Control beyond the bright-line ownership test under OFAC: legal support

A multinational closes its standard screening run on a prospective joint-venture partner. No names hit the SDN List (OFAC's list of Specially Designated Nationals and blocked persons). The compliance team signs off. Six weeks later, an external adviser flags that a named shareholder holds a meaningful stake and that a second listed person holds an adjacent interest. Together they cross 50 percent or more in aggregate. The deal was, from day one, a prohibited transaction. The opportunity is now a liability.

The 50 percent rule (OFAC's rule treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked) is the bright line. But OFAC's analysis of control beyond that threshold – looking past legal ownership to the practical and economic reality of a relationship – can capture entities that clear the ownership test on its face. Under the rule set administered by OFAC through IEEPA, a non-listed entity need not be majority-owned by blocked persons to present prohibited-transaction risk; the control inquiry extends to voting rights, board appointment, contractual dominance, and the structural capacity of a listed person to direct material decisions. This is the gap that name-only screening cannot close.

This page explains where the bright-line ownership test ends, what the control analysis adds, how OFSI and the EU approach the same question, and what a business or financial institution should do when an ownership-and-control gap surfaces before – or after – a transaction closes.

Where the bright-line ends: understanding the ownership threshold and its limits

The 50 percent rule is mechanical and does not turn on knowledge or intent. OFAC's guidance under IEEPA holds that any entity owned 50 percent or more in the aggregate by one or more blocked persons is itself blocked, whether or not the entity appears on the SDN List. That position is binary: cross the threshold and the entity is blocked; sit below it and the ownership test alone does not block the entity.

The problem is what sits below the line. OFAC does not treat a sub-50-percent holding by a blocked person as automatically safe. Where a listed person holds a significant minority stake and exercises effective control through other means – shareholder agreements, veto rights over fundamental decisions, exclusive supply or off-take arrangements, or side letters that override the nominal governance documents – OFAC has consistently applied its broader authority to prohibit transactions that benefit the blocked person, even indirectly.

Consider a practical pattern we see frequently. A listed individual holds 35 percent of a holding company. A separate but commonly associated entity holds 18 percent. Neither holding alone breaches the bright-line. Aggregation does not help because the two holders are not confirmed as acting in concert. But the individual has a contractual right to appoint three of five board seats and a veto right over any asset disposal. The economic benefit of the transaction flows to the holding company, which the individual effectively directs. The facilitation prohibition – which bars US persons from facilitating transactions that would be prohibited if done directly by them – catches any US-nexus participant who assists.

As of January 2026, OFAC guidance treats the 50 percent threshold as a floor rather than a ceiling and looks past legal form to the practical and economic reality of a transaction. Any business relying solely on a pass-or-fail ownership count without a control overlay is working with an incomplete picture.

What does the OFAC control analysis actually examine?

The control inquiry examines the range of mechanisms by which a blocked person can direct, limit, or benefit from the activities of an entity, independent of formal ownership percentage. OFAC's position, under IEEPA and the relevant programme regulations, is that US persons are prohibited from dealings that provide a benefit to a blocked person; the route to that benefit – through a nominally unblocked intermediary – does not break the chain.

In practice, the analysis covers several distinct control vectors.

Governance rights are the starting point. Board-seat appointment rights, weighted voting, reserved-matter vetoes, and quorum requirements that give a blocked person effective blocking power over key decisions all constitute relevant control indicators. A blocked person who cannot pass a resolution without consent but whose consent is required for any disposal, financing, or change of business scope exercises meaningful control, regardless of the percentage figure in the share register.

Contractual arrangements deserve at least as much scrutiny as the cap table. Management agreements, licensing arrangements under which a significant royalty or fee flows to a blocked person, exclusive distribution arrangements, and intercompany loan facilities all create economic flows that OFAC regards as benefits to the creditor or fee recipient. We regularly advise on structures in which the listed person's formal stake is modest but the economic architecture of the entity is built around payments to that person. The ownership percentage is almost irrelevant to the prohibition analysis in those cases.

Operational influence – the capacity to appoint key personnel, direct day-to-day management, or control access to critical technology, intellectual property, or infrastructure – rounds out the picture. A blocked person who is the sole holder of a technology licence on which the entity's business depends exercises a form of control that an ownership register will never show.

OFAC's strict liability framework means that an entity that misjudges this analysis faces civil penalties without the regulator needing to prove any intention to evade. The statute of limitations for civil violations under IEEPA and TWEA, as currently in force, has been extended – verify the current position before relying on it. The exposure window is, in any event, longer than most compliance teams assume.

How do OFSI and the EU approach control beyond formal ownership?

Cross-border transactions rarely sit under one regime alone. Any business with a US nexus – a dollar clearing, a US-person counterparty, a US-origin component – must satisfy OFAC. But the same transaction may also fall under OFSI in the United Kingdom and EU Council regulations, and those regimes approach the control question differently.

Under OFSI and the relevant UK thematic regulations, the test looks at both ownership (applying a criterion similar in spirit to OFAC's) and control (the UK and EU test for whether a non-listed entity is caught through a listed person's actual authority over it). UK case law distinguishes existing influence from a hypothetical ability to exert control; the leading authorities hold that control must be actual, not theoretical. A contractual right that has never been exercised and that the counterparty has the practical capacity to resist carries less weight than a right that is being actively used to direct corporate behaviour.

The EU position, under the relevant Council Regulation, uses an ownership criterion of more than 50 percent combined with a control test. An EU General Court ruling of September 2026 held that control must be proved by objective and sufficiently weighty evidence, and that structural features of a political or economic system are not by themselves sufficient proof that a particular person controls a given company. That is a meaningful constraint on listing decisions – but it does not relax the obligations of counterparties who must assess control before transacting.

The practical consequence is that a transaction structured to sit below OFAC's bright-line ownership threshold may still be prohibited under UK and EU rules if actual control by a designated person can be established. Where the stricter prohibition governs, a person subject to both regimes must comply with the more restrictive rule. A control-only analysis that satisfies OFAC may not satisfy OFSI and the EU, and vice versa. In our cross-border practice, we map each regime's control test separately before advising on the transaction's legality.

Singapore, Japan, and the UAE each implement UN Security Council measures through their own national instruments; those regimes generally track the consolidated list rather than imposing autonomous ownership-or-control analysis, but their financial institution obligations can create parallel screening requirements that need separate mapping.

The screening gap: why name-only checks consistently miss the control question

The most persistent compliance myth in this area is that name screening alone is enough to meet the rules. It is not – and the gap between what screening tools report and what the law requires is where sanctions exposure most often originates.

Standard commercial screening tools match names, aliases, and identifiers against published lists. They answer the question: does this exact legal person appear on a sanctions list? The control question is different: does a listed person's influence over this unlisted entity make dealings with it prohibited? No screening tool can answer that question automatically. It requires structured human analysis of governance documents, shareholding data, contractual arrangements, and economic flows.

The pattern of failure follows a predictable sequence. A transaction is screened and passes. It proceeds. A subsequent regulatory review – triggered by a related filing, a correspondent bank query, or an enforcement sweep – surfaces the control relationship. The business or financial institution cannot demonstrate that it applied a control analysis at the time. OFAC's strict-liability framework then operates. The absence of a screening hit is not a defence; it is, at most, an incomplete mitigation.

Sanctions screening obligations attach on a risk basis. OFAC's guidance makes clear that "we screened the name" is not by itself a complete control. A sanctions compliance programme that discharges its obligation on a name-match alone falls short of the five-element standard that OFAC expects a reasonably designed programme to meet. The elements – management commitment, risk assessment, internal controls, testing and auditing, and training – collectively require that the entity know what it owns and controls, not merely what its legal name is.

Where does the gap surface in practice? In our experience, the highest-risk points are mergers and acquisitions (where a target's shareholder register changes meaning if a listed person holds a stake in a selling entity), supply-chain relationships (where a preferred supplier is partly funded by or commercially dependent on a listed entity), and financial transactions involving special-purpose vehicles or holding structures in jurisdictions with limited beneficial-ownership disclosure. Each of these is a scenario where the name-match passes and the control analysis fails.

How does a business address the control gap before it becomes a breach?

Pre-transaction control analysis follows a defined sequence. Getting the sequence right determines whether a business can proceed, restructure, or must decline – and whether, if a problem is identified, it can be managed proactively rather than reactively.

The first step is ownership mapping. This goes beyond the cap table. It traces all direct and indirect holdings, aggregates the positions held by persons acting in concert, and identifies any beneficial owner whose position is obscured by nominee arrangements or bearer instruments. The output is a verified ownership chain, not a screenshot of a company registry. Aggregation is the operative concept: two listed persons each holding a minority stake can together cross the threshold and do.

The second step is governance review. This examines the constitutional documents of the entity – its articles, shareholder agreements, investment agreements, and any side letters – for rights that give a listed person effective control over board composition, reserved matters, or key operational decisions. The question is not whether the right has been exercised but whether it exists and is legally enforceable.

The third step is economic-flow analysis. This maps all material payments, fees, royalties, licensing charges, and loan obligations that flow from the entity to any person identified in step one as a potential blocked person. Facilitation of any payment that benefits a blocked person, even indirectly, is itself prohibited for US persons. The economic architecture of a transaction can therefore block a deal that the governance review cleared.

The fourth step is regime overlay. Applying the OFAC analysis to the entity produces one answer. Applying the OFSI control test and the EU Council Regulation test may produce a different one. The overlay ensures that a transaction is assessed against each applicable regime, and that the most restrictive applicable rule is identified and applied.

Where this analysis identifies a potential control relationship, a business has several options: restructure the transaction to eliminate the benefit flowing to the blocked person, seek a specific licence (a case-by-case authorisation to conduct an otherwise prohibited transaction) from OFAC before proceeding, or decline the transaction and document the decision. If a potential issue surfaces mid-transaction, the analysis shifts from pre-transaction structuring to breach management – and the options narrow.

A voluntary self-disclosure (VSD – voluntary self-disclosure to a regulator) is a recognised mitigating factor under OFAC's Enforcement Guidelines. Where a business completes a control analysis, identifies an apparent violation, and discloses proactively, the enforcement outcome differs materially from one where the violation is identified by the regulator. VSD does not eliminate exposure, but OFAC's framework treats it as one of the strongest mitigating factors. The decision to disclose, and the timing and content of that disclosure, are themselves legal questions that require advice before action.

The position above covers the standard pre-transaction case. Your facts – the counterparty's structure, the nature of the listed person's holding, the regimes in play, and the US-nexus analysis – change the sequence and the risk profile. If a screening hit has already been raised, or a transaction has closed and a control question has since surfaced, an early review preserves options that narrow with time.

For a confidential assessment of your exposure under OFAC, contact Calder & Vance at info@caldervance.com.

Risk flags: when does a control question demand immediate escalation?

Not every sub-50-percent interest by a listed person requires the same response. The risk level is calibrated by the nature of the interest, the structure of the entity, and the US nexus of the proposed transaction. Certain patterns, however, demand immediate escalation to specialist sanctions counsel experienced in OFAC control analysis.

The first risk flag is an unexpected change in ownership structure shortly before or after a transaction closes. A seller who restructures its shareholder register immediately before signing, or a counterparty that introduces a new SPV into the chain at a late stage, warrants a full control review regardless of any prior screen.

The second flag is the presence of a listed person in any capacity beyond passive minority ownership. A listed person who appears as a director, a manager, a key employee, a licensor, or a lender – even where the formal ownership stake is below threshold – places the entity in the control zone regardless of the cap table. The governance and economic-flow questions then dominate.

The third flag is a jurisdiction with limited beneficial-ownership disclosure requirements. Where a counterparty is incorporated in a jurisdiction that does not maintain a public or accessible beneficial-ownership registry, the ownership analysis cannot be completed from public sources. That is a due-diligence gap, not a clean result, and it must be treated accordingly.

The fourth flag is any correspondent-bank or payment-processor query about a transaction involving the counterparty. A de-risking (a financial institution exiting a relationship to avoid sanctions exposure) or a payment delay triggered by a correspondent's screening is an external signal that the control question may already have been identified further up the transaction chain. Ignoring that signal and completing the payment without a control review creates enhanced exposure.

The fifth flag is a sharp change in trade flows to a neighbouring or transit jurisdiction involving the same counterparty group. Where a supplier network reconfigures itself around a third-country intermediary shortly after a designation of a key group member, the transit and anti-circumvention analysis – which treats a sudden diversion of trade flows as a red flag – applies on top of the ownership-and-control review.

For businesses operating across the financial services, advanced manufacturing, or energy sectors, the foreign financial institution exposure framework may create an additional layer of restrictions that operates independently of the entity-specific control question. US authority allows measures against foreign financial institutions that conduct or facilitate significant transactions for designated persons; that analysis runs in parallel and is not resolved by a clean ownership screen.

If a transaction has already been flagged, or a control question has surfaced after closing, an early review can preserve options that narrow with time. For a confidential review of a potential breach or a control-structure question, contact us at info@caldervance.com.

How Calder & Vance supports businesses on the control question

The control analysis is not a box-ticking exercise. It is a structured legal opinion that either clears a transaction, conditions it on restructuring, or surfaces an issue that must be managed before it becomes an enforcement matter. We act for multinationals, financial institutions, and exporters on sanctions and export-control matters across the major regimes.

On the ownership and control question specifically, we test the screening logic, map the ownership and control chain, and redesign the compliance programme to the five-element standard that OFAC expects. Where a transaction requires a pre-clearance view, we prepare a legal memorandum setting out the control analysis across each applicable regime. Where a licence is required, we assess eligibility, prepare and submit the specific-licence application, and manage the regulator's queries throughout the review process.

For businesses that have identified a potential breach through a post-transaction control review, we scope the apparent violation, advise on voluntary self-disclosure, and prepare the penalty defence. The decision whether to disclose and how is not mechanical; it requires a considered assessment of the facts, the enforcement guidelines, and the position across all relevant regimes.

We work across OFAC and BIS in the United States, OFSI and ECJU in the United Kingdom, EU Council regulations, and the applicable national regimes in Switzerland, Canada, Australia, the UAE, Singapore, and Japan. Where multi-jurisdiction matters require local-law input, we work with local counsel in the relevant jurisdiction.

In a recent matter, a financial institution processing a series of structured payments through a correspondent network identified a beneficial owner holding a sub-threshold stake in the ultimate counterparty. Initial screening had passed. We completed a full control analysis, identified a contractual right that gave the beneficial owner effective direction over key operational decisions, and advised on a voluntary disclosure and a transaction restructuring. The matter was managed before it became an enforcement file.

A related issue arises in supply-chain structures where a component manufacturer or distributor is partly funded by or commercially tied to a listed entity. Affiliate-level restrictions under the BIS and EAR affiliate framework can create parallel exposure that a sanctions-only screen will not surface. We advise on both layers and ensure that neither is analysed in isolation.

To discuss a matter, or to stress-test your screening and compliance programme for the control question, reach our team at info@caldervance.com.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.