Understanding aggregating holdings across several listed persons under OFAC

A compliance team at a mid-size trading group screens a prospective joint-venture partner. The direct shareholders return clean. But two OFAC-listed persons each hold a minority stake in the target – and together, their combined ownership crosses a threshold that changes everything. The deal the board approved is now prohibited.

Under OFAC's 50 percent rule (the rule that treats any entity owned 50 percent or more in the aggregate by one or more blocked persons as itself blocked), the relevant question is never whether any single listed person holds a majority. It is whether the combined holdings of all listed persons, across every ownership tier, reach that line. As of early 2026, this aggregation obligation applies under IEEPA and across all OFAC list-based programmes – and its mechanical, intent-free character means that aggregating holdings across several listed persons under OFAC rules catches companies that name-screening alone will miss.

This briefing explains the obligations that attach, how the aggregation test works in practice, where the US position diverges from the UK and EU, and what a business must do to manage the risk before it signs.

What the aggregation obligation actually requires

The 50 percent rule requires a business to combine the ownership stakes of all blocked persons – not just any single one – before determining whether a target entity is itself blocked. OFAC's position, set under IEEPA, is structural: if blocked persons together own 50 percent or more of an entity, directly or indirectly, the entity is treated as blocked regardless of whether it appears on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons). The entity inherits the legal status of the persons who own it.

The word "aggregate" does the heavy lifting here. Two listed persons each holding twenty-six percent of the same target reach the threshold together. Three listed persons each holding twenty percent do the same. None of them needs to be a majority owner individually. The rule does not ask whether any listed person has the power to direct the entity's affairs – that is a separate question under the control analysis that other regimes apply. The OFAC test is a simple arithmetic exercise, but it demands complete ownership information.

Indirect holdings count as fully as direct ones. A blocked person who holds forty percent of a holding company, which in turn holds seventy percent of the operating entity, contributes twenty-eight percent of the operating entity to the aggregate calculation. Layers compress. In our experience, this is precisely the pattern that compliance programmes built on name-screening fail to detect, because the target entity itself appears on no list.

OFAC's guidance under IEEPA is explicit that the blocked status of an entity owned at or above the threshold is automatic. It does not require a separate designation. It does not require knowledge on the part of the US person dealing with it. OFAC liability for civil penalties is generally strict – no knowledge or intent is required for the violation itself. A firm that transacts with a blocked entity is liable even if it did not know the ownership position.

How the OFAC position differs from OFSI and EU control tests

The US aggregation rule is mechanical; the UK and EU tests are not. That divergence is the source of the most common misreading we encounter in cross-border transactions.

Under OFAC, the question stops at arithmetic: do blocked persons own fifty percent or more in total? If yes, the entity is blocked, full stop. There is no further enquiry into whether those persons direct the entity's day-to-day decisions, whether they can appoint its management, or whether they exercise any practical authority over it.

Under OFSI, the ownership and control test (the UK test for whether a non-listed entity is caught through a listed person) has two limbs. The ownership limb mirrors the OFAC approach: an entity owned by designated persons is caught. But the control limb goes further – an entity that a designated person controls, even without reaching any ownership threshold, can also be subject to UK financial sanctions. Control means more than a theoretical ability to exert influence; UK case law holds that the control must be actual rather than hypothetical.

The EU position under the relevant Council Regulations mirrors the dual-limb structure. An entity is caught if designated persons own more than fifty percent of it, or if designated persons control it by other means. The EU General Court has considered what evidence suffices to establish control; recent case law holds that objective and sufficiently weighty evidence is required, and that the nature of a state's political system is not by itself proof that its leadership controls a given company.

The practical consequence for a multinational subject to all three regimes is that the analysis must be run twice. A company may clear the OFAC aggregation threshold – say, combined listed-person ownership of forty-three percent – yet still be caught under OFSI or EU rules if a listed person controls it through contractual rights, board-appointment authority, or debt instruments. Where two regimes both apply, the stricter prohibition governs. The regimes do not cancel each other out.

For businesses with operations or counterparties in Singapore, Japan, Canada, or Australia, each regime applies its own ownership and control tests, generally modelled on UNSC implementation requirements, with incremental national variation. A transaction cleared under OFAC alone is not cleared globally.

What OFAC prohibits when an aggregated entity is blocked

Once an entity is blocked through aggregation, the full range of OFAC prohibitions applies to it exactly as they would to a named SDN. US persons – and non-US persons processing transactions that touch the US financial system – may not engage in any transaction with the entity, provide it with services, or make goods, funds, or resources available to or for its benefit.

The prohibition extends to facilitation: a US person who arranges, funds, or approves a transaction that another party then executes is itself in violation, even if the US person never touches the blocked entity directly. Facilitation by US persons of transactions that would be prohibited if done directly by them is itself prohibited. This captures subsidiaries, agents, legal counsel, and financial intermediaries who structure a prohibited deal even at one remove.

Blocked property must be frozen immediately and reported to OFAC within 10 business days of the blocking. The obligation to report is not contingent on a regulator's instruction. It attaches the moment a US person or a US-person-controlled entity identifies that it holds property belonging to, or for the benefit of, a blocked entity. The reporting window is short, and missing it is a separate compliance failure from the underlying blocking.

Records of blocked and rejected transactions must be retained for five years. This record-keeping obligation supports OFAC's ability to conduct enforcement reviews long after the original transaction, including under the statute of limitations that IEEPA allows.

There is no mechanism for transacting with a blocked entity without first obtaining an OFAC licence. A specific licence (a case-by-case authorisation to conduct an otherwise prohibited transaction) is available in principle; a general licence (a standing authorisation that permits a defined category of transactions without a separate application) may also be relevant depending on the programme. But no licence exists to conduct a prohibited transaction without applying for one, and the processing timeline for a specific licence application is not guaranteed.

What does OFAC require for aggregating holdings across several listed persons: the practical test

Meeting the obligations that flow from the aggregation rule requires a structured ownership-chain investigation, not a one-off name search. The practical test has four stages, each of which must be documented.

First, identify every direct beneficial owner of the counterparty and screen each against the SDN List and OFAC's other administered lists. This step is necessary but not sufficient. A clean result at this layer establishes only that no single direct owner is individually listed.

Second, map the full indirect ownership chain. For each direct owner, identify its own shareholders, up to and including natural-person ultimate beneficial owners. The depth of analysis is not fixed by a bright-line rule; the search goes as deep as the ownership structure requires to be confident that no blocked person sits in the chain, at any tier, with a holding that contributes to the aggregate.

Third, calculate the aggregate contribution of every identified listed person to the target entity's ownership, accounting for the compression of indirect stakes across layers. If that aggregate reaches fifty percent, the entity is blocked.

Fourth, document the analysis. OFAC's Enforcement Guidelines treat the completeness and contemporaneity of compliance records as relevant to its assessment of a firm's culpability. A well-documented analysis supports a finding of non-egregious conduct and strengthens the case for a voluntary self-disclosure (a VSD – disclosure to OFAC of an apparent violation before the regulator identifies it) if an issue is later discovered.

In our practice, we regularly advise compliance teams on where the documentation typically breaks down. The most common failure is an ownership investigation that terminates at a nominee shareholder or a trust structure without piercing through to the underlying economic owner. A layered structure is not itself suspicious; but it is exactly the architecture through which indirect blocked-person ownership can be concealed, and the obligation to identify it does not diminish because the structure is opaque.

Risk flags: when is the aggregation analysis hardest?

Three ownership patterns create the most acute aggregation risk, and in our experience they cluster in specific deal types.

Consortium and joint-venture structures. When several investors pool minority stakes to form a new vehicle, the beneficial-ownership profile of each investor matters. A target with four investors, two of whom are themselves owned by different listed persons at the minority level, can cross the aggregation threshold at the operating-entity level even though no investor individually holds an obvious position. Consortium diligence must screen the ownership chain of each consortium member, not just the members themselves.

Post-designation changes. A counterparty that was clean at the time of contracting can become blocked mid-contract if a shareholder is subsequently designated and the combined listed-person stake now crosses fifty percent. OFAC does not grandfather existing contracts. The obligation to screen is ongoing, not transactional. A business that screens only at the point of onboarding but not thereafter may miss exactly this exposure.

Inherited structures in M&A. When a buyer acquires a target with complex subsidiary trees, listed-person ownership may sit at sub-holding levels that the acquisition diligence did not penetrate. The buyer inherits both the asset and any pre-existing blocking analysis failures. Post-close ownership-chain reviews are therefore standard practice in transactions involving businesses with operations or counterparties in higher-risk jurisdictions.

Cryptocurrency and digital-asset holdings complicate the picture further. Blockchain analytics is used by regulators to trace wallet clusters, and a designation can extend to addresses associated with a designated person. Where a counterparty's capitalisation includes digital-asset holdings, wallet-level screening is part of the aggregation analysis, not a separate exercise.

What are the early warning signs that a counterparty's ownership structure warrants deeper scrutiny? Nominee arrangements, multiple layers of holding companies in jurisdictions with limited beneficial-ownership transparency, trust structures where the economic beneficiary is undisclosed, and recent ownership transfers at discount prices are each a signal for a more intensive review.

How is aggregating holdings across several listed persons enforced under OFAC?

OFAC enforcement of the aggregation rule follows the same framework as enforcement of direct SDN-touching violations. Civil penalties are assessed per violation under IEEPA on a strict-liability basis: OFAC does not need to prove the business knew a counterparty was blocked through aggregation. Penalties may be substantial, and the statute of limitations applicable to IEEPA violations is extended, meaning OFAC can examine conduct well after the relevant transactions.

The Enforcement Guidelines distinguish between egregious and non-egregious matters and between cases with and without a voluntary self-disclosure. A VSD is a recognised mitigating factor; so is a demonstrated compliance programme with adequate ownership-chain controls. Conversely, a pattern of inadequate screening – including a programme that relied on name-checks without ownership-chain analysis – is an aggravating factor.

OFAC can and does issue civil enforcement actions where the firm involved had no direct knowledge that a counterparty was blocked but had access to ownership information that would have revealed the blocked status had it been properly reviewed. The "we screened the name" position is not by itself a complete control, and it will not insulate a firm from an enforcement action if the information necessary to identify blocking was reasonably available.

Enforcement risk is compounded for foreign financial institutions. US authority allows measures against foreign financial institutions that conduct or facilitate significant transactions for designated persons or specified sectors. Correspondent-account restrictions are a principal consequence. A foreign bank that processes payments for an entity that is blocked through aggregation – even where that bank does not itself access the US financial system directly on those transactions – can face restrictions on its US correspondent relationships. This extraterritorial dimension is a central feature of OFAC's enforcement posture.

The practical lesson for compliance counsel is direct: if an ownership investigation was not thorough at the time of the transaction, the enforcement exposure does not diminish with time. OFAC's extended statute of limitations means that a transaction executed years earlier can be revisited. Early internal review – and, where appropriate, voluntary self-disclosure – preserves options that narrow as time passes and as OFAC's own investigations develop.

How the major regimes treat divergent results: managing a multi-regime ownership analysis

A multinational subject to OFAC, OFSI, and EU sanctions simultaneously will sometimes face a result where the three ownership analyses reach different conclusions about the same counterparty. This is not an error. It is a structural feature of how the regimes were designed, and managing it is one of the more demanding tasks in cross-border compliance work.

The starting point is that where a counterparty is blocked under any one of the regimes to which a business is subject, the business must treat it as blocked for the purposes of that regime – regardless of whether the other regimes reach the same result. The stricter prohibition governs. If OFAC's arithmetic test finds blocking and the EU control analysis does not, US-person employees and US-dollar transactions remain prohibited. If the EU control test finds control and the OFAC threshold is not met, EU-regulated business is restricted even if the US side is clear.

Cross-border businesses should maintain a single ownership-chain analysis but apply each regime's test to it independently. The analysis then produces three separate conclusions – one for OFAC purposes, one for OFSI, one for EU – each with its own mitigation steps. Where the conclusions diverge, the compliance team identifies which parts of the planned transaction engage which regime and applies the relevant prohibition to those parts. This is more granular work than a single pass through a screening database, and it requires advice that spans the regimes in question rather than treating each in isolation.

We regularly advise on exactly this multi-regime alignment. For more on how the EU control test operates independently of the arithmetic threshold, see our regime briefing on control beyond the bright line under EU sanctions. For businesses whose ownership structures intersect with BIS-listed entities, see our related service page on affiliate-level restrictions under the BIS Entity List and EAR.

Digital-asset considerations also arise in multi-regime ownership analyses. Where a counterparty holds blockchain-based assets, the aggregation analysis should be read alongside the relevant guidance on blockchain analytics and OFAC screening, since wallet-cluster designations can affect the ownership picture in ways that conventional corporate-records searches do not capture.

The myth that name screening alone is enough to discharge the aggregation obligation is one of the most persistent compliance misconceptions we encounter. It is false. Name screening identifies direct SDN-list matches. It does not calculate the combined ownership position of multiple listed persons across layered holding structures. A firm that relies exclusively on name-screening to clear an ownership analysis is relying on a control that was not designed to answer the question it is being asked.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.