Sanctions ownership and control: when an unlisted counterparty is still blocked

Sanctions screening matches names against lists. Sanctions ownership and control answers a harder question: is a counterparty blocked when its own name appears on no list at all? A company can be absent from every list and still be off limits, because the persons who own or control it are designated. That is how an institution makes a prohibited payment while its screening log shows a clean pass.

This article sets out what the two tests are, how the United States, the European Union and the United Kingdom differ, and how to run and evidence the analysis in a cross-border payment business. It is general information for compliance and payments leaders, not legal advice on a specific counterparty.

What does sanctions ownership and control actually mean?

Two tests sit behind the phrase, and they work differently. Ownership is arithmetic. You add up the proprietary interest held by designated persons in the entity in front of you, directly and through intermediate companies, then compare the total with a threshold. Control is judgement. You ask whether a designated person can direct the entity's decisions, however few shares they hold.

The consequence is the same either way. A caught entity is treated as though it were listed: its funds are blocked or frozen, and a payment to it, through it or for its benefit is prohibited. No list entry tells you this. The analysis is yours to run, and so is the obligation.

How does the OFAC 50 percent rule work in practice?

In the United States the arithmetic comes from OFAC's Revised Guidance on Entities Owned by Persons Whose Property and Interests in Property Are Blocked, issued in August 2014. An entity owned 50 percent or more, directly or indirectly, in the aggregate, by one or more blocked persons is itself blocked, whether or not it appears on the Specially Designated Nationals list.

Three words in that sentence do the work. Aggregate means you add separate designated holders together, so two listed individuals holding a quarter each produce a blocked company under the same OFAC guidance. Indirectly means you follow the chain: once a holding makes a company blocked, that company's own majority holdings are blocked in turn, and the chain can run several levels deep. Or more means the threshold bites at the line, not above it.

Control is treated differently in the United States. The same OFAC guidance says entities controlled by, but not majority owned by, a blocked person are not automatically blocked, while urging caution in any dealing with them. That is not permission. A payment that in substance benefits a designated person can still be prohibited.

Why do the EU and UK tests reach further than ownership alone?

The European Union applies two criteria side by side. According to the Council of the European Union's EU Best Practices for the effective implementation of restrictive measures, ownership is established where a designated person holds more than 50 percent of the proprietary rights in an entity. Control is assessed separately, through indicators that need not involve a shareholding at all.

• Holding or controlling a majority of the voting rights, directly or under an agreement with other shareholders.
• Having the right to appoint or remove a majority of the board or the senior management.
• Being able to exercise a dominant influence over the entity under a contract or a provision of its constitution.
• Having the right to use all or part of the entity's assets.
• Managing the entity on a unified basis with the designated person's own business, or sharing liability for its debts.

The United Kingdom works the same way. Its sanctions regulations define ownership and control by reference to holding more than half of the shares or voting rights, the ability to appoint or remove a majority of the board, or the ability to have the entity's affairs conducted in accordance with a designated person's wishes. Guidance from the Office of Financial Sanctions Implementation explains how to apply it.

The practical consequence for a corridor business is that one counterparty can be clear in one jurisdiction and caught in another. If you settle in US dollars or otherwise have a US nexus, the US test applies alongside the local one. Run every test that reaches the payment.

Is the 25 percent beneficial ownership threshold enough for a sanctions decision?

No, and treating it as enough is the most common failure in this control. The thresholds answer different questions. FinCEN's customer due diligence rule, at 31 CFR 1010.230, requires a covered institution to identify beneficial owners holding 25 percent or more of the equity interests in a legal entity customer, plus one individual with significant responsibility for control. That data supports know your business work and sits in the onboarding file.

It does not settle the sanctions question, for three reasons. It stops at a single layer, so an intermediate holding company hides the chain above it. It records owners one by one, so it never produces the aggregate of designated stakes that the test needs. And it is captured at onboarding, so it ages, while designations do not wait for your refresh cycle.

The fix is not a higher threshold. It is a structure chart that runs to natural persons, carries a date, and is rescreened when a list changes rather than when a review falls due. FATF Recommendation 24 pushes jurisdictions towards beneficial ownership information that is adequate, accurate and up to date, yet registry quality still varies, so signed evidence from the counterparty is still needed.

How do you run the ownership and control analysis, step by step?

• Fix the triggers: onboarding a corporate sender or payout partner, a change in its ownership, a list update touching its jurisdiction or sector, and a refresh set by risk rating.
• Obtain a signed, dated structure chart from the counterparty, showing every layer up to natural persons and the stake held at each link.
• Verify it against an independent source, a registry filing, an audited account or a commercial database, and record which one you used.
• Screen every entity and every natural person in the chart, not only the immediate counterparty.
• Compute the aggregate designated interest at each level, multiplying through indirect links and adding separate designated holders together.
• Run the control test separately against each applicable regime's indicators, reading the shareholder agreement and constitution where you can get them.
• Record a conclusion for each regime that reaches the payment, with a named decision maker, a date and a reason.
• Set a review date and a standing watch, so a new designation anywhere in the chart raises an alert on its own.

Two of those steps are routinely skipped. Multiplying through indirect links is the first, and it is where a structure built to sit just under a threshold is caught. Screening the whole chart is the second. A parent two levels up is often the designation that matters, and it never surfaces from screening the name on the invoice.

When should a payment be held, and what evidence will a reviewer read?

Hold when the analysis is unresolved, not only when it is adverse. An unknown layer is a reason to stop, because you cannot compute an aggregate you cannot see. The usual triggers are a refused or incomplete structure chart, a nominee arrangement you cannot pierce, a registry entry that conflicts with the counterparty's own statement, and a designation in the chart still being assessed.

Escalate on a defined path. The first line raises it, sanctions expertise assesses it, and a named senior person decides whether to release, reject or report. A frozen asset or an attempted breach is reportable where a regime requires it, and that report is separate from the commercial decision. Keep the payment stopped while the assessment runs, and say so to the client only in the terms your regime allows.

A reviewer reads a short file: the structure chart and its date, the screening results for every party in it, the arithmetic shown rather than asserted, the control assessment and what it relied on, and the decision with its author, reasoning and review date. That file answers most of what an examination asks. A clean screening certificate on its own answers none of it.

A screening pass tells you a name is not on a list. Only an ownership and control analysis tells you whether the payment is permitted, and it is the second document a reviewer asks to see.

None of this is new law. What has changed is the volume. Designations now reach large corporate groups, so the question arises on ordinary commercial counterparties rather than exotic ones. Build the analysis into onboarding and keep the chart current, and the hard cases arrive as alerts rather than as surprises on the day a payment is due.

Where StableNet fits

StableNet, built by SpendTheBits, is a cross-border B2B payment and settlement platform for banks, credit unions, licensed money service businesses, exchange houses and remittance fintechs. Compliance is built in, with KYB and KYC onboarding that captures the ownership structure behind a corporate sender, KYT, sanctions and PEP screening, FATF Travel Rule data in IVMS101 form, a compliance workbench and a tamper-evident audit trail, so a conclusion is recorded against the payment it governs rather than in a separate folder. Settlement runs in regulated stablecoins on public blockchains with on-chain auditability, and because the platform is ISO 20022 native, with pacs.008 customer credit transfers, pacs.009 interbank legs, pacs.002 status reports and pacs.004 returns tracked by UETR, a held or rejected payment carries the same reference as the decision file behind it.