A UK-registered trading company routes a shipment of industrial components through a third-country distributor. The ultimate buyer turns out to be connected to a party subject to UK financial sanctions. The distributor is not based in the United Kingdom. Does OFSI have anything to say about it? The answer — increasingly — is yes, and the basis for that answer is less understood than it should be.
Re-export and extraterritorial reach under OFSI describes the circumstances in which UK financial-sanctions obligations, administered by the Office of Financial Sanctions Implementation (OFSI, the UK authority responsible for licensing and enforcing financial sanctions), apply to transactions that originate or are processed outside the United Kingdom. The legal basis is the Sanctions and Anti-Money Laundering Act ("SAMLA") and the thematic sanctions regulations made under it. As of May 2026, the reach of those regulations extends to conduct by UK persons and UK-incorporated entities anywhere in the world, and to conduct by any person within the United Kingdom's territory. That dual nexus is what makes re-export and secondary-supply chains a live compliance problem for businesses that do not consider themselves primarily UK-facing.
This guide works through the jurisdictional trigger, the test a business must apply, how OFSI's position compares with that of OFAC and the EU, the practical risk flags that appear in cross-border supply chains, and the steps a compliance programme should take before a shipment moves.
Step 1 — Identify whether the OFSI jurisdictional trigger is engaged
OFSI's prohibitions engage when a transaction involves a UK person, a UK-incorporated entity, or conduct taking place within the United Kingdom — including the processing of sterling payments through the UK financial system. A business that clears neither test in a given transaction falls outside OFSI's direct reach for that specific act, though it may still face exposure under parallel regimes.
The first question in any re-export analysis is therefore not "what is the sanctioned party?" but "what is the UK nexus?" In our experience, that question is skipped far more often than it should be. A non-UK company with a UK parent, a UK branch, or a UK-resident director authorising the transaction is already inside the jurisdictional perimeter. Sterling settlement or a UK correspondent bank introduces a separate, independent hook — one that a compliance programme focused only on entity screening will not catch.
UK persons includes British nationals. That matters for individuals employed outside the United Kingdom who remain subject to SAMLA-based obligations wherever they sit geographically. A UK national approving a transaction from a Dubai office is conducting that approval as a UK person. The geographic location of the approval does not neutralise the personal nexus.
Step 2 — Apply the ownership and control test to the supply chain
Once the jurisdictional trigger is confirmed, the next step is to determine whether any party in the supply chain — buyer, end-user, financing institution, or freight intermediary — is a designated person or is owned or controlled by one. Under OFSI's ownership and control test (the UK and EU mechanism for treating a non-listed entity as caught through a listed person's ownership or direction), a non-listed entity can be caught even if it does not itself appear on the UK Consolidated List.
The ownership limb looks at whether a designated person holds a majority interest, directly or indirectly, in the entity. The control limb is wider: it asks whether a designated person is in a position to direct or influence the entity's affairs. Control is not defined purely by shareholding. Board representation, contractual rights to direct commercial decisions, or a position as sole supplier of critical inputs can each be relevant. This is where the UK and EU test diverges materially from the OFAC 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked): OFAC's rule is mechanical; OFSI's control limb is qualitative and requires judgement about actual power to direct.
In a re-export scenario, the ownership and control question must be applied at each node of the chain — not only to the named buyer but to the end-user identified in the shipping documentation and to any intermediary holding the goods between the UK exporter and that end-user. A distributor that is 40 percent owned by a designated person does not trip the ownership limb, but if that designate also has the contractual right to direct the distributor's onward sales, the control limb may be met. Have you reviewed the commercial arrangements as well as the register of members?
Step 3 — Assess the cross-regime exposure before the transaction closes
For most cross-border businesses, OFSI is not the only sanctions authority with a view on the same transaction. US export controls under the Export Administration Regulations (the EAR) can apply to goods with US-origin content, US-origin technology, or US-manufactured equipment, wherever those goods are re-exported — the so-called de minimis and foreign-direct-product rules extending BIS's reach beyond US territory. EU sanctions Council regulations can catch an EU-incorporated subsidiary involved in the chain. The cardinal principle across all regimes is that the strictest prohibition governs: a transaction that OFSI would permit under a specific licence may still be unlawful under the EAR, or vice versa, and obtaining one authorisation does not provide cover under the other.
This cross-regime dimension is especially acute for dual-use goods — items with both civilian and military or intelligence applications. An item that does not require a UK export licence may nonetheless require a BIS licence for a re-export to a third country, and the applicable country regime at the destination may impose its own controls independent of both. In our practice, we regularly advise clients who have secured one licence in good faith and assumed it resolves the compliance picture, only to discover a parallel exposure they had not mapped. That assumption costs time and, when the gap is discovered mid-shipment, it costs considerably more.
A practical three-way check — OFSI, OFAC/BIS, and the EU — should be completed before any transaction involving dual-use goods, UK-nexus parties, and a high-risk destination or end-user moves to execution. For businesses with US operations or US-origin components in their products, the deemed export and technology transfer service addresses how the EAR treats knowledge transfers and re-exports separately from the physical movement of goods. That distinction is often the source of a gap in a mixed UK-US supply-chain programme.
The position above covers the standard cross-regime analysis. Your facts — the goods classification, the ownership structure, the route, the end-user, and the jurisdictions involved — will all shift the weight of the analysis. To assess your specific exposure before a transaction closes, contact Calder & Vance at info@caldervance.com.
Step 4 — Review end-use documentation and contractual protections
Knowing who the end-user is, and having documented that knowledge, is a core obligation in re-export compliance under any sanctions regime. Under OFSI's enforcement guidance, a business that cannot demonstrate it took proportionate steps to verify the end-user and the end-use is in a weaker position when an apparent breach arises, even if the goods were not ultimately diverted.
End-use certificates and contractual no-re-export clauses are minimum markers, not a complete answer. An end-use certificate that is inconsistent with the buyer's business, the quantity of goods, or the logistics route is a red flag rather than a comfort. Proportionate due diligence means testing the plausibility of the stated use — comparing it with the buyer's known commercial activity, the technical specifications of the goods, and the delivery arrangements. A certificate that says "civil industrial use" for goods that have a well-documented dual-use application to a buyer in a sector with no obvious civil need should not be accepted at face value.
Contractual protections — including representations and warranties that the counterparty will not re-export to a sanctioned destination or end-user, and rights to terminate and audit — serve two functions. They allocate commercial risk between the parties. And they form part of the evidence base that a business acted diligently if a subsequent diversion occurs. They do not, however, discharge the primary compliance obligation, which runs to OFSI and is not altered by a private contractual arrangement between the parties to the sale.
How does OFSI's extraterritorial reach compare with OFAC and EU sanctions?
OFSI's extraterritorial reach operates on two tracks: the personal nexus (UK persons and UK entities, wherever they act) and the territorial nexus (any person acting within the United Kingdom). OFAC's reach is generally described as the wider of the two principal Western sanctions regimes, extending to US persons globally, to transactions processed in US dollars through the US financial system, and — via secondary-sanctions risk — to non-US persons transacting with designated parties. The EU regime applies to EU persons, EU-incorporated entities, and conduct within EU territory, with the additional effect that EU-law obligations bind subsidiaries of EU companies even when those subsidiaries are incorporated outside the EU if the parent is directing the relevant conduct.
In practical terms, a UK-based trading house transacting with a US-origin product through an EU subsidiary faces all three regimes simultaneously. OFAC's reach through dollar settlement is particularly significant: a transaction involving no US-origin goods and no US person can still engage OFAC prohibitions if the payment chain routes through a US correspondent bank. That is a US-nexus test, not a UK one, and OFSI will not help resolve it.
One structural difference matters for re-export specifically. OFAC's SDN List is published with global notes and supplementary identifiers that often signal secondary-sanctions exposure — designations carrying implications beyond direct US-person prohibitions, affecting the behaviour of non-US banks and counterparties. OFSI's UK Consolidated List does not carry equivalent secondary-sanctions annotations in the same form. The practical result is that a non-UK company screening only against the UK Consolidated List to assess OFSI exposure may not capture the full secondary-sanctions risk that a US-connected transaction carries. That gap, in our experience, is one of the most common structural weaknesses in multi-regime screening programmes.
For businesses managing cross-border supply chains that touch Switzerland or other European jurisdictions alongside OFSI, the SECO re-export guide and the extended SECO analysis address how Swiss export-control obligations interact with UK and EU positions — a comparison that is increasingly relevant for goods transiting through Swiss intermediaries.
Common risk flags and when to involve counsel
Re-export and extraterritorial exposure tends to crystallise around a recognisable set of risk factors. When several appear in the same transaction, that is a signal to pause rather than proceed.
- High-risk destination or end-user. A buyer or end-user in a jurisdiction subject to a broad sectoral or comprehensive sanctions programme, or listed on any major regime's consolidated or entity list, is an obvious starting point. Less obvious is a buyer in a third country that is itself a known transshipment point for goods diverted to sanctioned destinations.
- Atypical payment routes. Payment through a jurisdiction or financial institution that is not commercially connected to the transaction — especially where the payment instruction originates from a third party unknown to the exporter — is a red flag under OFSI enforcement guidance and under anti-money-laundering rules simultaneously.
- Inconsistent end-use representation. A stated civilian end-use for goods with a well-documented controlled application, or a buyer whose known sector does not match the stated application, should prompt enhanced diligence rather than acceptance of the certificate at face value.
- Complex or opaque ownership chain. Where the ultimate beneficial owner of the buyer is not clearly established, or where the ownership chain passes through secrecy jurisdictions, the control limb of the OFSI ownership and control test cannot be confidently assessed.
- Last-minute changes to the routing or the buyer. A request to change the named end-user, the delivery address, or the freight route after the commercial terms are agreed is a well-documented indicator of diversion risk.
- Mismatch between quantity and stated application. Ordering volumes inconsistent with the stated operational need, or ordering a single specialised component in bulk, is a red flag in dual-use export-control practice and applies equally to the sanctions-diversion analysis.
Counsel should be involved before the transaction executes when the risk flags are multiple, when the goods are classified dual-use or controlled under the applicable regime, when the ownership and control analysis is genuinely ambiguous, or when a OFSI specific licence may be required. A specific licence from OFSI — a case-by-case authorisation to conduct an otherwise prohibited transaction — takes time to obtain and does not have a guaranteed outcome. Leaving the application to the last stage of a deal creates execution risk for the transaction and reputational risk for the business.
If a transaction has already been flagged — by an internal screen, a bank query, or a OFSI enquiry — an early review preserves options that narrow quickly. Contact Calder & Vance at info@caldervance.com to discuss the position.
Correcting the common misconception: "We are not UK-based, so OFSI does not apply"
The most persistent myth in re-export compliance is that OFSI is a concern only for businesses with a UK office, UK staff, or UK customers. It is not. A non-UK company that employs a single UK national in a decision-making role, that settles invoices in sterling through a UK bank, or that is majority-owned by a UK-incorporated parent is within OFSI's reach for the relevant act — even if every other aspect of the transaction is conducted outside the United Kingdom.
That myth has a direct operational consequence: businesses that consider themselves non-UK assume that screening against US and EU lists is sufficient, and omit the UK Consolidated List from their programme. The lists are not identical. A party designated under SAMLA-based regulations may not appear on OFAC's SDN List or the EU's lists, and vice versa. A screening programme that omits any one of the three major Western sanctions lists has a structural gap, regardless of where the business is incorporated.
We regularly advise non-UK multinationals on exactly this issue — typically after a compliance review surfaces the gap, occasionally after a bank query or a transaction refusal prompts the question. The cost of adding the UK Consolidated List to a screening programme is low. The cost of discovering the gap after an apparent breach is not.
Related practices
- Deemed export and technology transfer – BIS/EAR service – advising on how US export controls treat technology and knowledge transfers across borders
- Re-export and extraterritoriality under SECO – Swiss export-control obligations and their interaction with UK and EU positions