A private equity fund is three weeks from signing a cross-border acquisition. Its legal team runs the target through a standard KYC screen. One ultimate beneficial owner carries a partial name match against the SDN List (OFAC's list of Specially Designated Nationals and blocked persons). The deal team wants to proceed. The compliance officer wants to stop. Neither is sure what the law actually requires. That uncertainty, multiplied across a complex ownership chain, is exactly where M&A transactions come unstuck on sanctions grounds.
Sanctions due diligence in M&A under OFAC is the process of determining, before signing or closing, whether the target, its owners, its subsidiaries, or its material counterparties are blocked or otherwise subject to a US sanctions prohibition. As of early 2026, OFAC enforces programmes under IEEPA and related statutory authorities that apply to US persons and – through secondary-sanctions mechanisms – to a wide range of non-US transactions. A failure to conduct adequate pre-closing diligence can expose an acquirer to strict-liability civil penalties, disgorgement of deal value, and mandatory disclosure obligations under the applicable regime.
This page explains how the OFAC diligence test works, where it diverges from the parallel UK and EU tests, what the common failure points are, and how Calder & Vance supports transaction teams through each stage of the process.
What does OFAC sanctions diligence in M&A actually require?
OFAC sanctions diligence in M&A requires a systematic review of the target, its ownership chain, its subsidiaries, and its key contractual counterparties against every relevant OFAC list and programme – not just the SDN List. The legal obligation flows from IEEPA and the applicable programme regulations. There is no defined statutory checklist, but OFAC's enforcement posture makes clear that "adequate" diligence is judged against what a reasonable, compliance-oriented acquirer would have done given the facts available.
The practical scope is broader than many deal teams expect. Diligence must cover direct ownership, indirect holdings through intermediate vehicles, and any control rights that could indicate a sanctioned person is the effective economic beneficiary. The 50 percent rule (OFAC's rule treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked) means a target can be a blocked party without any of its own names appearing on a list. That is the gap that standard CDD tools routinely miss.
In our experience, the transactions most likely to generate post-closing exposure are those where diligence stops at the first layer of ownership. Have you traced the full beneficial ownership tree, not just the entities that appear on the face of the cap table?
How does the OFAC ownership test compare with OFSI and EU ownership rules?
The OFAC ownership test is mechanical: if blocked persons own 50 percent or more in the aggregate, the entity is blocked, regardless of management arrangements or the degree of active control exercised. OFSI and the EU operate a different standard that adds a control limb – an entity can be caught even where the listed person's ownership share falls below the fifty-percent threshold, provided that person can exercise dominant control over the entity's decisions.
That divergence has direct M&A consequences. A target that clears the OFAC ownership test may still be caught under OFSI's ownership-and-control analysis if a UK-sanctioned individual sits on the board with effective veto rights. Similarly, the EU standard can capture an entity through indirect contractual or structural control mechanisms that OFAC would not treat as triggering. For a transaction that has a US nexus and a UK or EU nexus simultaneously – and most cross-border M&A does – both analyses must be run in parallel.
Where the analyses diverge, the stricter prohibition governs the conduct of the parties subject to each respective regime. A US acquirer cannot simply accept an EU clearance as a proxy for OFAC compliance. We regularly advise transaction teams that are running a dual-track diligence process, and the sequencing of those tracks – which regime is scoped first, which findings are escalated, and how the results are integrated – is itself a compliance decision.
For parties with UK nexus, our colleagues handling OFSI-specific diligence cover the ownership-and-control test in detail on the M&A sanctions diligence service page for OFSI.
What is the step-by-step diligence process for an M&A transaction under OFAC?
A structured OFAC diligence process for an M&A transaction follows six sequential phases, each with a defined output that feeds the next. The process is designed to surface exposure before signing and to document the steps taken in a form that supports a voluntary self-disclosure or penalty-mitigation argument if issues emerge later.
- Scope definition. Identify the universe of entities and individuals to be screened: target, parent, subsidiaries, and material counterparties with a US nexus. Map the relevant OFAC programmes based on the target's sector, geography, and supply chain.
- List screening. Run all names against the SDN List, the OFAC Non-SDN Consolidated Sanctions List, the Entity List (BIS), and any applicable sectoral sanctions identifiers. Automated tools are a starting point, not a conclusion.
- Ownership analysis. Trace beneficial ownership to the ultimate level, applying the fifty-percent aggregation rule at each tier. Document the ownership percentage held by each natural person and any blocked entity in the chain.
- Control and nexus review. Assess whether any non-listed person exercises control in a manner that could indicate a sanctioned party as the effective beneficiary. Review major contracts for counterparties with exposure to high-risk programmes.
- Secondary-sanctions risk mapping. For non-US entities in the target group, assess exposure to secondary-sanctions risk under the relevant OFAC programme. This step determines whether a non-US subsidiary of the target has ongoing dealings that would create a prohibition for the acquirer post-closing.
- Findings and remediation planning. Document findings in a written diligence memorandum. Identify any items that require a licence, a pre-closing remediation step, a post-closing covenant, or an escrow mechanism.
The timeline for these steps depends on the ownership complexity of the target and the number of OFAC programmes in scope. Simple targets with concentrated ownership and limited geographic reach can be scoped within a matter of days. Complex, multi-layered structures with exposure to several high-risk sectors require more time and, in our experience, should not be compressed for deal-speed reasons alone.
The position above covers the standard case. Your facts – the target's sector, its geography, the number of ownership tiers, and the regimes in play – change the analysis considerably.
For a scoping discussion, contact Calder & Vance at info@caldervance.com.
Where do M&A transactions most commonly fail the OFAC diligence test?
The most common point of failure in OFAC diligence for M&A is an ownership analysis that stops at the direct shareholders and does not trace indirect holdings through intermediate holding companies, trusts, or fund structures. The fifty-percent aggregation rule operates at every tier of a chain simultaneously, and a blocked interest that is split across two or three intermediate vehicles can reach the threshold in aggregate without appearing to do so at any single level.
Secondary failures cluster around four areas. First, sectoral sanctions: many deal teams screen for list-based exposure but do not assess whether the target's activities or its contractual counterparties fall within a sectoral restriction that prohibits new investment or debt arrangements without a licence. Second, successor-entity liability: where the acquirer is a US person and the target has conducted prohibited transactions before signing, the acquirer may inherit that exposure. OFAC's guidance makes clear that successor liability is a live risk in acquisition structures. Third, general-licence reliance: some transactions proceed on the assumption that a general licence covers the activity without a proper analysis of the licence conditions and their applicability to the specific facts. Fourth, post-closing integration: newly acquired subsidiaries with high-risk customer books can create ongoing exposure that was not visible at the time of signing.
A fifth risk is subtler. Have you considered the secondary-sanctions position of the target's non-US subsidiaries? A non-US subsidiary transacting with a party that OFAC has designated may not itself be blocked, but its activity can create a significant exposure for the US parent post-closing.
If a transaction has already been flagged, or if post-closing review has identified a potential issue, an early review preserves options that narrow with time. A VSD (voluntary self-disclosure to a regulator) submitted promptly, before OFAC initiates an inquiry, is treated as a significant mitigating factor in the penalty calculus. The window in which a VSD produces its maximum mitigating effect is short.
Contact us at info@caldervance.com for a confidential review of a potential compliance issue.
How does secondary-sanctions risk affect M&A transactions with a non-US dimension?
Secondary-sanctions risk operates differently from primary OFAC exposure and requires a distinct analytical step in cross-border M&A diligence. Primary OFAC sanctions apply directly to US persons and to transactions with a US nexus. Secondary-sanctions mechanisms create the risk that a non-US entity, by conducting certain specified transactions with designated parties, will itself become a target for designation or be cut off from the US financial system.
For an acquirer with a US parent, a non-US subsidiary that has ongoing relationships with parties connected to certain OFAC programmes carries secondary-sanctions risk that transfers on acquisition. The question is not only whether a current dealing is prohibited for the US parent: it is whether the non-US subsidiary's existing and prospective dealings will expose the consolidated group to secondary-sanctions consequences. That analysis requires understanding which programmes have active secondary-sanctions provisions and how OFAC has interpreted the relevant conduct thresholds – which are qualitative rather than mechanical.
In our cross-border practice, we see acquirers underestimate this dimension because their diligence is scoped primarily around the SDN List. The SDN List is necessary but not sufficient. A target that is entirely list-clean can still create a secondary-sanctions problem if its commercial relationships fall within a programme's secondary-sanctions perimeter.
Non-US parties to the same transaction – a European seller, an Asian joint-venture partner – face their own regime analysis under EU, UK, or local rules. The combined exposure across regimes needs to be mapped coherently, not in separate silos. Divergences in the applicable tests, particularly the control limb under OFSI and the EU, can mean that a target is cleared under one regime and problematic under another. The deal structure may need to be adjusted accordingly.
A common misconception: standard KYC is not OFAC diligence
A persistent misconception among deal teams is that a standard KYC or AML screen at the outset of a transaction satisfies the OFAC diligence requirement. It does not. Standard KYC is designed to meet anti-money-laundering obligations and to identify the customer for regulatory purposes. It is not calibrated to the OFAC ownership analysis, the secondary-sanctions risk assessment, or the programme-specific scope questions that are central to a sanctions review.
KYC tools typically screen direct parties. They do not aggregate indirect beneficial ownership positions for purposes of the fifty-percent rule. They do not assess whether the target's counterparties in its ordinary course of business fall within a sectoral restriction. They do not analyse the secondary-sanctions implications of the target's non-US activities. And they do not produce the documented analysis that OFAC would consider in a voluntary self-disclosure or a penalty-mitigation argument.
We have acted for acquirers who relied on a KYC screen completed at the outset of a transaction and discovered, at the post-closing integration stage, a sanctions problem that a proper ownership analysis would have surfaced before signing. The cost of remediation – which can include mandatory reporting, post-closing restructuring, and legal fees – consistently exceeds the cost of proper pre-closing diligence by a significant margin. This is not a compliance formality. It is a deal-value question.
How Calder & Vance supports M&A sanctions diligence under OFAC
Calder & Vance provides OFAC sanctions diligence support for acquirers, sellers, and their financial advisers at every stage of a transaction – from early scoping through to the post-closing compliance covenant review. Our work is structured around the transaction's timeline and ownership complexity, not a standard template.
For a typical acquisition with moderate complexity, our team will assess eligibility for any applicable general-licence or specific-licence pathways, screen the target and its ownership chain across the relevant OFAC programmes and list databases, conduct the fifty-percent aggregation analysis at each beneficial-ownership tier, map secondary-sanctions exposure for non-US subsidiaries, prepare a written diligence memorandum suitable for board or investment-committee presentation, and advise on any remediation steps, licence applications, or contractual protections required before or after closing.
In a recent matter, a logistics-sector acquirer identified a partial name match on a target shareholder during pre-signing diligence. We conducted the full ownership and aggregation analysis, confirmed that the match was a false positive, documented the conclusion in a form that could be produced to a regulator if required, and provided the deal team with a clear compliance sign-off in time for the scheduled signing. The process did not delay the transaction.
Where a genuine exposure is identified, we advise on the options – which may include a pre-closing restructuring of the target's ownership, a specific-licence application to OFAC, a post-closing wind-down covenant for non-compliant activities, or, in some cases, a recommendation not to proceed on the current terms. We do not assess these options as academic alternatives: we advise on the realistic timeline and risk profile of each, so the deal team can make an informed decision.
Related practices
- Correspondent banking and de-risking under OFAC – sanctions risk management for financial institutions with cross-border payment exposure
- M&A sanctions diligence under OFSI – ownership-and-control analysis and diligence support under the UK financial-sanctions regime
- M&A sanctions diligence under OFSI: extended service – detailed OFSI diligence and licensing support for complex cross-border acquisitions