A private equity fund signs a letter of intent to acquire a manufacturing group with operations across three continents. The target's ownership structure runs through four intermediate holding companies. Two weeks before closing, a mid-tier shareholder appears on a routine screening run. The deal does not close on schedule. Whether it closes at all depends on work that should have started the day the exclusivity period began.
Sanctions due diligence in M&A under OFAC is the structured legal process of identifying, analysing, and managing sanctions exposure in a target before a transaction completes. Under the rules administered by the Office of Foreign Assets Control, an acquirer who completes a deal without adequate diligence can inherit blocked property, assume liability for prior violations, and face civil penalties measured against the full value of the transaction. As of February 2026, OFAC expects acquirers to demonstrate affirmative diligence – not merely the absence of a positive screen hit.
This page sets out what that process requires under the OFAC regime, where it diverges from UK OFSI and EU sanctions rules, and how Calder & Vance supports deal teams from letter of intent through post-closing remediation.
What does OFAC sanctions due diligence in M&A actually cover?
OFAC sanctions diligence in M&A covers five distinct analytical tasks, each capable of producing a standalone deal risk: ownership and control mapping, sanctions-list screening, secondary-sanctions exposure, representations and warranties structuring, and post-closing integration obligations. Treating diligence as a one-step screening exercise is the single most common error we see.
The ownership analysis is the foundation. Under the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked, whether directly or through intermediate layers), the target may be treated as blocked even if it does not appear on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons). Two listed shareholders each holding a minority stake can aggregate above the threshold. A clean screen of the target entity itself is therefore necessary but not sufficient.
Beyond the 50 percent rule, OFAC's general sanctions prohibitions may bar a US person from engaging in any transaction with the target, regardless of ownership, if the target operates in or provides significant revenue to a sanctioned sector or jurisdiction. Deal teams must trace not only who owns the target but what the target does, where it earns revenue, and who its key counterparties are. That analysis requires sector-level OFAC programme review, not just a list check.
The position above covers the standard ownership case. Your facts – the target's industry, its geographic footprint, and the composition of its shareholder base – change the analysis materially. For a scoped assessment of your transaction's OFAC exposure, contact Calder & Vance at info@caldervance.com.
The legal basis: which OFAC programmes govern a cross-border deal?
OFAC administers the major US sanctions programmes under authority granted by the International Emergency Economic Powers Act (IEEPA) and the Trading with the Enemy Act (TWEA), among other statutes. Each programme – whether targeting a particular jurisdiction, sector, or designated person – carries its own prohibitions and general-licence permissions, and the relevant programme determines which transactions require an OFAC specific licence before they can proceed.
For cross-border deals, the critical question is whether the target, any material subsidiary, or any significant counterparty falls within the scope of a sanctions programme that binds US persons. A US person includes not only US-incorporated entities and US citizens, but also non-US branches of US firms and, in some programmes, foreign persons transacting in US-origin goods, technology, or financial services. Deal teams outside the United States frequently underestimate that reach.
A specific licence (a case-by-case authorisation from OFAC to conduct an otherwise prohibited transaction) is sometimes available where a general licence (a standing authorisation permitting a defined category of transactions without a separate application) does not already cover the proposed deal. Licence timelines are not fixed at a specified number of business days in every programme; in our experience, complex transactions involving unlicensed SDN counterparties can take considerably longer than standard commercial timelines allow. Parallel OFSI and EU analysis is essential where the target has UK or European nexus, as those regimes carry their own licensing requirements and do not automatically mirror OFAC's programmes or exceptions.
How the OFAC diligence process works in a live deal
Effective OFAC due diligence in M&A follows a defined sequence, and the sequence matters as much as the substance: risks identified before exclusivity are negotiable; risks identified on the eve of closing become crisis management.
The process runs in four stages. First, a preliminary OFAC risk-scoping assessment at the letter-of-intent stage reviews the target's sector, jurisdiction of operations, and publicly known ownership to identify which OFAC programmes are potentially in play. This takes one to three business days and produces a written risk rating. Second, a full ownership-and-control mapping exercise traces the beneficial ownership chain of the target and each material subsidiary, screens each node against the SDN List and other relevant OFAC lists, and applies the 50 percent rule at each layer. Third, a programme and sanctions-nexus analysis reviews the target's revenue streams, contracts, and counterparty base for exposure to sanctioned jurisdictions, sectors, or persons that would engage OFAC programme prohibitions even absent a list match. Fourth, a representations, warranties, and conditions structuring exercise produces sanctions-specific provisions in the sale-and-purchase agreement, including closing conditions, pre-closing obligations on the seller, and the indemnity package.
In a recent matter, a financial-services business acquiring a payments-technology target discovered during stage-three analysis that a material portion of the target's recurring revenues derived from processing activity with nexus to a programme under active OFAC enforcement. We mapped the exposure, assessed the voluntary self-disclosure options, and restructured the transaction's closing conditions to require prior remediation. The deal closed on amended terms without a licence application. The lesson: programme-nexus analysis at stage three routinely surfaces risks that list-screening alone misses.
If a transaction has already been flagged – by a lender, by a title insurer, or by the target's own compliance counsel – or if a filing has already been refused, an early legal review preserves options that narrow significantly with time. Write to us at info@caldervance.com to arrange that review.
How does OFAC diligence differ from OFSI and EU sanctions due diligence?
OFAC, OFSI, and the EU apply different ownership-and-control tests, and a multi-regime deal requires each analysis to run independently. The assumption that a clean OFAC result clears the deal under UK or EU rules is a significant and recurring error in cross-border transactions.
Under OFAC, the 50 percent rule is mechanical: aggregate blocked-person ownership at or above the threshold is the sole operative test. Control, in the functional sense, is not independently tested by OFAC where ownership is below the threshold. Under OFSI and the EU ownership and control test (the UK and EU regime for determining whether a non-listed entity is caught through a listed person's influence), a target can be caught even where listed-person ownership is below 50 percent, if a designated person exercises effective control. Control can include board appointment rights, veto rights over material decisions, or contractual rights that give the designated person de facto authority over the entity.
The practical divergence is significant. A target that passes the OFAC 50 percent rule may still be caught under the OFSI or EU ownership and control test because of contractual governance rights held by a minority shareholder. In our cross-border practice, we regularly advise on deals where the OFAC analysis cleared but the EU analysis required a licence before completion could proceed. Deal teams that run only one jurisdiction's analysis risk completing a transaction that is prohibited under a regime they did not check.
For targets with a UK sanctions nexus, our colleagues advising on OFSI licensing and OFSI enforcement matters can coordinate the UK analysis in parallel. See also our dedicated guidance on M&A sanctions diligence under OFSI for the UK-specific procedure.
What are the main risk flags in OFAC M&A diligence?
Six risk flags in OFAC M&A diligence consistently generate the most significant exposure: opaque beneficial-ownership structures, majority-minority aggregation at intermediate holding levels, secondary-sanctions nexus in the target's revenue base, legacy contractual relationships with sanctioned counterparties, unresolved apparent violations in the target's prior operations, and jurisdictional misalignment between the deal structure and the applicable OFAC programme.
Opaque ownership is the primary driver of post-closing OFAC exposure. Where the target is incorporated in a jurisdiction with weak beneficial-ownership disclosure, or where nominee arrangements or bearer instruments are in use, standard registry searches do not reveal the ultimate beneficial owners. A full diligence exercise requires direct representations from the seller, supported by certified ownership charts, lien searches, and, in higher-risk transactions, independent verification.
Secondary-sanctions nexus is frequently underestimated in deals involving targets that operate across multiple markets. OFAC's secondary-sanctions provisions – applicable in certain programmes to non-US persons conducting transactions outside US jurisdiction but involving US-designated persons or sanctioned activity – can expose both the acquirer and the target post-closing to enforcement risk, even where neither party is a US person. Have you mapped where the target's revenues originate, and whether those origins carry a secondary-sanctions flag?
Unresolved apparent violations in the target's prior operations represent a distinct category of risk. An acquirer who completes without identifying and addressing a target's prior OFAC apparent violation may assume both the underlying liability and the adverse factor of concealment, if post-closing it appears the violation was known to the seller. A VSD (voluntary self-disclosure to a regulator) filed before or shortly after closing, where appropriate, can substantially affect the penalty calculus. That assessment requires specialist counsel, not general M&A advice.
A common myth: "our screening tool covered it"
The most persistent misconception we encounter at the start of an M&A diligence instruction is that a positive or negative automated screening result resolves the OFAC question. It does not. Automated screening tools are essential; they are not a substitute for legal analysis.
Screening tools check names against lists at a point in time. They do not apply the 50 percent rule across layered ownership structures. They do not assess whether the target's activity falls within an OFAC programme prohibition. They do not identify secondary-sanctions nexus in revenue streams. They do not review representations in the sale-and-purchase agreement, or flag the absence of sanctions conditions precedent in the deal documents. A clean automated screen result can co-exist with a transaction that is prohibited under OFAC, or that will expose the acquirer to civil-penalty risk post-closing.
We regularly advise clients who received a clean automated screen and proceeded to signing, only for a programme-nexus issue to surface during lender due diligence – at which point the deal timeline and the leverage to negotiate remediation had both narrowed substantially. Compliance counsel should be instructed before the data-room opens, not after the board has approved the transaction.
How Calder & Vance supports your OFAC M&A diligence
Calder & Vance provides end-to-end OFAC due diligence support for cross-border M&A transactions, structured around the four-stage process described above. Our work integrates into the deal timetable and produces written deliverables at each stage.
For the ownership-and-control analysis, we screen the target and each material subsidiary against the SDN List and all applicable OFAC programme lists, apply the 50 percent rule at each ownership layer, and produce a written ownership-chain map with a per-entity sanctions status. For the programme and sanctions-nexus review, we identify the OFAC programmes relevant to the target's operations, assess the target's revenue and counterparty base for prohibited-transaction exposure, and advise on the risk rating and on remediation options where exposure is identified. For transaction documentation, we draft sanctions representations and warranties, closing conditions, and seller-covenant obligations, and advise on the indemnity structure appropriate to the risk profile. Where a specific licence is required or a VSD is appropriate, we assess eligibility, prepare and submit the application or disclosure, and manage OFAC's queries through to resolution.
We also coordinate multi-regime diligence where the target has UK or EU sanctions nexus. For the OFSI side of a dual-regime transaction, see our M&A sanctions diligence under OFSI guidance. For the financial-institution-specific dimensions of sanctions exposure in transactional contexts, including correspondent-banking and de-risking considerations, see our page on correspondent banking and de-risking under OFAC.
Related practices
- Correspondent banking and de-risking under OFAC – sanctions exposure for banks and payment firms in transactional relationships
- OFAC M&A sanctions diligence: advanced issues – secondary sanctions, licensing, and post-closing integration
- M&A sanctions diligence under OFSI – UK-parallel analysis for deals with British sanctions exposure
Frequently asked questions: sanctions due diligence in M&A under OFAC
How long does running sanctions diligence in a deal take under OFAC?
A preliminary OFAC risk-scoping assessment for a straightforward bilateral deal can be completed in one to three business days. A full ownership-and-control mapping exercise for a target with multiple jurisdictions and layered intermediaries typically requires one to two weeks, depending on the quality and promptness of seller disclosure. Programme and sanctions-nexus analysis is conducted concurrently. Where a specific-licence application is required, timeline depends on the OFAC programme and complexity; in our experience, deal teams should treat this as a potentially material source of deal delay and build it into the exclusivity period rather than address it at closing.
What are the main risks in sanctions due diligence in M&A under OFAC?
The principal risks are: completing a transaction involving blocked property, which constitutes a prohibited dealing regardless of intent; assuming a target's prior apparent OFAC violations and the associated civil-penalty liability; and triggering secondary-sanctions exposure through the target's existing revenue relationships. A secondary risk category involves insufficient transaction documentation – the absence of sanctions representations, conditions precedent, or indemnities – which limits the acquirer's remedies and may be treated as an aggravating factor in enforcement. Early legal analysis, before signing, is the only reliable mitigation for each category.
Do we need specialist counsel for sanctions due diligence in M&A?
Yes, for any transaction involving a target with cross-border operations, a complex ownership structure, or any operating nexus with a sanctioned jurisdiction or sector. General M&A counsel typically does not conduct the ownership-chain analysis required by the 50 percent rule, assess programme-nexus risk in the target's revenue base, or advise on the voluntary self-disclosure process for apparent violations. Sanctions and export-control counsel should be engaged at letter-of-intent stage and should produce written deliverables that inform both the deal documentation and any post-closing remediation plan. In our practice, the cost of early specialist review is consistently lower than the cost of addressing an identified issue after signing.
About the author
J. M. Aldridge advises multinationals and financial institutions on US sanctions and export controls, with a focus on OFAC licensing, secondary-sanctions risk, and BIS classification. Calder & Vance – International Sanctions & Export Control Counsel.
About Calder & Vance
Calder & Vance is an independent international sanctions and export-control boutique. We advise multinationals, financial institutions, exporters, and individuals on the major regimes – OFAC and BIS in the United States, OFSI and ECJU in the United Kingdom, the EU Council regulations and the EU General Court, the United Nations Consolidated List, and the regimes of Switzerland, Canada, Australia, the UAE, Singapore, and Japan. Our work is limited to lawful compliance, licensing, delisting, enforcement defence, and due diligence. To discuss a matter, contact info@caldervance.com.
Disclaimer: This material is general information, not legal advice, and is not a substitute for advice on your specific facts. Sanctions and export-control rules change frequently and differ by regime; verify the current position before relying on anything stated here. Calder & Vance does not advise on circumventing or evading sanctions. For advice on your situation, contact info@caldervance.com.