A mid-size European trading company wins a distribution contract with a partner operating across three jurisdictions. The compliance team runs a standard name-check and finds no direct matches. The deal is approved. Six months later, the firm learns that the partner's parent company is listed under the relevant EU Council regulation – and that every payment since signature may constitute a breach. The question is no longer whether there was a problem. It is whether anything can still be done.
A sanctions risk assessment under the EU regime is the structured process by which a business identifies, measures, and mitigates its exposure to the prohibitions in the relevant Council regulations and Council decisions. As of mid-2026, those instruments cover financial, trade, and sectoral prohibitions that bind all EU-established entities, EU nationals worldwide, and any person conducting business within the European Union. The assessment must address direct counterparty exposure, ownership and control (the EU test for whether a non-listed entity is caught through a listed person), and the extraterritorial dimension that reaches non-EU businesses with any EU nexus.
This guide walks through the assessment in six steps, identifies the points where EU rules diverge from OFAC and OFSI approaches, and explains when external counsel should be involved.
Step 1: Map the Legal Basis – What Does the EU Regime Actually Prohibit?
Before any risk can be assessed, the team must understand exactly what the governing instruments prohibit – and under the EU regime that list is longer than many businesses expect.
EU sanctions are enacted through Council regulations (which are directly applicable in all Member States without domestic implementing legislation) and accompanying Council decisions. The prohibitions typically cover: making funds or economic resources available to listed persons; providing financial services in connection with listed activities; and, in sectoral programmes, transacting in specific goods, technologies, or services. Some programmes add import bans, export controls, and asset-freezes that operate in parallel.
The practical implication is that a business conducting an assessment must work from the actual text of the relevant regulation – not only the consolidated lists. A counterparty may be unlisted but still sit within a sectoral prohibition that catches the goods or the service. In our experience, teams that rely only on list-screening routinely miss sectoral and trade-based prohibitions entirely. That gap is one of the most common sources of undetected exposure.
The EU regime also carries de minimis exceptions for certain humanitarian and personal remittance transactions, and general derogations that Member State competent authorities can grant. Knowing which derogations exist under the applicable regulation – before you map the exposure – avoids the error of classifying a permissible transaction as a breach.
Step 2: Define the Scope – Which Entities, Products, and Relationships Fall In?
A sanctions risk assessment is only as accurate as its scope, and under the EU regime the scope question has a wider reach than many compliance programmes acknowledge.
The assessment must cover every legal entity in the corporate group that is EU-established or EU-incorporated, plus every EU national in the group regardless of where they sit. Beyond the legal entity, the analysis extends to subsidiaries, branches, and – critically – any person acting on behalf of an EU-established entity. An EU-incorporated holding company with a subsidiary in a third country is subject to the EU regime; so is the EU citizen signing transactions on behalf of an otherwise non-EU business.
Scope also has a product and service dimension. The relevant Council regulations typically specify controlled goods and services by reference to technical annexes and, in some programmes, cross-reference the EU dual-use list. A manufacturer must assess not only its customers but also the end-use of the goods and any re-export risk. A financial institution must assess not only direct counterparties but also the underlying transaction purpose.
The position above covers the standard case. Your facts – the counterparty's jurisdiction, the goods, the payment route, the group structure – change the analysis materially. For an early assessment of scope, contact Calder & Vance at info@caldervance.com.
How Does the EU Ownership and Control Test Differ From OFAC's 50 Percent Rule?
The EU ownership and control test is broader and more judgment-intensive than the corresponding OFAC rule, and that difference frequently decides whether a transaction is permissible.
Under OFAC, the test is mechanical: a non-listed entity is treated as blocked when listed persons own it 50 percent or more in the aggregate, directly or indirectly. Intention and management are irrelevant; the arithmetic is the trigger.
The EU standard looks at both ownership and control. Ownership at 50 percent or more is a bright line in EU guidance, mirroring the OFAC position. But a listed person who controls a non-listed entity through less than 50 percent ownership – through board appointment rights, veto powers, contractual dominance, or any other mechanism conferring decisive influence – can still render that entity subject to the freeze obligation. Control without majority ownership is the distinctively European feature of the test.
The practical consequence is significant. An EU business cannot clear a counterparty simply by confirming that no listed person holds 50 percent. It must also ask whether any listed person directs, instructs, or otherwise controls the entity's decisions. That requires access to shareholder agreements, board composition records, articles of association, and – in our cross-border practice – corporate documents from jurisdictions where public disclosure is limited.
Under OFSI, the UK adopts a similar ownership-and-control approach, having inherited and then adapted the EU model post-Brexit. The operative test is substantially comparable: both ownership and control trigger the freeze obligation. OFAC, however, has no control limb. A business assessing a transaction with any US nexus must therefore run both analyses. Where the EU test captures the counterparty but the OFAC test does not, the EU prohibition still governs for EU-nexus activity – and that is often where companies underestimate their residual exposure.
Have you confirmed not only who owns the counterparty but also who controls it? The two questions have different answers more often than a standard screening run will reveal.
Step 3: Screen Against the Right Lists – and Understand Their Limits
List-screening is a necessary element of an EU sanctions risk assessment. It is not, by itself, sufficient.
The EU maintains the EU Consolidated Sanctions List, which aggregates designations across all active programmes. Businesses should also screen against the UN Consolidated List (the Security Council's list of designated individuals and entities under UN Chapter VII resolutions), which Member States are obligated to implement and which may capture persons not yet added to the EU list. For groups with US-connected transactions, the OFAC SDN List (the list of Specially Designated Nationals and blocked persons) and the relevant thematic OFAC lists should be included in scope.
Screening discipline requires attention to three recurring failure modes. First, transliteration: names in Arabic, Cyrillic, Chinese, or other scripts produce variant romanisations, and a screening tool configured only for an exact match will miss them. Second, alias coverage: the EU list records aliases and former names, but corporate screening tools do not always parse them correctly. Third, update lag: the EU and Member State authorities update listings on an ongoing basis; a screening run valid at the time of contracting may not reflect the position at the time of payment.
Beyond the lists, the assessment must identify non-listed persons who may nonetheless be within scope because of their ownership or control connection to a listed person. No list-screening tool flags this automatically. It requires an ownership chain investigation, using company registry data, beneficial ownership registers, and – where registers are incomplete – public-source intelligence or third-party data providers.
Step 4: Apply the Cross-Regime Overlay – Secondary Sanctions and Extraterritorial Risk
An EU-focused assessment that ignores the US and UK dimensions of the same counterparty relationship provides an incomplete picture and exposes the business to material residual risk.
US secondary sanctions are designed to deter non-US persons from engaging in conduct that OFAC has designated as sanctionable – even where no US person, US dollar clearing, or US-origin goods are involved. The principal instruments that carry secondary-sanctions risk are enacted under IEEPA and related authorities. An EU exporter with no US operations is not immune: where a transaction falls within the categories identified as secondary-sanctions exposure, the risk is that US correspondent banking, US technology supply chains, or future US market access is affected.
The EU Blocking Regulation is the EU's formal response to this extraterritorial pressure. It prohibits EU persons from complying with certain designated US secondary-sanctions measures and, in principle, provides a mechanism for EU persons to recover damages resulting from such compliance. In practice, the Blocking Regulation creates a genuine legal dilemma: a business that complies with OFAC secondary-sanctions guidance risks violating the Blocking Regulation, and a business that ignores the guidance risks US regulatory action. Managing that tension is one of the most technically demanding tasks in EU-US cross-border compliance, and it is one we address routinely in our practice.
For UK-nexus transactions, the post-Brexit OFSI regime under the Sanctions and Anti-Money Laundering Act must be assessed in parallel. The UK regime now diverges from the EU position on certain programmes: designated persons differ, licensing conditions differ, and reporting obligations under the UK rules have their own timing requirements that may not align with EU Member State requirements. A business with both EU and UK connections cannot treat the two regimes as interchangeable.
If a transaction has already been flagged under one regime, or a filing under another has been refused, the sequencing of the parallel analysis matters. An early review can preserve options that close quickly. Contact us at info@caldervance.com.
Step 5: Risk-Rate the Findings and Decide on Mitigating Action
The purpose of a risk assessment is not to produce a list of findings but to produce a prioritised set of decisions.
Once the scope is defined and the screening and ownership analysis completed, each finding should be risk-rated by reference to two variables: the probability of a prohibition being engaged, and the severity of the consequence if it is. A counterparty that is directly listed under the applicable Council regulation is a confirmed prohibition, not a risk. A counterparty with a 30-percent shareholding held by a listed person requires a control analysis before the position is established. A counterparty with no listing but operating in a sanctioned sector requires a product-and-service check before the position is clear.
Mitigating actions fall into three categories. The first is transactional: restructure the deal to avoid the prohibited element – different payment route, different product, different counterparty entity. The second is authorisation-based: apply for a specific licence from the relevant Member State competent authority, which may permit an otherwise prohibited transaction where it falls within the derogation criteria of the applicable regulation. The third is exit: terminate the relationship where neither restructuring nor licensing resolves the exposure.
Decision documentation is as important as the decision itself. Under OFSI's enforcement guidance and the comparable guidance of EU Member State competent authorities, the quality of a firm's compliance record – including the reasoning recorded at the time of the decision – is a significant factor in determining the enforcement response to a subsequent breach. Record the analysis, the sources consulted, the risks identified, and the reasons for the chosen course. Retain those records for a period consistent with the applicable regime's requirements; Member State guidance and EU-level guidance both indicate that record-keeping periods of several years are standard, and in our experience five years is the baseline most regulators expect.
Step 6: Review, Update, and Embed the Assessment in the Programme
A sanctions risk assessment is not a point-in-time document. It is a living function that must be reviewed whenever the legal environment, the counterparty base, or the business activity changes materially.
EU programmes are updated on an ongoing basis. The Council designates and de-lists persons through implementing regulations published in the Official Journal. New sectoral restrictions are added by amendment. Member State competent authorities issue guidance that refines the operative meaning of provisions. A risk assessment completed at contract signature can be materially outdated by the time the first payment is due.
Review triggers should be built into the compliance programme as standing procedures. The minimum set includes: a periodic re-screening of the counterparty and ownership chain (interval determined by risk tier); an update review whenever the relevant programme is amended; a transaction-level check before each payment or shipment in a long-running relationship; and an immediate review when a counterparty appears on a watch list or is the subject of enforcement action in any jurisdiction.
Integration with the wider compliance programme is equally important. The sanctions risk assessment does not sit in isolation – it connects to the anti-money laundering risk assessment, the export-control classification process, and the broader third-party due diligence function. Where those functions are siloed, information that would resolve a sanctions question sits in a different team and is never surfaced. We regularly advise clients on how to link these functions without creating an unworkable review burden.
Related practices
- Compliance audit and testing – testing screening logic, mapping exposure, and redesigning programmes to an effective standard
- Sanctions risk assessment under EU – guide 4 – extended analysis covering licensing routes and enforcement considerations
- Sanctions risk assessment under OFAC – comparable guide for US sanctions obligations and the OFAC risk-assessment process
Common Risk Flags and When to Involve Counsel
Certain patterns in an EU sanctions risk assessment signal that the matter has moved beyond standard in-house review and warrants external counsel.
The first is a complex ownership chain. Where a counterparty is held through four or more layers of intermediate entities, or where the chain runs through jurisdictions with limited public registry data, the control analysis cannot be completed reliably on internal resources alone. The risk of a wrong conclusion – in either direction – is material.
The second is a dual-regime conflict. Where the EU Blocking Regulation and OFAC secondary-sanctions guidance point in opposite directions on the same transaction, the business faces a genuine legal dilemma that requires a jurisdiction-specific analysis and, usually, a documented legal-risk opinion before any action is taken.
The third is a potential past breach. Where the assessment reveals that a transaction already completed may have violated the applicable regulation, the question of whether and how to report to the competent authority arises immediately. In several EU Member States, a VSD (voluntary self-disclosure to the relevant authority) is a recognised mitigating factor. The timing and content of that disclosure affects the enforcement outcome. That analysis should not be conducted without counsel.
A myth we encounter frequently is that the EU regime is less actively enforced than OFAC, and that enforcement risk for non-financial businesses is low. That assessment is now outdated. Member State competent authorities have increased enforcement resources and have imposed significant penalties on non-financial firms across manufacturing, logistics, and professional services sectors. The enforcement posture across the EU is not uniform – it varies by Member State – but the direction of travel is clearly towards more active scrutiny, not less. Businesses that have relied on a low-enforcement assumption should update their risk assessment accordingly.
In a recent matter, a manufacturing business in a non-EU jurisdiction with an EU-incorporated subsidiary discovered, through a periodic ownership chain review, that a new investor in a key customer had been listed under the applicable Council regulation. We assessed the ownership and control position, confirmed that the EU subsidiary's transactions fell within the freeze prohibition, and advised on the licensing route available under the relevant derogation. The matter required a coordinated approach across EU Member State competent authorities and, because the customer had US operations, an OFAC secondary-sanctions overlay. Early identification preserved the option of an orderly resolution.