A European private-equity fund signs an exclusivity agreement on a mid-market manufacturing target. Two weeks before closing, an enhanced ownership trace surfaces a minority stake held by a person whose name appears on the EU Consolidated List. The fund's legal team must now answer three questions simultaneously: is the target itself caught by the relevant Council regulation, can the transaction proceed, and what must be disclosed to the competent authority? Every day of delay costs money. Getting the analysis wrong costs more.
Sanctions due diligence in M&A under EU rules requires a structured assessment of whether a target, its owners, or its counterparties are designated under the relevant EU Council regulation or the UN Consolidated List, and whether the proposed transaction would be prohibited or would require prior authorisation. The ownership-and-control test under EU law is not a fixed numerical trigger – it requires an assessment of actual control as well as ownership, which means the analysis is more fact-intensive than the mechanical 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) applied by the US Office of Foreign Assets Control. Transactions that clear the EU test may still be caught by OFAC or the UK Office of Financial Sanctions Implementation, and that cross-regime gap is where deals most often fail at closing.
This page sets out the governing EU regime, the ownership-and-control test, how it compares with the OFAC and OFSI approaches, the practical diligence procedure, the common risk flags, and how Calder & Vance structures an engagement for M&A teams that need a clearance position before signing.
What governs EU sanctions due diligence in M&A transactions?
EU financial sanctions are imposed through Council regulations that have direct effect across all member states without requiring national implementation. The relevant regulations – adopted under the Common Foreign and Security Policy and given legal force under EU treaties – prohibit making funds or economic resources available, directly or indirectly, to designated persons and entities. A share sale, an asset acquisition, or a merger that results in value flowing to or for the benefit of a listed person engages that prohibition.
The administering authority differs from the US model. There is no single EU sanctions agency equivalent to OFAC. Enforcement sits with national competent authorities in each member state – the Bundesbank and relevant federal ministry in Germany, the Banque de France and Direction du Trésor in France, national financial intelligence units and trade ministries elsewhere. This decentralised structure matters for M&A: the competent authority for a licensing or notification question is determined by where the legal entity or the funds are located, not simply where the deal is signed.
The EU General Court and, on further appeal, the Court of Justice of the European Union provide the judicial review route for designation challenges. For M&A purposes, the more immediate forum is the national competent authority, which receives licence applications and issues the authorisations that can permit an otherwise-prohibited transaction to proceed.
As of early 2026, EU sanctions regimes in force span thematic programmes covering proliferation, terrorism, human rights, and country-specific measures. Any of those regimes can be triggered depending on the geographic exposure and business activities of the target. In our practice, the most frequent M&A complications arise where a target has a supply chain or subsidiary in a jurisdiction subject to the relevant country measures, or where a minority shareholder sits on a list maintained under one of the thematic programmes.
How does the EU ownership-and-control test work in practice?
The EU ownership-and-control test – the rule used to determine whether a non-listed entity is caught through a listed person's interest in it – operates on two separate limbs: direct or indirect ownership of more than 50 percent of the entity's proprietary rights, and effective control by a listed person, even where ownership falls below that line. Both limbs must be assessed independently.
The control limb is the harder and more consequential part of the analysis. Control can arise through voting rights, contractual rights, board appointment powers, veto rights over material decisions, or patterns of de facto dominance. It is assessed on the facts, not on a formula. A listed person holding 30 percent of a target but exercising effective control through a shareholders' agreement, a founders' veto, or exclusive operational authority may bring the entire target within the prohibition.
Aggregation is relevant on the ownership side. Where multiple listed persons each hold a sub-50 percent interest in the same target, the EU position is that their holdings should be aggregated for the purpose of the ownership test. In our experience, automated screening tools frequently miss this because they check each listed person against each entity individually rather than summing related holdings. Deals have reached the signing stage with this analysis incomplete.
What makes the EU test meaningfully different from OFAC's approach is the control element. OFAC applies its 50 percent rule mechanically: at or above the threshold, the entity is blocked; below it, ownership alone does not automatically capture the entity (though OFAC may separately designate a controlled entity). The EU rules apply the broader control assessment regardless of the precise ownership figure. OFSI applies a comparable test under the UK regime. For a cross-border deal touching all three regimes, a target with a 35 percent listed-person stake may be clear under OFAC but caught under the EU and UK rules. That divergence must be resolved before the transaction proceeds.
What does a structured EU sanctions diligence process look like?
Effective EU sanctions diligence in M&A follows a defined sequence, not a one-step screening exercise. Each phase produces a documented output that supports the deal team's closing position and, if needed, a licence application or a notification to the competent authority.
The process begins with scope definition. The diligence team identifies which EU Council regulations apply, based on the target's jurisdiction of incorporation, its operational presence, its customer and supplier geography, and the nationality of its shareholders and directors. Where the target has subsidiaries in multiple jurisdictions, the scope must cover each entity in the group, not simply the acquisition vehicle.
The second phase is ownership-and-control mapping. The full ownership chain is traced to the beneficial-owner level using corporate-registry data, the target's shareholder register, and, where available, disclosed financing arrangements. Each natural person and entity in the chain is screened against the EU Consolidated Sanctions List, the UN Consolidated List, and any other list relevant to the applicable regime. Control indicators are then assessed separately: articles of association, shareholders' agreements, board composition, and any related-party agreements that could give a listed person effective authority.
The third phase covers the target's business operations. Sanctions exposure can arise not only from ownership but from a target's own transactions – contracts with designated entities, payment flows through sanctioned jurisdictions, or goods and services supplied under arrangements that would be prohibited post-closing. In our practice, operational exposure is underweighted in many M&A diligence processes that focus solely on ownership.
The fourth phase is the risk assessment and deal-structure analysis. Where a listing or a control risk is identified, the team must assess whether a licence is required, whether an exemption applies, or whether the transaction can be structured so that funds or economic resources do not flow to or for the benefit of the listed person. Where a licence application is needed, the applicable procedure is the national competent authority in the relevant member state; processing times vary and should be built into the deal timetable.
The output of the process is a written diligence memorandum setting out the methodology, the findings, the legal analysis, and the recommended course of action. That document serves the deal team, satisfies the competent authority if it is required to review the matter, and evidences the good-faith compliance effort that is relevant to any enforcement assessment.
How does EU diligence compare with OFAC and OFSI requirements?
A cross-border M&A transaction involving a European buyer, a target with US-dollar payment flows, and a shareholder with connections to a designated jurisdiction will be examined under at least three independent regimes. Understanding where they converge and where they conflict is essential before the deal team decides on a closing structure.
On the ownership test, OFAC's 50 percent rule is the most mechanical. If blocked persons own 50 percent or more in the aggregate, the entity is treated as blocked regardless of control indicators. Below that line, OFAC does not automatically extend the prohibition by ownership alone, though control can be relevant to OFAC's designation decisions. The EU and UK (OFSI) tests both extend to control, making them broader in scope where a listed person holds a minority stake but exercises effective authority.
On licensing and authorisation, the three regimes operate differently. OFAC licensing is centralised – applications go to OFAC in Washington and are subject to its review standards. OFSI licensing is handled by the Office of Financial Sanctions Implementation in London. EU licensing is decentralised, with applications directed to the national competent authority in the relevant member state; the standards and processing times differ across member states, and there is no single EU licensing window for a transaction that spans multiple member states.
Secondary-sanctions risk adds a further dimension for non-US parties. US secondary sanctions – measures that can restrict non-US entities' access to the US financial system on the basis of conduct that does not necessarily involve US persons, territory, or currency – can apply to a European acquirer's transaction even where there is no direct US nexus. In our experience, this is the risk most frequently underestimated by European M&A teams that focus exclusively on the EU Council regulation applicable to the target. A transaction that is lawful under EU rules may still expose the buyer to designation or market-access restrictions under US secondary-sanctions programmes.
Where the target has operations in the United Kingdom post-Brexit, OFSI's regime operates separately from the EU. The two regimes are no longer aligned on all designations, and there are entities on the UK Consolidated List that do not appear on the EU list and vice versa. For any deal with a UK subsidiary or a UK-based shareholder, both lists must be checked independently.
The position above covers the standard multi-regime analysis. Your specific facts – the acquirer's jurisdiction, the target's activities, the ownership chain, and the deal structure – alter the analysis materially. For a preliminary assessment of where the exposure sits in your transaction, contact Calder & Vance at info@caldervance.com.
What are the most common risk flags in EU M&A sanctions diligence?
The risk flags that most frequently complicate or delay EU M&A transactions fall into a small number of recurring patterns, each of which requires a specific analytical response rather than a generic disclosure.
The first is a minority listed-person stake. A seller or existing shareholder appearing on an EU list at a sub-50 percent holding does not automatically block the transaction, but the control analysis must be completed and documented before that conclusion can be reached. In a recent matter, a private-equity acquirer identified a 22 percent stake held by a person on the EU Consolidated List. The ownership test was not triggered. However, a founders' agreement gave that person a veto right over major capital decisions. The control test was engaged. Structuring the transaction required a competent authority analysis and a specific modification to the shareholders' agreement before close.
The second flag is supply-chain and customer exposure. A target that supplies goods or services to entities in a sanctioned jurisdiction, or that receives components from designated suppliers, carries post-closing compliance risk. The acquirer steps into the operational profile of the target and must be in a position to terminate or remediate non-compliant arrangements without breaching other contractual obligations.
The third flag is stale or incomplete KYC data in the target's own records. Where the target has not maintained current ultimate beneficial owner information – a common finding in smaller targets – the diligence team cannot complete the ownership trace without additional investigation. This is not a reason to stop the deal; it is a reason to build time for the enhanced trace into the timetable.
The fourth flag is dual-use goods or technology in the target's product portfolio. An acquisition of a business that manufactures or distributes items subject to EU dual-use export controls adds a parallel compliance obligation to the sanctions analysis. The two regimes interact: an item subject to export licensing may also be subject to end-user controls that engage the sanctions rules where the end-user is designated. The diligence scope should cover both.
A fifth flag – and one that frequently surprises deal teams – is the position of the target's bankers and payment processors. If the target's primary banking relationships are with institutions that have restricted or exited certain correspondent corridors due to sanctions risk (a practice known as de-risking – where a financial institution exits a relationship to avoid sanctions exposure), the acquirer may face post-closing liquidity constraints that were not visible on the face of the balance sheet. Have you confirmed that the target's payment infrastructure will survive the change of control?
If a diligence review has already surfaced a concern, or if a transaction is approaching closing with an unresolved sanctions flag, early specialist engagement preserves more options than a last-minute review. Contact us at info@caldervance.com to discuss the position.
What is the myth about EU sanctions diligence that costs deals?
The most persistent misconception we encounter in M&A practice is that EU sanctions diligence is a screening exercise – run the names through a compliance database, receive a clear result, and proceed. That view is incorrect and, if relied upon, expensive.
Automated screening tools are a necessary starting point. They are not a sufficient conclusion. The EU ownership-and-control test requires a legal assessment of control indicators that no database produces automatically. The aggregation of minority holdings across multiple listed persons requires a manual calculation that the tool cannot perform. The interaction with OFAC secondary-sanctions risk requires a separate analytical step that falls entirely outside the EU-focused screen. And the competent authority analysis – whether a transaction requires a licence, a notification, or a structured modification – requires legal judgment on the specific facts of the deal.
A second myth is that EU diligence is needed only for targets with a direct connection to a sanctioned jurisdiction. In practice, thematic EU sanctions programmes covering human rights, counter-terrorism, and non-proliferation designate individuals and entities across a wide range of jurisdictions. A target with no obvious geographic risk can still have a designated shareholder, a designated customer, or a compliance exposure through its financial institution. The scope of the diligence cannot be determined by geography alone.
In our cross-border practice, we regularly advise deal teams that have received a clear screening result and then discovered a material exposure at a later stage – often after the purchase price has been fixed. Rebuilding the analysis under time pressure, with fewer structural options, is significantly more expensive than designing the diligence correctly at the outset.
How does Calder & Vance structure an M&A sanctions diligence engagement?
Our M&A sanctions diligence practice under the EU regime is structured to produce a clearance-ready analysis within a defined timeline that fits the deal timetable, not around it. We work alongside the transaction's lead M&A counsel and the deal team's internal compliance function, handling the sanctions-specific analysis so that the broader legal team can focus on commercial and corporate matters.
For a standard mid-market acquisition, our engagement covers: scoping the applicable EU Council regulations and any parallel OFSI or OFAC exposure; mapping the ownership and control chain to the ultimate beneficial-owner level; screening all persons and entities in scope against the EU Consolidated List, the UN Consolidated List, and the OFSI and SDN lists where cross-regime exposure is present; assessing control indicators in the shareholders' agreement and constitutional documents; reviewing the target's operational profile for transactional exposure; and producing a written diligence memorandum with a clear risk assessment and recommended next steps.
Where the diligence identifies a licensing requirement, we assess eligibility, prepare and submit the licence application to the national competent authority, and manage the regulator's queries through to a decision. Where the risk is structural rather than licence-based, we advise on the deal modifications needed to ensure the transaction does not make funds or economic resources available to a designated person.
We operate on a fixed-fee basis for defined scope engagements, with a written fee estimate agreed before work begins. For complex group structures or multi-regime transactions, we provide a phased scope so that the deal team can stage expenditure alongside the deal milestones.
Related practices
- Correspondent banking and de-risking under OFAC – sanctions risk assessment for financial institution relationships and correspondent corridors
- Further EU M&A sanctions diligence support – extended coverage for complex group structures and multi-regime transactions
- M&A sanctions diligence under OFAC – US sanctions clearance for cross-border acquisitions involving US persons, dollars, or counterparties