An acquirer based in Frankfurt signs a non-binding letter of intent on a mid-market logistics business headquartered in a third country. The target's ultimate beneficial owner sits behind a chain of holding companies. Two weeks before signing, a routine screening run by the acquirer's compliance team returns a partial name-match against the EU Consolidated Sanctions List. The deal team asks: is the match determinative? Does the target itself become subject to EU asset-freeze obligations even though it is not itself listed? And what liability sits with the acquirer if it proceeds without resolving the question?
EU sanctions due diligence in M&A requires a buyer to verify, before signing and before closing, that no counterparty, target entity, or person in the ownership and control chain is subject to EU asset-freeze or dealing-prohibition measures. The obligation derives from the relevant Council regulations and applies to any person or entity within EU jurisdiction – including non-EU businesses with EU-nexus activities. As of January 2026, the EU has substantially widened criminal-law harmonisation across member states, raising the personal exposure of directors and compliance officers who approve a prohibited transaction.
This briefing sets out who administers the EU regime, the ownership-and-control test that catches unlisted subsidiaries, the due diligence procedure practitioners apply in cross-border M&A, the principal risk flags, and the points at which early legal review preserves options that close with delay.
Who administers EU sanctions and what authority do they carry?
EU sanctions are adopted by the Council of the European Union and give rise to directly applicable obligations across all member states through Council regulations. No single pan-European enforcement body corresponds to OFAC or OFSI. Enforcement falls to the competent authorities of each member state – financial intelligence units, customs agencies, export-licensing offices, and prosecuting authorities, depending on the measure and the member state concerned.
That decentralised structure has practical consequences for an M&A transaction. A buyer incorporated in the Netherlands and acquiring a target with operations in Spain, Poland, and Germany may face the enforcement posture of three separate national authorities, each applying the same regulation but with different investigative traditions, penalty calibrations, and reporting requirements. Coordination between national authorities has improved, but divergence in practice persists.
The EU General Court and, on appeal, the Court of Justice of the European Union hear challenges to designations. A listed person or entity may bring an annulment action. That judicial route is separate from the licensing route and from the compliance obligations that bind the acquirer as third party.
Council decisions set the political basis for each sanctions programme; Council regulations translate those decisions into directly binding legal obligations. In cross-border M&A, it is the regulation – not the Council decision – that creates the prohibition a buyer must navigate. Understanding which regulation, and which programme within it, governs the target's sector and jurisdiction is the first classification step in any diligence exercise.
What does EU law prohibit in relation to a sanctioned party in M&A?
The core prohibition is an asset freeze: where a listed person or entity is the target, or controls or owns the target above the applicable threshold, funds and economic resources must not be made available to that person or entity, directly or indirectly. Acquiring equity in a target company is, on its face, making funds available to its shareholders. The transaction therefore engages the prohibition from the moment of signing, not merely at closing.
Beyond the asset-freeze prohibition, EU regulations in several programmes impose prohibitions on providing certain services – legal, accounting, consulting, and financial services – to designated parties. An M&A adviser providing financial due diligence to, or working alongside, a sanctioned person may itself breach a services prohibition. The services prohibitions are programme-specific and require assessment against the particular regulation in scope.
The ownership and control test (the EU rule that catches non-listed entities that are owned or controlled by listed persons) is the most operationally demanding element of M&A diligence. Unlike the US approach – where OFAC applies a mechanical 50 percent or more aggregate ownership threshold under the 50 percent rule – the EU test extends to control exercised through means other than majority shareholding. Voting rights, board composition, contractual veto rights, and economic dependency can all constitute control for the purposes of the regulation. An entity owned at 30 percent by a listed person but controlled by that person through a shareholders' agreement may be caught even though the numeric ownership threshold is not met.
This is the point of greatest divergence from the OFAC position, and it is where M&A transactions most frequently encounter unexpected blockage. In our experience, buyers who run only a list-screening exercise against the target's registered shareholders routinely miss control-based exposure. The question is not only who owns the target – but who controls it, and on what documentary basis.
How should the ownership and control analysis be structured in practice?
A structurally sound EU sanctions due diligence exercise in M&A proceeds in four stages, applied iteratively as the ownership chain is mapped.
The first stage is list screening: checking the target's known principals against the EU Consolidated Sanctions List, the UN Consolidated List, and any programme-specific supplementary lists relevant to the target's jurisdiction. Screening must cover natural persons and entities in the ownership chain, not only the target itself. We regularly advise buyers to extend the screening perimeter to the target's top-tier customers and critical suppliers where the transaction involves regulated sectors or dual-use goods.
The second stage is ownership mapping: constructing the beneficial ownership chain to the ultimate beneficial owner, using corporate registry filings, shareholder registers, and, where available, beneficial ownership registers. The EU has made beneficial ownership transparency a legislative priority; buyers operating across the EU can access central registers in many member states. Where registers are incomplete or unavailable, the buyer must rely on representations and contractual warranties – which in turn require careful drafting.
The third stage is the control analysis: examining the governance documents of each entity in the chain – shareholder agreements, articles of association, board resolutions, loan agreements, and any instrument that confers an economic or governance right – to identify whether a listed person exercises control through means other than legal ownership. This is a document-intensive exercise. It cannot be delegated to an automated screening tool.
The fourth stage is risk calibration and decision: assessing the probability that a match is confirmatory, the materiality of the exposure to the transaction, the availability of a specific licence, and the proportionate remedy. Remedies range from restructuring the transaction to excluding the affected entity, to applying to the competent authority for a specific licence authorising the dealing.
A specific licence (a case-by-case authorisation to proceed with an otherwise prohibited transaction) is available under most EU sanctions programmes. Applications are made to the competent national authority of the relevant member state. Processing timelines vary by member state and by the programme in scope; buyers should obtain early indicative guidance from counsel before treating a licence application as a reliable path to closing.
How does the EU position compare with OFAC and OFSI requirements?
Buyers operating across the Atlantic or managing a transaction with UK-nexus exposure face three regimes that overlap in subject matter but diverge in their legal architecture.
OFAC, administered by the US Treasury, applies the 50 percent rule: any entity owned 50 percent or more in the aggregate by persons on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) is itself treated as blocked, regardless of whether it appears on the list. The test is mathematical and does not incorporate a control limb. Secondary-sanctions risk – OFAC's extraterritorial reach over non-US persons transacting in USD or with US-nexus counterparties – adds a further layer for non-US buyers on cross-border deals. Our colleagues advising on OFAC matters regularly encounter EU-based buyers who assume that, because the target is not on the SDN, OFAC is irrelevant; that assumption is wrong wherever there is a US-person or US-dollar nexus.
OFSI, administered by HM Treasury in the United Kingdom, applies an ownership and control test that more closely parallels the EU approach than the OFAC numerical rule. OFSI guidance addresses both direct ownership and indirect control, including control through intermediate companies and through contractual arrangements. Post-Brexit, the UK Consolidated List diverges from the EU list in its composition; a person designated under EU measures is not automatically designated under UK measures, and vice versa. An M&A transaction with UK and EU elements therefore requires two separate list checks and two separate ownership analyses.
For a fuller discussion of the OFAC-specific requirements, see Sanctions due diligence in M&A under OFAC: scope and obligations. For transactions with Japanese-nexus exposure, Sanctions due diligence in M&A under the Japanese regime sets out the authority and the procedural requirements. Where the target is a financial institution or the acquirer routes the transaction through correspondent banking relationships, the implications for de-risking strategies are addressed in our correspondent banking and de-risking service.
The practical lesson for a cross-border acquirer is this: three regimes, three lists, and three ownership tests may all apply to the same deal. Where they diverge, the stricter prohibition governs the ability to proceed. Designing the diligence programme to satisfy the highest applicable standard is the only approach that reliably protects the buyer.
What are the principal risk flags that indicate heightened diligence is needed?
Certain transaction characteristics consistently signal that standard-form list-screening is insufficient and that a full ownership-and-control analysis is required.
Opaque ownership structures are the primary indicator. A target with ultimate beneficial owners resident in a high-risk jurisdiction, a layered holding structure across multiple registrations, or shareholders that are themselves privately held with limited public disclosures requires a document-based analysis beyond registry screening. Beneficial ownership registers, where accessible, are a starting point – not a conclusion.
Sector exposure matters independently of ownership. Targets operating in the energy, financial services, technology, defence-adjacent, and logistics sectors face programme-specific prohibitions – including sector-based or thematic designations – that attach to the activity rather than solely to a named person. A target in one of these sectors may be uncaught by list-screening but constrained by a sectoral measure that affects the buyer's ability to fund expansion, refinance debt, or export goods after closing.
Jurisdictional nexus to a high-risk third country is a third flag. A target whose revenues derive substantially from sales into a jurisdiction subject to a comprehensive EU sanctions programme requires a services-prohibition analysis in addition to an asset-freeze analysis. The buyer should assess not only whether the deal is blocked, but whether the target's existing business model is itself permissible under the regulation that will bind the post-closing combined entity.
Management and board composition can also indicate risk. Where a target's board includes nominees of a major shareholder whose sanctions status has not been fully verified, or where a listed person has recently resigned from a board position, the historical control relationship requires analysis. Resignation from a board does not, of itself, extinguish the control-based exposure for transactions that pre-date the resignation, and representations to the contrary in the target's disclosure should be examined critically.
Finally, prior enforcement history – even in other jurisdictions – elevates the scrutiny that a competent authority is likely to apply to any post-closing dealings. An acquirer that inherits a target with unresolved sanctions-related enquiries may find itself accountable for remediation.
What common misconceptions affect EU M&A sanctions diligence?
The single most common misconception we encounter is that a clean screening result from a commercial database is a sufficient discharge of the diligence obligation. It is not. Commercial screening tools compare against published list data. They do not analyse control structures. They do not capture programme-specific sectoral measures. They do not identify a person who was recently de-listed but whose influence over the target entity persists through contractual means. A clean screening result is the starting point for diligence – not the conclusion of it.
A related misconception is that EU sanctions apply only to targets or counterparties that are themselves listed persons. The ownership and control test means that a clean target with a listed ultimate beneficial owner is itself subject to the asset-freeze obligation. In our cross-border practice, we have assessed transactions where the target entity appeared on no list, the deal team had confirmed that fact, and yet the ultimate beneficial owner – three corporate layers above the target – was designated under the relevant programme. The exposure was real and the closing was delayed while a licence application was prepared.
A third misconception is that the EU and UK lists are identical. They are not. Post-Brexit divergence is documented and material; it grows with each subsequent designation decision. A buyer that verifies EU-list status but does not separately verify UK-list status for a transaction with UK-nexus elements has left a gap in the diligence record.
Finally, some acquirers treat sanctions diligence as a pre-signing obligation only, believing that a clean result at signing is sufficient. EU obligations attach on a continuing basis. If new designations are issued between signing and closing – or between closing and the expiry of any escrow or deferred consideration arrangement – the buyer must re-screen and reassess. The obligation does not close with the deal.
When should a buyer involve external sanctions counsel?
External counsel adds decisive value at three moments in an M&A process.
The first is at the scoping stage, before the due diligence programme is designed. The choice of which registers to search, which corporate-law jurisdictions to examine for control-document production, and which programme-specific sectoral measures to apply requires a legal assessment of the applicable EU regulations. Designing the scope incorrectly at the outset means that findings are incomplete, regardless of the execution quality of the diligence team.
The second moment is on receipt of any match – whether a confirmed hit or a high-confidence partial match. Determining whether a match is determinative under the EU ownership and control test requires legal analysis. It also requires a decision about whether to apply for a specific licence, restructure the transaction, or advise the deal team to withdraw. That decision carries legal liability if made incorrectly and should not be delegated to a compliance function without external legal review.
The third moment is where the transaction involves a jurisdiction subject to a comprehensive EU sanctions programme, or where the target operates in a sector subject to programme-specific service prohibitions. In those situations, the legal analysis extends beyond the ownership structure to the legality of the target's existing business, the implications for post-closing operations, and the buyer's own exposure under the applicable regulation.
The position above covers the standard case. Your facts – the target's jurisdiction, its ownership structure, its sector, and the EU regulations in play – change the analysis materially. Involving counsel before the diligence programme is designed, rather than after a problematic finding is made, consistently produces better outcomes.
If a transaction is already in process and a sanctions-related issue has been identified, an early review can preserve options that narrow with delay. Contact Calder & Vance at info@caldervance.com for a confidential assessment.
Related practices
- Correspondent banking and de-risking – sanctions-driven de-risking analysis for banks and payment firms in cross-border transactions
- Sanctions due diligence in M&A under OFAC – scope, the 50 percent rule, and OFAC procedure for cross-border acquirers
- Sanctions due diligence in M&A under the Japanese regime – authority, obligations, and cross-border comparison for Japan-nexus deals