A private equity fund signs a letter of intent to acquire a manufacturing business with operations spanning four continents. The target's ownership structure runs through three holding companies in separate jurisdictions. Two weeks before closing, a compliance review surfaces a minority investor two layers up the chain whose name is a partial match on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons). Does that match block the deal? Does it trigger reporting obligations? Can the acquisition close on the original timetable? These questions are not hypothetical – they arise in cross-border M&A transactions every month.
Sanctions due diligence in M&A under OFAC rules means verifying, before and at closing, that no target entity, beneficial owner, or post-acquisition counterparty is a blocked person or a non-listed entity owned 50 percent or more in the aggregate by blocked persons. The Office of Foreign Assets Control, acting under authority granted by IEEPA and related statutes, treats the acquisition of a blocked entity as itself a prohibited transaction. Failure at due diligence is not a procedural defect – it is a substantive sanctions violation.
As of January 2026, OFAC's enforcement posture toward M&A participants has hardened. This briefing sets out who administers the regime, what the key tests require, where the diligence process tends to fail, and how a business should structure its review before it commits to a transaction.
Who administers OFAC sanctions in M&A transactions?
OFAC administers US economic sanctions under authority delegated by the President through IEEPA and, for certain programmes, through the Trading with the Enemy Act. Its jurisdiction reaches US persons wherever they are located, transactions that touch the US financial system, and, under certain programmes, non-US persons acting outside the United States. That extraterritorial reach is what makes OFAC relevant to a European acquirer buying a non-US target: if any part of the transaction – payment, banking, clearing – passes through US correspondent infrastructure, OFAC's rules apply.
For M&A specifically, the prohibition is structural. Acquiring an entity that is blocked, or that is owned 50 percent or more by blocked persons under the 50 percent rule (OFAC's rule treating any entity so owned as itself blocked, even if unlisted), means the acquirer takes on a blocked asset at closing. It does not matter that the target is not named on the SDN List directly. The status follows ownership, not listing.
In our cross-border practice, we regularly advise acquirers whose domestic counsel has confirmed the target is "not on the list" without mapping the ownership chain above it. That analysis is incomplete. OFAC's position is that the unlisted subsidiary of a listed parent is blocked; the obligation is on the transacting party to discover this, not on OFAC to list every intermediate vehicle.
What does OFAC prohibit in M&A contexts?
OFAC's prohibitions in an M&A context fall into three categories: the acquisition itself, the economic benefit flowing from it, and ongoing activities post-closing. Acquiring property in which a blocked person has an interest – including equity, contractual rights, or the proceeds of future trading – is prohibited. Paying the purchase price, even indirectly, constitutes a "transfer" of value to a blocked person if they benefit. And operating the target after closing, if it remains blocked, sustains the violation for the life of the holding.
The regime also reaches deal-adjacent activity. Paying commitment fees, break fees, or milestone payments into an account that benefits a blocked person is a prohibited transaction in its own right. Providing advisory services – legal, financial, accounting – to a blocked person in connection with a transaction is prohibited for US persons. This has implications for deal teams that include US-regulated entities acting as advisers on the buy side or sell side.
What is less understood is the position on general licences (standing authorisations that permit defined categories of transactions without a separate application). Some OFAC programmes issue general licences that cover limited M&A-adjacent activity – winding down positions, for example. These are programme-specific, narrow in scope, and carry expiry provisions. A deal that relies on a general licence must confirm that its specific transaction falls within the terms, because an activity that exceeds a general licence receives no protection from it. We advise clients never to assume a general licence covers a transaction without a careful textual analysis.
The position above covers the standard case. Your facts – the target's ownership chain, the programme in play, the route of funds, the jurisdiction of closing – change the analysis materially.
For an initial review of an M&A transaction's OFAC exposure, contact Calder & Vance at info@caldervance.com.
How does the 50 percent rule operate in an acquisition?
The 50 percent rule is OFAC's most consequential test for M&A practitioners, and it operates as a mathematical aggregation rule applied across all blocked persons simultaneously. If blocked persons collectively own 50 percent or more of an entity – whether directly or through intermediate holding structures – that entity is treated as blocked even though it does not appear on any published list.
Aggregation across multiple blocked persons is the point most frequently misunderstood. Two SDN-listed investors each holding 28 percent of a target company are together at 56 percent. The target is blocked, despite neither investor individually crossing the threshold. Standard screening tools that check only first-tier ownership will not flag this. The diligence team must map all ownership interests and attribute each to any listed holder before aggregating.
Layering compounds the problem. A listed person owning 80 percent of a holding company that in turn owns 60 percent of the target means the listed person holds 48 percent of the target indirectly. That falls below the threshold taken alone. But if the same listed person holds any direct stake in addition, the calculation resets. In our experience, three-tier and four-tier structures – common in private equity, in real estate vehicles, and in trading businesses with multiple founders – require a dedicated ownership mapping exercise rather than a point-in-time sanctions screen.
Post-acquisition, the rule does not disappear. If the acquirer purchases 70 percent of a target and a blocked person retains 30 percent, the target is not automatically blocked on the numbers. But OFAC's control analysis may still capture it if the retained minority gives the blocked person effective control over the entity's decisions. The ownership and control test – the UK and EU standard for whether a non-listed entity is caught through a listed person – reaches the same outcome by a different route, so cross-regime consistency in the diligence workstream matters.
Where does sanctions diligence most commonly fail in M&A?
Diligence failures in M&A sanctions reviews cluster around four recurring patterns. Identifying them before the deal closes is significantly less costly than addressing them after.
The first is reliance on automated screening without a legal overlay. Screening tools match names and identifiers against published lists. They do not apply the 50 percent rule, map indirect ownership, or assess the effect of a control structure. A target that passes a screening run can still be blocked. The screen is a starting point, not a legal conclusion.
The second is incomplete beneficial ownership disclosure by the seller. In competitive processes, sellers may provide the information available at the top of the data room without surface-level probing of underlying holding structures. Buy-side diligence must independently verify ownership through company registry records, corporate filings, and – where available – ultimate beneficial ownership registers, rather than accepting the seller's representation as complete.
The third is timing. Sanctions lists are updated continuously. A clean screen at the start of exclusivity provides no protection if a designation occurs before closing. OFAC designations take immediate effect on publication. Best practice is to re-run a full screen immediately before closing, not to rely on a diligence exercise conducted weeks or months earlier.
The fourth, and perhaps the subtlest, is programme specificity. Not all OFAC sanctions programmes define the prohibitions identically. The rules applicable under one country programme may differ from those under another. A target with investors from multiple jurisdictions may trigger obligations under more than one programme simultaneously, each with different licence structures and different general-licence coverage. A single cross-programme analysis should map each applicable programme separately before combining the conclusions.
How does OFAC's approach compare with OFSI and the EU?
A cross-regime comparison is essential for any M&A transaction with a non-US dimension. Under OFAC, the ownership test is largely mechanical: 50 percent or more aggregated means blocked, regardless of control. That clarity has costs – it captures entities over which a blocked person has no operational influence – but it is at least predictable.
OFSI, the UK's Office of Financial Sanctions Implementation, applies an ownership and control standard. A non-listed entity can be caught if a designated person owns a majority, controls it through contractual or structural means, or directs its activities – even below the 50 percent ownership threshold. In a deal where a designated person holds 35 percent and also holds board veto rights, OFSI's test may capture the target where OFAC's would not. The UK's Sanctions and Anti-Money Laundering Act ("SAMLA") and the thematic regulations made under it provide the governing authority.
The EU operates a broadly similar ownership and control standard under the relevant Council Regulations. One relevant divergence from both OFAC and OFSI is the EU's treatment of subsidiaries: where a designated person controls an entity, each transaction involving that entity requires separate analysis against the specific programme regulation. The EU General Court has, in a number of annulment proceedings, scrutinised whether a designation meets the evidentiary standard required – a consideration relevant to a target whose investor is disputing its listed status.
For a deal team advising on a transaction with US, UK, and EU dimensions, these three tests should be run in parallel. The strictest prohibition governs in practice: where one regime captures the target and another does not, the transaction remains prohibited as a whole if any US person, UK person, or EU person is involved in the relevant leg.
See also our related guidance on correspondent banking and de-risking under OFAC, which addresses how financial institutions handle the payment infrastructure for cross-border deals, and our briefing on maritime sanctions in the Australian regime, relevant where a target's operations include shipping or commodities.
What does an OFAC-standard M&A sanctions diligence review cover?
An OFAC-standard diligence review for an M&A transaction is a structured exercise with five components, each mapped to a distinct sanctions risk.
The first is entity-level screening. Every legal entity in the target group – parent, subsidiaries, joint ventures, material contractual counterparties – is run against the SDN List, the Entity List (BIS's list of parties subject to export-licence requirements, relevant where the target manufactures or trades in controlled goods), and the relevant consolidated lists maintained by OFSI, the EU Council, and the UN Security Council. The screen covers current names and any known historical names or transliterations.
The second is beneficial ownership mapping. This goes above the entity screen. For each entity in the target group, the diligence team reconstructs the full direct and indirect ownership chain to the level of natural persons or listed entities, then applies the 50 percent aggregation test. Where company registries do not provide sufficient depth, corporate filings, fund-level reports, and – where the deal size justifies it – proprietary ownership data sources are used to supplement.
The third is programme-specific prohibition analysis. Once any potentially sensitive ownership or counterparty exposure is identified, the team determines which OFAC programme or programmes are engaged and what the specific prohibitions are. Not every programme blocks the same categories of activity; a target caught under one programme may have a different risk profile than a target caught under another.
The fourth is licence assessment. Where a prohibition is identified, the team assesses whether any general licence covers the intended transaction and, where not, whether a specific licence (a case-by-case authorisation to conduct an otherwise prohibited transaction) can be sought from OFAC. Specific licence applications are made through OFAC's licensing portal. The timeline for review varies by programme complexity and caseload, and should be built into the deal timetable early rather than treated as a closing-week task.
The fifth is representation, covenant, and indemnity structuring. A diligence finding short of an outright block may be managed through deal mechanics: seller representations as to ownership and sanctions status, pre-closing covenants to notify of changes in ownership, and post-closing indemnities against sanctions liabilities arising from pre-closing facts. These are not substitutes for a legal licence where one is required, but they allocate the residual risk between the parties in a defined way.
In a recent matter, a financial-services business conducting a cross-border acquisition identified through our ownership-mapping exercise that a minority investor in the target held interests through a structure that, in aggregate, crossed the 50 percent threshold across the target and two related entities. We assessed eligibility, prepared the licence application package, and managed OFAC's subsequent queries. The matter progressed to a resolution that permitted the parties to restructure the transaction on an adjusted basis, without the acquirer taking a position in the blocked entities. We state this as an example of the range of work; we do not represent it as indicative of any particular outcome.
If a transaction has already been flagged, or a filing has returned an unexpected result, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com.
How is OFAC sanctions non-compliance enforced against M&A participants?
OFAC's enforcement authority in the M&A context extends to every party that engaged in, facilitated, or caused a prohibited transaction. That includes the acquirer, the target, intermediary holding companies, advisers who are US persons, and financial institutions that processed payments. The breadth of potential enforcement subjects is wider than many deal teams anticipate.
Civil penalties under IEEPA have a statutory maximum per-transaction component, and in egregious cases OFAC has levied penalties calculated on the full transaction value rather than a nominal per-count figure. The regulator publishes enforcement guidelines that distinguish between egregious and non-egregious violations, and it weighs aggravating factors – wilfulness, prior history, senior management involvement, harm to sanctions-programme objectives – against mitigating ones, including a VSD (voluntary self-disclosure to a regulator), the strength of the compliance programme, and remedial action taken after discovery.
For M&A participants, the most significant mitigating factor is often the quality of pre-transaction diligence. Where an acquirer can demonstrate that it conducted a structured OFAC review, identified no red flags on the information available, and closed in good faith, that record materially affects how OFAC characterises the violation. Where there is no documented diligence, OFAC has treated the absence of a compliance programme as an aggravating factor in its own right.
A VSD, where there has been a violation, can reduce penalties significantly under OFAC's published guidelines. The decision whether to file a VSD is one of the more consequential judgments in an enforcement matter. It requires a careful assessment of the evidence, the apparent violation, the scope of the exposure, and the likely enforcement trajectory. We advise that this decision should not be taken without counsel who can scope the apparent violation, advise on the voluntary self-disclosure process, and prepare the penalty defence.
Criminal exposure is reserved for wilful violations and is pursued through the Department of Justice. In M&A, criminal referrals have arisen where post-acquisition managers continued to operate a blocked entity with knowledge of the designation. That scenario is preventable with a proper closing-day protocol and post-acquisition integration review.
For export-control dimensions – where the target manufactures controlled goods or has existing BIS licences – see our briefing on BIS and the EAR in maritime and shipping contexts, which addresses parallel export-control obligations that frequently arise alongside OFAC issues in industrial-sector acquisitions.
A common misconception: "if it is not on the list, it is not blocked"
This is the single most persistent misconception we encounter among in-house teams approaching an M&A transaction for the first time. The belief is understandable: OFAC publishes the SDN List and other lists precisely so that businesses can check against them. The implication seems logical: if the target is not named, it is not blocked.
It is incorrect. The 50 percent rule operates independently of listing. An entity is blocked by operation of law from the moment the aggregate ownership threshold is crossed by blocked persons, whether or not OFAC has formally designated it or added it to any published list. OFAC does not guarantee that it will designate every entity that meets the threshold before a transaction closes. The obligation to apply the rule lies with the transacting party.
We also regularly advise clients who have conflated "not on the SDN List" with "cleared for all purposes." The SDN List is one of several lists OFAC maintains. The Sectoral Sanctions Identifications List imposes targeted restrictions on specific transaction types rather than full blocking. The Foreign Sanctions Evaders list and the Non-SDN Iran Sanctions Act list carry separate and distinct consequences. A complete OFAC screen addresses each applicable list for the relevant programme, not only the SDN List.
The practical correction is to treat listing status as a necessary but not sufficient condition for clearance. A diligence exercise that is legally sound under OFAC's own guidance will include the ownership aggregation analysis and the programme-specific list review, not only a match against the SDN List.
Related practices
- Correspondent Banking & De-risking under OFAC – managing payment-infrastructure risk and financial-institution OFAC exposure in cross-border transactions
- Maritime Sanctions: Australian Regime – sanctions obligations for shipping and commodities businesses under the Australian autonomous sanctions regime