A payment firm processing cross-border transactions on behalf of a corporate client discovers, mid-review, that one of the client's upstream shareholders appears on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons). The immediate question is OFAC exposure. But the client's banking relationships are primarily in London. The question that actually decides the matter is whether the client is itself caught under UK financial sanctions – and the test OFSI applies is not the same one OFAC uses. As of July 2026, that divergence continues to produce preventable compliance failures for businesses that assume the rules are aligned.
Under OFSI, a non-listed entity may be caught by ownership and control (the UK test for whether a non-listed entity falls within a designated person's reach) where a designated person owns or controls it, directly or indirectly. The ownership limb mirrors the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked), but the control limb goes further – and it is the control element that most often surprises businesses operating across the UK and US regimes simultaneously.
This case comment traces an illustrative matter through the OFSI ownership and control analysis, maps the points at which the UK test diverges from its OFAC and EU counterparts, and draws out the lessons for compliance teams screening counterparties under multiple regimes.
The Situation: What the Compliance Team Found
In a recent matter, a financial-services business in the payments sector was conducting routine periodic enhanced due diligence on a long-standing corporate client. The client was a holding company incorporated in a common-law jurisdiction outside the United Kingdom. Its direct shareholders were all un-listed entities. Screening returned no hits at the first ownership layer.
On reviewing the second layer, however, the compliance team identified a minority shareholder – holding just under forty percent of an intermediate holding company – whose name matched a designated person on the UK Consolidated List. The intermediate company in turn held a majority stake in the client. The compliance team's initial read was that the forty percent holding fell short of any threshold that would bring the client within scope. That read was incomplete.
The error was a familiar one. The team had applied the logic of a purely arithmetic ownership test: below fifty percent, no issue. That logic is broadly correct for the OFAC position. It does not capture the full OFSI position. OFSI's ownership and control analysis requires the firm to ask not only whether ownership reaches a specific threshold but also whether the designated person can, in any other way, exert control over the entity. A forty percent stake, combined with board appointment rights and a contractual veto over material decisions, can satisfy the control limb even where it does not satisfy any ownership threshold.
In our experience, this is precisely the gap that structured screening programmes miss. Automated tools are calibrated to flag ownership percentages. They do not read shareholder agreements. The human analyst layer, where it exists, is often trained on OFAC standards and may not apply the broader OFSI control concept without specific guidance.
The Legal Question: How Does OFSI's Ownership and Control Test Work?
OFSI's ownership and control test draws its authority from the Sanctions and Anti-Money Laundering Act – referred to throughout this comment as SAMLA – and from the relevant thematic sanctions regulations made under it. A non-listed entity is treated as owned or controlled by a designated person where the designated person holds, directly or indirectly, more than fifty percent of the shares or voting rights, has the right to appoint or remove a majority of the board, or otherwise has the right to exercise, or actually exercises, significant influence or control.
That final limb – significant influence or control – is deliberately broad. It is not exhausted by formal legal rights. OFSI's published guidance indicates that contractual rights, including rights contained in shareholder agreements, loan agreements, and operating agreements, can constitute control for these purposes even in the absence of majority ownership. A lender holding minority equity but retaining veto rights over material asset disposals, dividend policy, or financing decisions may well satisfy the control test.
The test therefore has two distinct mechanisms. The first is arithmetic: does the designated person own, in aggregate, a share that meets or exceeds the threshold? The second is qualitative: does the designated person, in fact or by right, exercise control? Both must be considered. A clean result on the first does not close the analysis on the second.
How does this compare with the OFAC position? OFAC's 50 percent rule is substantially more mechanical. Ownership of 50 percent or more in the aggregate by one or more blocked persons – whether held directly or layered through intermediate entities – is sufficient to treat the entity as itself blocked. OFAC guidance under IEEPA does not require a separate control assessment. The arithmetic test is decisive. That makes OFAC's rule in some respects easier to apply to ownership chains, but it does not extend as far as OFSI's rule where a designated person holds a minority stake but retains practical authority over the entity's decisions.
The EU position sits closer to the OFSI model, though expressed differently. EU sanctions regulations capture entities owned or controlled by designated persons, and EU guidance and General Court judgments have made clear that control can be established through means other than majority shareholding. For a business operating across the UK, US, and EU simultaneously, the compliance programme must accommodate all three tests – and in any divergence, the stricter prohibition governs the conduct of a regulated UK firm.
How Was the Matter Worked Through?
Once the compliance team identified the potential control issue, the immediate task was to scope the analysis properly before the business made any decision about the relationship. Acting on a flawed or incomplete ownership analysis – in either direction – carries its own risk. Freezing assets unnecessarily and failing to freeze them when required both carry legal consequences under the UK financial-sanctions regime.
The analytical work proceeded in stages. The first stage was documentary: obtaining the shareholder agreement, any ancillary consent rights agreements, the client's constitutional documents, and the governance terms governing the intermediate holding company. This is not a step that can be skipped. The OFSI control test is applied to the facts, not to the statutory register alone.
The second stage was legal analysis: mapping each of the control rights held by the forty-percent shareholder against the limbs of the OFSI test. The shareholder in question held board appointment rights for one of three board seats, a contractual veto over disposals above a defined threshold, and a pre-emption right over new issuances. On the arithmetic limb, the position was clear – forty percent does not reach the ownership threshold. On the control limb, the position was genuinely uncertain. A board seat representing a minority of the board does not ordinarily satisfy the control test in isolation. The veto right over material disposals was harder to dismiss.
In our experience, these are the fact patterns that require a structured legal opinion rather than a compliance-team determination. The stakes of getting it wrong run in both directions: a business that proceeds on a mistaken no-control conclusion has potentially provided a financial service to a person subject to UK financial sanctions, which is a strict-liability matter. A business that freezes assets on a mistaken control conclusion has taken a step with significant legal and commercial consequences of its own.
The third stage, following the legal analysis, was to consider whether to seek OFSI guidance. OFSI accepts requests for guidance on specific factual positions. The decision to seek guidance is not cost-free – it discloses the transaction to the regulator and is not confidential in the way that a legal-professional-privilege communication is. But for genuinely uncertain ownership and control questions, it is a legitimate risk-management tool. In this matter, after a careful consideration of the facts, the conclusion reached on the control question did not ultimately require formal OFSI guidance, because the legal analysis established, with sufficient certainty, that the contractual veto operated only in limited defined circumstances and was not, in context, indicative of significant influence or control over the client's affairs as a whole.
The relationship was retained. Enhanced monitoring and a documented ownership and control analysis were put in place. The analysis was recorded in a format that would support the firm's position in the event of any later regulatory review.
Risk Flags: Where Ownership Analysis Breaks Down
Four patterns produce the most serious OFSI ownership and control failures in practice. Understanding them reduces the risk of replicating this matter's initial error.
The first is over-reliance on automated screening at the first ownership layer. Tools calibrated to match names and entity identifiers against list entries will not identify indirect ownership or control issues buried in the second or third layer. The OFSI control test requires going further. Proportionality applies – a small-value, low-risk relationship warrants a lighter analysis than a high-value, complex-ownership counterparty – but the obligation to look exists regardless of the tool's output.
The second is treating the OFAC 50 percent rule as a universal standard. It is not. A business whose compliance manual references only the OFAC arithmetic test is systematically under-screening for OFSI and EU purposes. The control limb of both the UK and EU tests will catch fact patterns that the OFAC test does not.
The third is failing to review shareholder agreements and governance documents. Ownership analysis cannot be completed on statutory register information alone where a control question arises. The rights that produce control – veto rights, board appointment rights, approval thresholds – are almost always contained in private agreements that do not appear in any public filing. Not obtaining those documents is not a defence.
The fourth is failing to update the analysis when the ownership structure changes. A conclusion reached at onboarding can become incorrect within twelve months if a new investor enters, a loan is restructured, or governance rights are renegotiated. De-risking (a financial institution exiting a relationship to avoid sanctions exposure) is one response to this difficulty, but it is not a substitute for a maintained ownership analysis. Periodic review triggers should be built into the compliance programme for any counterparty where a designated-person connection has previously been identified, even if the prior conclusion was that no control existed.
The Cross-Border Dimension: Secondary Sanctions and Multi-Regime Exposure
This matter involved a UK-regulated firm applying OFSI's test. But the counterparty's shareholder also appeared on the OFAC SDN List. That created a secondary dimension to the analysis that compliance teams sometimes overlook when their primary regulatory obligation is OFSI.
For a UK business with US dollar clearing relationships, US operations, or US-person employees or directors involved in the relevant transactions, OFAC secondary-sanctions exposure may arise independently of the OFSI position. The OFAC 50 percent rule would apply to determine whether OFAC itself treats the client as blocked. In this matter, the forty-percent holding by the SDN did not reach the OFAC arithmetic threshold, and no other blocked persons held interests in the ownership chain. The OFAC analysis therefore closed differently to the OFSI analysis – confirming once again that these regimes must be assessed separately and in parallel, not as a single merged test.
Where a transaction involves EU-regulated entities, EU financial-sanctions rules also require assessment. The EU control test, like OFSI's, goes beyond arithmetic ownership. An EU-regulated entity in the same group as the UK firm would need to apply the EU standard to the same counterparty, and the outcome might again differ from both the OFAC and OFSI conclusions on precisely the same facts.
This is the practical consequence of multi-regime exposure: three tests, the same facts, potentially three different conclusions. The business operating across all three jurisdictions is bound by the most restrictive result in each of its regulated entities. Documenting the per-regime analysis separately – and ensuring that the entity responsible for each relationship applies its own regime's test – is essential. A combined group analysis applying OFAC logic to an OFSI obligation is inadequate and will not satisfy an OFSI examination.
The Lesson: What Similar Businesses Should Take Forward
The lesson from this matter is not that OFSI's ownership and control test is unworkable. It is that the test requires a qualitative step that a purely list-based screening approach cannot supply.
A compliance programme that is fit for OFSI purposes includes, at a minimum, three elements beyond name-matching. The first is a second-layer and indirect-ownership review for counterparties where a designated-person connection is identified at any point in the chain. The second is documentary review of governance rights – shareholder agreements, loan agreements, and operating documents – wherever a minority-equity designated-person connection raises a potential control question. The third is a documented, regime-specific legal analysis that distinguishes between the OFSI, OFAC, and EU positions and records the basis on which each conclusion was reached.
Record-keeping is not a bureaucratic afterthought. OFSI's enforcement posture has become demonstrably more active. A firm that holds a well-documented analysis – one that shows it considered the right questions, obtained the right documents, and reached a reasoned conclusion – is in a materially different position in a regulatory review than one that relied on a screening tool's negative result alone.
There is also a myth worth addressing directly. Some compliance teams operate on the assumption that OFSI's ownership and control test is effectively identical to the OFAC 50 percent rule, and that a clean OFAC analysis therefore resolves the OFSI question. That assumption is wrong as a matter of law and has caused firms to under-analyse UK-law obligations on the basis of a US-law test that does not apply. OFSI's control limb is broader, and it will catch fact patterns that OFAC's arithmetic rule does not. Running both analyses is not optional for a business with obligations under both regimes.
When should counsel be involved? In our practice, the threshold is practical rather than theoretical. Where a designated-person connection exists anywhere in the ownership chain – at any percentage – and where the counterparty relationship is of material value or involves regulated financial services, a documented legal analysis is warranted. The control question, in particular, is one that requires legal judgment rather than compliance-team determination. The consequences of an incorrect conclusion are strict-liability in character under OFSI's regime, and the firm bears the burden of demonstrating that it took all appropriate steps.
Related practices
- Compliance audit and testing – stress-testing sanctions screening and ownership analysis programmes for OFSI, OFAC, and comparable regimes
- The 50 percent rule and ownership analysis: a Singapore matter – how the ownership and control test applies under a comparable Asian regime
- Name and entity screening: an EU matter – screening failures and the EU control test in a cross-border fact pattern