OFSI, OFAC and EU Sanctions: The UK Professional's Screening Guide

The Strict Liability Reality for UK Professionals

Since the enactment of the Economic Crime (Transparency and Enforcement) Act 2022, the compliance landscape for UK professionals has fundamentally shifted. The Office of Financial Sanctions Implementation (OFSI) no longer needs to prove that a firm knew, or had reasonable cause to suspect, that a transaction breached financial sanctions. Civil monetary penalties are now issued on a strict liability basis. If your firm transacts with a designated person, or an entity owned or controlled by one, you are liable for enforcement action regardless of your intent or internal knowledge.

For solicitors, accountants, corporate finance advisers, and lenders, checking a client's name against a static database at the point of onboarding is legally insufficient. Corporate structures are routinely weaponised to obscure the ultimate beneficial ownership (UBO) of sanctioned individuals. These structures rely on offshore trusts, proxy shareholders, nominee directors, and multi-jurisdictional holding companies to create distance between the sanctioned individual and the UK operating entity.

Failing to identify these obscured structures exposes UK professionals to severe consequences. OFSI holds the power to levy fines of up to £1 million or 50% of the estimated value of the breach, whichever is higher. Beyond direct financial penalties, firms face regulatory censure from bodies such as the Solicitors Regulation Authority (SRA) or the Financial Conduct Authority (FCA), alongside catastrophic reputational damage when OFSI publishes the details of the breach.

Regulatory Exposure: Beyond OFSI Fines

The risk of dealing with a sanctioned entity extends beyond immediate Treasury fines. When an entity is sanctioned, its assets are frozen. It can no longer legally pay its suppliers, service its debt, or receive funds from its customers.

For a UK lender or trade creditor, discovering that a borrower is sanctioned usually means the debt becomes entirely unrecoverable. The sanctioned entity will rapidly default on its obligations. Creditors attempting to recover funds cannot simply seize assets without a specific OFSI licence. Often, the financial paralysis leads to aggressive creditor action from parties unaware of the sanctions, resulting in insolvency proceedings. Professionals advising on debt recovery must routinely perform a winding up petition search to monitor whether the frozen entity is being forced into compulsory liquidation by frustrated suppliers or HMRC.

Furthermore, before taking security over a corporate asset, lenders must ensure the borrower is free from sanctions exposure. Registering a charge against a sanctioned entity's assets without authorisation is a direct breach of the asset freeze provisions. Advisers must conduct a rigorous company charge check alongside comprehensive UBO unwrapping before any facility is drawn down.

The Core Sanctions Regimes Dictating Global Transactions

UK professionals must routinely screen entities and individuals against three distinct sanctions lists. While OFSI acts as the primary domestic regulator, the extraterritorial reach of US and EU sanctions means UK firms cannot afford to ignore international watchlists. A failure to screen across all three regimes leaves a critical blind spot in any due diligence process.

1. OFSI (United Kingdom)

Under the Sanctions and Anti-Money Laundering Act 2018 (SAMLA), OFSI enforces financial sanctions on behalf of HM Treasury. UK sanctions apply to all individuals and legal entities within the UK, and to all UK nationals and UK-incorporated entities anywhere in the world.

The jurisdiction is broad. If a UK-headquartered private equity firm acquires a target in South America, that transaction must comply entirely with OFSI regulations. Similarly, a British citizen acting as a director for a Dubai-based company is personally bound by UK sanctions law, even if the company itself has no UK operations.

2. OFAC (United States)

The Office of Foreign Assets Control (OFAC) administers US sanctions. While primary US sanctions apply strictly to "US persons" (citizens, permanent residents, and US-incorporated entities), UK firms must comply with OFAC in two critical scenarios:

3. EU Sanctions

EU sanctions apply within the jurisdiction of the European Union, to EU nationals, and to entities incorporated under the law of an EU Member State. Post-Brexit, the UK maintains its own autonomous sanctions regime, but there remains heavy overlap in designated targets.

UK firms with EU subsidiaries, EU national directors, or operations within the bloc must ensure absolute compliance with the EU Consolidated List. Furthermore, many UK firms rely on European banking partners who will unilaterally block transactions that breach EU sanctions, regardless of whether the UK firm is legally bound by them.

Regime Comparison Summary

| Feature | OFSI (UK) | OFAC (US) | EU Sanctions |

| :--- | :--- | :--- | :--- |

| Primary Regulator | HM Treasury | US Department of the Treasury | European Commission / Member States |

| Jurisdiction | UK territory, UK nationals, UK entities globally | US persons, US territory, USD transactions | EU territory, EU nationals, EU entities |

| Liability Standard | Strict liability (civil fines) | Strict liability (civil fines) | Varies by Member State (often strict) |

| Extraterritoriality | Limited to UK persons abroad | Extensive (Secondary sanctions via SDN listing) | Limited to EU persons abroad |

| Aggregation Rule | Yes (50% or more combined) | Yes (50% or more combined) | Yes (50% or more combined) |

Expert Analysis: Mastering the 50% Aggregation Rule and De Facto Control

The most complex aspect of sanctions compliance is not identifying direct targets. Searching a name against a list is trivial. The true regulatory risk lies in identifying entities that are owned or controlled by designated persons. Under OFSI, OFAC, and EU rules, an entity is subject to the exact same asset freezes and prohibitions as a designated person if that person owns or controls it, even if the entity itself does not appear on any published sanctions list.

The 50% Aggregation Principle

An entity is captured by sanctions if a designated person holds, directly or indirectly, 50% or more of the shares or voting rights. Crucially, OFSI, OFAC, and the EU all apply an aggregation principle.

If Sanctioned Individual A owns 25% of a UK company, and Sanctioned Individual B owns 26%, neither individual meets the threshold alone. However, their combined ownership is 51%. The UK company is therefore treated as a sanctioned entity by extension, and its assets must be frozen immediately. Firms must unwrap the entire corporate structure, identify every ultimate beneficiary, cross-reference them against the sanctions lists, and mathematically aggregate the holdings of any designated persons.

Identifying De Facto Control

Ownership is a mathematical calculation; control is a qualitative assessment. OFSI guidance explicitly states that an entity is controlled by a designated person if it is reasonable to expect that the designated person would be able to ensure the entity's affairs are conducted in accordance with their wishes.

Indicators of de facto control include:

If a designated oligarch owns 0% of a UK property holding company, but retains the contractual right to appoint the sole director via an unpublished shadow agreement, that company is sanctioned under UK law. Professionals must look beyond the Companies House confirmation statement and examine shareholder agreements, loan covenants, and articles of association.

Realistic Worked Example: Project Cobalt

Consider a corporate finance team advising a UK mid-market lender on a £15m revolving credit facility for "Cobalt Tech Ltd", a UK-registered software developer.

A basic check of the OFSI Consolidated List shows no results for Cobalt Tech Ltd or its sole UK resident director. The initial compliance check is marked green. However, deep corporate intelligence reveals the following obscured structure:

1. Cobalt Tech Ltd is 100% owned by a Cyprus holding company, Cobalt Holdings Ltd.

2. Cobalt Holdings Ltd is owned by three separate entities:

3. Unpacking the BVI trust reveals the ultimate beneficiary is an individual designated under OFSI and OFAC Russia sanctions.

4. Unpacking the Swiss vehicle reveals the ultimate beneficiary is a different individual, also designated under OFSI.

Individually, neither designated person breaches the 50% threshold. However, aggregated together, designated persons own 55% of the Cyprus parent company. Consequently, the UK subsidiary, Cobalt Tech Ltd, is deemed a sanctioned entity by extension.

If the UK lender had provided the £15m facility without uncovering this structure, they would have committed a strict liability breach of SAMLA 2018, rendering them liable for a fine of up to £7.5m (50% of the breach value) and regulatory action from the FCA.

Sanctions Screening Decision Framework

To establish a defensible compliance position and satisfy regulatory scrutiny, UK professionals should implement the following step-by-step framework when onboarding or reviewing a corporate counterparty.

1. Direct Entity Screening: Check the exact legal name, trading names, and previous names of the target company against live OFSI, OFAC, and EU lists. Ensure fuzzy logic is applied to catch slight spelling variations or transliteration differences from Cyrillic or Arabic scripts.

2. Director and Officer Screening: Screen all current directors, shadow directors, and key management personnel. A sanctioned director may exercise qualitative "control" over the entity, tainting the entire business.

3. UBO Unwrapping: Trace ownership up through every layer to the ultimate natural persons. Do not stop at offshore corporate directors or opaque trust structures. You must identify the individuals behind them.

4. Apply the Aggregation Rule: Calculate the total percentage of shares or voting rights held by all designated persons within the structure. If the combined total is 50% or more, treat the entity as sanctioned.

5. Assess De Facto Control: Review the articles of association, shareholder agreements, and debt covenants. Does a designated person hold veto rights, board appointment powers, or golden shares, even if their equity stake is below 50%?

6. Supply Chain and Customer Risk: Assess whether the target entity's primary revenue source or critical supplier is a sanctioned entity. This presents severe secondary sanctions risk and threatens the target's ability to remain a going concern.

7. Implement Ongoing Monitoring: Sanctions lists update frequently. A clean entity on Monday can become a designated entity on Wednesday. Establish a continuous review cycle to catch status changes immediately.

The Traditional Manual Burden vs Corp Intel

Traditionally, compliance and corporate finance teams perform sanctions checks manually. This involves downloading the latest CSV files from HM Treasury, querying the OFAC search portal, and cross-referencing findings against Companies House filings. When complex offshore structures are involved, analysts spend hours mapping ownership trees in spreadsheets, manually calculating aggregate percentages, and attempting to resolve false positives (such as distinguishing between two individuals named "Alexander Ivanov" using dates of birth).

Furthermore, manual checks are inherently static; they only represent a snapshot in time. If a shareholder is sanctioned three months after a transaction closes, the firm relies on ad-hoc news monitoring or annual KYC refresh cycles to spot the risk. By the time the risk is identified, multiple strict liability breaches may have already occurred.

Corp Intel fundamentally changes this workflow by integrating comprehensive sanctions screening directly into the corporate research process. When a professional runs a company search, the platform automatically unwraps the corporate structure, calculates aggregate ownership percentages across all layers, and screens every connected entity and UBO against live OFSI, OFAC, and EU lists. Instead of manual spreadsheet mapping, professionals receive an immediate, defensible view of sanctions exposure.

Crucially, by utilising free company monitoring, firms transition from static checks to dynamic compliance. If a director, shareholder, or parent company is subsequently added to a sanctions list, the system generates an automated alert. This ensures the firm can freeze assets, halt transactions, or exit the client relationship before a strict liability breach occurs, satisfying the FCA's requirement for continuous vigilance.

FAQ

What happens if a UK firm breaches OFSI sanctions?

Under the Economic Crime (Transparency and Enforcement) Act 2022, OFSI can impose civil monetary penalties on a strict liability basis. The maximum fine is £1 million or 50% of the estimated value of the breach, whichever is higher. OFSI also publishes the details of breaches, causing severe reputational damage, and the FCA may take secondary action against regulated firms.

Do UK firms have to comply with OFAC if they have no US operations?

Yes, in specific circumstances. If a transaction involves US Dollars, clears through a US correspondent bank, or involves US citizens, OFAC primary sanctions apply. Furthermore, OFAC's secondary sanctions allow the US government to penalise non-US firms for conducting significant transactions with certain sanctioned entities, potentially cutting the UK firm off from the US financial system entirely.

How frequently should we screen our existing client base?

The FCA Financial Crime Guide expects firms to have systems that respond promptly to updates in sanctions lists. Screening only at onboarding or during an annual review is insufficient. Best practice requires automated, continuous monitoring of the client portfolio against daily list updates.

What is a 'false positive' in sanctions screening?

A false positive occurs when a client or counterparty shares the same name as a designated person on a sanctions list, but is not actually that person. Firms must use secondary identifiers-such as date of birth, nationality, known addresses, or passport numbers-to discount false positives and maintain a clear audit trail of their decision-making process.

Can a company be sanctioned if the designated person owns less than 50%?

Yes. If a designated person owns less than 50% of the shares but exercises "control" over the entity-for example, through the right to appoint a majority of the board, veto business decisions, or via a proxy agreement-the entity is treated as sanctioned under OFSI rules.

What should a firm do if they discover a sanctioned client?

The firm must immediately freeze any assets held for the client, halt all transactions, and report the finding to OFSI. Regulated professionals must also consider their obligations to submit a Suspicious Activity Report (SAR) to the National Crime Agency (NCA) if they suspect money laundering or sanctions evasion.

Next Steps for Compliance Teams

Relying on point-in-time, manual sanctions checks exposes your firm to strict liability enforcement and critical blind spots regarding aggregate ownership. To protect your practice and satisfy regulatory expectations, you must implement automated unwrapping of corporate structures and continuous screening against global watchlists.

Start securing your client portfolio today. Set up free company monitoring on your highest-risk counterparties to receive immediate alerts on changes to ownership, directorships, and sanctions exposure, ensuring you remain defensible in the face of regulatory scrutiny.