An international NGO preparing to deliver medical supplies into a conflict-affected territory discovers that its local partner may fall within the scope of a UN Security Council sanctions programme. The shipment is ready. The contract is signed. Does the authorisation regime permit the transfer? What obligations attach once the goods move? These are not theoretical questions – they are the kind that determine whether life-saving operations continue or halt.
Humanitarian and NGO authorisations under UN rules operate through regime-specific derogations adopted by Security Council committees, which permit otherwise-prohibited transactions for qualifying humanitarian purposes. The applicable authorisation is not universal: each UN sanctions programme sets its own scope, procedural requirements, and conditions. Organisations that assume a blanket humanitarian carve-out exists are routinely caught out when the specific programme they are operating under contains no such standing derogation, or attaches conditions they have not met.
This briefing sets out how the UN humanitarian authorisation regime works, who administers it, how the major national implementing regimes treat the same question, and what practical steps organisations must take to operate within the rules. As of June 2026, the UN Consolidated List encompasses multiple active programme-specific committees, each with its own humanitarian derogation posture.
What is the governing authority for humanitarian authorisations under UN sanctions?
The UN Security Council is the primary authority. It adopts resolutions under Chapter VII of the UN Charter that establish sanctions programmes and, where it chooses to do so, build in derogations for humanitarian activities. Those derogations are given operational effect by the relevant sanctions committee – a subsidiary body of the Security Council constituted for each programme. The committee administers the list and handles requests for humanitarian exceptions or standing authorisations.
It is important to understand how authority flows here. The Security Council resolution is the legal basis. The committee is the decision-making body for individual authorisation requests. The UN Secretariat – including the Office for the Coordination of Humanitarian Affairs (OCHA) in certain programmes – may play a facilitation role, but it does not grant authorisations in its own right. Implementing states are then separately required to transpose the obligations into national law, which means the same transaction may require both a UN-level clearance and a domestic licence or notification.
Not every UN programme contains a humanitarian derogation. Where the Security Council has not adopted one, the absence is deliberate. Practitioners cannot simply assume that humanitarian purpose provides an implied exemption. The committee's own guidance – where published – is the controlling document, and we regularly advise organisations to review that guidance at the outset of any new programme entry, before operations begin.
What is the scope of UN humanitarian authorisations?
The scope of any humanitarian authorisation depends entirely on the text of the relevant Security Council resolution and the committee's implementing decisions. There is no single, universal UN humanitarian derogation. That said, common patterns emerge across the programmes where derogations have been adopted.
Typical authorisations cover the supply of food, medicine, medical equipment, and shelter materials. Some programmes extend cover to funds transfers to NGOs for operational expenses in the affected territory. A number of recent programme-specific decisions have also addressed the position of UN agencies operating directly, distinguishing their activities from those of third-party implementing partners – the distinction matters because the authorisation in some programmes is personal to the UN agency and does not automatically extend to its contractors or grantees.
What is the practical scope question a compliance team must answer? It is this: does the specific transaction – the goods, the funds, the service, the counterparty, the destination – fall within the exact text of the committee's authorisation decision, or does it fall outside it and therefore require a specific request? NGOs operating across multiple UN programmes frequently discover that the answer differs from one programme to the next, even when the goods and the counterparty are identical. We have acted for organisations that correctly managed one programme's derogation but failed to seek separate authorisation under a parallel programme applicable to the same territory.
Dual-use goods present a particular difficulty. Where an item could plausibly serve both humanitarian and prohibited purposes – communications equipment is a recurring example – committees have sometimes required enhanced end-use assurances or limited the authorisation to specific UN-affiliated supply chains. Exporters of such goods should not rely on the receiving NGO's humanitarian status as a self-standing clearance.
How does the authorisation procedure work, and how does it compare across OFAC, OFSI, and EU regimes?
At the UN level, the procedure for securing a humanitarian authorisation – where no standing derogation applies – involves a written request to the relevant sanctions committee. The request must identify the organisation, the nature of the activity, the goods or funds involved, and the basis for claiming humanitarian purpose. The committee may approve, reject, or impose conditions. There is no fixed statutory deadline for committee decisions, and timelines vary significantly between programmes and in practice between individual requests.
The cross-border dimension is unavoidable. Most organisations operating in UN-sanctioned territories must satisfy not only the UN committee but also one or more of the national implementing regimes that give the Security Council resolution domestic legal force. Those regimes do not simply adopt the UN authorisation wholesale.
Under OFAC, the US approach to humanitarian activities in UN-sanctioned contexts operates through a combination of general licences (standing authorisations that permit defined categories of transactions without a separate application) and specific licences (case-by-case authorisations). OFAC has in certain programmes published general licences covering NGO humanitarian activities to a defined scope; outside that scope, a specific licence application is required. The US regime applies to US persons and to dollar-denominated transactions, giving it significant extraterritorial reach. An EU-based NGO routing a payment through a US correspondent bank may find itself within OFAC's jurisdiction even if no US person is directly involved.
OFSI, the UK's Office of Financial Sanctions Implementation, similarly administers a licensing regime. Under OFSI, a specific licence (a case-by-case authorisation to conduct an otherwise-prohibited transaction) is the standard route for activities not covered by a general licence. OFSI has published general licences in some UK sanctions programmes that track the UN programme structure, but the UK regime is autonomous following the UK's departure from the EU, and its derogation decisions are not automatically aligned with either the UN committee or OFAC. Organisations operating under OFSI should not assume that a UN committee approval or an OFAC general licence resolves their UK position.
The EU Council regulations implementing UN programmes similarly provide for authorisations by member-state competent authorities. In some programmes, the EU has adopted a humanitarian derogation that broadly mirrors the UN committee's position; in others, the member state's competent authority must consider each request on its merits. The EU's approach also involves the EU Blocking Regulation in a limited set of contexts, though its primary application relates to secondary sanctions rather than humanitarian activities per se.
The practical implication for any cross-border humanitarian operation is that the authorisation matrix is multi-layered: UN committee decision, OFAC position (if US nexus exists), OFSI position (if UK nexus exists), and the relevant EU member-state position. Where those layers do not align – and in our experience they frequently do not – the stricter prohibition governs. Organisations that plan their programmes around the most permissive layer take on significant enforcement risk.
The position above covers the standard case. Your facts – the specific programme, the counterparty, the goods, the payment route, the nationalities of the implementing staff – change the analysis materially.
For an initial assessment of which authorisation layers apply to your programme, contact Calder & Vance at info@caldervance.com.
What obligations attach once an authorisation is in place?
Securing an authorisation is the beginning of the compliance obligation, not the end. Every humanitarian authorisation – whether granted by a UN committee, OFAC, OFSI, or an EU competent authority – attaches conditions that the beneficiary must meet throughout the duration of the permitted activity.
Record-keeping is a universal requirement. Organisations must retain documentation demonstrating that the authorised transaction fell within the scope of the derogation and that the goods or funds reached the intended humanitarian purpose. The applicable retention period varies by regime; practitioners should plan for a minimum of several years and align to the strictest requirement in the matrix of applicable regimes. Where an OFAC nexus exists, record-keeping obligations are particularly detailed.
Reporting is a second consistent obligation. Some committee decisions and national licences require the organisation to notify the relevant authority of completed transactions within a defined window. Failure to report is itself a breach, independent of whether the underlying transaction was substantively compliant. In a number of OFSI enforcement matters known in practice (not specific penalty notices), the breach identified was a reporting failure rather than a prohibited transaction.
End-use monitoring obligations apply where the authorisation covers goods. The organisation must take reasonable steps to verify that goods reach the intended beneficiary and are used for the stated humanitarian purpose. This typically means documentary controls at the point of delivery and, in some programmes, post-delivery reporting. The standard is not absolute certainty – supply-chain conditions in conflict-affected territories make that impossible – but it is a genuine obligation of due care, not a formality.
Diversion risk management is now explicitly addressed in several committee decisions. Organisations must demonstrate that they have assessed the risk of diversion to designated parties and have controls in place to detect and respond to it. This is a substantive compliance obligation, not merely a declaration of intent. We regularly advise implementing organisations on the documentary standards that satisfy this requirement across the relevant implementing regimes.
What are the principal risk flags for NGOs and implementing organisations?
Several risk patterns recur across the programmes where humanitarian authorisations apply. Each represents a point at which a compliant operation can inadvertently move into sanctionable conduct.
The first is reliance on a local partner whose ownership or control chain has not been screened against the UN Consolidated List and the relevant national lists. A foreign NGO may hold a valid authorisation, but if its implementing partner is itself a listed entity or is owned or controlled by a listed person, the transfer of funds or goods to that partner can be prohibited regardless of the NGO's own status. The ownership and control test (the UK and EU test for whether a non-listed entity is caught through a listed person) applies here and can capture entities that do not appear directly on any list.
The second is scope creep. Humanitarian authorisations are specific in their terms. An organisation that begins by delivering food under a food-specific derogation and then transfers funds for salaries, or delivers communications equipment, may move outside the authorisation without realising it. Each material change in the nature of the activity should trigger a fresh analysis of whether it remains within the existing authorisation or requires a separate request.
The third is the payment-route problem. Even where a transaction is substantively authorised, routing a payment through a correspondent bank in a jurisdiction whose implementing regime contains stricter restrictions can trigger a block. Dollar-clearing through US correspondent banks brings OFAC into the analysis. Sterling clearing brings OFSI. This is not a theoretical risk; it is a routine source of transaction delays and, in some cases, enforcement attention in the financial institutions involved.
The fourth is the lapse of authorisation. Humanitarian derogations granted for a defined period must be renewed. Committee decisions are sometimes updated or revoked. Organisations operating on multi-year programmes must maintain a calendar of authorisation expiry dates and renew in advance of expiry, not in response to a transaction being blocked.
If a transaction has already been flagged, or an authorisation has lapsed while operations continued, an early review can preserve options that narrow with time.
For a confidential review of a potential breach or an authorisation gap, contact us at info@caldervance.com.
How is compliance with humanitarian authorisations enforced, and what does enforcement look like in practice?
Enforcement of humanitarian authorisation conditions operates at two levels: the UN committee level and the national-implementing-regime level. The former is concerned with the integrity of the programme and the accuracy of reporting to the committee. The latter is where financial penalties and criminal liability arise.
At the national level, OFAC can impose civil penalties for violations of the terms of a general or specific licence, including for transactions that exceed the scope of a humanitarian derogation. An OFAC civil monetary penalty can be substantial, and the base amount reflects the full value of the transaction rather than any profit. Where OFAC identifies a reporting or record-keeping failure, it treats that as a separate violation. The enforcement posture for humanitarian-sector violations is generally more lenient where the organisation self-discloses promptly, cooperates fully, and demonstrates that remediation is genuine – but this does not mean penalties are waived; it means the penalty calculation takes the conduct into account. VSD (voluntary self-disclosure to a regulator) is a formal mechanism and carries defined procedural consequences under OFAC's enforcement guidelines.
OFSI's enforcement approach similarly distinguishes between cases where an organisation was unaware of a breach and acted promptly on discovery, and cases where a breach was known and unreported. OFSI has the power to impose a monetary penalty and to publish details of the breach. In our experience, the single factor most likely to affect OFSI's enforcement response is the quality and promptness of the organisation's disclosure and the credibility of its remediation plan.
At the EU level, enforcement is the responsibility of member-state competent authorities, and the penalty regime differs between member states. Some member states treat breach of a humanitarian authorisation condition as a criminal matter; others address it through administrative penalties. Organisations with operations across multiple EU member states should not assume that the enforcement standard is uniform.
The UN committee itself does not directly impose financial penalties. Its role is to review compliance with authorisation conditions, to update the list, and to consider revocation of authorisations where conditions have been breached. Revocation of a committee-level authorisation does not, however, release the organisation from national-level enforcement for past conduct.
A common misconception about humanitarian status and automatic authorisation
One misconception we encounter regularly is the belief that registered humanitarian or charitable status – whether under national charity law, UN accreditation, or sector frameworks – automatically confers a sanctions authorisation. It does not.
Humanitarian status in any registration sense is a separate legal category from a sanctions authorisation. The two systems exist independently. A UN-accredited NGO, an ICRC-affiliated organisation, or a nationally registered charity must still identify the specific UN programme in scope, determine whether a humanitarian derogation exists for that programme, confirm that its specific activity falls within the derogation's terms, and – where it operates through a national implementing regime – secure any additional domestic authorisation required. The registration certificate is irrelevant to that analysis.
The myth is understandable. Humanitarian organisations often work in contexts where speed is essential, and the idea that legal status should confer automatic permission is operationally attractive. But the Security Council's sanctions committees and national implementing regulators do not operate on that basis. In our cross-border practice, we have seen organisations with impeccable humanitarian credentials face enforcement attention precisely because they proceeded on the assumption that their status was self-authorising.
Related practices
- Frozen Account Management – BIS and EAR – managing blocked assets and licence pathways under US export-control rules
- Legal Fees Licence under EU Sanctions – scope and procedure for EU legal-fees derogations and the conditions that apply
- Legal Fees Licence under OFAC – how OFAC licences legal-fees payments and what the authorised amounts cover