A trading subsidiary of a mid-sized European holding group opens its daily screening queue. One entry stops the team cold. The company's name – or something very close to it – appears on the EU Consolidated List of persons, groups, and entities subject to financial sanctions. Payments freeze. Banks ask questions. Counterparties put transactions on hold. Yet the company has done nothing wrong. It is not the listed person. It is a different legal entity that happens to share a similar name, a similar jurisdiction, or a partial identifier match.
Mistaken-identity removals under the EU regime address precisely this situation: a non-listed party that has been operationally treated as though it were a designated person, because automated or manual screening has returned a false positive against the EU Consolidated List or a programme-specific list maintained under the relevant Council Regulation. The route to resolution runs through the Council's listing committee, through the administering Member State, and – where necessary – through the EU General Court. Speed and documentary precision are decisive.
This case comment examines how a mistaken-identity matter of this kind unfolds, what the governing regime requires, how the EU route compares with the OFAC and OFSI equivalents, and what a business or individual in this position should do in the first hours and days after a false-positive hit.
The situation: how a false positive escalates quickly
Mistaken-identity problems under EU sanctions arise when a screening system produces a match between a non-listed party and an entry on the EU Consolidated List or a programme-specific list, and that match is then acted upon as though it were a confirmed designation. The consequences are immediate and commercially damaging – and they compound if the affected party does not respond with documentary evidence within a short window.
In the matter we examine here, a manufacturing company with operations across two Member States found that its accounts had been suspended by its clearing bank. The bank's automated screening had flagged a name overlap with a designated individual. The individual's name differed by one letter in the transliteration of a non-Latin script name. The company's registered identifier, its LEI, and its incorporation documents were all unambiguous. But the bank had applied a conservative compliance posture – as it was entitled to do – and had frozen the relationship pending clarification.
The company had not been notified in advance. It discovered the freeze when a supplier payment was rejected. Within twenty-four hours, a second counterparty had received the same flag from its own screening provider. The operational cascade was rapid. What appeared to be a minor data-quality issue had become a working-capital problem.
In our cross-border practice, this pattern is familiar. Screening tools differ in their fuzzy-matching thresholds, transliteration dictionaries, and confidence scoring. A threshold calibrated for a global correspondent-banking network will generate hits that a more granular corporate-counterparty tool would not. The affected party is rarely at fault. The resolution burden falls on it nonetheless.
What does the EU regime require – and who administers it?
The EU financial-sanctions regime operates through Council Regulations that are directly applicable across all Member States. Designations are made by the Council; the lists are maintained and updated by the relevant Council working group and published in the Official Journal. The EU Consolidated List, which aggregates programme-specific entries into a single searchable database, is maintained by the European External Action Service and published through the EU Sanctions Map.
There is no single EU equivalent of OFAC's delisting petition process for mistaken-identity situations. The formal delisting route – applicable where a party is actually listed – runs through the designating Member State or the Council's working party, and ultimately the EU General Court for annulment. But a mistaken-identity case is different. The affected party is not listed. The issue is that a third party – a bank, a payment processor, a trading counterparty – has treated it as though it were.
The resolution therefore operates on two tracks simultaneously. First, the affected party must engage directly with the institution that has applied the freeze, producing documentary evidence that it is not the listed person. Second, it should consider requesting a formal confirmation – variously described as a "no match" or "not the same person" determination – from the competent national authority in the relevant Member State, typically the treasury or finance ministry that acts as the designated competent authority for the programme in question.
Some Member States have published guidance on how affected parties should submit evidence and request such confirmations. Others have not. In our experience, the procedural clarity available to an affected party depends significantly on which Member State's competent authority is engaged, and on which programme-specific list or the Consolidated List the match has been drawn from.
The legal question: is the affected party actually caught?
The central legal question in a mistaken-identity matter is whether the affected party falls within the scope of the relevant Council Regulation at all. The answer turns on identity, not similarity. EU sanctions prohibit dealing with persons, groups, or entities that are listed; they do not prohibit dealing with parties that resemble listed persons. The obligation on the financial institution or counterparty is to take reasonable steps to identify whether its customer or counterparty is in fact the listed person.
What constitutes reasonable steps has been considered in guidance issued by the European Banking Authority and by various national competent authorities. The consensus is that name alone is not sufficient where other identifiers – nationality, date of birth, legal entity identifiers, registration numbers – are available and inconsistent with the listed person's entry. A bank that freezes an account on the basis of a name overlap alone, without examining the available identifiers, may itself be acting disproportionately.
This creates a practical lever for the affected party. The argument runs: the regulation does not apply to us, because we are not the listed person; the freeze is not legally required; it should be lifted once the distinguishing evidence is presented. The strength of that argument depends on how clearly the available identifiers differentiate the affected party from the listed entry, and on the willingness of the institution to accept it.
The cross-regime comparison is instructive here. Under OFAC, a company in this position can seek an unblocking licence or, where it believes it is not blocked at all, request an informal guidance letter from OFAC confirming it is not the subject of a designation. The latter route is relatively well-developed in US practice. Under OFSI, the affected party can write to OFSI requesting a confirmation of non-designation; OFSI has issued such confirmations and they carry significant practical weight with UK-regulated firms. The EU position is procedurally less uniform, which makes the documentary package more important, not less.
How was the matter resolved – and what did it take?
Resolution in the matter examined here required action on three fronts over approximately two weeks. That timeline is not guaranteed in comparable matters; it reflects the speed with which the relevant evidence could be assembled and the responsiveness of the institutions involved.
The first step was a documentary package prepared for the clearing bank. It included the company's certificate of incorporation, its VAT registration, its LEI with the GLEIF registration record, its beneficial ownership filing from the national register, and a brief legal analysis demonstrating that the listed individual's identifying characteristics – nationality, date of birth, and the address recorded in the EU Consolidated List – were inconsistent with any officer, director, or shareholder of the company. The package was submitted to the bank's financial-crime compliance function with a covering note explaining why the regulatory prohibition did not apply.
The bank reviewed the package and, following an internal escalation to its sanctions-compliance team, confirmed within four business days that it would resume normal processing. That confirmation was documented in writing.
The second front was the competent national authority in the primary Member State of incorporation. A formal request was submitted for a written confirmation that the company was not a designated person and was not subject to the prohibitions of the relevant Council Regulation. The authority issued a written response within approximately ten business days. That response was then shared proactively with the second counterparty that had flagged the match.
The third front was a review of the company's own screening and supplier-communication protocols. The false positive had emerged partly because the company's name had not been submitted to its own screening system in its full registered form. Correcting that omission reduced the likelihood of recurrence and provided a cleaner audit trail for future compliance reviews.
We regularly advise clients that the documentary package is not a one-off exercise. Once prepared, it should be maintained and updated so that it can be deployed immediately if a second institution raises the same flag. False positives on a common name or transliteration pattern tend to recur.
Cross-regime risk: what if the company also has US or UK exposure?
A mistaken-identity situation that arises under the EU regime does not stay contained to the EU if the affected company has US dollar transactions, UK counterparties, or a broader international footprint. Each regime operates independently, and a resolution obtained from an EU competent authority carries no formal weight with OFAC or OFSI.
For a company with US dollar clearing or US counterparties, the same name-overlap issue may independently trigger OFAC screening alerts. OFAC's SDN List (the list of Specially Designated Nationals and blocked persons) is maintained separately. The EU Consolidated List and the SDN List are not co-extensive. A person listed on one is not necessarily listed on the other, and a false positive on one list does not produce an automatic false positive on the other – but in practice, screening tools often query multiple lists simultaneously, so a hit on the EU list may appear in the same alert as an OFAC near-match.
Under the UK regime, OFSI administers the UK Consolidated List independently of the EU list. Since the UK's departure from the EU, the two lists have diverged. A designation made by the EU Council after a certain point may not be mirrored on the UK list, and vice versa. That divergence has created a class of situations where a business faces a false positive on one list but not the other, and must manage two separate resolution tracks.
The practical lesson is that a company facing a mistaken-identity issue should map its full jurisdictional exposure in the first twenty-four hours. Which institutions are flagging the match? Which list are they querying? Are US dollar transactions affected? Are UK counterparties in scope? The answers determine whether the resolution is a single-jurisdiction exercise or a multi-track matter requiring coordinated engagement with EU, UK, and US authorities.
Have you identified all of the jurisdictions in which your counterparties are running your name through screening? The answer is rarely obvious from the face of the first alert.
Risk flags: when does a mistaken-identity case become harder to resolve?
Not all mistaken-identity matters resolve quickly. Several factors make a case harder to manage and increase the likelihood that an affected party will need to engage counsel and, in some instances, the competent authority or the courts.
The first risk factor is an incomplete or inconsistent corporate record. Where a company's name appears in multiple forms – a short-form trading name, a full registered name in a non-Latin script, an English transliteration, and a local-language version – each variant may generate independent screening alerts. If the corporate register and the banking relationship do not use a consistent identifier, the documentary package is harder to construct convincingly.
The second is the listing entry's quality. The EU Consolidated List entry for the listed person contains whatever identifying information the Council had available at the time of designation. Older entries sometimes lack date of birth, nationality, or a valid address. Where the entry is thin, the distinguishing evidence available to the affected party is also thinner, because there is less to distinguish against. In our experience, thin-entry cases require a more intensive engagement with the competent authority.
The third is institutional conservatism at the flagging firm. Banks operating under significant supervisory pressure in the area of financial-crime compliance may decline to accept a documentary package at the operational level and escalate internally for a period that exceeds the commercial tolerance of the affected party. In those cases, a formal written request to the competent national authority – or a legal letter to the bank setting out the position – may be necessary to accelerate the review.
The fourth, and most serious, is a contested identity. Where the listed person's name, nationality, and date of birth are sufficiently similar to those of the affected individual (not just a similar company name, but a similar personal identity) the competent authority may need to make a formal determination rather than accept documentary evidence at face value. That process takes longer and may require the submission of certified documentation, sworn statements, or biometric materials depending on the applicable country regime.
The myth: a formal delisting petition is necessary in every case
A misconception we address regularly is that any contact with an EU competent authority in a sanctions context necessarily involves a formal delisting petition and the procedural timeline associated with it. That belief causes affected parties to underestimate the speed with which a mistaken-identity situation can be resolved – and to delay taking the simpler steps that are available to them.
A formal delisting petition – or an annulment action before the EU General Court – is the correct route for a party that is actually designated and wishes to challenge that designation on substantive grounds. It is not the first or the primary route for a party that is not listed at all. The distinction matters because the two routes have very different procedural requirements, timelines, and evidentiary standards.
For a party that is not listed, the first step is always the documentary package directed at the institution applying the freeze. If that does not resolve the matter, the next step is a request for a confirmation from the competent national authority. A formal petition is a last resort, used when the administrative resolution has failed or when the institutional freeze is causing damage that the administrative route cannot address quickly enough.
The same logic applies in the OFAC and OFSI contexts. OFAC's reconsideration process and OFSI's confirmation mechanism are designed, in part, to address exactly these situations without requiring a full delisting proceeding. The EU position is less standardised procedurally, but the administrative track is still the starting point.
Understanding this distinction allows an affected party – and its counsel – to calibrate the response proportionately and to deploy the faster, lower-cost mechanism first.
Related practices
- Delisting evidence package – Australia – building the documentary record for an Australian autonomous-sanctions delisting.
- An OFAC matter: mistaken-identity removal – how a comparable false-positive situation was resolved under the US regime.