Insurers and card networks in the sanctions perimeter under EU: legal support

A European insurer underwrites a marine policy on a vessel that later appears in a port-access restriction list. A card network routes a transaction through an acquiring bank whose ultimate parent has come within the EU asset-freeze perimeter. Neither firm screened for these connections at the point of onboarding. By the time the exposure surfaces, a mandatory reporting window may already be running and remediation options have narrowed. That is the practical cost of a screening gap – and it is the scenario we are asked to help manage regularly.

Insurers and card networks sit squarely within the EU sanctions perimeter as operators who can "make funds or economic resources available, directly or indirectly, to or for the benefit of" a listed person. Under EU Council regulations, both categories of firm are subject to the asset-freeze and making-available prohibition without any knowledge requirement to establish the breach. The legal question is not whether they are covered – they are – but whether the controls they run are designed for the specific exposure pathways that their business models create.

This page sets out the outcomes Calder & Vance delivers for insurers and card-network operators on EU sanctions perimeter questions, the legal tests that govern their exposure, how the EU position compares with OFAC and OFSI, and when to involve specialist counsel before a gap becomes a file.

What outcomes does Calder & Vance deliver for insurers and card networks?

We assist insurers and card networks to reach a defined, defensible position on their EU sanctions exposure – not a generic compliance health-check, but a structured review tied to the specific transaction types, counterparty relationships, and data flows that create perimeter risk for each business model. The outcomes we work toward are: a mapped and prioritised risk picture, revised screening logic that covers entity-level and indirect exposure, a written assessment of current controls against the EU legal standard, and, where a potential breach has been identified, a clear account of the firm's obligations and options.

In our experience, the firms that engage us at this stage have typically run a name-screening programme for years without questioning whether it addresses the right question. The EU making-available prohibition does not require a direct transaction with a listed person. Cover that attaches to a vessel insured by a designated insurer, or a card transaction that clears through a correspondent whose parent is within the perimeter, can each engage the prohibition without any named designee appearing on the paying firm's own system. Mapping the actual perimeter – rather than the perimeter a firm assumes it operates within – is the starting point for everything else.

We also assist at the enforcement end: reviewing the facts if OFSI or the relevant EU member-state competent authority raises questions, advising on voluntary reporting where that is the appropriate course, and preparing the factual and legal account of the firm's position. We do not promise outcomes. We do deliver analysis that is grounded in the current state of EU law and in the practical enforcement posture of the competent authorities.

What is the legal basis for EU sanctions exposure of insurers and card networks?

EU sanctions are imposed by Council Regulation – directly applicable across all member states without transposition – and by Council Decision. The asset-freeze and making-available prohibitions in the relevant thematic regulations apply to all natural and legal persons within the EU, and extend to all transactions in currencies denominated and cleared within member-state jurisdictions. Insurers issuing policies and card networks routing transactions within that perimeter are caught regardless of where they are incorporated, provided the transaction has a sufficient EU nexus.

The making-available prohibition is the provision that bites hardest for these sectors. It reaches any act – direct or indirect – that makes funds or economic resources available to or for the benefit of a listed person. An insurer that pays a claim under a policy where a designated person is the ultimate beneficiary of the payout has made funds available. A card network that clears a transaction where the merchant's acquiring bank is itself subject to an asset freeze has, depending on the facts, done the same. The EU's formulation does not require that the firm knew the listed person was involved; the prohibition is engaged on the objective facts.

Control is the second vector. The EU ownership-and-control test catches non-listed entities that are owned more than 50 percent or controlled by a designated person, as currently in force – verify before reliance. A counterparty that passes a name check may still be within the perimeter because its ultimate beneficial owner, or a person who controls it in fact, is listed. For insurers assessing policyholders and for card networks assessing acquiring banks and merchants, this requires a look-through analysis that goes beyond the legal name on the policy or the acquiring agreement.

How does the EU standard compare with OFAC and OFSI?

The comparison matters for any insurer or card network operating across jurisdictions – and in our cross-border practice, virtually all of the firms we advise do operate across more than one regime. Understanding where the tests converge and where they diverge determines which standard sets the compliance floor.

Under OFAC, the 50 percent rule (the rule treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked) is a bright-line ownership test. It is mechanical. Control is not a separate trigger in the same way; OFAC's focus is on the ownership percentage, applied directly, indirectly, and in the aggregate across all blocked-person holdings. Where a vessel's insurer is on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons), a US-connected card-network operator routing a premium payment may face a US-law issue entirely independently of the EU position.

OFSI under the UK regime uses an ownership-and-control test that tracks the EU formulation more closely than OFAC's. The UK ownership-and-control test can catch a non-listed entity controlled by a designated person. UK case law has emphasised that control must be actual rather than theoretical – a distinction that matters when a state-connected entity argues that its designated shareholder exercises no day-to-day influence. The specific licence (a case-by-case authorisation to conduct an otherwise prohibited transaction) exists under OFSI as well as under EU and US regimes, and the grounds differ between them.

The cross-cutting rule is that where two regimes both apply, the stricter prohibition governs the conduct of a person subject to both. An insurer subject to both EU and UK rules cannot net them out or pick the more permissive standard. Both apply on their own terms. For card networks with US dollar clearing, the OFAC dimension adds a third layer. Mapping all three is the only reliable way to understand the actual perimeter.

Why is name screening alone not enough for these sectors?

Name screening identifies direct counterparty listings – but the EU making-available prohibition extends well beyond direct counterparties, and the indirect pathways are where insurers and card networks are most exposed. The gap between what a name screen catches and what the law requires is not a theoretical concern; it is the gap that produces enforcement files.

Consider the specific pathways that name screening misses. An insurer may screen the policyholder and the named insured at inception, but the beneficiary of a claim payout – which may be a mortgagee, an assignee, or a loss payee named only at the claims stage – is often not screened at the same time. A card network screens merchants and acquiring banks at onboarding, but the ownership chain of those entities changes. A designated person can acquire a controlling interest in a merchant after the onboarding screen ran. The EU sanctions regime is not a point-in-time obligation; it applies continuously.

The de-risking response – a financial institution exiting a relationship to avoid sanctions exposure – is sometimes the correct answer. But it is not always the proportionate one, and a firm that de-risks without understanding whether the legal test is actually engaged is not managing its risk; it is managing its discomfort. The defensible position requires knowing whether the perimeter is crossed, not just whether the counterparty name appears on a list. That is precisely the analysis we are engaged to provide.

Are your screening processes calibrated to catch entity-level exposure – ownership chains, beneficial owners, and indirect beneficiaries – or only individual name matches? The answer to that question determines how much of the legal perimeter you are currently outside.

What are the specific risk flags for insurers and card networks under the EU regime?

The risk flags for these two sectors overlap in some areas and diverge in others. Understanding which flag is relevant to which business model is the foundation of a proportionate response.

For insurers, the principal risk flags are: a policyholder or insured whose ultimate beneficial owner is a designated person or entity; a vessel, aircraft, or asset that is itself subject to a port-access or movement restriction (these restrictions operate independently of cargo-level prohibitions); an insurer in the reinsurance chain that is itself designated – a designation of an insurer can cascade into loss of cover for the vessels or assets it insures, which is a compliance trigger for all firms in the chain; and claims-side beneficiaries who were not screened at policy inception. The maritime sector is particularly acute: AIS transmission gaps and ship-to-ship transfers are treated as diversion red flags under established practice, and an insurer writing marine cover is expected to have controls that address these patterns.

For card networks, the principal risk flags are: an acquiring bank whose parent or ultimate beneficial owner is within the EU perimeter; a merchant in a high-risk jurisdiction whose transaction flows show a sharp change consistent with circumvention or diversion patterns; and a card scheme that routes through correspondent arrangements involving institutions subject to foreign financial institution risk under US rules – because the OFAC dimension does not disappear simply because the primary analysis is EU-focused. US authority allows measures against foreign financial institutions that conduct or facilitate significant transactions for designated persons or specified sectors, as currently in force, and a card network's correspondent relationships can bring that risk into scope.

In a recent matter, a payment-sector client discovered during a routine review that one of its acquiring-bank relationships had undergone a change of ownership that brought a designated entity into a significant minority position. The firm's onboarding screen had not been re-run after the ownership change. We mapped the ownership structure, assessed whether the EU and UK control tests were engaged, advised on the reporting position, and assisted with the redesign of the firm's ongoing monitoring process. No specific outcome is guaranteed in any matter; what an early review does is preserve options.

When should you involve specialist EU sanctions counsel?

The answer is not "when you receive a notice from a competent authority". By that point, the most valuable early-stage options – accurate self-assessment, voluntary reporting on the best available facts, and a considered response to the first regulatory contact – may have been foreclosed by decisions made in the days and weeks before counsel was instructed.

The points at which involving a sanctions lawyer with EU sanctions specialism adds the most value are: before a product launch or market entry that will bring the firm into a new counterparty class or a new clearing arrangement; when an ownership-chain review at onboarding reveals a designated person with a significant minority holding; when a claim arises under a policy where the beneficiary's identity was not fully verified at inception; when the firm receives a de-listing notification and needs to understand whether previous transactions created a retrospective exposure; and when a competent authority in any EU member state makes an informal inquiry about a specific transaction or counterparty relationship. Each of these is a decision point, not a crisis – but each can become a crisis if the legal analysis runs behind the facts.

We act for multinationals, financial institutions, and exporters on sanctions and export-control matters across the major regimes. Our EU practice covers Council-regulation analysis, ownership-and-control questions, and annulment actions before the EU General Court. For card networks and insurers, the entry point is typically a scoped perimeter-mapping exercise, after which the firm has a written assessment and a clear view of what its next steps are. For an EU sanctions risk assessment tailored to your business model, contact Calder & Vance at info@caldervance.com.

How do EU sanctions obligations interact with anti-circumvention controls?

Anti-circumvention has moved from a background risk to an active enforcement priority. The EU has an anti-circumvention instrument allowing restrictions to be directed at operators in third countries where measures are being circumvented; it was applied for the first time in 2026 and its scope continues to develop – verify the current position before relying on it. For insurers and card networks, the practical significance is that a firm which structures its operations to route transactions through a non-EU subsidiary, or which accepts cover or acquiring arrangements from counterparties in third-country jurisdictions without adequate look-through, may find that the anti-circumvention instrument reaches it.

Transit through a third country does not change an item's controlled status; the analysis follows the transaction, not the route. A sharp change in transaction flows to a neighbouring or transit jurisdiction is treated as a diversion red flag. For insurers writing political-risk or trade-credit cover and for card networks processing cross-border e-commerce transactions, these patterns appear in the data and are visible to competent authorities. The question is whether they are also visible – and properly assessed – in the firm's own monitoring.

The EU Blocking Regulation adds a further layer for firms with US connections. That instrument can prohibit EU operators from complying with specified third-country measures, creating a compliance tension between what OFAC requires and what the Blocking Regulation permits. Resolving that tension requires a considered, documented legal analysis – not a policy default to one regime. Do you have a written position on the Blocking Regulation's application to your current correspondent and counterparty relationships? If not, the absence of that analysis is itself a risk flag.

How does Calder & Vance structure its assistance for this sector?

Our engagement model for insurers and card networks on EU sanctions perimeter questions follows four stages, each with a defined scope and a defined output. The firm is not locked into later stages at the point of instructing on the first.

The first stage is a perimeter-mapping exercise: we review the firm's counterparty classes, transaction flows, ownership-chain data, and current screening logic against the EU legal standard – the making-available prohibition, the asset-freeze perimeter, the ownership-and-control test, and the anti-circumvention instrument. The output is a written gap assessment that identifies where the firm's current controls address the legal standard and where they do not. This is typically scoped as a fixed-fee engagement; the scope is agreed before we begin.

The second stage, which follows from the gap assessment, is control redesign: revising screening logic, updating onboarding and monitoring procedures, drafting or amending internal policies, and – where the ownership-and-control analysis requires it – designing a look-through methodology that is proportionate to the firm's risk profile and capable of being applied consistently. We test the redesigned controls against the scenarios that produced the gaps identified in stage one.

The third stage covers transaction-specific advice: assessing whether a specific policy, acquiring arrangement, or clearing relationship is within the perimeter; advising on the applicable licensing grounds where an authorisation may be available; and, where a potential breach has been identified, advising on the reporting obligations that may be running. Voluntary self-disclosure (a proactive report to the regulator before the regulator makes contact) is a recognised factor in the enforcement posture of EU member-state competent authorities as well as in OFAC's enforcement guidance; the decision to make such a report, and how to frame it, requires careful legal analysis.

The fourth stage is enforcement support: acting as legal counsel in a competent-authority inquiry, preparing the factual and legal account of the firm's position, and managing the regulatory dialogue. We have acted in matters before EU member-state competent authorities and in cases where the EU and UK positions diverged and required concurrent management. For a confidential review of a potential breach or a regulatory inquiry, contact us at info@caldervance.com.

Related practices

• Secondary sanctions and bank risk under OFAC – understanding US secondary-sanctions exposure for financial institutions in cross-border relationships
• Affiliate-level restrictions under BIS and the EAR – managing entity-list and export-control risk across corporate structures and related-party transactions

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.