A mid-sized commodities trading firm – operating across European and Gulf markets – completed what it considered a standard counterparty check before entering a structured supply agreement. The screening returned no direct hits. Six months later, an OFSI inquiry arrived. A beneficial owner sitting two layers above the contractual counterparty appeared on the UK Consolidated List. The firm had conducted due diligence. The due diligence had simply not gone far enough.
This matter illustrates a recurring pattern in OFSI counterparty due diligence: the absence of a direct listing is not the same as the absence of a sanctions nexus. Under the UK regime, ownership and control (the test for whether a non-listed entity is caught because a listed person owns or controls it) extends to indirect holdings and to factual control arrangements that do not appear in a corporate registry. The firm had no licence, no voluntary self-disclosure plan, and no documented escalation procedure. As of mid-2026, OFSI's enforcement posture treats the comprehensiveness of the prior diligence as a material factor in its penalty assessment.
The following account is anonymised and illustrative. It traces the situation front to back – the initial facts, the legal question, the regime analysis, the options the firm faced, the route taken, and the lessons that apply to any business with cross-border counterparty exposure under OFSI or a comparable regime.
The situation: what the firm did and did not check
The trading firm had a single-tier screening process: it checked the contractual counterparty's registered name against three lists – the UK Consolidated List, the EU list, and the SDN List (OFAC's list of Specially Designated Nationals and blocked persons). The check returned clear. No further steps were taken. The counterparty was an established trading entity incorporated in a Gulf jurisdiction, with a clean registration and audited accounts.
What the firm did not check was the counterparty's beneficial ownership structure. The corporate registry in the relevant jurisdiction disclosed only nominee directors and a holding company. Behind that holding company sat two further layers of intermediate vehicles before reaching a natural person who appeared on the UK Consolidated List – not under the same programme as the primary trade concern, but under a separate thematic designation that had been in force for several months at the point of contracting.
In our experience, this pattern is among the most common we encounter in financial-sector and commodities clients. A counterparty that presents cleanly at the contractual layer very often has ownership or control arrangements at a deeper level that bring a UK sanctions nexus into play. The question is not merely whether the party you contract with is listed. The question is whether any person or entity in the ownership and control chain is listed, and whether their interest crosses the threshold that the UK regime treats as sufficient to capture the entity itself.
The firm had no policy requiring it to look beyond the first layer. Its compliance manual required screening of the "direct counterparty". No definition of beneficial ownership threshold was specified. The escalation procedure required legal sign-off only for contracts above a defined revenue figure – this contract sat just below it.
The legal question: does ownership and control under OFSI bite here?
The central legal question was whether the trading counterparty was itself a designated person – or treated as one – because of the listed beneficial owner's indirect interest.
Under the UK regime, the prohibition on dealing with a designated person extends to entities that are owned or controlled by a designated person. OFSI's guidance addresses both ownership and control as distinct limbs. On ownership, a direct or indirect holding of 50 percent or more of the shares or voting rights ordinarily suffices. On control, the analysis is broader: it asks whether the designated person has the practical ability to direct the entity's activities, regardless of formal ownership percentage.
In this matter, the listed natural person's indirect economic interest, once aggregated across intermediate vehicles, exceeded 50 percent of the economic rights in the contractual counterparty. That analysis was not straightforward – it required mapping four corporate layers, applying the aggregation principle, and confirming the economic interest rather than the voting-rights structure, which had been intentionally separated.
Does the split between economic rights and voting rights change the answer? In most cases under the UK regime, it does not. OFSI's guidance is clear that the analysis covers both ownership of shares and ownership of economic interests, and that artificial separation of economic and governance rights is not a path away from the prohibition. The control limb was also in play: the listed person had contractual rights to appoint the ultimate decision-maker of the holding vehicle. That qualifies as control under the practical test.
The firm had therefore been transacting with an entity that was, on a proper legal analysis, captured by the UK designation – and had been doing so for six months. The question that followed was what to do about it.
How does the OFSI regime handle discovery after the fact?
Once the firm identified the position, two procedural obligations became immediately relevant. First, the duty to report to OFSI: where a firm reasonably suspects it holds funds or economic resources owned or controlled by a designated person, it must report to OFSI as soon as reasonably practicable. Second, the firm needed to stop any further activity that would constitute dealing with the counterparty, pending either a licence or a determination that activity could cease cleanly.
OFSI has an express power to impose monetary penalties for conduct that constitutes a breach of the financial-sanctions regulations, including for acts taken by a person who did not know – but ought to have known – that the counterparty was a designated person or was owned or controlled by one. The civil standard applies. Criminal liability requires knowledge or reasonable cause to suspect. The distinction between the two limbs is live in every enforcement review, and the comprehensiveness of prior diligence directly affects where the analysis lands.
The firm also needed to consider whether a specific licence (a case-by-case authorisation to conduct an otherwise prohibited transaction) was available to allow it to wind down the commercial relationship in an orderly way – for instance, to receive payments already contractually due without that receipt itself constituting a breach. OFSI issues licences for a range of purposes, including wind-down of pre-existing contracts. The application process requires a clear factual account of the existing position, the amounts involved, and the steps proposed.
A third consideration was voluntary self-disclosure. Firms that come forward promptly with a full account of an apparent breach, and that demonstrate the steps taken to correct it and prevent recurrence, are treated differently by OFSI than firms where the breach is identified through an external complaint or regulatory detection. The practical benefit of a well-structured VSD (voluntary self-disclosure to a regulator) is not a guaranteed outcome, but it is a material procedural step that preserves options which narrow with time.
The position above describes the standard case under OFSI. Your facts – the amounts involved, the duration of the breach, the counterparty relationship, the jurisdiction in which payments were made – change the analysis materially. If a transaction has already been flagged, or an inquiry has already arrived, an early review can preserve options that narrow with time. To discuss your specific position confidentially, contact Calder & Vance at info@caldervance.com.
Cross-regime comparison: where OFSI, OFAC, and EU positions diverge
This matter involved a UK nexus. But the counterparty had transacted in US dollars through a correspondent bank, and the holding structure included a vehicle incorporated in an EU member state. That combination immediately raised cross-regime questions that the firm had not anticipated.
Under OFAC, the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) applies mechanically to ownership and does not formally include a control limb equivalent. Where a blocked person owns 49 percent and exercises day-to-day management, OFAC's position on whether the entity is itself blocked differs from the UK position. OFSI's control test captures that scenario; OFAC's ownership rule alone may not – though OFAC retains discretion to designate the entity directly.
The EU position is closer to the UK: the relevant Council regulations extend prohibitions to entities owned or controlled by listed persons, and the control analysis under the EU regime is also fact-based and practical. The EU General Court has reviewed a number of designations on annulment applications and confirmed that the control test is not limited to formal legal rights. That body of case law provides useful interpretive context even for UK practitioners, given the shared heritage of the EU and UK sanctions regimes.
In practice, the dollar-denominated payments meant that US correspondent banks had processed funds that OFAC could regard as related to a blocked-person transaction. The EU vehicle in the ownership chain meant that a parallel question arose under the relevant Council regulation. The firm was exposed on three regimes simultaneously, even though it had conducted its commercial relationship entirely through a UK entity and a Gulf counterparty.
This is the cross-border reality that single-regime screening misses. The regulatory answer to "are we clear?" depends on which regime is asking the question – and all three were asking it at once. In our cross-border practice, multi-regime exposure of this kind is not an edge case; it is the standard pattern for any business with dollar payments, EU-entity counterparties, or UK-incorporated subsidiaries.
The options the firm faced and the route taken
The firm had three realistic options once the legal position was mapped. Each carried a different risk profile and a different timeline.
The first option was to make a voluntary self-disclosure to OFSI, supported by a full account of the diligence conducted, the gap identified, the duration and value of the prohibited activity, and a remediation plan. This option required the firm to accept that it would be on the regulatory record as having made a breach, but it positioned the VSD as evidence of good faith, internal capability, and genuine remediation commitment. The VSD route was consistent with OFSI's published guidance on the factors it considers when determining whether a penalty is proportionate and when a warning or caution rather than a penalty is appropriate.
The second option was to apply for a specific licence to wind down the commercial relationship, receive outstanding sums due, and exit the arrangement in an orderly way. A wind-down licence does not amount to an admission of breach; it is a forward-looking authorisation. However, applying for a licence implicitly acknowledges the sanctions nexus, and OFSI's review of the application would surface the same underlying facts that a VSD would cover. In our view, the two steps – VSD and licence application – were best pursued together and on coordinated terms.
The third option was to do nothing further and to rely on the argument that the firm had conducted screening and had a clean result. That option was not viable. The legal position was clear on the ownership analysis. The argument that the firm had checked and been given a clean result might be relevant to penalty quantum – it went to state of mind and to the comprehensiveness of the procedure – but it did not remove the underlying breach, and silence in the face of a known breach would itself become an aggravating factor.
The firm pursued the first and second options concurrently. We assisted in preparing the VSD, mapping the factual account, structuring the remediation plan, and drafting the licence application for wind-down. The matter reached a conclusion with OFSI that did not involve a public penalty notice. That outcome is not a guarantee, and stating it as a precedent would be misleading. What the VSD and licence route did was preserve the optionality that would have been lost had the firm delayed further.
Risk flags: what should have triggered earlier scrutiny?
Looking back at the timeline, several signals should have prompted a deeper review before the contract was signed. Identifying them here is useful for compliance teams designing or stress-testing their own procedures.
The first flag was the counterparty's jurisdiction of incorporation. The Gulf jurisdiction in question maintains a corporate-registry system that does not require beneficial-ownership disclosure at a level equivalent to the UK's register. That gap is well-documented among sanctions practitioners. A jurisdiction with limited UBO transparency is precisely the environment where reliance on the registry alone is insufficient. The compliance manual should have required enhanced due diligence for this counterparty category.
The second flag was the ownership structure itself. Nominee directors and a single holding company with no apparent operational function are characteristic of a structure designed to separate beneficial and legal ownership. That structure does not indicate a sanctions nexus on its own – many legitimate businesses use holding vehicles for tax and corporate governance reasons – but it does indicate that the standard screening result does not answer the sanctions question.
The third flag was the threshold for legal sign-off. A revenue-based threshold for escalation, without a risk-based parallel trigger for counterparties with opacity in their ownership chain, creates a gap that sophisticated counterparties can sit inside. Risk-based escalation – triggered by jurisdiction, ownership opacity, sector, or transaction type rather than contract value alone – is the standard that OFSI and other regulators expect from regulated businesses. We regularly advise clients on recalibrating escalation thresholds to reflect this.
The fourth flag was the absence of a periodic re-screening procedure. Sanctions lists change. A counterparty that is clean at contract signature may not be clean at month six. The beneficial owner in this matter had been designated several months before the contract was signed; re-screening at inception using a current list would have surfaced the issue. The firm's process did not include re-screening of existing counterparties on a scheduled basis, or on designation-update triggers.
What is the lesson for similar businesses?
The core lesson is structural: counterparty due diligence that ends at the first corporate layer is not due diligence for sanctions purposes under OFSI or any comparable regime. The ownership-and-control test requires the analysis to proceed until it reaches natural persons or listed entities, however many intermediate layers that requires.
A second lesson concerns documentation. OFSI's enforcement guidance is explicit that the quality of a firm's prior diligence is a factor in the penalty assessment. A firm that can demonstrate a well-designed, risk-calibrated, and documented process – even if the process did not detect the issue – is in a materially better position than a firm that cannot show what it actually did. The process must be documented to be defensible. Documentation of a superficial process is not enough; the process itself must meet a substantive standard.
A third lesson is about response speed. From the point at which a potential sanctions nexus is identified, the window in which the most favourable options remain open is short. Reporting obligations engage quickly. Licence applications take time. Coordinating a VSD and a licence application while managing a commercial counterparty relationship and three regulatory regimes simultaneously is not a task that benefits from delay. The decision to instruct sanctions counsel early – before the firm has fully mapped what it knows – consistently produces better outcomes than waiting until the picture is complete.
Is your own counterparty diligence procedure designed to meet the ownership-and-control test, or does it stop at the contractual layer? The answer to that question is the most practical diagnostic a compliance team can run.
Related practices
- Sanctions compliance audit and testing – end-to-end review of screening logic, ownership analysis, and escalation procedures
- SECO counterparty due diligence matter – a parallel case comment under the Swiss sanctions regime
- Crypto and VASP compliance cross-border matter – ownership and control questions in virtual-asset counterparty screening