A mid-market private equity firm is three weeks from signing on an acquisition target in the industrial sector. The target operates across several jurisdictions. Screening has been run on the named directors. Then a restructured ownership diagram arrives late in due diligence – and buried two layers down is an intermediate holding company whose majority shareholder appears on the UK Consolidated List (the Office of Financial Sanctions Implementation's register of designated persons and entities). The transaction has to stop. The question now is whether it can restart, on what terms, and how quickly.
Sanctions due diligence in M&A under OFSI requires more than a name-screen of the target's board. The UK's ownership and control test – the principle that a non-listed entity may still be caught if a designated person owns or controls it – can extend prohibitions to subsidiaries, holding vehicles, and intermediate layers that never appear on a list. As of January 2026, OFSI's enforcement posture continues to prioritise strict liability cases where acquirers fail to look through complex structures before completion.
This case comment walks through an anonymised M&A matter in which the ownership and control question almost derailed a transaction, examines the analytical steps taken, and draws out the lessons for deal teams managing similar exposure.
The situation: a late-stage ownership discovery
Three weeks before the scheduled signing date, a revised cap-table disclosure surfaced material that earlier due diligence had not captured. The acquisition target – a holding company with operational subsidiaries in two EU member states and one Gulf jurisdiction – had been screened against the UK Consolidated List, the EU Consolidated List, and OFAC's SDN List (the Specially Designated Nationals and Blocked Persons list maintained by the US Treasury's Office of Foreign Assets Control). All named counterparties cleared. The problem was not on the lists; it was one step behind them.
The intermediate holding company in the ownership chain had a majority shareholder. That shareholder did not appear on any list in its own right. Its parent entity, however, was subject to a UK designation under the relevant thematic sanctions regulations. Under the UK ownership and control test this created a potential attribution question running downstream through the chain.
The deal team's instinct was to proceed on the basis that the direct target was unlisted. In our experience, that instinct is understandable and wrong. The applicable test under UK law is not whether the entity in front of you appears on a list; it is whether a designated person owns or controls it. Those are different questions.
The acquirer's in-house counsel contacted Calder & Vance within 48 hours of the discovery. At that point, three weeks from signing, options still existed. A month later, some of those options would have closed.
What does the OFSI ownership and control test actually require?
The UK ownership and control test is the legal standard that determines whether a non-listed entity falls within the scope of a financial-sanctions prohibition by reason of its relationship to a designated person. Under the Sanctions and Anti-Money Laundering Act 2018 ("SAMLA") and the relevant thematic regulations, a person must not deal with funds or economic resources that are owned or controlled by a designated person.
Ownership is assessed by aggregate holding. The UK position, broadly consistent with OFAC's 50 percent or more threshold, treats a designated person as owning an entity when that person's direct or indirect holdings reach or exceed that level. Aggregation applies: two designated persons each holding a minority stake can together satisfy the ownership test.
Control is a separate and supplementary test. It looks beyond the share register. OFSI's guidance indicates that control includes the ability to direct or influence the management and policies of an entity, whether through voting rights, contractual arrangements, or other means. A designated person who holds, say, 35 percent of an entity but appoints the majority of its board may satisfy the control test even though the ownership threshold is not met. This is where the UK and EU positions can diverge from the OFAC 50 percent rule: OFAC's attribution test is largely mechanical and does not include a freestanding control concept of equivalent breadth.
In the matter described here, the question was whether the upstream designation, running through an unlisted intermediary, meant that the immediate target was owned or controlled directly or indirectly by a designated person. The analysis required a full ownership-chain map, not a list-screen of the visible parties.
The position above covers the standard case. Your facts – the counterparty, the structure, the jurisdiction, and the regime in play – change the analysis considerably. For matters touching OFAC exposure alongside OFSI, our correspondent banking and de-risking service covers the intersection of the two regimes.
How the due diligence was reconstructed
Effective sanctions due diligence in an M&A context is not a screening exercise. It is a legal analysis of the ownership chain, the control relationships, and the jurisdictional reach of the regimes that apply to the transaction. In this matter, reconstruction proceeded in three phases.
The first phase was a complete ownership-chain mapping. Every layer between the acquirer and the ultimate beneficial owner was identified, charted, and cross-referenced against the UK Consolidated List, the EU Consolidated List, the OFAC SDN List, and the UN Security Council Consolidated List. This is not the same as the screening that had already been done. Prior screening had run named parties against lists. The mapping exercise started from the lists and asked: does any designated entity appear anywhere in this chain, at any level?
The second phase applied the ownership and control test at each level where a designated entity appeared in the broader group. This meant calculating aggregate ownership percentages at each tier, assessing voting rights and board-appointment rights, and reviewing any shareholders' agreements or governance documents that might establish a control relationship independent of shareholding.
The third phase was a cross-regime comparison. The transaction had a US element: one of the subsidiaries had a US person counterparty on a supply contract. That US nexus meant that OFAC attribution rules also had to be considered alongside the UK analysis. The OFAC 50 percent rule and the UK ownership and control test do not always produce the same result. Where they diverge, the stricter prohibition governs the conduct of parties subject to both regimes.
The reconstruction took five business days to complete to a level of confidence sufficient for the deal team to resume informed decision-making. That timeline was achievable only because the disclosure had come early enough to allow structured analysis before the signing deadline.
Risk flags that due diligence teams most commonly miss
Several features of this matter recur in transactions our practice reviews. Each is a known risk flag that a prepared due diligence team can identify before it becomes a crisis.
Late or incomplete ownership disclosure is the most common single failure point. Cap tables arrive in tranches; corporate structures are reorganised during the sale process; nominee arrangements obscure ultimate beneficial ownership. A screening exercise run against the initial data set may clear all visible parties while a material risk sits undisclosed in documents not yet in the data room. Due diligence protocols need a dedicated document-request list for every intermediate holding vehicle, with a refresh obligation triggered by any structural change notified during the process.
The control test blind spot is the second recurring issue. Compliance teams that understand the 50 percent ownership threshold sometimes fail to apply the control test at all. Shareholder agreements that give a minority holder veto rights over major decisions, or that grant board appointment rights disproportionate to the equity stake, can establish control without ownership. In a transaction context, these instruments are rarely absent from the data room; they are simply not reviewed through a sanctions lens.
Third: the multi-regime comparison is often deferred or omitted. A buyer subject to OFAC jurisdiction – or a target with US-person counterparties – cannot stop its analysis at the OFSI result. The two tests differ in structure; an entity can clear the OFAC mechanical threshold while the UK control test still captures it, or vice versa. Treating either regime as a proxy for the other produces incorrect conclusions.
Finally, deal teams underestimate the significance of the Gulf and EU subsidiary jurisdictions in this matter. The UAE, for instance, operates its own autonomous sanctions regime. A structure that clears OFSI and OFAC may still present exposure at subsidiary level if the relevant local authority has a designation or prohibition that extends to the chain. Cross-border diligence must address each jurisdiction in which the target operates, not only the acquirer's home regime.
The route taken and how the matter resolved
Once the ownership-chain analysis was complete, the deal team had a clearer factual picture. The upstream designated entity's holding, traced through the intermediate vehicle, sat at a level that required further assessment under both the ownership and the control tests. It did not, on the facts as disclosed, produce a clear conclusion that the immediate acquisition target was owned or controlled by a designated person. But the analysis was not binary: several structural features warranted additional disclosure, and one contractual arrangement in the shareholders' agreement required specific review.
The options considered were, broadly, three.
The first was to seek an OFSI licence. A specific licence is a case-by-case authorisation issued by OFSI permitting an otherwise prohibited transaction. In our experience, the licensing route is viable when the legal position is genuinely unclear and a clean legal opinion cannot be obtained. It is slower than completing the transaction unilaterally and involves disclosure to OFSI of the full facts, but it provides a sanctioned pathway. OFSI's licensing timelines vary by complexity; for M&A matters with significant evidentiary requirements, parties should allow for a materially longer process than a straightforward financial-transaction licence.
The second option was to restructure the transaction to remove or ring-fence the element of the target associated with the exposure. In a holding-company acquisition, where the risk is contained within one subsidiary or one contractual relationship, carve-out structures can be designed to complete the transaction without the tainted asset. This route requires care: a structure designed to disaggregate a sanctioned exposure must be genuinely driven by commercial logic, not by a desire to circumvent a prohibition.
The third option was to renegotiate the sellers' representations and warranties to require resolution of the ownership question before completion, backed by a specific indemnity for any sanctions exposure that materialised post-closing.
In this matter, the parties pursued a combination of the second and third approaches. The problematic shareholding arrangement was restructured by the sellers before completion. An OFSI-specific indemnity was added. Completion proceeded after written confirmation from the deal team's sanctions counsel – including an assessment of both the UK and OFAC positions – that no designation covered the restructured target as a matter of ownership or control.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Our case comment on a parallel OFAC matter in the maritime sector illustrates the enforcement consequences of a delayed response.
The cross-border dimension: where OFSI, OFAC, and the EU diverge
Cross-border M&A transactions almost always engage more than one sanctions regime simultaneously. This matter engaged three: OFSI (the primary UK regime), OFAC (by reason of US-person contractual counterparties), and the EU regime (by reason of subsidiary operations in EU member states). Each regime applies its own test for ownership and control, and the tests do not overlap perfectly.
OFAC's 50 percent rule (the OFAC attribution principle that entities owned in the aggregate 50 percent or more by blocked persons are themselves blocked) is the most widely cited threshold in cross-border diligence practice. It is mechanical: where ownership meets the threshold, the entity is treated as blocked regardless of whether OFAC has separately designated it.
The EU position under the relevant Council regulations closely tracks this threshold for ownership, but adds a control concept that looks at the ability of a designated person to direct the entity's management, even below the ownership threshold. EU General Court case law has addressed this in the context of annulment proceedings, and practitioners need to be aware that the EU standard may capture arrangements that would not trigger the OFAC rule.
OFSI's position under SAMLA and the relevant thematic regulations is similarly structured to the EU: ownership at or above the applicable threshold, plus a separate control limb. OFSI's guidance makes clear that where control can be established on the facts – whether through formal instruments or factual influence – the entity may fall within the prohibition even if the ownership threshold is not reached. In an M&A context, target companies often have complex governance arrangements that deserve specific review against this standard.
The practical consequence is that a multi-regime analysis in cross-border M&A cannot be run as a single exercise. Each regime must be applied to the facts separately, and where the analyses produce different conclusions, the stricter prohibition governs for the parties subject to that regime. A UK buyer with US-person involvement on the target's supplier base needs both analyses completed, not one as a proxy for the other.
Our practice regularly advises on exactly this intersection. We have acted for acquirers and targets at the stage when an ownership question has surfaced mid-process, and we work through the full multi-regime picture before the deal team commits to a route. For an OFSI-focused enforcement scenario outside the M&A context, see our case comment on the maritime shipping matter.
What this OFSI matter teaches deal teams
The core lesson of this matter is procedural: sanctions due diligence in M&A needs to be structured as a legal analysis of ownership and control, not as a screening run. Screening is necessary but not sufficient. It tells you who is on a list. It does not tell you whether the unlisted entity in front of you is owned or controlled by someone who is.
There is a persistent myth in M&A practice – and we regularly encounter it in the briefings that deal teams present to us – that a clean screen means a clean transaction. That is not correct. The UK, EU, and OFAC ownership and control tests all have the capacity to attribute a listed person's status to an entity that does not appear on any list. A clean screen means the visible parties are not directly designated. It says nothing about the layers behind them.
Several practical steps follow from this. Due diligence scope should include a specific requirement for full ownership-chain disclosure, not simply disclosure of directors and named shareholders. Document requests should cover shareholders' agreements, voting arrangements, board-appointment rights, and any arrangement through which a third party may exercise influence over the target. The initial screening should be run against all disclosed entities, including intermediate holding companies, not only the named parties at the front of the transaction.
Where the ownership chain is complex – multi-layered, cross-jurisdictional, or involving arrangements in jurisdictions with limited public registry information – an independent ownership-chain tracing exercise, separate from any screening tool, is warranted. This is not a theoretical observation. The matter described here was identified because the ownership diagram was reviewed by a practitioner applying the legal test, not because a screening tool flagged a name.
Timing matters. The earlier in the due diligence process that the ownership-chain analysis is completed, the more options remain open. A designation risk identified two months before signing can be managed by restructuring, licensing, or renegotiation. The same risk identified two days before completion may leave only withdrawal. Deal teams should treat the sanctions ownership-chain analysis as a gate-check at the same stage as corporate structure review – not as a last-step clearance exercise.
When to instruct sanctions counsel in an M&A transaction
Sanctions counsel should be involved in an M&A transaction at three distinct stages, not only when a problem has been found.
The first stage is scope-setting at the outset of due diligence. A brief review of the target's geographic footprint, ownership profile, and sector will identify which regimes are in scope and what the due diligence protocol should require. This is a short exercise; it prevents a more expensive one later.
The second stage is on receipt of the initial ownership disclosure. At that point, a practitioner can apply the relevant ownership and control tests to the disclosed structure and identify whether any further inquiry is needed. If the structure is straightforward and the disclosed parties are clean, the analysis confirms that. If there are layers that require deeper review, the inquiry is opened before time pressure becomes acute.
The third stage is any point at which the structure changes. Corporate structures change during a sale process: reorganisations, pre-completion transfers, and refinancings can alter the ownership chain materially. A sanctions clearance given on the initial structure does not carry forward automatically to a restructured one.
In the matter described here, sanctions counsel was instructed at stage three – after a material structural change was disclosed. That was late, but not too late. In our experience, the outcome is better in every case where the instruction comes earlier.
Related practices
- Correspondent banking and de-risking (OFAC) – managing sanctions exposure in correspondent and financial-institution relationships
- Maritime shipping sanctions – OFAC matter – lessons from an enforcement-facing scenario in the shipping sector