A mid-size trading company is expanding into a new region. Its compliance team has run counterparty screening. No direct hits appear on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons). The transaction proceeds – and months later the firm receives an OFAC subpoena. The problem was not a direct match. It was a layered ownership chain that the screening tool never mapped, and a product family that carried secondary-sanctions exposure that no one had assessed against the counterparty's financing route.
A sanctions risk assessment under OFAC is a structured process for identifying, measuring, and mitigating a business's exposure to US sanctions before a transaction, relationship, or programme is approved. OFAC expects regulated businesses to run risk assessments calibrated to five core factors: customers, products and services, transactions, geographies, and delivery channels. As of mid-2026, OFAC's published compliance guidance treats a documented risk assessment as a foundational element of any adequate compliance programme.
This guide walks through the process step by step – from framing the scope through ownership-chain mapping, cross-regime comparison with OFSI and the EU, and the risk flags that warrant counsel involvement before a decision is made.
Step 1: Define the scope and the governing legal basis
Before any data is gathered, the assessment must define what it covers: which legal instruments apply, which business units are in scope, and which sanctions programmes are relevant to the activity being reviewed.
OFAC's authority derives from IEEPA and, for older programmes, TWEA. Those statutes allow the US President to block transactions and property of designated persons and entities. The scope of each programme varies – some apply only to US persons, others carry extraterritorial reach that extends obligations to non-US businesses transacting in US dollars, using US-origin goods, or involving US financial institutions as correspondents. In our experience, the first scoping error is treating OFAC as a purely domestic regime. A European or Asian business with no US subsidiary can still face OFAC exposure through dollar clearing or the re-export of US-origin technology.
Scoping questions the team must answer at this stage include: Which OFAC programmes apply to the relevant geography, sector, or counterparty type? Does the activity involve US persons, US dollars, or US-origin goods? Are there secondary-sanctions risks that could affect non-US counterparties who do business with the firm? Answering these questions before the data-gathering phase saves considerable rework later.
The position above covers the standard case. Your facts – the counterparty, the goods, the route, the financing structure, and the specific OFAC programme in play – change the analysis materially.
For an initial assessment of your OFAC exposure across a transaction or business line, contact Calder & Vance at info@caldervance.com.
Step 2: Map the customer and counterparty base
Customer and counterparty mapping is the analytical core of any OFAC sanctions risk assessment, and it is where most programmes produce gaps rather than assurance.
The SDN List contains blocked persons and entities. A counterparty appearing directly on that list is straightforward to catch – any competent screening tool will flag it. The harder question is the 50 percent rule (OFAC's rule treating any entity owned 50 percent or more, directly or indirectly, by one or more blocked persons as itself blocked, even if not separately listed). Aggregation across multiple blocked persons holding minority stakes is the mechanism that compliance tools routinely miss.
Mapping must therefore go beyond the immediate counterparty to its beneficial owners, its controlling shareholders, and any intermediate holding companies. For private counterparties in jurisdictions with limited corporate-registry disclosure, this means using commercial due-diligence providers, reviewing ultimate beneficial owner declarations, and triangulating across multiple data sources.
Sector context matters too. Financial-institution counterparties in certain programmes face sectoral sanctions rather than full blocking – meaning some transactions are prohibited and others are not. The assessment must identify which transactional category applies. Have you mapped the full ownership chain, or only the layer your screening tool can see?
Step 3: Classify products, services, and delivery channels
The product and service profile of a business determines which OFAC prohibitions are directly relevant and where the residual risk sits after counterparty screening.
Goods with a US-origin component – hardware, software, technology – carry export-control obligations under the EAR (the Export Administration Regulations administered by BIS) in parallel with any OFAC prohibitions. A dual-use classification under the EAR does not resolve OFAC exposure, and an OFAC licence does not authorise a BIS-controlled export. These are separate regimes with separate licensing authorities. In our practice, treating them as interchangeable is one of the most common errors we see in multi-product compliance programmes.
Delivery channels raise distinct risk. A transaction cleared through a US correspondent bank triggers OFAC jurisdiction for the bank and creates exposure for the non-US parties if the bank is required to block or reject the payment. Digital-asset transactions present a structurally similar issue: OFAC has listed digital-wallet addresses as well as entities, and a blockchain transaction that touches a blocked address can give rise to a strict-liability violation regardless of the transacting party's knowledge.
For each product line and delivery channel, the assessment should produce a written risk rating: low (no US nexus, no relevant programme), medium (potential nexus requiring enhanced screening), or high (direct nexus requiring a licence or a confirmed exemption before the transaction proceeds).
Step 4: Assess geographic exposure and secondary-sanctions risk
Geography is an amplifier. A counterparty in a low-risk jurisdiction with no OFAC-listed owners presents a materially different risk profile from the same counterparty type operating in or through a jurisdiction subject to comprehensive OFAC programme coverage.
The geographic assessment must cover both the counterparty's location and the transit points for any goods, funds, or services. A payment routed through a financial institution in a high-risk jurisdiction carries compounded risk even if the ultimate beneficiary is not designated. Freight routed through specific transshipment hubs raises questions about re-export controls and end-use that the geographic layer of the assessment should capture.
Secondary-sanctions risk requires separate treatment. OFAC programmes with secondary-sanctions provisions can expose non-US businesses to US sanctions simply by conducting significant transactions with designated persons or in covered sectors – regardless of any US-person or US-dollar nexus. This is where a UK or EU-domiciled business conducting what looks like a purely local transaction finds itself within OFAC's reach. The cross-regime implication is direct: OFSI and the EU Council regulations impose their own geographic and sectoral restrictions, and those regimes sometimes diverge from OFAC in ways that create compliance asymmetries. A transaction that is permissible under one regime may remain prohibited under another; the stricter prohibition governs what the business can actually do.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com.
How does OFAC differ from OFSI and the EU on risk assessment methodology?
OFAC, OFSI, and the EU each publish compliance guidance, but the underlying methodology and the ownership-and-control tests differ in ways that matter for a cross-border risk assessment.
OFAC's 50 percent rule is mechanical: blocked-person ownership of 50 percent or more in the aggregate renders the entity blocked, full stop. There is no separate control analysis. OFSI and the EU apply an ownership and control test (the UK and EU standard for whether a non-listed entity is caught through a listed person) that looks beyond arithmetic ownership to effective control – board appointment rights, veto powers, contractual dominance. An entity that escapes the OFAC threshold because blocked-person ownership is at forty-eight percent may still be caught by OFSI or the EU if a designated individual exercises control over management decisions.
Risk-assessment documentation standards differ too. OFAC's published compliance programme guidance sets out five pillars, with a risk assessment as the first. OFSI's enforcement guidance similarly treats the quality of a firm's risk assessment as a mitigating factor in penalty decisions. The EU's approach is regime-specific and member-state-implemented, but supervisory expectations across the major EU financial centres increasingly align with the OFAC and OFSI models in requiring documented, proportionate, and regularly reviewed risk assessments.
For businesses operating across regimes, the practical approach is to run the assessment against the most demanding standard on each point and then verify that the result satisfies each applicable regime. Where regimes conflict, the stricter prohibition governs. We regularly advise businesses that have completed a sound OFAC assessment on how to extend it to cover OFSI and EU requirements without duplicating the underlying work.
What are the principal risk flags that require counsel involvement?
Several risk indicators, when identified during the assessment, should trigger escalation to sanctions counsel rather than internal resolution alone.
The first is any match – direct or potential – against a designated person in the ownership chain of a counterparty, particularly where ownership sits at or near the 50 percent threshold. The legal analysis of whether the entity is itself blocked is a legal conclusion, not a compliance-team judgment call.
The second is a proposed transaction that falls within a sectoral sanctions programme rather than a blocking designation. Sectoral restrictions are transactional in scope and technically defined; the prohibited categories require legal interpretation against the specific facts of the deal.
The third is any situation where a transaction appears to require an OFAC specific licence (a case-by-case authorisation to conduct an otherwise prohibited transaction). Licence applications to OFAC are substantive legal submissions. Processing times vary, and OFAC may request additional information or impose conditions. A business that proceeds without a required licence, or that misconstrues the scope of an available general licence (a standing authorisation that permits a defined category of transactions without a separate application), faces strict-liability exposure.
The fourth is any voluntary disclosure question. When the assessment surfaces an apparent past violation, the question of whether and how to make a VSD (voluntary self-disclosure to a regulator) is a decision with significant procedural and penalty consequences. OFAC treats a timely, complete VSD as a mitigating factor; the decision to file and the content of the disclosure are matters for counsel.
In our cross-border practice, we have found that businesses most at risk are those that treat the risk assessment as a screening exercise rather than a legal analysis. Screening identifies the raw data. The assessment converts that data into a legal conclusion and a defensible record.
Common mistakes and how to avoid them
The most common mistake in sanctions risk assessment is treating a clean screening result as the end of the analysis rather than the beginning. No screening tool maps the full ownership chain automatically; that work requires structured due diligence against multiple sources.
A related error is applying only one regime's test to a multi-regime situation. A business that maps ownership only to the OFAC threshold and does not apply the OFSI or EU control test to the same chain may be legally exposed under those regimes even where the OFAC position is clear. The assessment must be regime-specific on each operative test.
Documentation failures are the third category. An assessment that reaches the right conclusion but leaves no record of the analysis is not an adequate compliance programme for OFAC's purposes. If a subsequent examination or enforcement action requires the business to demonstrate its pre-transaction diligence, an undocumented assessment provides no protection. OFAC's guidance on compliance programmes is clear that documentation and senior management review are structural requirements, not optional enhancements.
Finally, the static-assessment problem. A risk assessment completed at onboarding goes stale. Designation lists update continuously. Ownership structures change. A programme of periodic reassessment – calibrated to the risk rating of the relationship and to material changes in the counterparty or the regulatory environment – is a compliance requirement, not a best practice aspiration.
Related practices
- Compliance audit and testing – stress-testing your existing sanctions controls against current regime requirements
- Sanctions risk assessment under OFAC: guide 5 – the next instalment in this series, covering programme design
- Sanctions risk assessment under OFSI – the UK equivalent analysis, covering OFSI's ownership and control test