Insurers and card networks in the sanctions perimeter under OFSI: explained

An insurer discovers mid-policy that its reinsurer's parent sits on the UK Consolidated List. A card network's processor settles a transaction for a merchant whose majority shareholder was designated three weeks earlier. In both cases, the sanctioned nexus was not the direct counterparty – it was one step removed. Yet both firms may have made funds or economic resources available to a designated person, and under the UK financial-sanctions regime (the body of prohibitions administered by the Office of Financial Sanctions Implementation, or OFSI, under the Sanctions and Anti-Money Laundering Act 2018 and the relevant thematic regulations) that is enough to constitute a breach.

As of January 2026, OFSI's sanctions perimeter extends well beyond the named entity on a screening list. The ownership-and-control test (the UK rule that catches a non-listed company when a designated person owns or controls it) and the prohibition on making funds or economic resources available directly or indirectly to or for the benefit of a designated person together mean that insurers and card networks face exposure through their policyholders, merchants, and correspondent relationships even where those parties are not themselves listed. The regime is strict-liability: knowledge and intent are not required for a civil penalty to attach, as confirmed in OFSI's enforcement powers in force since 2022.

This briefing sets out the obligations that bite hardest for insurers and payment-card businesses, explains how the ownership-and-control test operates across the UK, EU, and US regimes, identifies the risk flags that name screening alone misses, and describes when OFSI's reporting and record-keeping obligations are triggered.

What obligations fall on insurers and card networks under OFSI?

Insurers and card-network operators are subject to the same general prohibitions as any other person or body operating in the UK: they must not deal with the funds or economic resources of a designated person, must not make funds or economic resources available to or for the benefit of a designated person (directly or indirectly), and must not facilitate another person's breach. These prohibitions arise under the relevant thematic sanctions regulations made under SAMLA and are directly applicable to all persons within the UK, all UK persons wherever they operate, and all legal entities incorporated under UK law.

For insurers, the operative question is whether a premium payment, a claim settlement, or a reinsurance recovery constitutes making funds available. In our experience, each of these flows can engage the prohibition depending on the route the money takes and whether a designated person sits anywhere on that route as beneficial owner, controlling party, or named beneficiary. The direct-or-indirect formulation is not a technicality: OFSI reads it to cover multi-step arrangements where the economic benefit ultimately accrues to a designated person even if that person is not the immediate recipient.

For card networks, the equivalent question arises at authorisation and settlement. A card-network operator that authorises a transaction for a merchant, then settles the gross proceeds into an account, may be making funds available where the merchant or its beneficial owner is a designated person. Networks that rely solely on name screening at merchant onboarding – and do not screen beneficiaries, beneficial owners, or account holders at point of settlement – routinely underestimate this exposure. Have you stress-tested your settlement flow against the ownership chain of your largest merchant portfolios?

How does the OFSI ownership-and-control test work?

A non-listed company is caught by the UK asset-freeze when a designated person owns or controls it. Ownership in this context means holding more than 50 percent of the shares or voting rights; control (the broader limb) means the right to appoint or remove a majority of the board, or any other basis on which a designated person can materially direct the affairs of the entity. The control test is the UK's departure from the purely mechanical US position, and it is the limb that causes most enforcement exposure for insurers and card networks.

UK case law distinguishes existing influence from a hypothetical ability to exert control. The leading authorities hold that control must be actual, not theoretical. This matters in practice: a minority shareholder with contractual veto rights over material decisions may fall within the control test even without a majority stake, whereas a majority shareholder who has ceded operational authority to independent management may not. Assessing this requires looking beyond the corporate register to shareholder agreements, board composition, and the reality of how decisions are made.

The EU control test is analytically similar: it looks at ownership of more than 50 percent and at a broader control criterion, and EU courts have held that control must be proved by objective and sufficiently weighty evidence. The US position under OFAC's 50 percent rule is narrower – it is a direct ownership threshold applied mechanically, without a parallel control limb – though updated US guidance treats the threshold as a floor rather than a ceiling and looks past legal form to the practical and economic reality of a transaction. Where both UK and US obligations apply (as they will for a UK insurer with US counterparties or US-dollar flows), the stricter prohibition governs; a firm must satisfy both tests, not the more permissive one.

Why name screening alone fails the OFSI standard

A common and costly misunderstanding is that running counterparty names against a consolidated screening list satisfies a firm's OFSI obligations. It does not. OFSI's regime requires a firm to know whether the economic benefit of a transaction accrues to a designated person, directly or indirectly, and that question cannot be answered by a single-pass name check of the immediate contractual party.

The gaps that name screening misses fall into four categories. First, beneficial ownership: a merchant or policyholder may be an unlisted company majority-owned by a designated person. The listed name appears nowhere in the transaction documentation, but the economic resource flows to it. Second, control without majority ownership: a designated person holding a minority stake but controlling the board is caught by the UK control test, not by the ownership threshold, and typical sanctions-screening tools do not interrogate that layer. Third, layered structures: ownership held through multiple intermediary entities requires aggregation; two designated persons each holding minority stakes may collectively reach the ownership threshold. Fourth, timing: a counterparty clean at onboarding may be acquired by, or come under the control of, a designated person mid-relationship. Periodic rescreening is not optional.

We regularly advise insurers on the practical architecture of their screening programmes, and in our experience the single most common control gap is the absence of a beneficial-ownership screening step at both underwriting and renewal. The second most common gap is failing to screen reinsurance chains: a reinsurer may itself be clean but the cedant may transfer risk to a retrocessionaire that is owned or controlled by a designated person. A screening programme limited to the primary counterparty will not detect that exposure.

What must an insurer or card network do when it identifies a match?

When a relevant firm identifies that it holds frozen funds or that a transaction involves a designated person, two immediate obligations arise. The firm must freeze the assets – meaning it must not deal with them and must not make them available – and it must report the matter to OFSI. Blocked-property reports and information supporting them must be filed promptly; a firm should proceed on the basis that the reporting window is short and should not delay pending internal investigation. Where a transaction has been rejected rather than blocked (for example, where no prior relationship exists and the firm declines to proceed), a rejected-transaction report is similarly required.

OFSI's reporting obligation extends to relevant firms (a category that includes financial institutions and, under the applicable thematic regulations, certain insurers) who know or have reasonable cause to suspect that a counterparty is a designated person or is owned or controlled by one. This is a suspicion-based trigger, not a conviction-standard one. A firm that runs a name match and then files the match away without assessing the ownership chain has not discharged the reporting obligation if the reasonable-cause threshold was met.

Record-keeping obligations run alongside reporting. Sanctions records must be kept for five years. This means that the audit trail of a screening decision – the list version consulted, the ownership-chain analysis conducted, the rationale for a match-or-no-match determination – must be preserved in a form that can be produced to OFSI on request. In our experience, many firms maintain adequate screening records at the point-in-time decision but fail to preserve the list version used, making retrospective review difficult when a later designation covers a counterparty that was screened earlier.

How does OFSI enforce against insurers and card networks?

OFSI may impose monetary penalties on a strict-liability basis: the firm's knowledge of the breach is not required for civil liability to attach, though it affects the penalty level. The maximum civil penalty is the greater of £1,000,000 or 50 percent of the value of the breach, as currently in force – verify the current position before reliance, since revised guidance has been in consultation and the maximum thresholds are subject to ongoing legislative review. OFSI also publishes details of enforcement cases and monetary penalty decisions, creating reputational as well as financial consequences.

Voluntary self-disclosure is a recognised mitigating factor. A firm that identifies a breach, reports it promptly to OFSI, and cooperates fully with the investigation is in a materially better position than one that responds only to OFSI's own enquiries. The mitigating effect of disclosure is not quantified by a fixed formula, but OFSI's enforcement guidance sets out how disclosure, cooperation, and remediation interact with the penalty assessment. An early and well-prepared disclosure – with a root-cause analysis and a credible remediation plan – is consistently treated more favourably than a disclosure that simply acknowledges the facts.

For insurers in particular, there is a second enforcement vector. A claim payment that amounts to a sanctions breach may expose the firm not only to OFSI but also to consequences under professional-liability and regulatory rules in the insurance sector. Card networks face a parallel exposure through their acquiring and issuing bank relationships: a network settlement that involves a designated person may trigger obligations on the acquiring bank as well as on the network itself, and a designation of an insurer can cascade into loss of cover for other participants in the system who rely on that insurer's policies.

Cross-regime considerations: the US and EU dimensions

Insurers and card-network operators with US-dollar flows, US counterparties, or operations within the United States are simultaneously subject to OFAC's sanctions rules. OFAC's reach extends extraterritorially to US persons wherever located, to transactions denominated in US dollars that clear through the US financial system, and to entities incorporated in the United States. For these firms, the OFSI analysis does not displace the OFAC analysis; both apply in parallel and the stricter prohibition governs conduct where the two diverge.

The practical divergence between OFSI and OFAC is sharpest on the control test. OFAC's 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) is a mechanical ownership threshold without a freestanding control limb. OFSI's regime adds the control test, meaning a company that clears the OFAC ownership screen may still be caught under OFSI if a designated person controls it without reaching the ownership threshold. A UK insurer reinsured through a US market cannot assume that OFAC clearance resolves the OFSI position.

EU-regulated firms face a third layer. The EU asset-freeze prohibition, imposed by Council Regulation (directly applicable in member states), extends to making funds or economic resources available directly or indirectly to or for the benefit of listed persons – language substantially equivalent to the UK prohibition. The EU control test mirrors the UK test in its basic structure: ownership of more than 50 percent or a broader control criterion, with EU courts applying an objective and sufficiently weighty evidence standard to the latter. For a multinational insurer operating across EU jurisdictions and the UK, post-Brexit divergence in listings and in the pace of listing updates means that a counterparty delisted in one regime may remain listed in the other; a single consolidated list view is not sufficient.

US secondary-sanctions risk adds a further dimension. Secondary sanctions under OFAC can expose non-US financial institutions that conduct significant transactions for designated persons or specified sectors to correspondent-account restrictions in the United States, regardless of whether those transactions touch US jurisdiction. For a card-network operator with correspondent-banking relationships, this is not a theoretical risk: a pattern of merchant settlements involving persons in a sanctioned sector can trigger secondary-sanctions scrutiny even where each individual transaction appears below a significance threshold.

Risk flags specific to insurers and card-network operators

Certain fact patterns in the insurance and payments sectors are consistently associated with elevated sanctions risk, and recognising them early is the most effective way to prevent a breach rather than manage one.

For insurers: a cedant or reinsurer domiciled in a jurisdiction that applies different sanctions lists from the UK; a policyholder whose beneficial ownership is held through a jurisdiction with opacity rules that limit registry disclosure; a mid-term change of ownership or control of a policyholder; a claim under a marine or aviation policy where the cargo or the aircraft's operational route involves a sanctioned area; and a policy beneficiary who differs from the named insured with no commercial explanation.

For card networks: a merchant onboarded through an aggregator or payment facilitator where the network has limited visibility of the sub-merchant's ultimate beneficial ownership; a sharp change in transaction volume from a merchant in a sector or geography associated with diversion risk; a beneficial owner whose identity was not verified at onboarding because the merchant was treated as low-risk; and a processor or acquiring bank that operates in a jurisdiction whose sanctions list does not align with the UK Consolidated List.

A sharp change in counterparty behaviour – new payment routes, changes to beneficial-ownership filings, requests to restructure settlement flows – is itself a diversion red flag. Indicators of sham transactions under OFAC overlap substantially with the OFSI-facing analysis, and a firm that has conducted that cross-regime review is better placed to detect the pattern under both regimes. Does your compliance programme have a mechanism for flagging behavioural anomalies in existing relationships, or only for screening at the point of onboarding?

When should an insurer or card network involve sanctions counsel?

There are five situations in which prompt involvement of external sanctions counsel is likely to preserve options that diminish with delay.

First, when a potential match is identified and the firm cannot quickly determine whether the counterparty is captured by the ownership-and-control test. The analysis requires legal judgment, not just data retrieval, and an incorrect determination – either a false positive that freezes a clean counterparty or a false negative that allows a breach to continue – has material consequences in both directions.

Second, when a transaction has already closed or a claim has already been paid and the firm identifies a possible sanctions nexus post-execution. The reporting window runs from when the firm has knowledge or reasonable cause to suspect, not from when it achieves certainty. Delay in these circumstances compounds the exposure. We have acted for insurers facing exactly this situation and the consistent lesson is that an immediate privileged review – before any external communication – protects the firm's position most effectively.

Third, when a regulator (OFSI or another UK authority) makes an enquiry. The scope of OFSI's information-gathering powers under SAMLA is broad, and an informal enquiry can foreshadow a formal investigation. Early legal involvement sets the tone and controls the information produced.

Fourth, when a firm is redesigning its compliance programme after an identified control gap. Mapping the ownership-and-control test onto a payment or insurance operating model requires a structured analysis of transaction flows, counterparty categories, and screening architecture that external compliance counsel can carry out systematically.

Fifth, when the firm operates across multiple regimes and needs to reconcile OFSI, OFAC, and EU obligations. Affiliate-level restrictions under export-control rules create an analogous multi-regime analysis challenge, and the methodology for mapping overlapping obligations transfers directly to the sanctions context. Our practice advises multinationals, financial institutions, and exporters on this kind of cross-regime reconciliation as a recurring matter, not an exceptional one.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.