A trading business with operations across three jurisdictions closes what appears to be a routine supply agreement. Weeks later, its bank flags a payment as potentially prohibited. The goods have already shipped. Licences were not in place. The business now faces blocked funds, a potential voluntary self-disclosure, and no clear route to unwind the position without making it worse.
This case comment examines a specific licence applications matter involving a cross-border footprint – touching OFAC, OFSI, and the relevant EU Council regulation simultaneously. The matter illustrates how a gap in licence strategy at one regime level can create cascading exposure across others. Working through the matter required separate applications to two authorities, careful sequencing, and documentary precision that the business had not anticipated.
What follows sets out how the matter arose, how it was resolved, the procedural and legal questions at each stage, and the lessons that apply to any business operating across jurisdictions where more than one sanctions authority has reach.
The situation: a transaction that spanned three regimes at once
A mid-sized commodity trader, incorporated in one EU member state and with a UK-registered subsidiary, entered a supply arrangement with a counterparty in a third country. The counterparty itself was not listed. One of its ultimate beneficial owners, however, appeared on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons), holding a stake that crossed the relevant threshold when aggregated with a connected family holding.
The UK subsidiary was the contractual party on the payment leg. The EU parent held the trading licence under EU instruments. The goods – processed industrial components – were sourced partly from a US-origin manufacturer. That sourcing introduced BIS jurisdiction under the EAR (the Export Administration Regulations, administered by the US Bureau of Industry and Security), because US-origin content brought the items within BIS reach regardless of where the transaction was booked.
The result was jurisdictional layering. OFSI had jurisdiction over the UK subsidiary's payment. The EU Council regulation applied to the EU parent's role in facilitating the supply. OFAC's secondary-sanctions perimeter was engaged by the SDN ownership position. BIS rules were potentially triggered by the US-origin content. No single authority captured the full picture. Each required a separate assessment.
In our experience, this layering is the norm rather than the exception for businesses of any scale operating across the UK, EU, and US simultaneously. The common mistake is treating a sanctions question as belonging to one regime. It rarely does.
What is the governing authority for a cross-border specific licence application?
There is no single cross-border licence authority: each regime operates its own licensing function, and a licence from one authority confers no protection under another. In this matter, OFSI administered the UK-side licensing assessment; the relevant competent authority in the EU member state handled the EU-side licence; and OFAC held jurisdiction over any US-person nexus and the SDN ownership position.
Under UK law, OFSI may issue a specific licence (a case-by-case authorisation to conduct an otherwise prohibited transaction) where the applicant satisfies a statutory licensing ground. The relevant thematic sanctions regulations identify those grounds. OFSI has published guidance on the information it expects in an application. That guidance makes clear that an incomplete submission is likely to result in refusal or significant delay rather than a request for further information – a point the business in this matter had not appreciated when it drafted its first attempt.
The EU-side licence ran on parallel tracks under the applicable Council regulation. The licensing competent authority in the relevant member state applied the grounds set out in that regulation. The grounds do not map precisely onto the UK grounds, which meant that the legal basis for each application had to be framed differently – a point of genuine divergence that caught the business off-guard.
OFAC's licensing function operates separately again. General licences – general licences (standing authorisations permitting a defined category of transactions without a separate application) – cover certain humanitarian and wind-down scenarios, but the facts here did not fall within any available general authorisation. A specific licence from OFAC would have been required to cure the US-person and SDN exposure. Given that no US person was directly party to the transaction, the team took the view that the OFAC exposure was secondary in priority but could not be ignored. An analysis of secondary-sanctions risk was prepared and retained.
How did the application process unfold across OFSI and the EU authority?
The UK application was filed first, because the blocked funds sat in a UK bank account held by the UK subsidiary and the bank required evidence of an application before it would extend any informal forbearance. The application set out: the identity of all parties and their ownership chains; the nature of the goods; the contractual basis for the payment; and the specific licensing ground relied upon. Supporting documents included certified translations of the underlying contracts and a legal opinion on the ownership analysis.
OFSI's published guidance does not commit to a fixed processing time for specific licences. In our cross-border practice, straightforward cases are often resolved within weeks; more complex matters, particularly those involving layered ownership questions or unfamiliar counterparty structures, take considerably longer. Businesses should not assume a rapid turnaround, and should plan their commercial arrangements accordingly.
The EU application ran in parallel, filed approximately two weeks after the UK submission. The EU competent authority required a distinct application format and additional supporting documentation regarding the end-use of the goods. It also required evidence that the transaction served a purpose consistent with the applicable licensing ground under the Council regulation. The framing of the grounds was materially different from the OFSI submission, because the statutory language differed. Copying the UK application and resubmitting it to the EU authority would have been an error – one that businesses frequently make when they treat a multi-regime matter as a single-jurisdiction problem.
The EU authority issued a licence approximately six weeks after the UK licence was granted. The sequencing mattered: the goods were still in transit during part of the application period, and the logistics provider required documented legal authority before releasing the consignment at the destination port.
What risk flags did this matter expose?
Several risk flags became apparent as the matter progressed. Each is instructive for businesses in comparable positions.
Ownership analysis at first-layer only. The business's screening process checked the named counterparty against consolidated lists. It did not trace the ownership chain to the second and third layers. The SDN-linked holding was at the second layer, held through an intermediate entity. A first-layer check would not have found it. Effective ownership and control analysis (the UK and EU test for whether a non-listed entity is caught through a listed person) requires tracing the full chain, not merely the immediate counterparty.
The US-origin content question was a separate risk flag. The business had not asked its supplier whether the components it sourced contained US-origin technology or software above any applicable de minimis threshold. Under the EAR, the US-origin character of items can follow them through further incorporation, bringing the finished goods within BIS jurisdiction even when the re-exporter is not a US person. The business was fortunate that the licensing outcome resolved before BIS conducted any inquiry.
A third flag: the business had no documented escalation procedure for a sanctions hit identified after contract signature. When the bank flagged the payment, the business's first instinct was to instruct the bank to return the funds. That instruction was itself a potentially prohibited transaction under the applicable regulations. Reversing a payment that relates to blocked property requires its own analysis and, in some scenarios, its own licence.
Finally, the business had not prepared a VSD (voluntary self-disclosure to a regulator) strategy. OFSI's enforcement guidance identifies a VSD as a factor that can reduce the severity of a financial penalty. The decision whether to self-disclose, and the timing of that decision, required careful consideration once the extent of the exposure became clear.
How was the cross-border matter resolved?
The matter was resolved through two granted specific licences – one from OFSI, one from the EU competent authority – which together authorised the payment and the completion of the supply arrangement on defined terms. The licences imposed conditions: reporting requirements on the final disposition of the goods, record-keeping obligations, and a restriction on future dealings with the counterparty without separate authorisation.
On the OFAC dimension, the team prepared a documented secondary-sanctions risk assessment and retained it on file. No US-person involvement was identified that would have required a separate OFAC specific licence on the facts as they stood. That conclusion was recorded carefully, because the position under OFAC can change if new ownership information or a US-person nexus emerges later.
A voluntary self-disclosure to OFSI was made in relation to the period during which the payment was held without a licence in place. OFSI acknowledged receipt. No penalty was imposed at the conclusion of that process, though the outcome reflects the specific facts of this matter and should not be read as a prediction of any outcome in a different case.
The entire process, from first bank flag to both licences granted, took slightly under five months. That timeline was affected by the complexity of the ownership chain documentation and by the sequential rather than fully parallel filing strategy initially adopted. In our view, an earlier instruction to prepare the EU application simultaneously would have reduced the overall period by several weeks.
What myth does this matter correct, and when should counsel be involved?
The most persistent misconception we encounter in cross-border licensing matters is that obtaining one licence from one authority cures the problem. It does not. A business that holds an OFSI licence has a defence under UK law. It has no protection under the EU Council regulation. It has no protection from OFAC. Where multiple regimes are simultaneously engaged, each requires its own analysis and, where the facts require it, its own licence application.
A related misconception is that a licence application tolls the prohibition. It does not. The prohibition continues to apply until the licence is granted. Where a transaction is already in progress, businesses often feel pressure to complete it – to pay the counterparty, to release the goods, to settle an invoice – before the licence is in hand. That pressure must be resisted. Acting before a licence is granted is the violation; acting after it is granted is compliant.
Counsel should be involved as early as possible. The earlier a cross-border licensing matter is identified, the more options remain open. A business that contacts counsel before signing a contract can structure the transaction to reduce regime-overlap risk. A business that contacts counsel after a bank flag, after goods have shipped, or after a regulator has made an inquiry, faces a narrower set of choices. The licensing analysis, the self-disclosure question, the documentary package, and the sequencing of filings across authorities all benefit from early instruction.
In a recent matter, a logistics business identified a potential ownership concern mid-shipment and contacted us before completing the delivery leg. We were able to prepare a documented analysis of the applicable regime tests, advise on whether any general authorisation applied, and prepare a precautionary licence application within the commercially available window. The matter concluded without enforcement action. Early instruction made the difference.
Related practices
- Frozen account management under BIS and the EAR – managing blocked funds and accounts within the US export-control and sanctions architecture
- Specific licence application: SECO matter – a practitioner account of Swiss SECO licensing for a cross-border supply arrangement