A European trading group is preparing to close a joint-venture agreement with a partner headquartered in a third country. The compliance team has run standard screening on the named counterparty. Nothing flags. Two weeks before signing, an internal audit query surfaces a question about a minority shareholder three tiers up the ownership chain. The deal is paused. The question is no longer whether the counterparty is on a list – it is whether the ownership and control analysis has been done properly. That distinction drives the EU sanctions risk assessment, and it is where most assessments fall short.
A sanctions risk assessment (a structured review of the exposure a business faces under applicable sanctions law) under EU law is governed by the relevant Council Regulations and Council Decisions administered by the competent authorities of each EU Member State. The assessment tests whether a counterparty, transaction, or business relationship is caught by asset-freeze, trade, or sectoral restrictions, applying the EU's ownership and control test (the rule that an entity is subject to sanctions obligations when it is owned or controlled by a designated person, even if the entity itself is not listed). As of mid-2026, the EU operates some of the most detailed sectoral and trade-restriction regimes in force globally, and the obligations they impose differ in material respects from those under OFAC and OFSI.
This guide walks through the procedure for conducting an EU sanctions risk assessment step by step, identifies the most common pitfalls, and explains how the EU position diverges from the US and UK regimes that often apply to the same transaction.
Step 1: Identify the legal basis and the competent authority
Before testing any counterparty or transaction, you must identify which EU Council Regulation applies and which national competent authority administers it in the relevant Member State. The EU sanctions regime is created by Council Regulations that are directly applicable across all Member States, but the enforcement, licensing, and designation-challenge functions are split among the competent authorities of each Member State. A breach in France is investigated by the French authority; a licence application in Germany goes to the German authority. The EU itself does not issue licences or enforce penalties directly.
In our cross-border practice, this first step is the one most frequently skipped. A business with operations in several Member States may be subject to the same underlying regulation but to different national implementing rules on penalties, reporting, and derogation procedures. Identifying the correct forum at the outset shapes every subsequent step. Have you confirmed which national authority has jurisdiction over the specific transaction or relationship you are assessing?
The governing instruments to identify are the relevant Council Regulation (which contains the prohibitions and the list of designated persons and entities) and the accompanying Council Decision (which sets the political framework). Neither is referred to here by article number. What matters at this first step is confirming that the version you are working from is current – Council Regulations are amended frequently, sometimes with immediate effect, and working from a superseded version is a recognised source of compliance failure.
Step 2: Define the scope of the assessment – entities, goods, services, and funds
An EU sanctions risk assessment is not a single-purpose screening exercise; it covers four distinct prohibition types that may apply simultaneously. Those are: asset freezes (prohibitions on dealing with funds or economic resources of designated persons or entities); trade restrictions (prohibitions on importing, exporting, selling, or transferring specified goods or technology); service restrictions (prohibitions on providing advisory, financial, or other services to designated persons or sectors); and sectoral measures (restrictions on capital-market access, energy transactions, or other defined economic activities applicable to specified sectors rather than named persons).
Defining scope requires mapping which of those four dimensions is engaged by the transaction. A payment to a supplier engages the asset-freeze analysis. A shipment of specified goods engages the trade-restriction analysis. An advisory mandate to a financial institution in a restricted sector may engage both the service restrictions and the sectoral measures simultaneously. In a recent matter, a professional-services firm retained to advise on a restructuring discovered mid-mandate that the sectoral restrictions applicable to the client's sector were more extensive than the asset-freeze position the firm had screened at the outset. The mandate structure had to be revised, and additional authorisations were sought. Scoping the correct prohibition type from the beginning prevents that outcome.
Step 3: Apply the ownership and control test
The EU's ownership and control test determines whether an entity that is not itself listed is nonetheless caught by the asset-freeze or other prohibitions because a designated person owns or controls it. The EU test is broader than OFAC's mechanical 50 percent ownership threshold: the EU captures entities that a designated person controls through other means, including the ability to appoint a majority of directors, to exercise a dominant influence through a contract, or to block decisions through a veto right in the constitutional documents.
We regularly advise clients who have cleared a counterparty on the basis that no listed person holds a direct stake of fifty percent or more, only to find that a listed person holds a controlling board-appointment right or holds a minority stake combined with contractual veto rights that satisfy the EU control test. That gap between the OFAC ownership threshold and the EU control test is one of the most operationally significant divergences in cross-border practice. Under OFSI's approach for UK purposes, the ownership and control analysis follows broadly similar lines to the EU, but the specific guidance issued by OFSI and the analytical steps it sets out differ from the EU competent-authority guidance. A business subject to both regimes must apply both tests separately and act on whichever produces the more restrictive result.
Aggregation matters under the EU test in a way that often surprises compliance teams. Two or more designated persons each holding minority stakes can be aggregated to determine whether their combined ownership satisfies the threshold. Control rights held by different listed persons through different instruments must also be considered together. The ownership chain must be mapped to the ultimate beneficial owner, not merely to the first tier of intermediary.
Step 4: Screen lists and check secondary exposure
List screening against the EU Consolidated List of persons subject to financial sanctions is a necessary but insufficient step. Effective EU sanctions risk assessment also checks the UN Security Council Consolidated List (which the EU incorporates by reference and whose designations take effect within the EU independently), and – for a business with any US or UK nexus – the OFAC SDN List and the OFSI consolidated list. Failing to cross-reference the UN list is a recognised source of technical non-compliance, because UN designations bind EU-nexus entities regardless of whether the EU has separately listed the same person.
Secondary sanctions risk is a separate but related concern. A European business with US-dollar transactions, US-person counterparties, US correspondent-bank relationships, or goods incorporating US-origin content may be exposed to OFAC's secondary-sanctions provisions even when the EU itself does not prohibit the transaction. The EU Blocking Regulation (the instrument designed to limit the extraterritorial effect of certain US measures on EU-based businesses) adds a further layer: under that instrument, EU persons may in specified circumstances be prohibited from complying with certain US secondary-sanctions designations, creating a direct conflict of obligations. Assessing secondary exposure is not optional for any EU-based business with a US-dollar or US-person dimension.
What documentation does a compliant EU assessment require?
A compliant EU sanctions risk assessment must be documented in a form that demonstrates the methodology applied, the sources checked, the control test analysed, and the conclusion reached with the reasoning that supports it. Undocumented screening is not an assessment in the regulatory sense; it is a record that a list was checked on a given date. Competent authorities in enforcement proceedings look for evidence that the business understood the applicable prohibition, applied the correct test to its specific facts, and reached a reasoned conclusion.
Documentation should record: the date of the assessment; the version of the relevant Council Regulation consulted; the lists screened and the screening date; the outcome of the ownership and control analysis with the supporting evidence (corporate registry documents, ultimate beneficial ownership declarations, constitutional documents); the prohibition types tested; and the conclusion with the rationale. Where a derogation or authorisation was relied upon, the record should include the text of the authorisation and the legal basis for concluding it applied.
Record-keeping requirements under EU sanctions law are set at the Member State level, and periods vary. As a practical benchmark, maintaining records for five years from the date of the transaction or assessment is a well-established standard across the regimes most relevant to cross-border businesses. Verify the applicable period for the relevant Member State before relying on any single figure.
How does the EU regime differ from OFAC and OFSI on sanctions risk assessment?
Three divergences matter most in cross-border practice. First, the ownership and control test: OFAC applies a mechanical ownership threshold; the EU and OFSI apply a broader control analysis. A counterparty that passes OFAC screening may still be caught under EU rules. Second, the prohibition architecture: OFAC organises its regime primarily around designated persons; the EU combines designated-person prohibitions with detailed sectoral and trade restrictions that apply by category of goods, services, or transaction, not only to named parties. Third, the licensing and derogation route: OFAC issues general and specific licences centrally; EU derogations are issued by national competent authorities, and the procedure, timing, and evidential requirements vary by Member State.
A business subject to both OFAC and EU obligations must run two separate analyses. The more restrictive prohibition governs. That principle – that where obligations conflict, the stricter one applies – is a cross-cutting rule in multi-regime compliance. It means that clearing a transaction under EU law does not authorise it under OFAC, and vice versa.
Japan, Singapore, and the UAE each maintain their own sanctions regimes, and their ownership and control tests, list structures, and enforcement postures differ from both the EU and OFAC models. For a business with operations or counterparties in those jurisdictions, the assessment must be extended to the applicable country regime. In our experience, businesses most frequently underestimate the compliance burden of the Singapore and UAE regimes, both of which have been strengthened materially in recent years.
Risk flags and when to involve counsel
Certain fact patterns routinely escalate the complexity of an EU sanctions risk assessment beyond what an in-house team can safely complete without external input. Those patterns include: a counterparty with beneficial owners in a jurisdiction subject to comprehensive or sectoral EU measures; a transaction involving goods, technology, or services that appear on the EU's restricted-goods lists; a payment route passing through a correspondent bank with its own US-nexus obligations; a corporate structure that includes intermediate holding companies in jurisdictions with limited registry transparency; and any situation where the EU Blocking Regulation may be engaged.
A failed or inadequate assessment is not the only risk. An assessment that produces a compliant conclusion but lacks documentary support is equally exposed in an enforcement proceeding. Regulators in several Member States have taken enforcement action against businesses that could demonstrate good intent but could not demonstrate a rigorous and documented methodology.
One persistent myth in this area is that an EU sanctions risk assessment is primarily a list-screening exercise, and that a clean screening result is a clean bill of health. That reading of the obligation is incorrect. The EU prohibition on dealing with a designated person's funds or economic resources extends to entities that person owns or controls, and the sectoral and trade restrictions apply by category regardless of whether any listed person is involved. A clean screening result is the beginning of the analysis, not the end.
When to involve counsel: at the scoping stage when a transaction has a significant sectoral or trade-restriction dimension; immediately when the ownership and control analysis is unclear; before submitting a derogation application to a national competent authority; and whenever the EU Blocking Regulation and OFAC obligations appear to conflict. Delaying external input until a transaction has closed or a payment has been made consistently narrows the available options.
Related practices
- Compliance Audit & Testing (Australia) – structured sanctions audit and testing services for businesses with Australian-regime exposure.
- EU Sanctions Risk Assessment: Guide 3 – deeper analysis of sectoral restrictions and trade-measure compliance under EU law.
- EU Sanctions Risk Assessment: Guide 4 – advanced ownership and control issues, including aggregation and control-rights analysis.