one or more EU competent authorities is a strategic exercise. The order in which applications are filed, the basis asserted in each, and the documentation submitted should be consistent and co-ordinated. An application to OFSI that describes the transaction in terms that conflict with a concurrent OFAC application creates a risk that regulators comparing notes – as they sometimes do in major transactions – will identify inconsistencies that damage both applications.
The position above covers the standard procedural case. Your specific facts – the counterparties, the currency, the correspondent chain, the ownership structures in play – change the analysis at each stage. For a confidential review of a specific payment matter, contact Calder & Vance at info@caldervance.com.
There is a common misconception that a firm which does not itself need a licence – because it is not a US person and the payment is not in US dollars – is entirely outside OFAC's reach. That is not correct. Secondary-sanctions risk under OFAC applies to non-US persons in certain contexts, particularly in relation to specified sectors or transactions involving certain jurisdictions. The analysis does not begin and end with primary-sanctions nexus. Secondary-sanctions exposure is a separate question and requires a separate assessment.
Similarly, some firms assume that if they are not UK-incorporated they have no OFSI exposure. OFSI's jurisdiction extends to conduct by persons in the United Kingdom and to conduct by UK persons anywhere in the world. A non-UK firm routing a payment through a UK bank, or instructing a UK-based correspondent, may bring OFSI's jurisdiction into play regardless of the firm's own place of incorporation.
If a transaction has already been flagged by a correspondent or a payment has been returned, the options available narrow quickly. Early legal review at that stage can preserve positions that a delayed response forecloses. For a confidential assessment of a live payment matter, contact us at info@caldervance.com.
How should a business manage concurrent authorisation applications?
Managing concurrent applications across OFAC, OFSI, and an EU competent authority requires a structured approach: a single co-ordinating team, a consistent factual record across all filings, and active management of each open file.
The first step is a complete jurisdictional mapping exercise. For each regime potentially engaged, the business must determine: (a) whether the transaction is prohibited under that regime; (b) whether a general licence is available and, if so, whether its conditions are met; (c) if no general licence applies, whether a specific licence ground exists; and (d) what documentation is required to support that application.
That mapping exercise should produce a regime-by-regime matrix. It should record the applicable authority, the licence ground relied upon, the documents required, the expected timeline, and any interim measures needed to preserve the transaction or prevent the escalation of a hold. That matrix should be treated as a live document, updated as each application progresses and as facts develop.
The second step is co-ordinating the factual record. The description of the transaction, the ownership and control analysis, the commercial purpose, and the parties must be consistent across all applications. Where the licensing grounds differ between regimes – and they often do – the framing will differ, but the underlying facts must not. Inconsistency in the factual record is one of the most effective ways to undermine a multi-regime application.
The third step is active file management. Each regime should have a named owner within the compliance or legal team. Queries from OFAC, OFSI, or a member state competent authority should be escalated immediately and responded to within the shortest feasible timeframe. Where a response will take time to prepare, it is often better practice to communicate with the authority early to indicate that a substantive response is in preparation, rather than allowing the file to go silent.
In a recent matter, a financial institution handling a trade finance transaction identified that the underlying supply chain involved a counterparty with an indirect connection to a listed person under two separate regimes. We co-ordinated a parallel licensing exercise across both regimes, ensured the factual record was consistent, and managed the regulator queries through to resolution. The matter illustrated that the principal risk in multi-regime payment matters is not legal complexity – it is procedural disorganisation.
Related practices
Related practices
- Frozen account management and licensing – procedure and options when sanctioned funds are held pending authorisation
- EU payment authorisation guide – step-by-step analysis of the EU competent authority procedure
- Supplementary EU payment authorisation analysis – extended coverage of member state divergence and documentation standards