A European trading company sources components from a network of tier-two and tier-three suppliers spread across several continents. A routine audit flags that one upstream vendor has indirect links to a party that appears on the EU Consolidated List. The question is not merely whether that vendor is caught. The question is how far the obligation travels up the supply chain – and what the company must do before the next shipment moves.
Supply-chain sanctions mapping under EU rules is the process of tracing each node in a commercial supply chain against EU restrictive measures, applying the ownership and control test (the EU standard for treating a non-listed entity as subject to the same prohibitions as a listed person) at every tier, and documenting the result in a form that satisfies the due-diligence expectation of the relevant Council regulation. As of January 2026, EU restrictive measures cover a broad range of sectors, counterparties, and goods categories. An incomplete map is not a defence against enforcement by national competent authorities.
This briefing covers who administers these obligations, the legal basis, the ownership and control test, how the EU position compares with OFAC and OFSI, the practical procedure for mapping a supply chain, the principal risk flags, and when to involve counsel.
Who administers EU supply-chain sanctions mapping, and what is the legal basis?
EU restrictive measures are adopted by the Council of the European Union through Council regulations, which have direct effect in every member state. Each Council regulation designates persons, entities, and goods subject to prohibitions – asset freeze, funds-and-resources restrictions, import and export bans, and sector-specific measures. National competent authorities in each member state are responsible for licensing, enforcement, and information requests. There is no single EU-level sanctions enforcer equivalent to OFAC: the European Commission provides guidance and co-ordinates between member states, but the enforcement power sits with the member-state authorities.
For supply-chain work, the practical consequence is that a business with operations in France, Germany, and the Netherlands faces three national contact points, each with its own enforcement posture and its own practice on licensing. The Council regulations are uniform; the enforcement texture is not. In our cross-border practice, this divergence is one of the first facts we explain to clients who have assumed that EU sanctions function as a single monolithic regime.
The EU General Court and the Court of Justice of the European Union provide the judicial review route for designated parties challenging a listing. That route is relevant to businesses that discover a supplier or counterparty is listed – the listing may be challengeable, though the process takes time and the prohibition stands during the challenge unless interim relief is granted.
What is the EU ownership and control test, and how does it apply in a supply chain?
Under EU restrictive measures, the ownership and control test determines whether a non-listed entity is caught by the same asset-freeze and funds prohibition as a listed person. The EU standard has two distinct limbs: ownership (a listed person holds more than 50 percent of the proprietary rights of an entity, or holds a majority interest) and control (a listed person can exercise a dominant influence over an entity by other means, for example through board composition, veto rights, or financial dependency).
This is the critical divergence from the US position. Under OFAC's 50 percent rule (the rule that treats an entity as blocked when blocked persons own 50 percent or more in the aggregate), the test is mechanical: count the ownership percentage, and if it reaches the threshold, the entity is blocked. The control limb does not operate in the same way under OFAC.
Under the EU, control can catch an entity even where ownership sits below 50 percent. A listed person with 30 percent ownership plus a board appointment and a veto right over major decisions may be exercising dominant influence. That entity is caught. A supply-chain map that stops at ownership percentages and never examines governance rights will miss this exposure. We regularly advise clients who have invested significant resource in ownership-tracing only to discover that they have not examined the contractual arrangements that confer control.
The OFSI standard in the United Kingdom adds a third layer for cross-border businesses: OFSI applies both an ownership test and a control test, but the precise contours of the control analysis have been elaborated differently in OFSI guidance compared with the EU position. A business with UK and EU operations must satisfy both standards – and the stricter prohibition governs the transaction.
How do you map a supply chain against EU restrictive measures in practice?
Effective supply-chain sanctions mapping under EU rules follows a structured sequence. Each stage must be documented. The documentation itself is part of the defence if a national competent authority later questions the process.
- Define the scope of the chain. Identify every tier of supplier and sub-supplier whose goods or services feed into the end product. For complex manufactured goods, this can extend to five or more tiers. The EU prohibition on making funds and economic resources available to a designated person applies regardless of the commercial distance between the listed party and the contracting entity – there is no safe-harbour simply because the contact is indirect.
- Identify the applicable measures. EU restrictive measures vary significantly across regimes. Sector measures may prohibit transactions in specific goods or services even where no individual person is designated. Confirm which Council regulations apply to each supply-chain relationship, including any goods prohibitions that operate independently of designation status.
- Screen all counterparties and their ownership chains. Screen each supplier against the EU Consolidated List and against any sector-specific prohibitions. Apply the ownership limb of the ownership and control test: trace each supplier's shareholders up to the ultimate beneficial owner and confirm that no listed person holds more than 50 percent in the aggregate, directly or through layers of intermediaries.
- Apply the control analysis. For each relationship where a listed person appears in the ownership structure below the 50 percent threshold, or where the counterparty has disclosed governance arrangements involving a person of concern, assess whether that person exercises dominant influence. Review constitutional documents, shareholder agreements, board composition, and any contractual arrangements that affect decision-making.
- Document the result and date it. The EU expectation is that the assessment is documented and that it is refreshed when the list changes, when there is a change in the ownership or governance of a counterparty, or when the Council adopts a new measure affecting the relevant sector.
- Assess goods and technology prohibitions. In addition to person-based screening, confirm that no goods, technology, or services in the supply chain are subject to sector-specific EU prohibitions. Dual-use controls under EU rules operate alongside financial-sanctions prohibitions and must be mapped separately.
How often should you refresh the map? The EU Consolidated List is updated frequently. A static mapping exercise conducted once at contract signature is not adequate for an ongoing supply relationship. The practical standard we apply with clients is a combination of trigger-based review (any list update in the relevant sector, any news alert involving a counterparty) and periodic scheduled review at a frequency proportionate to the risk profile of the chain.
How does the EU approach compare with OFAC and OFSI?
For a business operating across the Atlantic or between the UK and the EU, the three regimes must be satisfied concurrently, and where they diverge the strictest prohibition governs the position. Three points of practical divergence matter most for supply-chain mapping.
First, the control test. OFAC's 50 percent rule is aggregate-ownership-based and does not formally incorporate a separate control limb of the kind found in the EU and UK regimes. A supply-chain node that is not blocked under OFAC because no blocked person reaches the 50 percent ownership threshold may nonetheless be caught under EU or UK rules through the control analysis. Businesses that run EU and US supply-chain screening in parallel must not assume that an OFAC clear equates to an EU clear.
Second, goods and technology prohibitions. The EU dual-use regime, administered under EU rules on the control of exports of dual-use items, operates alongside the financial-sanctions regime. OFAC sanctions are primarily person- and sector-based; BIS under the EAR applies export controls by reference to the ECCN (Export Control Classification Number under the US Commerce Control List) of the item. A supply chain involving dual-use goods therefore requires both a financial-sanctions screen and an export-control classification review under each applicable jurisdiction. The two exercises are distinct and should not be conflated.
Third, enforcement approach. OFAC publishes its penalty settlements and enforcement guidelines publicly, providing detailed guidance on the factors it weighs. National competent authorities in EU member states vary considerably in their enforcement posture and in the transparency of their published guidance. In our experience, the absence of a published enforcement record from a particular member-state authority does not indicate a lower risk of prosecution – it may reflect differences in the disclosure regime rather than enforcement inactivity.
The position above covers the standard analytical case. Your facts – the specific Council regulations in play, the member states of your operations, the tier structure of your supply chain – change the analysis considerably.
For an initial assessment of your EU supply-chain exposure, contact Calder & Vance at info@caldervance.com.
What are the principal risk flags in EU supply-chain mapping?
Several patterns recur in supply-chain reviews and consistently indicate elevated EU sanctions risk. Recognising them early allows a business to conduct targeted enhanced diligence before a transaction completes, rather than managing a potential violation after the fact.
- Opaque ownership structures. Counterparties with layered holding company arrangements across multiple jurisdictions, particularly those using bearer-share vehicles or nominee arrangements, warrant enhanced scrutiny. The ownership and control test cannot be satisfied where the ownership structure cannot be reliably traced.
- Jurisdiction of incorporation without presence. A supplier incorporated in a jurisdiction with no operational footprint in that jurisdiction may be using the location for purposes that have nothing to do with sanctions – or it may be an indicator of a layering arrangement. Either way, it requires explanation before the screen can be treated as clean.
- Payment routing through third-country financial institutions. Payment instructions that route through banks in jurisdictions with limited sanctions-screening infrastructure, or that change shortly before settlement, are a material risk indicator. A financial institution processing the payment will apply its own screen; if it flags the payment, the commercial disruption can be significant.
- Goods with dual-use potential. Goods that appear in the EU dual-use list, or that are otherwise capable of application in prohibited programmes, trigger both the financial-sanctions screen and a separate export-control analysis. Missing this intersection is a common source of exposure for manufacturers and trading companies.
- Counterparties in sectors subject to sector-specific measures. Several EU restrictive-measures regimes include sector-specific prohibitions that apply regardless of whether any individual person in the supply chain is designated. A counterparty in an affected sector must be assessed against the sector prohibition even if it passes the ownership and control screen clean.
- Change of ownership or governance at a supplier. A supply-chain map that was accurate at contract signature becomes inaccurate if a supplier is subsequently acquired by a person of concern. Ongoing monitoring, not just upfront screening, is required to maintain a reliable position.
If a transaction has already been flagged by a bank, or a national competent authority has made an information request, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com to discuss the position.
A common misconception: the first-tier supplier is the only concern
One persistent assumption in supply-chain compliance is that the EU sanctions obligation reaches only the direct contractual counterparty – the tier-one supplier. This is incorrect, and it is the most consequential error we see in supply-chain due-diligence programmes.
The EU prohibition on making funds and economic resources available to or for the benefit of a designated person applies whenever a payment or goods transfer, at any point in the supply chain, benefits a listed party. A listed party embedded at tier three of a supply chain can receive a benefit – in the form of a sub-contract payment, a licensing royalty, or a supply margin – from a transaction that originates at the contracting entity's level. The fact that the contracting entity does not know the tier-three supplier, and has no direct commercial relationship with it, does not extinguish the prohibition.
This is why the mapping exercise must extend beyond tier one. How far it extends is a risk-based judgment: not every supply chain requires a five-tier trace. The relevant factors are the sectors involved, the jurisdictions of the suppliers, the presence of any person of concern at any tier that has already been identified, and the nature of the goods. We have acted for manufacturers who conducted a tier-one-only screen and subsequently discovered that a tier-two component supplier had a listed person as a controlling shareholder. The position required urgent remediation and a voluntary disclosure assessment. Earlier mapping would have surfaced the issue before the contract was signed.
When should you involve sanctions counsel?
Several circumstances make early instruction of counsel the correct course rather than a precaution that can be deferred.
First, where the ownership structure of a counterparty is complex or partially opaque. The legal analysis of whether a listed person exercises dominant influence over a non-listed entity is not a compliance-tool question – it requires a legal assessment of the facts against the EU standard, documented in a form that can be produced to a national competent authority.
Second, where a goods or technology supply chain touches sectors subject to EU dual-use controls or sector-specific prohibitions. The intersection of the financial-sanctions regime and the export-control regime requires assessment under both sets of rules. Treating them as a single screen is a structural error.
Third, where a supply-chain review surfaces a potential prior exposure – a transaction that has already occurred involving a party that, on further analysis, appears to have been caught by the EU measures at the time. This situation requires a prompt assessment of the apparent violation, the available defences, and whether a voluntary disclosure to the relevant national competent authority is appropriate. The decision on voluntary disclosure is a legal judgment; it is not a compliance administrative decision.
Fourth, where a cross-border supply chain requires simultaneous analysis under EU, UK, and US rules. The three regimes interact, and the result under each must be assessed and documented separately. A business that satisfies itself only on the EU position may still face exposure under OFAC or OFSI.
Related practices
- Correspondent banking and de-risking under OFAC – managing financial-institution sanctions risk in cross-border payment flows
- Supply-chain sanctions mapping under EU: advanced issues – deeper analysis of sector measures, dual-use intersections, and enforcement patterns
- Supply-chain sanctions mapping under OFSI – the UK ownership and control standard and its divergence from the EU position