Digital-asset counterparty diligence under OFSI: the essentials

A crypto-asset trading firm based in the United Kingdom agrees terms with an overseas counterparty. The transaction looks straightforward. Then, two hours before settlement, a compliance review flags a wallet cluster linked to a designated person. The deal stops. Losses mount. The question is no longer whether the trade proceeds – it is whether the firm has already breached the UK financial-sanctions regime.

Digital-asset counterparty diligence under OFSI rules is not optional due diligence. It is a legal obligation that sits at the intersection of the UK financial-sanctions regime under the Sanctions and Anti-Money Laundering Act and the rapidly expanding regulatory treatment of crypto-asset businesses. OFSI can impose monetary penalties on a strict-liability basis: no knowledge of a breach is required to incur a penalty. As of January 2026, the maximum civil penalty stands at the greater of £1,000,000 or 50 percent of the value of the breach, with further increases subject to legislation. Firms that treat sanctions screening as an afterthought face not just regulatory exposure but the commercial ruin of a deal that collapses at the eleventh hour.

This briefing follows a digital-asset transaction through its lifecycle – from the moment a counterparty relationship is proposed to the post-settlement reporting obligations that most firms miss – and explains what OFSI requires, where the UK regime diverges from OFAC and the EU, and when the position demands specialist counsel.

What triggers the OFSI digital-asset counterparty diligence obligation?

The obligation is triggered at first contact with the counterparty, not at the point of settlement. OFSI's financial-sanctions regime applies to any person in the United Kingdom, any UK-incorporated entity, and any person who is in, or deals with assets in, the United Kingdom. A crypto-asset service provider (a business that exchanges, transfers, or custodies digital assets, or facilitates related services) is squarely within scope. The trigger is not the specific type of digital asset – it is the relationship with a counterparty and the real or potential movement of funds or economic resources.

In practice this means that the diligence clock starts when a firm receives a counterparty's details, not when it finalises the terms. We regularly advise firms that discover this too late. The question to ask internally is: at what point in our onboarding sequence do we screen, and is that point genuinely before any commitment – contractual or reputational – is made?

OFSI's ownership-and-control test (the UK analogue of OFAC's 50 percent rule) extends the obligation beyond directly listed persons. A non-listed entity that a designated person controls – by virtue of shareholding, voting rights, board appointment, or any other means of directing its affairs – is itself caught. Digital-asset counterparties that operate through layered holding structures, nominee directors, or jurisdiction-hopping intermediate entities present exactly the fact pattern where that test bites hardest.

How does the screening and identification process work through the transaction lifecycle?

Effective digital-asset counterparty diligence is not a single check at onboarding: it is a repeating sequence of controls that runs from pre-trade through to post-settlement. The lifecycle has four distinct stages, and each carries its own OFSI exposure.

Stage one – pre-trade identification. The firm collects the counterparty's legal identity, ultimate beneficial ownership structure, and – critically for digital-asset transactions – the wallet addresses and custodian relationships it will use. This is where blockchain analytics enters the picture. Regulators use blockchain analytics to trace wallet clusters and attribute them to designated persons; a designation can extend to addresses associated with a listed party, even if those addresses are not themselves named. A firm that accepts a wallet address without tracing its history is not screening; it is hoping.

Stage two – pre-settlement review. Before funds or digital assets move, the firm re-runs its checks against the current OFSI Consolidated List and any other applicable lists. OFSI updates its list without notice. A counterparty that was clean at onboarding may not be clean on settlement day. This re-screening step is the single most commonly missed control we see in practice.

Stage three – transaction monitoring. During the life of a continuous trading relationship, the firm monitors for changes in counterparty status and for anomalous patterns – unexplained wallet-address changes, sudden increases in transaction volume, routing through jurisdictions associated with diversion risk. A suspicious transaction is not merely one involving a listed party; it is one where the pattern is inconsistent with the stated purpose of the relationship.

Stage four – post-settlement reporting. If a firm discovers that it has received or transmitted funds or digital assets involving a designated person, it must report to OFSI. Blocked-property reports and related disclosures carry a strict statutory window. Firms should not wait for legal advice to decide whether to report – they should take legal advice immediately on whether the obligation has already arisen, because the clock runs from the point of knowledge, not from the point of a decision to act.

Where does the UK regime diverge from OFAC and the EU?

Understanding the cross-border divergence is essential for any firm that operates across the major regimes. The UK, US, and EU share the same strategic objective – preventing designated persons from accessing the financial system – but the legal tests, institutional machinery, and enforcement postures differ in ways that decide the compliance programme design.

On the ownership test, OFAC's 50 percent rule is mechanical: aggregate ownership of 50 percent or more by one or more blocked persons makes the entity blocked, regardless of control dynamics. The UK test is broader. OFSI looks at ownership above 50 percent and at control by any means. A designated person who holds 40 percent of a counterparty but controls its board may bring that entity within the UK prohibition even though OFAC would not block it. The EU rule is materially similar to the UK position, extending to control and to the direct or indirect availability of economic resources for the benefit of listed persons.

On strict liability, both OFSI and OFAC can impose civil penalties without proof of knowledge or intent. Where the UK and US regimes are in play simultaneously – which is the common position for a firm operating in both markets – the stricter prohibition governs. A transaction that would survive OFAC scrutiny may still fall foul of OFSI if the UK control test captures a counterparty that OFAC does not treat as blocked.

On digital-asset-specific rules, the EU transfer-of-funds regime requires originator and beneficiary information on transfers between crypto-asset service providers regardless of the transaction value: a zero threshold applies. As currently in force, verify before reliance, this creates a data-collection and screening obligation at a lower level of operational granularity than the UK position, which is calibrated by reference to the risk-based approach of the applicable UK AML and financial-sanctions regimes. The practical implication for a cross-border firm is that its EU operations require information on every counterparty transfer, while its UK operations require a risk-assessed approach – but one that must still meet the ownership-and-control standard.

In our cross-border practice, the firms that face the sharpest enforcement exposure are those that build one programme for one regime and then assume it satisfies all others. It does not. The EU and UK requirements are close but not identical; the OFAC requirements are structurally different; and the digital-asset-specific layers add a further dimension that general-purpose sanctions screening tools frequently miss.

What are the principal risk flags in digital-asset counterparty diligence?

Risk flags in digital-asset transactions are different in character from those in conventional financial transactions. The pseudonymous nature of blockchain-based activity means that the paper trail is the on-chain record, not the client-presented document. A firm must learn to read both.

The following patterns, in our experience, consistently precede adverse findings:

• Counterparty wallets that show prior transactions with addresses publicly attributed to designated persons, even where the counterparty itself is not listed.
• Refusal or inability to provide beneficial ownership information to the standard required under the UK AML regime, which is itself a predicate for OFSI compliance.
• Use of anonymising technologies – privacy coins, mixers, or tumbling services – without a credible business rationale. Regulators treat this as a diversion red flag.
• A sharp change in the counterparty's jurisdictional profile: a firm that previously transacted through one wallet address in one jurisdiction and suddenly routes through multiple intermediary addresses in transit jurisdictions associated with diversion risk.
• Inconsistency between stated transaction purpose and the on-chain pattern – for example, a counterparty that claims to be a trading platform but whose wallet activity shows characteristics of a custodian or exchange.
• Counterparty structures that are opaque at the beneficial-owner level and resist standard corporate-registry verification: shell companies, nominee arrangements, or cross-border holding chains that do not resolve to an identifiable natural person.

None of these flags is conclusive on its own. But each one shifts the risk-based assessment and should trigger enhanced due diligence rather than a standard check. The question is not "does this counterparty appear on a list?" but "does this counterparty's profile give us confidence that we are not making funds available to or for the benefit of a designated person?"

What must a firm do when it identifies a potential sanctions issue?

When a firm identifies a potential OFSI issue in a digital-asset transaction, the sequence of actions in the first hours materially affects the firm's ultimate regulatory position. The initial steps must not be rushed into without legal advice, but certain protective actions should be taken immediately, in parallel with taking that advice.

First, the firm must freeze the transaction or asset pending investigation. Moving funds once a potential hit has been identified – even to return them to the counterparty – may itself constitute a prohibited dealing. Digital-asset transactions present a particular hazard here because the technical ease of executing a transaction can outrun the legal assessment of whether it is permissible.

Second, the firm must preserve all records relevant to the counterparty and the transaction. OFSI requires that sanctions records are maintained for five years. This obligation attaches to records of both blocked and rejected transactions. In the digital-asset context, preservation extends to on-chain transaction records, wallet-address data, blockchain analytics reports, and the internal communications that document the decision-making process.

Third, the firm should assess whether a reporting obligation has already been triggered. Relevant firms have a legal obligation to report to OFSI when they know or have reasonable cause to suspect that a designated person is a customer or holds assets with them. This obligation does not turn on a finding of breach; it turns on knowledge or suspicion. In many of the situations we advise on, the reporting obligation is already running by the time the compliance team contacts us.

Fourth, the firm should consider whether a licence application is required or available. OFSI operates a licensing regime with defined grounds for authorising transactions that would otherwise be prohibited. In a digital-asset context, a specific licence may be required to exit a frozen position or to complete an already-executed transaction where the sanctions hit is identified mid-settlement. Timing matters: a licence application made before a decision has crystallised carries more persuasive weight than one made in response to enforcement action.

Is voluntary self-disclosure appropriate? That question is often the most consequential one in an enforcement scenario. Voluntary self-disclosure (a proactive report to the regulator before it becomes aware of the matter through other means) is a recognised mitigating factor in OFSI's enforcement approach. But a disclosure made without adequate legal preparation can inadvertently broaden the scope of the investigation or admit facts that were not in issue. Expert legal advice before any disclosure is not optional.

The objection: "the seller's representations cover the risk"

A widely held view among in-house teams – particularly those structuring digital-asset acquisitions or secondary-market purchases – is that robust contractual representations and warranties from the seller transfer the sanctions risk. They do not.

OFSI's liability is strict. It does not require proof of knowledge or intent. A firm that acquires a digital-asset position linked to a designated person is exposed to enforcement action regardless of what the seller warranted. Contractual indemnities may provide a commercial remedy against the seller, but they do not constitute a defence against OFSI. The regulator's concern is not who bore the risk contractually; it is whether a prohibited transaction occurred.

This myth is particularly dangerous in secondary-market digital-asset transactions, where the buyer may not have direct access to the counterparty's underlying data and relies instead on the seller's due-diligence package. A package prepared by the seller for the seller's purposes is not a substitute for the buyer's own OFSI-compliant diligence. We have acted in matters where a buyer's assumption that the seller's compliance process was adequate led directly to a reportable OFSI position. The lesson is consistent: independent diligence, conducted to the standard the buyer's own obligations require, is the only reliable protection.

When does digital-asset counterparty diligence require specialist counsel?

Not every digital-asset transaction requires a sanctions lawyer. A well-designed screening programme, applied by a trained compliance team to a straightforward counterparty, should handle the standard case. But certain fact patterns consistently exceed what an in-house team can safely manage without specialist support.

Counsel should be involved when the counterparty's beneficial ownership structure is opaque or unresolvable through standard corporate-registry searches. This includes structures involving nominee directors, back-to-back trust arrangements, or beneficial owners in jurisdictions with restricted corporate-transparency regimes. The ownership-and-control test under OFSI requires an assessment that goes beyond the face of the register.

Counsel should be involved when a counterparty is connected – even indirectly – to a jurisdiction subject to comprehensive or thematic sanctions measures, and the connection is not immediately explicable by the stated business purpose. The extraterritorial reach of the US regime means that a UK firm's digital-asset counterparty may create secondary-sanctions risk under OFAC even if the direct transaction is UK-only. The stricter prohibition governs; it is not safe to assess only the UK position in isolation.

Counsel is essential when an OFSI issue has already been identified. At that point the analysis is no longer preventive – it is defensive. The decisions taken in the first 72 hours of an identified OFSI position (what to freeze, what to preserve, whether and how to disclose, whether to apply for a licence) cannot be undone. They set the parameters of the enforcement scenario. Acting without specialist advice in that window is the single most avoidable source of disproportionate regulatory exposure that we see in our practice.

Finally, when a firm is designing or redesigning its compliance programme in response to changed OFSI guidance, a new product launch, or entry into a new digital-asset market segment, independent review of the programme design is worth the cost many times over. A screening logic that works for one asset class or one counterparty type may not work for another. Testing the programme before it is stress-tested by a live sanctions event is the correct sequence.

Related practices

• AIS anomaly indicators – EU service – identifying vessel-tracking anomalies that signal sanctions exposure in cross-border trade
• Ship-to-ship transfer risk under OFSI – how OFSI treats STS transfers and what maritime counterparties must verify

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.