A trading company operating between London, Amsterdam, and a third-market buyer receives a compliance alert mid-transaction. The buyer's parent appears on a sanctions list. The underlying contract is lawful. The goods are legitimate. But the transaction cannot proceed without authorisation. Which regime governs? Which authority issues the licence? And how long does this take?
A specific licence (a case-by-case authorisation to conduct an otherwise prohibited transaction) is the principal tool for unlocking blocked or restricted activity under OFAC in the United States, OFSI in the United Kingdom, and the relevant Council regulations in the European Union. Each regime applies its own eligibility test, its own procedure, and its own timeline. As of June 2026, the divergence between those regimes is material enough to change both the route you take and the outcome you can expect.
This guide walks through the licensing process regime by regime, identifies the points where they converge and where they sharply diverge, and flags the errors that cause applications to fail or stall. It is structured for general counsel, compliance officers, and finance teams managing a cross-border position where more than one authority may be relevant.
What is a specific licence and when do you need one?
A specific licence is a written authorisation from the competent authority that permits a defined transaction or category of transactions that would otherwise be prohibited under the applicable sanctions regime. It is distinct from a general licence (a standing authorisation that permits a defined category of transactions without a separate application): where a general licence does not cover the activity, a specific licence is the only route to lawful execution.
The need for a specific licence arises in several recurring situations. A counterparty, or an entity that owns or controls it, appears on a designation list. Goods or technology subject to export controls are destined for a restricted end-user or end-use. A payment must pass through a sanctioned jurisdiction to reach a lawful recipient. A pre-existing contract was signed before a designation occurred, and performance now requires authorisation.
The threshold question – whether a general licence already covers the situation – must be answered before a specific-licence application is prepared. In our experience, businesses overlook general licences that would resolve the position without a formal application. Equally, they sometimes assume a general licence applies when it does not, creating unlicensed exposure. Both errors waste time and carry risk.
What the general licence does not cover, the specific licence must. That is the starting premise for everything that follows.
Step 1 – Identify which regime or regimes govern the transaction
A cross-border transaction can fall under more than one sanctions regime simultaneously, and each may require a separate licence from a different authority. Establishing jurisdiction is the first practical step and the one most often performed carelessly.
OFAC's authority extends to US persons, US-origin goods and technology, US-dollar payments processed through US correspondent banks, and – in certain programmes – conduct anywhere in the world with a sufficient US nexus. A European company using a US bank to settle an invoice can trigger OFAC jurisdiction even if neither party is American. Secondary-sanctions risk compounds this: conduct that involves certain designated persons or programmes can expose a non-US firm to US penalties without a primary jurisdictional hook.
OFSI administers UK financial sanctions under the Sanctions and Anti-Money Laundering Act. Its jurisdiction covers UK persons, UK-incorporated entities (wherever they operate), and conduct in the United Kingdom. An entity with a UK subsidiary or a UK-resident director can bring an otherwise foreign transaction within OFSI's reach.
EU sanctions, implemented through Council regulations, bind EU persons, EU-incorporated entities, and conduct within EU territory. They also extend to conduct aboard vessels and aircraft registered in an EU member state. Where a business has operations in both the UK and an EU member state, it faces two distinct licensing authorities – OFSI and the relevant national competent authority of the member state concerned – with no formal coordination mechanism between them.
Switzerland (SECO), Canada (Global Affairs Canada), Australia (DFAT), Singapore, Japan, and the UAE operate autonomous sanctions regimes with their own licensing procedures. Any of these can be engaged depending on the nationality of the parties, the payment routing, or the location of the goods. Determining which regimes are engaged is not a legal formality. It is the act that sets every downstream decision.
Step 2 – Assess eligibility before preparing the application
Each authority applies a test to determine whether a licence is available. Preparing a detailed application before checking eligibility is a significant time and cost risk.
Under OFAC, specific licences are granted on a policy basis. The agency publishes licensing policies for certain programmes. For others, the standard is whether the transaction is consistent with US foreign-policy and national-security objectives and whether the humanitarian, commercial, or personal circumstances warrant relief. Applicants who cannot articulate why their transaction falls within a recognisable licensing policy face a high bar.
OFSI applies a statutory test. The relevant thematic sanctions regulations set out the grounds on which OFSI may grant a licence. Common grounds include transactions for humanitarian purposes, legal fees and legal services, diplomatic activities, and arrangements for the ongoing administration of an existing contract. The grounds are exhaustive, not indicative. An application that cannot be fitted to a statutory ground will be refused. This is a point where OFSI and OFAC diverge sharply: OFAC's policy-based system gives more discretion; OFSI's statutory-grounds model is more constrained but more predictable.
EU licensing follows a similar statutory-grounds approach, but the grounds differ across programmes and across member states' implementing regulations. The national competent authority of the member state through which the application is routed applies the grounds in the relevant Council regulation. There is no EU-level licensing authority; licensing is decentralised to member states, creating variation in practice even within the same legal instrument.
Eligibility screening – matching the facts of the transaction to the available grounds – should be the first substantive task. It determines whether to apply at all, and to whom.
Step 3 – Build the evidence package
A specific-licence application that fails to give the authority what it needs to decide the matter is the most common avoidable cause of delay. Each authority has its own information requirements, but there is a common architecture that applies across regimes.
The core elements are: a clear description of the transaction or activity for which authorisation is sought; identification of all parties, including their ownership and control structure where any party is linked to a designation; the legal basis for the application (the licensing ground or policy relied upon); the purpose and intended use of the funds, goods, or services; and supporting documentation proportionate to the value and sensitivity of the transaction.
For OFAC applications, the submission typically includes a cover letter, a description of the parties and the transaction, relevant background documentation, and a statement of the policy rationale. OFAC may issue a request for additional information after the initial submission. Responsiveness to those requests is material to the timeline.
OFSI applications are made through the OFSI licensing portal. The submission should address the applicable statutory ground directly and provide documentary evidence for each factual assertion. OFSI may return an incomplete application without substantive review.
For EU applications, the format varies by member state. Some national competent authorities publish standard forms; others expect a structured letter. The level of documentary evidencing expected also varies. In our experience, under-documented applications are a consistent source of delay regardless of which authority receives them.
A well-built evidence package does two things: it answers the authority's questions before they are asked, and it demonstrates that the applicant has engaged seriously with the applicable test. That matters for discretionary decisions.
Step 4 – Submit, manage the review, and respond to queries
Submission mechanics and review timelines vary materially across regimes, and both affect how a business plans around the pending application.
OFAC operates under no statutory determination deadline for specific-licence applications. Review periods are typically measured in months rather than weeks. Timelines vary by programme, by the complexity of the transaction, and by OFAC's current caseload. An application touching a high-priority programme may receive closer and faster attention. One raising novel policy questions may take significantly longer. Businesses that need certainty within a commercial window should factor this into their planning.
OFSI aims to process applications within a defined period, though complex matters regularly take longer. The OFSI licensing team may request additional information during the review. Responses to those requests should be prompt and complete. A slow or partial response is a delay of the applicant's own making.
EU member-state competent authorities have varying statutory or administrative timelines. Some publish their target determination periods; others do not. The practical timeline is influenced by the complexity of the matter, the authority's caseload, and the quality of the initial submission.
Active management of the review period is not optional. The applicant should track the application's status, respond immediately to any query, and flag any material change in the facts – including a change in the counterparty's ownership or designation status – to the authority without delay. Failing to notify a change in circumstances can jeopardise the application and, in some cases, the authorisation if already granted.
Where a licence is refused, the options differ. OFAC decisions can be challenged through an administrative reconsideration process. OFSI refusals can be challenged by way of judicial review before the UK courts. EU national competent authority decisions are subject to review under the relevant member state's administrative law, and designation decisions themselves can be challenged by way of annulment action before the EU General Court.
How does the cross-border position create risk that a single-regime approach misses?
The most significant licensing risk in a cross-border transaction is not the application itself. It is the assumption that one licence, from one authority, is sufficient.
Consider a transaction involving a UK exporter, a EU-resident buyer, and US-origin components. The UK exporter needs OFSI clearance for the financial element. Export of the components may require a licence from the US Bureau of Industry and Security under the Export Administration Regulations – the EAR (the US rules governing the export of dual-use and commercial goods). The EU buyer's national competent authority may also be engaged if the buyer's jurisdiction has its own licensing requirement under EU Council regulations. Three authorities. Three applications. Three potentially different outcomes and timelines.
The regimes do not coordinate their licensing decisions. A licence from OFSI does not substitute for an OFAC licence, and neither substitutes for a BIS authorisation. Each decision is independent. Where the positions diverge – one authority grants, another refuses – the transaction may be blocked on the refused leg regardless of the other approvals in hand.
Secondary-sanctions risk adds a further dimension. A non-US firm that secures an OFSI or EU licence for a transaction may still face US secondary-sanctions exposure if the transaction involves certain designated persons or programmes that OFAC treats as triggering secondary risk. The licensing analysis cannot be performed in isolation from the secondary-sanctions risk assessment. These two inquiries are distinct but interdependent.
In our cross-border practice, we see this failure mode repeatedly: a business obtains the licence it knows it needs and overlooks the one it did not know applied. Early multi-regime mapping prevents it.
Risk flags and common failure modes
Several patterns appear consistently in applications that stall, are returned, or are refused. Awareness of them materially improves the quality of a submission.
Incomplete ownership disclosure. Every regime requires identification of the counterparty's ownership and control chain where a designated person is involved. An application that presents the counterparty's stated corporate structure without independent verification of the ownership chain is vulnerable. Authorities are aware that ownership and control (the test for whether a non-listed entity is caught through a listed person) can be structured to obscure the connection to a designation. An incomplete or unverified ownership map will generate queries and delay, and may be treated as a deficiency that goes to the application's credibility.
Mismatched licensing ground. Fitting the transaction to an inapplicable licensing ground – the most common drafting error in OFSI applications – results in a return or refusal. The ground relied upon must genuinely cover the facts. Where the facts do not fit cleanly, it is better to say so and explain the closest applicable ground than to assert a fit that the authority will not accept.
Stale documentation. An application supported by corporate documents, ownership charts, or financial statements that are out of date creates a credibility problem. Where the counterparty's structure has changed, or where a designation has been modified since the documents were produced, the application must reflect the current position.
Failure to address dual-use or export-control dimensions. A financial licence from OFSI or OFAC does not resolve the export-control position. Businesses that obtain a sanctions licence for a goods transaction without separately confirming the export-control status of the goods – whether a licence exception applies under the EAR, or whether ECJU authorisation is required under the UK Export Control Order – are completing half the analysis. Sanctions clearance and export-control clearance are separate requirements and must each be addressed.
One question that regularly arises at this stage: is a voluntary self-disclosure or VSD (a proactive report of an apparent violation to the regulator) relevant? If the application is being made because a transaction has already occurred – or partially occurred – without the required licence, the application must be accompanied by a VSD assessment. An after-the-fact licence application that does not address the unlicensed conduct will not resolve the enforcement exposure.
Related practices
- Frozen account management and BIS/EAR licensing – practical steps when assets are blocked or an export licence is required under the EAR.
- Specific licence applications: EU guide – regime-specific procedure for EU Council regulation licensing through national competent authorities.
- Specific licence applications: EU guide (advanced) – detailed treatment of EU licensing grounds, member-state variation, and General Court challenge routes.
A common misconception: the licence resolves everything
A persistent view among businesses encountering the licensing process for the first time is that obtaining a licence ends the compliance obligation. It does not.
A specific licence is a conditional authorisation. The conditions are usually set out in the licence itself. They typically include requirements to use the funds or goods only for the stated purpose, to report on the use of the authorisation within a defined period, to keep records for a defined period, and to notify the authority of any material change in circumstances. OFSI licences routinely include reporting conditions. OFAC licences frequently include record-keeping requirements. EU national competent authority licences may impose ongoing monitoring obligations.
Breach of a licence condition is itself a sanctions violation. A business that receives a licence and then fails to comply with its conditions has not resolved its sanctions risk. It has created a different exposure. In our experience, this is the failure mode that surprises businesses most, because the focus before the licence is issued is entirely on obtaining it. What the licence requires after it is issued receives less attention than it should.
Record-keeping is a concrete example. Each regime imposes obligations to retain records of licensed transactions for a defined period after the transaction. Those records must be sufficient to demonstrate compliance with the licence terms. Where a regulator subsequently queries the transaction, the records are the evidence. An incomplete record is an incomplete defence.
Post-licensing compliance should be treated as a separate workstream from the application itself. Assign responsibility, set diary dates for any reporting obligations, and confirm that the records are being retained in a form that satisfies the applicable requirement.
When should you involve sanctions counsel?
Not every licence application requires external counsel. A routine humanitarian-purpose application with a clean counterparty and straightforward documentation can be managed in-house by a team with licensing experience. But several indicators make external advice appropriate.
The transaction involves more than one regime and more than one authority. The counterparty's ownership chain is complex or opaque. The relevant licensing ground is ambiguous on the facts. The application is being made after the fact – because the transaction has already occurred or begun without a licence. The matter raises secondary-sanctions risk. A previous application for the same or a similar transaction has been refused. The goods or technology involved have a dual-use dimension.
In a recent matter, a financial institution faced a position where a legacy correspondent relationship had continued past a designation event. The question was whether the relationship required a specific licence, a VSD, or both – and whether a licence would be available given the circumstances. We assessed the exposure across the applicable regimes, advised on the VSD and licensing strategy in parallel, and managed the submissions. The sequencing of those steps affected the outcome and the enforcement posture. That sequencing decision is not intuitive without experience of how the authorities approach it.
Early involvement of compliance counsel – sanctions lawyers with direct experience of the relevant regimes – preserves options. Late involvement, after a submission has been made or after a refusal has been received, constrains them. The question is not whether the matter is complex enough to warrant advice. It is whether the cost of getting it wrong exceeds the cost of getting it right with help.