A trading company with operations across three continents discovers that a supplier it has worked with for years is now linked to a person appearing on the UN Consolidated List. The contract is mid-performance. Payments are pending. The compliance team asks: can we continue? Is there a licence? Who issues it? These questions do not have a single clean answer – because the UN sanctions architecture does not operate the way many businesses assume.
Specific licence applications under UN sanctions are not submitted to the United Nations itself. The UN Security Council establishes the prohibitions and the Consolidated List; implementation and licensing fall to each member state under its own national law. As of June 2026, businesses seeking authorisation to conduct an otherwise prohibited transaction involving a UN-listed person must apply to the relevant national authority – OFSI in the United Kingdom, OFAC in the United States, or the competent authority under the applicable EU Council regulation – and satisfy that authority's own licensing criteria.
This guide walks through the UN licensing architecture from the ground up: how authority is allocated, what the application process looks like at each major implementing regime, where cross-regime complexity bites, and what risk flags experienced compliance counsel look for before a file is submitted.
How does the UN sanctions architecture actually work?
The UN Security Council establishes binding sanctions obligations on all member states through Chapter VII resolutions, and the UN Consolidated List names the individuals and entities subject to those measures. What the Security Council does not do is operate a licensing office. Authorisation to engage in an otherwise prohibited transaction is a matter for each member state's own implementing legislation.
This layered structure has an important practical consequence. A business seeking a specific licence (a case-by-case authorisation to conduct an otherwise prohibited transaction) under a UN-mandated regime must identify the correct national authority. That authority will apply its own procedural requirements, its own evidence standards, and its own policy considerations – all within the framework the Security Council has set.
For businesses operating across multiple jurisdictions, the implication is direct. A licence granted by OFSI in the United Kingdom covers only UK-jurisdictional obligations. The same transaction may simultaneously require an OFAC authorisation under US rules, or an authorisation under the relevant EU Council regulation, if US or EU nexus is present. In our cross-border practice, we see this multi-authority requirement misunderstood as frequently as any other aspect of sanctions compliance.
The UN's own delisting mechanism – the Security Council committee and, for the ISIL/Al-Qaida regime, the Ombudsperson process – is a separate track. It removes a designation from the Consolidated List. It is not a licensing window and does not authorise specific transactions pending a delisting decision. Understanding that separation is the first step in building a sound applications strategy.
Step 1: Identify the correct implementing authority for your jurisdiction
Before any application can be drafted, the first task is mapping which national authorities hold jurisdiction over the transaction in question. The answer turns on three factors: the location of the applicant, the currency and payment route involved, and the nationalities and establishment of the counterparties.
In the United Kingdom, OFSI – the Office of Financial Sanctions Implementation – administers licensing under SAMLA and the relevant thematic regulations that implement UN measures. OFSI has published licensing guidance covering the grounds on which it will grant a licence, and the types of purpose that are ordinarily in scope.
In the United States, OFAC administers the programmes that implement UN designations, including the ISIL/Da'esh and Al-Qaida programme and other UN-mandated regimes. OFAC issues both general licences (standing authorisations for defined categories of transaction) and specific licences on application.
In the European Union, the relevant national competent authority – which varies by member state – handles licence applications under the EU Council regulations that transpose UN obligations. The EU does not have a single, central licensing office.
For a business with a UK entity, US-dollar payments, and an EU subsidiary all involved in the same transaction, three separate applications may be necessary. None of the three approvals substitutes for the others. This is the point at which many in-house teams, working on the assumption that one approval is sufficient, face the greatest exposure.
Step 2: Establish the legal basis and licensing grounds
Every specific licence application must identify the legal basis on which the applicant is requesting relief. Under each major implementing regime, that means selecting the correct licensing ground – and the grounds available differ by regime.
Under OFSI's published guidance, licensing grounds include purposes such as basic expenses, legal fees, prior contractual obligations, and other specific categories recognised under the applicable UK sanctions regulations. OFSI assesses each application against the ground claimed; an application citing the wrong ground, or failing to explain how the facts satisfy it, will be refused or delayed.
OFAC's licensing grounds are set out in its regulations and programme-specific guidance. OFAC distinguishes between general licences – which operate without an application if the transaction fits the defined category – and specific licences for transactions not covered by an existing general licence. A business should always check first whether a general licence already covers its transaction before filing a specific licence application. That check alone can save significant time and cost.
Under the EU implementing regulations, licensing grounds similarly vary by programme. Each Council regulation transposing a UN measure specifies the derogations available, and the competent authority interprets those derogations within the political guidance issued at the Council level.
In our experience, the single most common application error at this stage is claiming a licensing ground without providing the factual material that would allow the authority to verify it. An application asserting "basic expenses" without a breakdown of costs, supporting accounts, and an explanation of why no unlisted person can fund the expenses instead, will almost certainly invite a request for further information – and that request extends the timeline.
The position above covers the standard case. Your facts – the counterparty's position on the Consolidated List, the goods or services involved, the payment route, the number of jurisdictions engaged – change the analysis materially. For a preliminary assessment of the licensing grounds available to you, contact Calder & Vance at info@caldervance.com.
Step 3: Build the evidence package
A well-constructed evidence package is the factor that most consistently differentiates applications that succeed from those that stall. The authority reviewing the application cannot grant what it cannot verify. Every factual claim the application makes must be supported by documents.
A complete package for a UN-implementing-regime application typically includes the following elements. First, a narrative statement identifying the applicant, the listed person or entity, the nature of the relationship, and the transaction for which authorisation is sought. Second, evidence of the facts underlying the licensing ground – financial records for an expenses application, the relevant contract for a prior-obligation application, correspondence establishing the timeline of the relationship. Third, a legal analysis connecting those facts to the licensing ground under the applicable instrument. Fourth, a statement of the applicant's compliance measures and how the licensed activity would be monitored to prevent wider prohibited benefit to the listed person.
Authorities differ in what they require as a minimum. OFSI's guidance specifies categories of information it expects; OFAC's application portal has its own requirements. For EU applications, the competent authority's requirements vary by member state. In our practice, we prepare the package to the most demanding standard likely to be applied, rather than the minimum, because the cost of a request for further information – in time lost and in the uncertainty it creates for the transaction – almost always exceeds the cost of front-loading the documentation.
One element that applicants routinely under-invest in is the ownership and control analysis. If the listed person sits within a corporate group, the application should address the structure: who owns what, how the proceeds of the licensed activity would flow, and what controls the applicant proposes to ensure that unlisted affiliates do not act as conduits. An incomplete ownership picture is a red flag for any reviewing authority.
How do OFSI, OFAC, and the EU differ in processing and timelines?
Processing timelines and procedures vary significantly across the three major implementing regimes, and a realistic project plan for a multi-jurisdiction matter must account for each separately.
OFSI does not publish a fixed statutory processing deadline for specific licence applications, but its published guidance indicates that complex applications take longer, and that incomplete applications materially extend processing time. OFSI may issue a request for further information, to which the applicant must respond, and the clock on the application typically reflects that exchange.
OFAC's processing times vary by programme and by the complexity of the transaction. OFAC publishes guidance on its application process, including the expectation that applicants provide all material information upfront. In our experience, OFAC applications that require multiple rounds of correspondence take significantly longer than those resolved in the first exchange.
EU competent authorities are the most variable. Processing times differ not only by member state but by the volume of applications that authority is currently handling and by the political sensitivity of the programme. For time-critical transactions, the choice of which member state's authority to approach – where there is a genuine connection to more than one member state – can affect the timeline.
There is an additional cross-regime point that applies whenever licences from more than one authority are needed simultaneously. Each authority processes its application independently. Licence A from OFSI does not accelerate Licence B from OFAC. If the transaction cannot proceed until both are in hand, the effective timeline is the longer of the two. Planning the application calendar across authorities is itself a project-management task, and one that benefits from counsel experienced in all three regimes.
If a transaction has already been flagged, or an application has been refused and an appeal route is needed, the window for preserving options can be short. Contact us at info@caldervance.com as early as possible.
What are the risk flags that indicate an application needs specialist counsel?
Not every specific licence application requires external sanctions counsel. But certain fact patterns reliably indicate that internal resource alone is unlikely to be sufficient, and that the cost of a refused application – or a delayed one – outweighs the cost of early specialist input.
The first risk flag is multi-regime exposure. Where a single transaction engages OFSI, OFAC, and an EU authority simultaneously, the interaction between the three licensing processes, and the possibility that one authority's grant is conditional on information that another authority has not yet released, creates a coordination problem that an internal team managing its first multi-regime application may not be equipped to handle.
The second is a corporate ownership structure involving the listed person in a non-transparent way. Where the listed person is a minority shareholder, a nominee, a creditor with contractual rights, or a party whose connection to the transaction is through a chain of intermediaries, the application must address the ownership and control question fully. Authorities will probe this. An application that fails to address it proactively is likely to generate requests for further information.
The third risk flag is a refusal or revocation. A prior refusal by one authority does not bind others, but it is material information that subsequent applications to other authorities may need to disclose, and it affects the strategy for any re-application or appeal. Handling a refused application without understanding the reason for refusal and addressing it directly in the re-submission is a common mistake.
The fourth is time pressure. Licensing authorities do not accelerate their processing because a commercial deadline is approaching. Where a transaction has a hard closing date, the application timeline must be built backwards from that date, with realistic assumptions about processing times and requests for further information. Starting the application late, in the hope that it will be processed quickly, is a risk strategy that rarely succeeds.
A common misconception is that a UN listing is less serious than a bilateral designation under, say, an OFAC programme, because the UN's enforcement mechanisms are indirect. That misreads how the regime works. The prohibitions are implemented by national authorities, who have their own enforcement powers. OFSI can impose a significant civil penalty for a breach of UK financial sanctions, including those that implement UN measures. OFAC's civil penalty authority is similarly broad. The UN pedigree of a designation does not dilute the national enforcement risk.
Practical checklist: before you submit
A licence application submitted before it is ready creates problems that are harder to resolve than the delay involved in getting it right first. The checklist below reflects the pre-submission review our team conducts on every UN-implementing-regime application.
- Have you identified every national authority with jurisdiction over the transaction – considering the location of the applicant, the currency, the payment route, and the nationalities of the counterparties?
- Have you checked whether any general licence already covers the activity, removing the need for a specific application?
- Have you selected the correct licensing ground under the applicable national instrument and confirmed that your facts satisfy it?
- Does the evidence package address every factual claim in the narrative, with supporting documents rather than assertions?
- Have you mapped the ownership and control structure of the listed person and addressed any risk that funds flow to, or benefit, the listed person beyond the scope of the licensed activity?
- Does the application include a clear statement of the compliance controls that will govern the licensed transaction?
- If the application engages more than one authority, have you planned the application calendar so that the sequence and timing of filings is deliberate?
- Have you preserved records of the steps taken to identify the listing and the decision to apply, so that those records are available for any subsequent regulatory review?
In a recent matter, a financial institution with operations in the United Kingdom and the European Union sought to release funds held in an account connected to a UN-listed person for the purposes of meeting legal fees. We assessed eligibility under both OFSI's licensing grounds and the applicable EU derogation, prepared parallel applications to the two relevant authorities with a co-ordinated evidence package, and managed the follow-up correspondence from both. The matter required two separate grants before the funds could be released – and the sequencing of the two applications was itself a material part of the strategy.
Related practices
- Frozen account management under BIS / EAR – release of assets subject to US export-control holds
- Specific vs general licence under Australian sanctions – comparative analysis of DFAT's licensing options
- Specific vs general licence under BIS / EAR – when a specific licence is required under US export controls