A Canadian trading company signs a distribution agreement with a supplier headquartered in a third market. The immediate counterparty clears screening. Weeks later, a tier-two component manufacturer – buried three links back in the chain – turns out to be majority-owned by a person listed under Canadian autonomous sanctions. The distribution agreement is now a problem. The question is whether anyone mapped far enough to catch it before the contract was executed.
Supply-chain sanctions mapping under Canada means systematically tracing every material counterparty, supplier, and ownership interest in your procurement or distribution network against the lists maintained under the Special Economic Measures Act ("SEMA") and its thematic regulations, administered by Global Affairs Canada ("GAC"). As of January 2026, Canada operates a well-developed autonomous sanctions programme whose prohibited-dealings prohibitions extend to entities owned or controlled by listed persons – and whose extraterritorial reach intersects with OFAC, OFSI, and EU regulations for businesses operating across multiple jurisdictions.
This guide walks through the mapping process step by step: who the governing authority is, how the ownership-and-control test works under SEMA, how to structure a tiered screening workflow, where Canada diverges from the US, UK, and EU positions, and when a compliance team needs external counsel.
Step 1 – Understand who administers Canada's sanctions regime and why it matters for supply chains
Canada's autonomous sanctions programme is administered by GAC under SEMA, supplemented by the United Nations Act for UN Security Council-mandated measures. GAC maintains the Consolidated Canadian Autonomous Sanctions List, which is the primary screening reference for supply-chain purposes. The regime targets individuals and entities rather than sectors alone, which means the mapping exercise must focus on ownership and control of every supplier, not merely on the goods or services being purchased.
GAC is both the licensing authority for specific authorisations and the body that issues guidance on the scope of prohibitions. It does not operate a general-licence framework as extensive as OFAC's, so the avenue for continuing a restricted transaction is narrower. For a cross-border business, that matters at the contract-design stage: what OFAC permits under a general licence may require a specific authorisation from GAC, or may simply be prohibited. We regularly advise clients on exactly this divergence before they commit to a transaction structure.
The prohibited dealings under SEMA extend to any property interest, any financial transaction, and any dealing in property owned or controlled by a listed person. "Owned or controlled" is the operative phrase for supply-chain mapping. Unlike the US 50 percent rule (50 percent rule: OFAC's rule treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked), Canada's ownership-and-control test does not stop at a bright-line ownership percentage. Control by other means – through contractual arrangements, board composition, or economic dependency – can bring an unlisted entity within scope. Mapping must therefore go further than a shareholding table.
Step 2 – Define the scope of your supply-chain mapping exercise
Before any screening begins, the mapping team must agree on what the supply chain actually includes. That sounds straightforward. In practice, cross-border supply chains involve tiers of sub-suppliers that no single internal team has ever fully documented. Scope-setting is where most mapping exercises fail.
Define "material" by reference to value, strategic dependency, and risk profile. A tier-one supplier providing ninety percent of a critical component is obviously in scope. A tier-three raw-material provider in a jurisdiction subject to multiple SEMA thematic regulations is in scope regardless of its contract value. A domestic logistics provider with no ownership complexity may sit at a lower priority. Formalise this risk-tiering in writing. GAC, like OFSI and the EU Council, expects a proportionate risk-based approach – but proportionate still means documented.
For each tier, collect: the full legal name of the counterparty, its jurisdiction of incorporation, its ultimate beneficial owners down to the relevant threshold, any known related entities, and any government-owned or -controlled affiliates. Canada, the EU, and the UK all apply an ownership-and-control test that is not limited to direct shareholdings. The US 50 percent rule is, by contrast, purely mechanical on ownership alone. That divergence means a supplier that passes OFAC screening may still require additional analysis under SEMA or the relevant EU Council regulation.
The position above covers the standard case. Your specific supply chain – the goods, the jurisdictions, the ownership structures, and the regimes in play – can change the analysis materially.
To discuss a structured supply-chain mapping approach tailored to your sector and counterparty profile, contact Calder & Vance at info@caldervance.com.
Step 3 – Screen against the correct lists and apply the ownership-and-control test
Canada's primary list for SEMA-based autonomous sanctions is the Consolidated Canadian Autonomous Sanctions List, maintained by GAC. For UN-mandated measures, the United Nations Security Council Consolidated List is the additional reference. Both must be checked. It is a common compliance error to check only one.
Screening must be name-fuzzy and identifier-aware. Listed persons appear under variant spellings, aliases, and transliterations. A purely exact-match search will produce false negatives. The screening tool or manual process must generate sufficient candidate matches and have a documented escalation path for reviewing potential hits.
Once a potential match is identified, the ownership-and-control analysis begins. Under SEMA, the question is whether the entity in your supply chain is owned or controlled by a listed person. Ownership is relatively straightforward where a shareholding register is available. Control is harder. Ask:
- Does the listed person exercise decisive influence over the entity's commercial decisions?
- Does the listed person hold a veto right, a golden share, or a contractual right of approval over major transactions?
- Is the entity economically dependent on the listed person to the degree that the listed person effectively dictates its conduct?
- Does the listed person hold a senior executive or board role that gives practical control regardless of shareholding?
If any of those questions produces a "possibly yes", the entity is treated as potentially within scope and the transaction should be paused pending legal review. Do not proceed on the assumption that the absence of a majority shareholding resolves the question. The EU and UK regimes operate on the same logic, and in our cross-border practice we have seen transactions clear OFAC review only to require a specific authorisation under SEMA or an OFSI licence because of a control relationship that the ownership percentage alone did not reveal.
How far should you trace the chain? The answer is: as far as the risk-tiering exercise in Step 2 indicated was material. For tier-one suppliers, full ultimate-beneficial-owner tracing is the standard. For lower-tier suppliers, a documented proportionate assessment of why deeper tracing was not warranted is required. Record that reasoning. It is the evidence of a good-faith compliance process if a question arises later.
Step 4 – Address the cross-border dimension: where Canada diverges from OFAC, OFSI, and the EU
For a business with supply chains spanning multiple jurisdictions, SEMA does not operate in isolation. A cross-border supply chain is almost always subject to at least two sanctions regimes simultaneously. Understanding where those regimes diverge is not a theoretical exercise – it determines the structure of the deal and the steps needed to proceed lawfully.
On the ownership-and-control test, the most important divergence is between the US mechanical threshold and the qualitative approach taken by Canada, the UK, and the EU. OFAC's 50 percent rule aggregates direct and indirect ownership by blocked persons and treats any entity at or above that threshold as itself blocked. It does not assess control separately. Canada, the UK under OFSI, and the EU under the relevant Council regulations all apply a qualitative control analysis on top of ownership. That means an entity owned at 45 percent by a listed person may be caught under SEMA if the control test is satisfied, even though it would not be automatically blocked under OFAC.
On licensing, the divergence is equally significant. OFAC maintains an extensive body of general licences and regularly issues specific licences within defined processing timelines. OFSI similarly has a specific-licence route with published criteria and processing expectations. GAC's licensing practice under SEMA is more limited in scope and less procedurally standardised than OFAC's. Businesses should not assume that an OFAC general licence authorises the same activity under SEMA – the authorisation must be assessed separately under the applicable country regime.
On secondary-sanctions risk, Canada does not operate a secondary-sanctions programme in the same form as the United States. US secondary-sanctions designations under IEEPA create exposure for non-US persons conducting certain defined transactions, irrespective of whether those transactions are themselves subject to US primary jurisdiction. A Canadian supplier that falls outside SEMA's reach may nonetheless expose a US-connected business to OFAC secondary-sanctions risk. Mapping the supply chain must therefore flag US secondary-sanctions exposure as a separate analytical layer, not a substitute for SEMA analysis.
If a transaction has already been flagged under one regime, or a filing has been refused, an early cross-regime review can preserve options that close with time.
To discuss a cross-regime review, contact Calder & Vance at info@caldervance.com.
Step 5 – Document findings, remediate, and establish ongoing monitoring
Sanctions mapping is not a one-time exercise. A counterparty that cleared screening when a contract was signed may be designated during the life of the contract. Goods procured clean may become controlled if the export classification changes. The mapping programme must be live.
Documentation serves two functions. First, it demonstrates a good-faith compliance process to GAC or to any other competent authority that later reviews the transaction. Second, it is the baseline against which periodic re-screening is measured. Without a documented initial mapping, re-screening has no anchor.
The minimum documentation standard includes: the list of suppliers screened and the date of screening, the lists checked and the tool or methodology used, the results of each ownership-and-control analysis, the risk-tiering rationale for each tier of the chain, any escalations and their resolution, and the interval at which re-screening will be conducted. Canada, like the UK and the EU, expects records to be retained for a defined period under the applicable thematic regulations. Verify the current retention requirement before designing your records-management policy, as the period varies by regime and instrument.
Remediation follows from any positive finding. Where a supplier is confirmed as within scope of SEMA's prohibitions, the transaction must stop. The options are: seek a specific authorisation from GAC, restructure the transaction to remove the prohibited dealing, or terminate the supplier relationship. Those options are not equivalent in commercial impact, and the choice between them requires legal analysis of the specific prohibited-dealing provision, the available authorisation criteria, and the timelines involved.
For ongoing monitoring, the practical cadence depends on risk profile. Tier-one suppliers with complex ownership structures in high-risk jurisdictions warrant re-screening at a higher frequency than a domestic tier-three packaging supplier. Automate where possible, but ensure that automated alerts are reviewed by a person with the authority to escalate. Automated screening that generates alerts no one reviews is not a compliance programme – it is a liability that demonstrates awareness without action.
Common risk flags: what to watch for in a Canada supply-chain mapping exercise
Certain patterns generate disproportionate risk in SEMA supply-chain mapping. In our experience, the following appear most frequently in the cross-border matters we handle.
Nominee shareholders. Structures where the registered shareholder is a professional nominee and the beneficial owner is undisclosed require enhanced diligence. SEMA's control test, like OFSI's, can reach the beneficial owner regardless of the nominee structure. The mapping exercise should require disclosure of beneficial owners to a defined threshold, and should treat non-disclosure as a risk indicator requiring escalation.
State-owned or state-controlled entities. Some SEMA thematic regulations extend prohibitions to entities owned or controlled by a designated state. Where a supplier is a state-owned enterprise of a country subject to SEMA thematic sanctions, it requires a specific assessment of whether the entity or the state falls within the prohibition. Do not assume a commercial operating subsidiary of a state entity escapes the analysis.
Intermediaries in high-risk transit jurisdictions. Supply chains passing through jurisdictions with elevated sanctions risk introduce a specific concern: the intermediary may be used to obscure the ultimate origin or destination of goods. This is a detection issue, not a structuring question. The mapping exercise must identify intermediaries and trace their beneficial ownership, not accept the intermediary's own characterisation of its role.
Goods with dual-use characteristics. Canada maintains export-control obligations through the Export and Import Permits Act, and dual-use items may require an export permit independently of any SEMA prohibition. A supply-chain mapping exercise that focuses only on SEMA-listed persons may miss the export-control dimension for controlled goods. The two analyses should run in parallel, not sequentially.
Contractual arrangements that create control. Joint-venture agreements, exclusive distribution arrangements, and long-term offtake contracts can give a listed person practical control over an unlisted entity even where the ownership percentage is below any threshold. These arrangements require legal analysis, not just a name-list check.
A common myth: if the immediate counterparty is clean, the mapping exercise is complete
This is the misconception we encounter most often in cross-border compliance reviews. The assumption that a clear screening result for the tier-one counterparty discharges the mapping obligation is incorrect, and it is precisely the assumption that has resulted in significant enforcement attention in multiple major regimes.
GAC's prohibited-dealings provisions, like OFSI's and the EU Council's equivalent provisions, do not require that the direct counterparty be listed. They prohibit dealings that, directly or indirectly, benefit a listed person. An indirect benefit through a supply-chain relationship – a payment that flows, through legitimate commercial margins, to an entity owned or controlled by a listed person at tier two or three – can constitute a prohibited dealing. The test is not the counterparty's status alone; it is whether the transaction, taken as a whole, benefits a designated person or entity within the ownership-and-control chain.
The practical standard required by the regime is a proportionate but genuine tracing exercise. Proportionate means that not every conceivable tier must be traced to the same depth. Genuine means that the tiering rationale must be defensible on risk grounds, not driven by commercial convenience. Have you reviewed your supply-chain mapping methodology against that standard? If the honest answer is uncertain, the methodology needs review.
Related practices
- Correspondent banking and de-risking under OFAC – sanctions due-diligence for correspondent relationships and OFAC-driven de-risking decisions
- Supply-chain sanctions mapping: cross-border guide – multi-regime supply-chain mapping methodology across the major sanctions programmes
- Supply-chain sanctions mapping under the EU – EU Council regulation ownership-and-control analysis for supply-chain due diligence
Frequently asked questions: supply-chain sanctions mapping under Canada
What are the steps to map sanctions risk in the supply chain under Canada?
The process runs in five stages under the Canadian regime: define the supply chain and apply risk-tiering; identify the governing lists under SEMA and the United Nations Act; screen every material counterparty and trace ownership and control to the relevant depth; apply the qualitative control test for entities below a majority ownership threshold; document findings and establish periodic re-screening. Each stage must be recorded. The control analysis – whether a listed person exercises decisive influence over an unlisted entity – is the step where most compliance teams require external support, because it goes beyond name-matching and requires legal judgement on the specific facts of the ownership structure.
What is the most common mistake in supply-chain sanctions mapping?
The most common mistake is treating a clear screening result for the immediate counterparty as sufficient. SEMA's prohibited-dealings provisions extend to indirect benefits to listed persons through ownership and control relationships in deeper tiers of the supply chain. A mapping exercise that stops at tier one misses exactly the indirect-benefit risk that the regime targets. The second most common mistake is failing to apply a control analysis to entities where the ownership percentage is below a majority threshold – the Canada regime, unlike OFAC's 50 percent rule, does not treat below-majority ownership as automatically outside scope if control by other means is present.
How does Canada differ from other regimes here?
Canada's SEMA regime applies a qualitative ownership-and-control test, similar to the UK's OFSI and the EU Council regulations, rather than the US OFAC mechanical 50 percent ownership threshold. That means a supplier owned at 45 percent by a listed person may be within scope under Canada if the control analysis is satisfied, whereas it would not be automatically blocked under OFAC. Canada also does not operate a secondary-sanctions programme in the form that the United States does under IEEPA. For cross-border businesses, this means the mapping exercise must apply each regime's test separately and cannot treat clearance under one regime as clearance under another.
About the author
Henry Ashworth advises on UK financial sanctions and export controls, including OFSI licensing and enforcement, and judicial-review challenges to designations. Henry regularly advises on cross-border matters where UK sanctions obligations intersect with the Canadian, EU, and US regimes, including supply-chain diligence mandates for cross-border businesses. Calder & Vance – International Sanctions & Export Control Counsel.
About Calder & Vance
Calder & Vance is an independent international sanctions and export-control boutique. We advise multinationals, financial institutions, exporters, and individuals on the major regimes – OFAC and BIS in the United States, OFSI and ECJU in the United Kingdom, the EU Council regulations and the EU General Court, the United Nations Consolidated List, and the regimes of Switzerland, Canada, Australia, the UAE, Singapore, and Japan. Our work is limited to lawful compliance, licensing, delisting, enforcement defence, and due diligence. To discuss a matter, contact info@caldervance.com.
Disclaimer: This material is general information, not legal advice, and is not a substitute for advice on your specific facts. Sanctions and export-control rules change frequently and differ by regime; verify the current position before relying on anything stated here. Calder & Vance does not advise on circumventing or evading sanctions. For advice on your situation, contact info@caldervance.com.