A mid-sized trading company operating across three continents completed a routine supplier onboarding check and cleared it. Months later, a secondary review of the same counterparty surfaced a layered ownership chain connecting it, through two intermediate holding entities, to a person on OFAC's SDN List (OFAC's list of Specially Designated Nationals and blocked persons). The original screening had caught only the first layer. The deeper chain was invisible to it. This is the situation that supply-chain sanctions mapping under OFAC is designed to prevent – and the gap that, in our cross-border practice, we see most often.
Supply-chain sanctions mapping under OFAC requires tracing ownership through every intermediate entity until no blocked person holds 50 percent or more in the aggregate, directly or indirectly, at any layer. The governing authority is OFAC, acting under IEEPA, and its published guidance on the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) sets the mechanical threshold. A single mis-mapped layer can cause a company to engage in a prohibited transaction without any intent to do so.
This case comment walks through an illustrative but representative engagement: how the gap in the original mapping was identified, what OFAC's ownership and control analysis required, how the cross-border dimension – including OFSI and EU positions – shaped the advice, and what the business did next. The scenarios described are anonymised and composite; they do not represent any specific client or enforcement matter.
The situation: a supplier that passed initial screening
The business was a manufactured-goods exporter with supply relationships spread across several markets. Its compliance programme required sanctions screening on supplier onboarding, using a commercial screening tool calibrated to flag direct name matches against the SDN List and several other major lists. The supplier in question had no direct match. It onboarded without issue.
The gap emerged during a periodic supply-chain review driven by an internal audit finding: the programme screened counterparty names but did not systematically map beneficial ownership beyond the first registered-shareholder layer. For a supplier held through a chain of intermediate entities – common in trading structures across certain markets – the tool saw only the registered owner, not the beneficial chain behind it.
When the audit team pulled the corporate structure for a sample of active suppliers, one showed a majority stake held by a holding company, which was itself majority-owned by a second holding entity, which was controlled and majority-owned by a person who appeared on the SDN List. The arithmetic was straightforward once visible: the SDN-listed person held, indirectly, well above the 50 percent threshold. Under OFAC guidance the supplier was itself treated as a blocked person, regardless of the fact that it was not separately named on any list.
The business had been paying invoices and taking delivery across several months. Each transaction was, under OFAC's analysis, a transaction with a blocked entity. The question was: what now?
What does the OFAC 50 percent rule actually require?
The 50 percent rule requires that any entity owned in the aggregate by blocked persons – directly or indirectly, across any number of layers – at or above the 50 percent threshold is itself treated as blocked, whether or not OFAC has separately listed it. There is no intent element in the ownership test itself. The threshold is mathematical.
Aggregation operates across multiple blocked persons simultaneously. If two listed persons each hold twenty-eight percent of an entity, they jointly hold fifty-six percent – above the threshold – and the entity is blocked even though neither listed person individually meets the threshold. In our experience, this aggregation dimension is the most commonly missed aspect in self-administered ownership mapping. Screening systems that resolve individual names do not, by default, aggregate holdings across co-owners.
Indirect ownership works by multiplication through the chain. A listed person holding sixty percent of Company A, which holds eighty percent of Company B, holds forty-eight percent of Company B indirectly. That is below the threshold. But if the same listed person also holds ten percent of Company B directly, the aggregate is fifty-eight percent – above it. The analysis must trace every direct and indirect route simultaneously. This is why supply-chain sanctions mapping under an OFAC case requires a structural diagram, not a name-list search.
The rule does not apply only to equity ownership. OFAC guidance indicates that ownership for these purposes includes any form of equity interest. It does not require voting control or operational control; those are relevant under the EU and UK regimes but not to the mechanical OFAC ownership test.
How does OFSI and the EU position compare – and why does it matter?
The cross-border dimension shapes the analysis materially. The business had EU-incorporated entities and made payments through accounts held at UK-regulated banks. That meant the EU and UK regimes were engaged in parallel with OFAC, and the tests diverge in ways that affected the structuring of the advice.
Under OFSI (the UK's Office of Financial Sanctions Implementation) and the EU Council sanctions regulations, the test extends beyond ownership to ownership and control (the UK and EU test for whether a non-listed entity is caught through a listed person). Control can be established through contractual relationships, board appointment rights, or effective decision-making authority, even where equity ownership is below fifty percent. An entity that is not blocked under the OFAC 50 percent rule because ownership sits at, say, forty percent might still be caught under an OFSI or EU control analysis if the listed person effectively directs its operations.
What does this divergence mean in practice? It means that clearing the OFAC ownership threshold does not clear the matter for a business with EU or UK connections. We regularly advise clients to run parallel analyses – the mechanical OFAC ownership test on one track, the broader UK and EU ownership-and-control test on the other – because passing the former and failing the latter still produces a sanctions violation in the relevant jurisdiction.
In the matter described here, the supplier's full beneficial chain, once mapped, breached the OFAC 50 percent rule conclusively. The EU and UK control analysis did not need to reach a different result. But the methodology the business adopted going forward was built to satisfy both tests simultaneously, because its operating structure made it subject to all three regimes. The principle in multi-regime situations is straightforward: where regimes overlap, the stricter prohibition governs the transaction.
The position above covers the standard structure. Your specific facts – the jurisdiction of incorporation, the currencies used, the banks involved, and the route of any goods or payments – can pull in additional regimes and alter the analysis at each step.
For an initial assessment of your supply-chain exposure under OFAC and the intersecting UK or EU regime, contact Calder & Vance at info@caldervance.com.
What risk flags should a compliance team look for?
Risk flags in supply-chain sanctions mapping do not announce themselves. The most dangerous gaps are structural: the ones that the compliance programme was never designed to reach. Several patterns recur across the matters we handle.
Tiered holding structures are the first and most common. A counterparty that is majority-owned by an offshore holding entity, which is itself held by a further holding company, is exactly the type of structure through which SDN-listed ownership is held at arm's length from the operating entity. The operating entity's name will not appear on any list. The screen will return clean. The economic reality is entirely different.
Jurisdictions with limited beneficial-ownership disclosure requirements compound the problem. Where corporate registries do not require disclosure of beneficial owners beyond the registered-shareholder layer, there is no public source from which to verify the chain. A supplier registered in such a jurisdiction may provide only registered-shareholder information in its onboarding documentation. The business accepting that documentation may have no line of sight to beneficial ownership.
Stale screening is another structural risk. The SDN List is updated frequently, sometimes several times in a week. A supplier that was clean on the onboarding date may become connected to a newly listed person months later, through a change in ownership structure or a new designation. Periodic re-screening is not optional in an effective programme; it is the mechanism that catches changes in the beneficial chain that post-date initial clearance. In our cross-border practice, we see enforcement situations arise not from a defective initial screen, but from the absence of a re-screening cycle.
Nominee arrangements present a related challenge. Where a person listed on the SDN List uses a nominee to hold equity on paper, the true beneficial owner may be invisible to a surface review of corporate records. OFAC guidance makes clear that the legal analysis turns on the substantive economic interest, not the registered title. Identifying this requires document requests that go beyond the standard onboarding pack – and, in higher-risk supply relationships, independent verification of the ownership chain.
Finally, the payment route can itself introduce risk. A payment made through a correspondent bank that is itself subject to US jurisdiction may trigger OFAC's blocking obligation even if the underlying supply relationship did not, directly, engage US persons. The extraterritorial reach of US sanctions through the US dollar clearing system means that a transaction with no obvious US nexus may still engage OFAC's rules the moment it is settled in US dollars or routed through a US-correspondent account.
What options did the business have, and what route was taken?
Once the blocked ownership chain was confirmed, the business faced a defined set of options. None of them was cost-free. The analysis of which route to take depended on the nature of the relationship, the volume and value of prior transactions, and the risk tolerance of the business and its board.
The first option was immediate cessation and blocking. Under OFAC's rules, property in which a blocked person has an interest must be blocked – that is, frozen and reported. Any further dealing with the supplier would itself be a prohibited transaction. This was the baseline position and was non-negotiable as a matter of legal obligation, regardless of what other steps were taken.
The second question was what to do about the prior transactions. This is where the voluntary self-disclosure analysis began. A VSD (voluntary self-disclosure to a regulator) to OFAC can be a material mitigating factor in a civil penalty calculation. OFAC's published enforcement guidelines treat a VSD as a significant mitigating consideration. Whether to file, and on what timeline, required a careful scoping of the apparent violation: how many transactions, over what period, of what aggregate value, and whether any US-person nexus was present in each.
The decision matrix in a matter of this type typically runs as follows. Where the ownership breach was clearly above threshold, has been confirmed through a documented investigation, and involved multiple transactions over a sustained period, an early VSD generally reduces the enforcement risk more than it increases it. Where the exposure is marginal, the ownership chain ambiguous, or the US nexus thin, the calculus is different – and a pre-disclosure OFAC inquiry may be warranted before committing to a formal VSD. In our cross-border practice, we have acted in both situations, and the first step is always to scope the apparent violation precisely before any filing decision is made.
In this matter, the decision was made to file a VSD, accompanied by a structured remediation plan. The remediation included: a suspension of the supplier relationship, a full beneficial-ownership mapping review of the remaining active supply base, a redesign of the onboarding and periodic re-screening procedures, and an enhanced due diligence protocol for suppliers in higher-risk jurisdictions.
If a transaction has already been flagged, or a payment has been made to a counterparty whose ownership chain is now in question, an early review can preserve options that narrow with time. To discuss a potential VSD or a compliance remediation, contact Calder & Vance at info@caldervance.com.
What is the lesson for businesses managing multi-tier supply chains?
The central lesson is that supply-chain sanctions mapping is a structural discipline, not a screening event. Name-matching against sanctions lists is necessary but not sufficient. The entity that appears on the list is rarely the entity at the front of the supply relationship; it is the entity two or three layers back, holding the beneficial interest through a chain designed – for reasons that may have nothing to do with sanctions avoidance – to keep the beneficial owner at a distance from the operating entity.
A common misconception is that commercial screening tools perform this analysis automatically. They do not. Standard commercial screening tools match names and identifiers against published lists. They do not, without specific configuration and additional data sources, trace beneficial ownership through intermediate holding entities or aggregate the holdings of multiple listed persons in the same counterparty. Expecting a screening tool to do the work of a structured ownership-chain analysis is the single most prevalent misunderstanding we encounter in compliance-programme reviews.
A second misconception is that clearing OFAC clears the matter globally. As noted above, the UK and EU regimes apply independent tests, and a business with entities or banking relationships in those jurisdictions must satisfy both the mechanical OFAC ownership threshold and the broader ownership-and-control standard. A supply chain that passes OFAC may still produce a violation in the UK or EU if the listed person exercises effective control over the supplier without meeting the fifty-percent ownership threshold.
The practical steps for a business reviewing its current position are as follows. First, identify the suppliers – and their sub-suppliers, where the relationship is material – for whom beneficial ownership data is incomplete beyond the first registered layer. Second, run a structured ownership-mapping exercise on that population, tracing the chain to ultimate beneficial owner level and applying the OFAC 50 percent aggregation test at each layer. Third, apply the UK and EU control analysis to any counterparty in a higher-risk category, treating the ownership-and-control test as an additional gate. Fourth, implement a re-screening cycle calibrated to the frequency of SDN List updates, not just to the annual-review cycle. Fifth, build a clear escalation path: when an analyst identifies a potential match or an ambiguous ownership chain, the route to legal review should be defined and fast.
What is the myth about supply-chain sanctions compliance?
The myth most commonly encountered in this practice area is that sanctions compliance in the supply chain is primarily a documentation task: collect the right forms on onboarding and the obligation is met. That framing misreads what OFAC's rules actually require.
OFAC's liability analysis in civil enforcement cases does not turn on whether the business collected the correct onboarding documentation. It turns on whether a prohibited transaction occurred – that is, whether a US person dealt in property in which a blocked person had an interest. The business's state of mind (whether it knew, should have known, or had no reason to know) is relevant to penalty calculation, but it does not define whether a violation occurred. A transaction with a blocked counterparty is a violation even if the business collected every form it was asked for and the forms showed nothing suspicious.
This is why the due diligence obligation is substantive, not procedural. It requires the business to investigate what the forms cannot tell it: the beneficial ownership chain behind the registered entity, the aggregated holdings of co-owners, and the currency and routing of any payments. We regularly advise clients who believed their compliance programme was complete because it was process-complete. The programme looked full on paper. The ownership-mapping exercise it supported was, in practice, shallow.
Related practices
- Correspondent banking and de-risking under OFAC – sanctions exposure and de-risking analysis for banks and payment firms in US dollar clearing
- Trade transaction screening: a BIS/EAR matter – how export-control classification and Entity List screening intersect in a cross-border supply chain
- Trade transaction screening: a Canada matter – parallel analysis of supply-chain screening obligations under Canadian autonomous sanctions