A UK-based financial institution is processing a payment for a long-standing trade customer. A compliance officer notices that one of the customer's listed directors appears on the Consolidated List of Financial Sanctions Targets (the UK's unified register of designated persons maintained by His Majesty's Treasury). The question is immediate: does the designation of a director automatically block the company itself? Can the payment proceed? Knowing the answer – and knowing it quickly – is the difference between a clean transaction and a potential enforcement referral to OFSI (the Office of Financial Sanctions Implementation, the UK authority responsible for financial sanctions licensing and enforcement).
As of August 2026, counterparty due diligence under OFSI rules requires any person subject to UK jurisdiction to screen counterparties and their ownership and control structures against the UK Consolidated List before engaging in a financial transaction. The governing instrument is the Sanctions and Anti-Money Laundering Act 2018 (SAMLA), supplemented by the relevant thematic sanctions regulations. Where a counterparty is owned or controlled by a designated person, the prohibition on dealing with funds or economic resources applies as if the counterparty were itself designated.
This briefing sets out who administers the regime, what the ownership and control test requires, how OFSI's position diverges from OFAC's mechanical 50-percent rule, what obligations apply to different sectors, how enforcement works, and when to involve specialist counsel.
Who administers the OFSI regime and what is its legal basis?
OFSI administers UK financial sanctions under SAMLA and under the relevant thematic sanctions regulations made pursuant to that Act. It sits within His Majesty's Treasury and holds the authority to license otherwise prohibited activity, to investigate apparent breaches, and to impose civil monetary penalties. OFSI publishes the UK Consolidated List and issues guidance for regulated sectors. The UK Consolidated List operates independently of the EU and UN lists, although there is substantial overlap in the designated-person population.
The legal basis for the counterparty due diligence obligation is structural rather than prescriptive: SAMLA creates broad asset-freeze prohibitions, and the thematic regulations then apply those prohibitions to specific programmes. There is no single provision that uses the phrase "counterparty due diligence." Instead, the obligation arises because any person who makes funds or economic resources available to a designated person, or to a non-listed entity that a designated person owns or controls, commits the relevant breach. Knowing the status of a counterparty is therefore a precondition to lawful engagement, not an optional enhancement.
In our experience, firms that treat counterparty screening as a one-time onboarding step – rather than a continuous obligation – are the most exposed when a designation is made mid-relationship. OFSI designations can be made with immediate effect, which means a counterparty that was clean at onboarding may not be clean today.
What is the ownership and control test under OFSI?
The ownership and control test under UK sanctions regulations extends the prohibition on dealing with a designated person to any entity that person owns or controls, even if the entity itself is not listed. This is the UK version of the rule that OFAC expresses through the 50-percent aggregate ownership threshold – but the two tests are not the same, and the difference is operationally significant.
Under OFSI, ownership is generally assessed at 50 percent or more of shares or voting rights, consistent with the position under the thematic regulations. But the control limb goes further. An entity may be caught if a designated person holds the right, directly or indirectly, to appoint or remove the majority of the board, or exercises dominant influence over it. This means that a structure in which a designated individual holds a minority stake but retains de facto decision-making power over a company may still fall within the prohibition.
That control analysis is the point where UK diligence genuinely departs from the US position. OFAC's 50-percent rule is mechanical: if aggregate designated-person ownership reaches that threshold, the entity is blocked. OFAC's rule does not routinely ask whether a minority holder controls management. OFSI's regime asks both questions. For a compliance team reviewing a complex corporate structure – a holding company with a minority-stake designated shareholder and a board composition that gives that shareholder veto rights – the UK test produces a different outcome than an OFAC analysis of the same facts.
Does your screening programme capture the control limb, or does it stop at share ownership?
What counterparty due diligence obligations apply across regulated sectors?
The counterparty due diligence obligation under OFSI applies to all persons within its jurisdictional reach, but the intensity of the obligation varies significantly by sector. Financial institutions – banks, payment firms, insurance companies, and increasingly VASPs (virtual-asset service providers) – face the most prescriptive expectations, set out in OFSI's general guidance and in sector-specific publications. Those entities are expected to maintain screening processes that check counterparties, beneficial owners, and controlling persons against the UK Consolidated List in real time or near-real time.
For non-financial businesses – manufacturers, trading companies, professional-service firms – the obligation is identical in law but the operational baseline is less formally prescribed. SAMLA creates no exemption for commercial actors: a manufacturer that ships goods to a company owned or controlled by a designated person may commit an offence if the goods amount to economic resources made available. The obligation to know the status of the counterparty therefore runs across all sectors.
We regularly advise clients in the shipping, energy, and professional-services sectors who have not historically maintained the same screening infrastructure as banks. The risk profile has changed sharply in recent years: OFSI has expanded the designated-person population in several thematic programmes, and the sectoral scope of the relevant prohibitions has broadened. A company that last reviewed its counterparty screening process several years ago is almost certainly operating with an outdated methodology.
Three categories of counterparty data are essential to any adequate diligence process:
- Legal name, registered address, and registration number of the entity itself
- Ownership chain to the ultimate beneficial owner, checked against the UK Consolidated List
- Management and board composition, assessed against both the Consolidated List and the control test
How does OFSI compare with OFAC and EU sanctions on counterparty diligence?
The cross-regime comparison matters because most businesses engaged in international trade face more than one sanctions regime simultaneously. A UK company with US-dollar-denominated transactions, or with US-person involvement in a deal, faces both OFSI and OFAC obligations. A company operating within the EU – or dealing with EU-incorporated counterparties – may face the EU's ownership and control test as well. These regimes do not always produce the same result on the same facts.
On the ownership question, OFAC and OFSI are broadly aligned at 50 percent or more. The divergence is on control. The EU regulations also include a control limb, broadly comparable to OFSI's. The EU test, applied through the relevant Council regulations, looks at the ability of a designated person to exercise a decisive influence over an entity's decisions. The precise formulation differs slightly from OFSI's articulation, but the practical effect is similar: a minority-stake designated person who controls a board can cause the entity to be treated as restricted under EU rules.
The more significant divergence is extraterritorial reach. OFAC's secondary-sanctions architecture extends US sanctions risk to non-US persons transacting with certain designated parties. A UK company that deals with a counterparty subject only to OFSI designation may nonetheless face OFAC secondary-sanctions exposure if that counterparty is also on the SDN List (OFAC's list of Specially Designated Nationals and Blocked Persons) or falls within certain sectoral designations. In our practice, this intersection produces some of the most difficult diligence calls – where the UK law position is one thing and the US exposure is another.
For businesses operating across Singapore, the UAE, or other Asia-Pacific and Gulf jurisdictions, the local regimes add further layers. Singapore's sanctions framework, maintained by the Monetary Authority of Singapore, applies its own ownership thresholds and licensing process. The UAE's framework, coordinated through its Executive Office of Anti-Money Laundering and Counter Terrorism Financing, has moved toward closer alignment with the UN Consolidated List. Neither regime is identical to OFSI. Multi-regime counterparty diligence requires each test to be run independently and the results compared – the stricter prohibition governs.
For a detailed comparison of counterparty diligence obligations in Singapore, see our Counterparty due diligence under Singapore sanctions: scope and obligations. For the UAE framework, see Counterparty due diligence under UAE sanctions: scope and obligations.
What are the key risk flags in OFSI counterparty due diligence?
The most consistent risk flags we identify in OFSI counterparty diligence are structural: they arise from gaps in how firms map ownership chains, assess control, and update their records after a designation event. Specific red flags include the following.
- Layered ownership structures. A designated person holding through multiple intermediate companies may sit below a screening tool's line of sight. Aggregating indirect holdings requires manual investigation or enhanced data sources, not just a list check of the immediate counterparty.
- Stale data. OFSI can add a person to the Consolidated List with immediate effect. A counterparty whose beneficial ownership was verified at onboarding may be captured by a new designation made six months later. Periodic re-screening, calibrated to the risk of the counterparty, is therefore necessary.
- Control without majority ownership. The OFSI control test can be satisfied by contractual rights, articles of association, or governance arrangements that give a designated person decisive influence over a company's decisions, even without a majority stake. A share-register check alone does not answer this question.
- Third-country intermediaries. A transaction routed through a third country may appear clean at the UK-counterparty level but mask exposure at the level of the intermediary or ultimate beneficiary. Diligence should follow the transaction, not just the immediate counterparty.
- Newly designated persons in established relationships. An ongoing commercial relationship does not become automatically lawful just because it was clean at inception. A designation made during a contract's term requires an immediate review and, in some cases, an OFSI licence before any further performance.
What happens if you identify a potential issue mid-transaction? Speed matters. OFSI guidance is clear that a business that discovers it has been dealing with a person it should have screened is not absolved by ignorance, but the steps taken on discovery – including a prompt report and an application for a licence to wind down the position – bear on how OFSI assesses the matter. Delay narrows the options.
How is OFSI counterparty due diligence enforced?
OFSI enforces the financial-sanctions regime through a civil monetary-penalty power and through referrals to other enforcement bodies, including the National Crime Agency. The civil penalty power allows OFSI to impose a penalty on the basis of the balance of probabilities – that is, on a lower evidential standard than criminal proceedings. A business does not need to have intended to breach the sanctions to face a civil penalty; the question is whether it knew or had reasonable cause to suspect it was in breach.
OFSI's enforcement guidance makes clear that the adequacy of a firm's counterparty due diligence process is a relevant factor in how a breach is assessed. A firm that maintained a well-designed screening programme, identified a problem promptly, and reported it to OFSI will generally be assessed differently from one that had no process at all. This is not a guarantee of outcome – OFSI retains discretion in each case – but it reflects the consistent pattern in enforcement outcomes.
The voluntary self-disclosure route (a VSD – a proactive report to OFSI of an apparent breach before OFSI identifies it through other means) is an important tool in enforcement defence. OFSI's published guidance indicates that a VSD is a mitigating factor. The timing and substance of a VSD are critical: an incomplete or delayed disclosure does not produce the same mitigation as a prompt and comprehensive one. We have acted for clients in preparing VSDs, structuring the supporting materials, and managing OFSI's subsequent queries.
Criminal prosecution for the most serious sanctions breaches remains a possibility, handled through the Crown Prosecution Service with referral from OFSI or other agencies. The criminal threshold requires knowledge or intent and carries significantly more serious consequences. For most firms facing a counterparty due diligence failure, the immediate exposure is civil, but the risk of criminal referral in egregious cases cannot be dismissed.
When should a business involve sanctions counsel?
Counterparty diligence questions require specialist counsel at several defined points, not just when something has already gone wrong.
The first trigger is programme design. A compliance programme that has not been calibrated to the OFSI ownership and control test – or that relies on a single commercial screening database without a manual escalation process for complex structures – is not adequate for the current enforcement environment. Counsel can test the logic of the screening architecture, identify gaps in the control-limb analysis, and redesign the programme to a well-tested standard.
The second trigger is a screening hit. When a counterparty search returns a potential match – a name that may or may not be the same person as a listed individual – the decision about whether to proceed requires legal analysis. A false positive produces a lost commercial opportunity; a false negative produces a breach. The analysis of a potential match, particularly where the screening hit relates to an entity rather than an individual, requires a structured assessment of the ownership and control data.
The third trigger is a confirmed problem. If a firm has transacted with a counterparty it now believes was designated at the time, the immediate priorities are: scope the apparent breach, assess whether a VSD is warranted, consider whether an OFSI licence is needed to wind down or continue any element of the relationship, and preserve documents. Each of these steps has a procedural dimension that is easier to manage with specialist support from the outset.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential review.
A common misconception: "We only deal with listed persons, not their subsidiaries"
A persistent myth in counterparty due diligence is that the OFSI prohibition applies only to persons who appear by name on the UK Consolidated List. This reading is wrong. The prohibition extends to entities owned or controlled by a designated person, regardless of whether that entity is itself listed. A company wholly owned by a designated individual is caught by the regime even if it trades under a different name, is incorporated in a third country, and has never been listed. The ownership and control test is not a technicality – it is the primary mechanism by which listed persons are prevented from using corporate structures to access their frozen assets.
We regularly advise clients who have discovered that a counterparty they believed to be unaffected by sanctions is, on analysis of the ownership chain, controlled by a listed person. This discovery is not the end of the relationship in every case: OFSI has a licensing power that permits transactions that would otherwise be prohibited, subject to the applicable licensing grounds. But the discovery of the problem is the first step, and it requires a diligence process designed to ask the right questions.
Related practices
- Compliance audit and testing – Australia – screening-programme assessment and sanctions-audit support for businesses operating under the Australian regime
- Counterparty due diligence under Singapore sanctions – how Singapore's ownership and control framework compares with OFSI and what a cross-border firm must do
- Counterparty due diligence under UAE sanctions – the UAE's framework, its relationship to the UN Consolidated List, and its practical differences from the OFSI regime