Ownership and Control Across Sanctions Regimes

A bank can screen a company name perfectly and still miss a sanctions problem. The company may not appear on any list, yet a listed or blocked person may own enough of it for restrictions to extend to the company. In other cases the ownership percentage is below the relevant threshold, but a designated person may still exercise control under a framework that treats control as a separate route to restrictions. The difficult part is that the United States, European Union and United Kingdom do not use one identical test.

The practical mental model is therefore simple: one ownership graph, several legal tests. The bank should build the best available picture of who owns the entity, who can exercise voting or appointment rights, who can direct its affairs, when those rights took effect and which sanctions regimes actually apply. It then applies each applicable regime separately. The legal conclusions are kept separate even though they use the same underlying facts.

This matters because three questions that sound similar are legally different. First, is the entity itself treated as sanctioned because of ownership or control? Second, are particular funds or economic resources owned, held or controlled by a designated person and therefore frozen? Third, would a payment or other benefit to a non-listed entity amount to making funds or economic resources available to or for the benefit of a designated person? A bank should not collapse those questions into one generic sanctionsOwnedControlled = true flag.

Why the regimes produce different answers

Sanctions ownership rules exist to stop a listed person from avoiding restrictions simply by operating through a company whose name is absent from the sanctions list. That policy objective is shared across major frameworks, but the legal mechanics differ.

OFAC's 50 Percent Rule is an ownership rule. An entity directly or indirectly owned 50 percent or more in the aggregate by one or more blocked persons is itself treated as blocked, even if the entity is not separately named on the SDN List. OFAC does not automatically treat an entity as blocked merely because a blocked person controls it without reaching the ownership rule. OFAC may designate such an entity under available authority, and OFAC urges caution where blocked persons hold significant sub-50-percent interests or exercise control, but control by itself is not a second automatic limb of the 50 Percent Rule.

The EU approach is different. The Council's 2024 Best Practices say that, for asset-freeze purposes, ownership is generally met where a person or entity possesses 50 percent or more of the proprietary rights or has a majority interest. The same Best Practices state that aggregated ownership by designated persons should also be taken into account: the document gives the example of one designated person holding 30 percent and another holding 25 percent, with the entity in principle considered owned by designated persons. EU guidance also sets out a separate and broad control analysis, including appointment powers, majority voting arrangements, dominant influence, rights over assets, unified management and certain financial-liability relationships. Control conclusions can be rebutted case by case on the facts.

The UK test is again distinct. OFSI's current general guidance says an entity is owned or controlled directly or indirectly where a designated person holds more than 50 percent of its shares or voting rights, has the right to appoint or remove a majority of the board, or could reasonably be expected to ensure that the entity's affairs are conducted in accordance with that person's wishes. Importantly, OFSI does not simply aggregate different designated persons' separate minority holdings. Aggregation can become relevant where, for example, the shares or rights are held jointly, are subject to a joint arrangement, or one designated person controls another's rights. This means a 30 percent plus 25 percent structure can be treated differently under current EU and UK guidance.

UN Security Council asset-freeze measures frequently extend beyond the listed person to assets owned or controlled directly or indirectly by that person, to persons acting on their behalf or at their direction, and to entities owned or controlled by them. The Security Council does not provide one universal corporate percentage test equivalent to OFAC's 50 Percent Rule for all domestic implementations. Member States give effect to UN measures through their own laws and administrative systems, so a global bank must identify the implementing law applicable to the relevant legal entity, branch, transaction or asset.

OFAC: ownership arithmetic must follow OFAC's actual rule

The biggest operational error in OFAC analysis is to treat indirect ownership as ordinary multiplication through every corporate layer. That is not how FAQ 401 explains the 50 Percent Rule.

Suppose Blocked Person X owns 60 percent of Company A, and Company A owns 25 percent of Target Company T. Because A is 50 percent or more owned by X, A is itself blocked under the rule. A's 25 percent ownership interest in T is therefore a blocked-person ownership interest for the next step. It is not reduced to 60% × 25% = 15% for the 50 Percent Rule calculation.

By contrast, if X owns only 25 percent of A and A owns 50 percent of T, A is not blocked merely because of X's 25 percent holding. OFAC's published examples explain that X is not treated as indirectly owning T through that chain for purposes of the rule simply by multiplying 25 percent by 50 percent. This distinction is essential for calculation engines and analyst worksheets.

OFAC also aggregates ownership of multiple blocked persons. If Blocked Person A owns 30 percent of T and Blocked Person B owns 25 percent directly, the aggregate blocked ownership is 55 percent and T is blocked under the rule. The bank does not need T to appear separately on the SDN List for the property and interests in property of T to be considered blocked.

Control remains relevant, but it has to be described accurately. FAQ 398 states that an entity controlled by one or more blocked persons, but not owned 50 percent or more in the aggregate, is not automatically blocked under the 50 Percent Rule. The bank should still investigate whether another sanctions provision applies, whether a blocked person is personally participating in the transaction, whether OFAC has separately designated or identified the entity, and whether the structure presents designation, evasion or enforcement risk. Those are important issues, but they are not the same as declaring the entity blocked by control alone.

For system design, the U.S. result should therefore distinguish at least:

• ofac_50_percent_rule_met
• ofac_blocked_owner_total
• ofac_indirect_chain_basis
• blocked_person_control_indicator
• separately_designated_or_other_blocking_authority
• legal_or_compliance_escalation_required

That separation prevents the common mistake of converting a risk indicator into a legal blocking conclusion.

European Union: ownership, aggregation and control

The EU Best Practices updated on 3 July 2024 provide a useful cross-regime reference because they state the ownership and control approach in operational language. For ownership, the current text uses 50 percent or more of proprietary rights or majority interest. It also explicitly says aggregated ownership should be considered, including the 30 percent plus 25 percent example.

Control is not just a percentage test. The Best Practices list indicators such as the right or power to appoint or remove a majority of the management or supervisory body; controlling a majority of voting rights through an agreement; the right or de facto power to exercise dominant influence; the right to use all or part of the entity's assets; unified management combined with consolidated accounts; and specified financial-liability relationships. If a criterion is satisfied, control is considered present unless the contrary can be established case by case. The Best Practices also provide practical indicators such as a designated person being the largest shareholder, favourable buyback options, transfers around designation and the use of front persons.

The significance for banks is twofold. First, an EU asset-freeze assessment should not be reduced to an equity threshold. Second, control is an evidence question. A 40 percent shareholder who is merely the largest shareholder is not automatically controlled solely for that reason; the fact may trigger further analysis of appointment rights, agreements, influence and other evidence.

The European Commission's firewall guidance adds another practical dimension. Where a designated person owns or controls an entity, EU restrictions may affect the non-listed entity. In appropriate cases, competent authorities may permit structural safeguards designed to remove the designated person's ability to exercise relevant ownership or control rights. That is not something a bank should infer or implement unilaterally as a substitute for the applicable regulation or an authorisation. The bank needs the current legal act, the competent authority position and evidence that any firewall or divestment arrangement actually has the intended legal effect.

EU rules are also programme specific. The Russia regulations contain provisions that separately use concepts such as ownership of more than 50 percent, public control, acting on behalf or at the direction of an entity, transaction prohibitions and sector-specific restrictions. An ownership conclusion under the asset-freeze framework should therefore not be copied mechanically into every sectoral restriction without checking the wording of the measure being applied.

United Kingdom: more than 50 percent and no simple aggregation of separate minority DPs

The UK ownership rule is often misstated as identical to OFAC's. It is not.

OFSI's general guidance says the first limb is met where a person holds, directly or indirectly, more than 50 percent of the shares or voting rights. Exactly 50 percent does not satisfy that limb on percentage alone. The second limb is the right to appoint or remove a majority of the board. The third asks whether it is reasonable to expect that the person would be able to ensure that the entity's affairs are conducted in accordance with the person's wishes.

The aggregation rule is also materially different from OFAC and current EU guidance. OFSI says it would not simply add together different designated persons' separate holdings. If two designated persons each own 30 percent with no joint arrangement and neither controls the other's rights, that does not, by arithmetic alone, make the company owned by a designated person under the UK share-ownership limb. If the holdings are joint, subject to a joint arrangement, or one designated person controls another's rights, the analysis changes. The control limbs must always be considered separately.

This distinction should be encoded in systems rather than left to analyst memory. A global ownership engine that has only one field called aggregate_designated_percent cannot reliably produce both OFAC/EU and UK conclusions. It needs regime-specific logic and evidence about joint arrangements and control rights.

UK guidance also emphasises reasonable, good-faith due diligence rather than prescribing one universal level of inquiry. A bank should calibrate its work to the facts and risk, preserve the information used and escalate uncertainty where the legal consequence is material. The existence of a designated public official does not automatically mean every public body connected to that official is controlled by them; current UK guidance specifically warns against simplistic assumptions and requires the actual control test to be applied.

The UN layer: international obligation, domestic implementation

Many UN sanctions regimes require Member States to freeze without delay funds, financial assets and economic resources owned or controlled by listed persons, persons acting on their behalf or at their direction and entities owned or controlled by them. The wording can be seen across current Security Council committee pages, including Al-Shabaab, Yemen, South Sudan and DPRK measures.

The bank still needs to know how the obligation is implemented in the jurisdiction that governs its conduct. A UN listing may be incorporated automatically in one country and through a domestic designation or regulation in another. Ownership and control interpretation can therefore depend on national law, competent-authority guidance and the exact sanctions programme. The operational control should record the UN source and the domestic implementation separately.

A useful data structure is:

UN listing -> domestic implementation -> applicable bank entity/person -> ownership/control test -> legal outcome -> operational action

That structure is more defensible than a global list flag because it preserves the legal route from international measure to the bank's actual obligation.

The same structure can legitimately produce different conclusions

Consider an entity with the following direct shareholdings:

Assume there is no joint arrangement between A and B, neither controls the other's rights and neither has additional board or governance powers.

Under OFAC's 50 Percent Rule, the blocked interests aggregate to 55 percent, so the entity is considered blocked if A and B are blocked persons for the relevant OFAC programme. Under the EU Best Practices, aggregated designated ownership should be taken into account, and the 30 plus 25 structure is the document's own example of an entity that should in principle be considered owned by designated persons. Under current UK guidance, the two separate minority holdings are not simply aggregated; absent joint ownership, a joint arrangement, one holder controlling the other's rights or evidence satisfying another control limb, the percentage limb is not met.

This is exactly why the bank needs parallel regime computations.

Control below the ownership threshold

Control analysis is where legal precision matters most because everyday language is much broader than the legal tests.

A lender may have covenants. A minority investor may have vetoes. A founder may remain influential after selling shares. A government may be economically important to a company. Those facts can be relevant without automatically satisfying a sanctions-control test.

For the EU, the analyst should map the facts to the control criteria and examples in the current Best Practices and the applicable regulation. For the UK, the analyst should test the facts against board appointment/removal rights and the reasonable-expectation test in the applicable regulations and OFSI guidance. For OFAC, the analyst should remember that control without 50-percent ownership does not automatically block the entity under the 50 Percent Rule; the question becomes whether another legal basis applies and whether the exposure requires caution or escalation.

A structured control review should therefore ask what legal right exists, who holds it, whether it can be exercised unilaterally, whether it concerns ordinary investor protection or the ability to direct the entity's affairs, whether the right is current or contingent, and what evidence shows how it operates in practice.

Ownership of an entity is not the same as ownership of a particular asset

A second recurring source of errors is confusing entity attribution with asset ownership.

If a designated person owns shares in a company, those shares may themselves be frozen property. Whether the company as a whole is also treated as sanctioned depends on the applicable ownership/control rule. If a designated person and a non-designated person jointly own a particular asset, the rule for that asset may differ again. The UN Security Council's explanation of asset-freeze terms, for example, distinguishes segregable and non-segregable interests and requires the listed party's interest to be frozen without allowing the listed person to exercise it.

Banks therefore need separate records for legal-entity ownership and for ownership, holding or control of a specific account, security, vessel, property or other economic resource. A company can be non-listed while a designated shareholder's shares are frozen. Conversely, an owned or controlled company may itself fall within an asset freeze even though the bank does not hold the shareholder's personal assets.

This distinction affects custody, corporate actions, dividends, payment processing and customer communication. The legal conclusion has to be attached to the correct object.

When regimes disagree: satisfy each applicable law, do not use a simplistic 'strictest wins' rule

Operational teams often use a 'most restrictive' or 'strictest regime' shortcut. It can be useful as a temporary risk-control idea, but it is not a legal method.

The correct sequence is to identify which laws actually apply to the bank entity, staff, asset and transaction; compute the ownership and control result under each applicable framework; identify the prohibition, permission, licence or reporting duty produced by each; and then choose an operational action that satisfies all compatible applicable obligations.

If one regime clearly prohibits the transaction while another permits it, the bank can usually refuse or hold activity so that it does not breach the prohibition. But genuine conflicts of law require legal analysis. A bank should not assume that automatically following the most restrictive foreign rule is always lawful where another jurisdiction has blocking, anti-boycott, data, employment, contractual or other legal constraints.

The system should therefore store an obligation matrix, not just a severity score.

Divestment, restructuring and the importance of substance

A designated person's ownership can change. The bank may be shown a share sale, trust amendment, management buyout, voting agreement or firewall intended to remove sanctions exposure. The correct response is neither automatic acceptance nor automatic rejection.

The bank should determine whether the transaction was legally permitted, whether any required licence or authorisation was obtained, whether the new owner is independent, whether payment or value flowed to a frozen person, whether buyback or side agreements preserve influence, whether appointment or veto rights remain, and whether the behaviour after restructuring supports the documentary picture.

The legal effect of restructuring depends on the regime. EU guidance expressly recognises competent-authority-approved firewall arrangements in some situations. UK and U.S. consequences depend on their own rules and facts. A bank should not 'unfreeze' assets merely because a customer presents a new organisation chart where an applicable freeze remains in place or authority approval is required.

Effective dating is essential. The bank may need to answer what the ownership position was on the date of a payment, on the effective date of a designation and after a later restructuring. That requires historical ownership graphs and rule versions, not only the current corporate structure.

Data and systems: build the graph before the rule engine

The technology problem is not primarily fuzzy-name screening. It is graph data with legal context.

At minimum, the ownership model should capture the entity and natural-person nodes; direct ownership percentage; voting-right percentage where known; the relationship through which indirect ownership is held; joint ownership or joint-arrangement facts; board appointment/removal rights; other control evidence; effective-from and effective-to dates; evidence source and retrieval date; sanctions-list status by regime; and confidence or verification state.

The rule engine should not overwrite facts with conclusions. Holder A owns 30% is a fact. EU aggregated ownership threshold met is a rules-engine conclusion. UK ownership threshold not met on arithmetic, control assessment required is another conclusion. Keeping those layers separate allows the bank to change legal logic without corrupting the source graph.

Unknown information must remain unknown. A missing shareholder should not be represented as zero ownership. Missing voting rights should not silently default to ordinary share percentage. A stale registry extract should carry a freshness warning. Those data-quality controls matter because ownership engines can otherwise produce precise-looking but unsupported legal outputs.

Monitoring and event-driven reassessment

Ownership is not a once-a-year KYC attribute. Change events can alter sanctions exposure immediately.

Important triggers include a new designation; acquisition or disposal of shares; changes in voting rights; a new shareholder agreement; board appointment rights; merger or demerger; trust protector or beneficiary changes; conversion of debt or preference instruments; exercise of options or warrants; a management buyout; insolvency or creditor enforcement; and new evidence that a person is acting on behalf of or at the direction of a designated person.

The control design should route those events into sanctions reassessment according to materiality and legal urgency. A 2 percent ordinary share transfer among unrelated non-designated investors may not justify the same response as a designated shareholder moving from 48 to 52 percent or entering a joint arrangement that changes the UK analysis.

Rescreening should also propagate through the graph. When a person becomes designated, the bank should identify all entities in which the person has direct or indirect interests and run the applicable regime tests again. That is a different task from simply screening customer names against a new list file.

BA, architecture and testing considerations

For business analysts, the most important requirement is to stop requirements such as 'screen beneficial owners' from being accepted without decision logic. The functional specification should define which ownership/control tests are implemented, the legal source for each, how indirect ownership works, how aggregation works, how joint arrangements are represented, what data can be missing, what triggers recomputation and which outcomes need human legal review.

Architects need versioned rules. OFAC FAQ logic, EU Best Practices, OFSI guidance and domestic implementing rules can change independently. The engine should therefore produce a result with the rule version and assessment date, allowing historical reconstruction.

Testing needs deliberately divergent scenarios. A useful minimum test pack includes an OFAC 30+25 aggregate case; an OFAC indirect-chain case where a blocked person owns 60 percent of an intermediate that owns 25 percent of the target; an EU 30+25 aggregate case; a UK 30+25 case with no joint arrangement; the same UK case with a documented joint arrangement; an exactly-50-percent UK shareholder; a 51-percent UK shareholder; a minority shareholder with board-appointment rights; a contingent right that has not yet become exercisable; and a restructuring that changes ownership but leaves control evidence unresolved.

Tests should assert not only the final result but the reasoning. A pass should show which facts were used, which rule version ran and why the conclusion was reached. That is how the bank proves that a green result means 'tested and clear under this rule' rather than 'no record found.'

Mini case: the 30/25 company

A corporate bank customer, Meridian Components Ltd, is owned 30 percent by Person A, 25 percent by Person B and 45 percent by unrelated investors. A and B are both designated under the relevant EU and UK asset-freeze regime and blocked under the relevant OFAC programme. There is no evidence that A and B act jointly. They have no board appointment rights beyond ordinary proportional shareholder voting, and neither controls the other's shares.

The OFAC engine records 55 percent aggregate blocked ownership and treats Meridian as blocked under the 50 Percent Rule. The EU engine reaches an ownership conclusion using the Council Best Practices approach to 50-percent-or-more aggregate designated ownership. The UK engine does not simply add 30 and 25. It records that neither designated person holds more than 50 percent and that no joint arrangement or other control evidence has been established, so the percentage limb does not make Meridian owned by a designated person on those facts.

The bank then asks which regimes apply to the particular branch and payment. If the transaction is subject to U.S. or EU prohibitions, it cannot be processed merely because the UK arithmetic gives a different answer. If only UK law applies to a particular UK activity, the bank must not label Meridian UK-sanctioned solely by importing OFAC aggregation logic. Group policy may still impose a broader risk restriction, but that internal policy decision should be labelled as policy rather than misdescribed as the UK legal conclusion.

The case demonstrates the central discipline of this chapter: share the facts, separate the tests, preserve the legal basis of every conclusion.

Key takeaways

Ownership and control analysis across sanctions regimes is not a search for one universal percentage. OFAC's 50 Percent Rule is an automatic ownership rule with aggregate blocked ownership and its own indirect-ownership mechanics; control below 50 percent does not automatically block an entity under that rule. Current EU Best Practices use 50 percent or more, include aggregated designated ownership and apply a separate, broad control analysis. Current UK guidance uses more than 50 percent for the ownership limb, adds board and reasonable-expectation control tests, and does not simply aggregate separate designated minority holdings without the additional relationships described in OFSI guidance. UN measures establish international asset-freeze obligations that Member States implement through domestic law.

For a bank, the safest design is not 'apply the strictest percentage'. It is to maintain a reliable, effective-dated ownership and control graph, run every actually applicable regime separately, keep facts distinct from legal conclusions, escalate genuine conflicts or uncertainty, and ensure operational actions can be reconstructed from the evidence and rule version used at the time.

Operational deep dive: comparative calculation methodology

The difficult part of sanctions ownership analysis is not drawing an organisation chart. It is converting the same verified ownership facts into different legal conclusions without importing one regime's arithmetic into another. This deep dive focuses on that calculation discipline.

Start with a fact graph, not a legal conclusion

The graph should contain only facts and evidence at first: who owns what percentage, who holds voting rights, whether rights are joint, whether one party controls another party's rights, who can appoint or remove directors, what veto or consent rights exist, when each right became effective and which source proves it. Sanctions status is then attached to the relevant person or entity by regime.

A useful record for an ownership edge is:

owner -> target -> equity % -> voting % -> joint arrangement? -> effective dates -> evidence source -> verification date

Control evidence is stored separately. A shareholder agreement giving one investor the right to appoint four of seven directors is not another ownership percentage; it is a governance fact that may matter differently under EU and UK control tests and may be relevant to OFAC risk even though it does not itself satisfy OFAC's 50 Percent Rule.

OFAC indirect ownership: do not multiply through every layer

OFAC FAQ 401 is the critical source for complex ownership chains. The rule works through entities that are themselves 50 percent or more owned in the aggregate by blocked persons.

Consider Blocked Person X, Company A and Target T.

• X owns 60 percent of A.
• A owns 25 percent of T.

A is blocked because X owns at least 50 percent of it. For the next layer, A's 25 percent ownership in T is a blocked-person ownership interest. The OFAC analysis does not reduce that interest to 15 percent by multiplying 60 percent by 25 percent.

Now change the first fact:

• X owns 25 percent of A.
• A owns 50 percent of T.

A is not blocked under the 50 Percent Rule from X's 25 percent holding alone. OFAC's examples explain that X is not treated as indirectly owning 12.5 percent of T merely by ordinary mathematical multiplication through a non-blocked intermediary.

This means an OFAC engine needs graph traversal based on the blocked status of intermediate entities, not only a generic beneficial-ownership multiplication routine.

OFAC aggregation worked example

Assume:

• Blocked Person A directly owns 30 percent of Target T.
• Blocked Person B directly owns 25 percent of T.
• The remaining 45 percent is owned by non-blocked investors.

OFAC aggregate blocked ownership is 55 percent. T is therefore considered blocked under the 50 Percent Rule if A and B are blocked persons for the relevant programme.

Now assume B instead owns 60 percent of Holding Company H and H owns 25 percent of T. H is blocked because B owns 60 percent of it. H's full 25 percent interest in T is then included as a blocked-person interest, so the relevant interests in T are A's 30 percent plus H's 25 percent, again reaching 55 percent.

The common wrong answer is 30 + (60 × 25) = 45. That ordinary multiplication method is not OFAC's FAQ 401 method for this chain.

EU ownership aggregation

The Council of the EU's 2024 Best Practices state that ownership is met at 50 percent or more of proprietary rights or majority interest and that aggregated ownership by designated persons should be taken into account. The Best Practices explicitly use a 30 percent plus 25 percent example and say the entity should in principle be considered owned by designated persons.

For an EU rule engine, this means the model must be capable of aggregating designated ownership interests when applying the relevant asset-freeze ownership approach. The legal team should still identify the applicable Council Regulation and any programme-specific wording, because EU sanctions contain restrictions beyond the general asset-freeze concept.

EU control is a separate assessment. The 2024 Best Practices identify several possible control criteria, including board appointment/removal powers, majority voting arrangements, dominant influence, rights to use assets and unified management. A 40 percent shareholder is not automatically a controller simply because it is the largest shareholder; the guidance treats that fact as something that may warrant further analysis.

UK ownership and aggregation

The UK arithmetic must be kept separate from both OFAC and EU logic.

OFSI's general guidance states that the share or voting-right ownership limb is met where a designated person holds more than 50 percent directly or indirectly. It also states that OFSI would not simply aggregate separate minority holdings of different designated persons unless, for example, the shares or rights are subject to a joint arrangement, are held jointly, or one designated person controls another's rights.

Using the same 30 percent plus 25 percent structure with no joint arrangement, the UK percentage limb is not met merely by adding the two holdings. The control limbs must then be tested independently: board appointment/removal rights and the reasonable-expectation test.

This is a useful regression scenario because it should intentionally produce a different UK result from the OFAC and EU ownership calculations.

Exactly 50 percent is another deliberate test case

Threshold language matters.

• OFAC: 50 percent or more in the aggregate.
• EU 2024 Best Practices for the asset-freeze ownership criterion: 50 percent or more.
• UK OFSI ownership limb: more than 50 percent.

An exactly-50-percent direct holding can therefore produce different percentage-limb outcomes. The bank must not normalise all three frameworks to >= 50 or > 50 for implementation convenience.

The result is not necessarily the final transaction answer because control, other programme restrictions, acting-on-behalf provisions, licences and the jurisdictional scope of the relevant rule may still matter. But the percentage calculation itself must be correct before those other questions are added.

Control evidence needs legal mapping, not a score pretending to be law

Control frameworks benefit from structured evidence collection, but a numerical score should not be used as though it were the legal test.

A control worksheet can organise facts into categories:

• board appointment and removal rights;
• voting agreements and joint arrangements;
• veto or consent rights;
• rights over assets;
• management or services agreements;
• financing terms that may create influence;
• actual instruction patterns;
• family, nominee or associate relationships where supported by evidence;
• post-divestment buyback, side-letter or retained-benefit rights.

The analyst then maps those facts to the actual EU or UK criteria. The same fact can have different legal weight under different frameworks. Ordinary minority-protection rights, for example, should not automatically be labelled control. A financing covenant limiting extraordinary asset disposals may be ordinary creditor protection; a package giving a lender the practical ability to direct most significant business decisions is a materially different fact pattern. Legal analysis may be needed at the boundary.

For OFAC, control evidence below the 50 Percent Rule threshold should not be converted into an automatic blocked-entity result. It can justify enhanced investigation, other-programme checks, review of whether a blocked person is acting in the transaction and escalation because OFAC may designate controlled entities, but FAQ 398 is explicit that control alone does not automatically block the entity under the 50 Percent Rule.

Joint arrangements and coordinated rights

Joint arrangements matter especially in UK analysis. OFSI distinguishes simple separate minority ownership from jointly held rights or arrangements through which designated persons exercise rights together.

The evidence should therefore capture whether an agreement actually exists, what rights it covers and whether the parties must exercise those rights jointly. Family connection, commercial friendship or similar voting history may be relevant evidence but should not be treated as proof of a legal joint arrangement without more.

The EU's 2024 Best Practices already direct firms to consider aggregated designated ownership in the asset-freeze ownership analysis. Joint arrangements can also be important to EU control analysis, but they are not a prerequisite for the published 30 plus 25 aggregation example.

OFAC aggregation likewise does not require the blocked persons to be acting in concert. The 50 Percent Rule aggregates blocked ownership interests because they are blocked interests, not because the holders have signed a joint voting agreement.

These distinctions are a strong reason to store joint_arrangement as a fact rather than using it as a universal precondition for aggregation.

Effective-dated recomputation

Every ownership conclusion has an as-at date. A transaction on 1 March may have been clear under the ownership structure then in effect and restricted after a share acquisition on 2 March. A person may have been undesignated at the time of an earlier payment and designated later. A shareholder agreement may give new appointment rights from a future effective date.

The graph should therefore version both facts and legal rules. Historical reconstruction needs:

• the ownership and voting structure at the relevant time;
• the sanctions status of each party at that time;
• the rule or guidance version used by the bank;
• the applicable jurisdiction and programme;
• the evidence available when the original decision was made;
• later evidence that may affect a retrospective review.

This enables lookbacks and investigations without pretending today's organisation chart existed in the past.

Funds, shares and entity status are separate objects

A designated person can own shares in a non-designated entity without the entity itself necessarily satisfying the relevant ownership/control test. The shares may nevertheless be frozen property. A particular bank account may be jointly owned. A company may be owned or controlled by a designated person and therefore subject to restrictions even though the bank has no direct relationship with that person.

Systems should therefore identify what the conclusion attaches to:

person, legal entity, shareholding, account, security, vessel, property, payment, or another economic resource.

A generic sanctioned = yes flag loses that distinction and creates operational mistakes in custody, payments and reporting.

Worked comparative case

Assume a target company is owned as follows:

• Person A, blocked/designated under all three frameworks being tested: 30 percent.
• Holding Company H: 25 percent.
• Unrelated investors: 45 percent.
• Blocked/designated Person B owns 60 percent of H.
• There are no additional control rights.

For OFAC, H is blocked because B owns 60 percent of it. H's 25 percent interest in the target is a blocked-person ownership interest. Together with A's 30 percent, aggregate blocked ownership in the target is 55 percent. The target is blocked under the 50 Percent Rule.

For the EU, the analyst determines the ownership interest attributable through H under the applicable EU framework and applies the 2024 Best Practices together with the relevant regulation. If the resulting designated ownership interests reach 50 percent or more, ownership is established. The conclusion should cite the specific legal basis and graph path rather than simply importing the OFAC result.

For the UK, H's own status and the indirect ownership path must be assessed under the relevant UK regulation and OFSI guidance. The engine cannot assume that the OFAC treatment of H's entire 25 percent interest automatically gives the UK answer. It separately applies the more-than-50-percent share/voting test and the control limbs, recording how indirect ownership is attributed under the UK rules.

The correct architecture is therefore not a single algorithm with three country labels. It is a common graph with distinct regime evaluators.

Ownership-data evidence hierarchy

No legal rule compensates for weak facts. The bank needs a documented approach to source reliability.

Official corporate registries, constitutional documents, shareholder registers and filed accounts are often strong starting points, but their reliability and verification practices differ by jurisdiction. Customer declarations can fill gaps but need corroboration where the consequence is material. Commercial databases are useful for discovery and linkage but should not be treated as infallible primary evidence. Media and investigative reports can generate leads about nominee structures or retained influence but usually require corroboration before a legal conclusion is made.

The evidence record should retain the source date and, where licensing permits, a snapshot or reference sufficient to reconstruct what the analyst saw. Ownership data changes frequently, and a live registry query months later may not reproduce the earlier result.

Testing the engine with divergent expected outcomes

A robust test pack should intentionally include cases where frameworks disagree.

1. Two blocked/designated direct shareholders at 30 and 25 percent, no joint arrangement.
2. Exactly 50 percent direct ownership.
3. A blocked person with 60 percent of an intermediate that owns 25 percent of the target.
4. A blocked person with 25 percent of an intermediate that owns 50 percent of the target.
5. A UK joint arrangement between two separate designated minority holders.
6. A minority holder with a right to appoint a majority of directors.
7. A minority holder with ordinary investor-protection vetoes but no broader direction rights.
8. A post-designation restructuring with a buyback option retained by the designated seller.
9. A historical case where the ownership structure changed between transaction date and review date.
10. A case where the ownership calculation is clear but the relevant sanctions regime does not apply to the bank entity or transaction being assessed.

Expected results should be legally reviewed. The test should assert intermediate reasoning as well as the final disposition, because a system can accidentally produce the correct outcome for the wrong reason and fail on the next structure.

Practitioner checkpoint

A practitioner should be able to explain why OFAC indirect ownership is not generic percentage multiplication; why OFAC aggregates blocked persons without a concert requirement; why the EU's 2024 Best Practices expressly include aggregate designated ownership; why the UK does not simply aggregate separate designated minority holdings absent the additional relationships described by OFSI; why exactly 50 percent matters differently; and why control evidence must be mapped to each framework rather than scored once globally.

If those distinctions are preserved in both procedure and technology, the bank can use one ownership dataset without pretending there is one sanctions ownership law.

Advanced practice: worked cross-regime cases

The cases below are fictional and use illustrative percentages. They are designed to practise legal reasoning, not to create universal outcomes. In every real case the bank must identify the applicable sanctions programme, jurisdiction, current legal text and authoritative guidance before deciding whether an entity, asset or transaction is restricted.

Case 1: two designated minority shareholders

Northstar Industrial is owned 30 percent by Designated Person A, 25 percent by Designated Person B and 45 percent by unrelated investors. A and B do not hold their shares jointly, there is no shareholder agreement between them, neither can appoint a majority of directors and there is no evidence that one controls the other's voting rights.

For an OFAC analysis, assume A and B are both blocked persons under the relevant programme. Their direct interests aggregate to 55 percent. Northstar is therefore blocked under OFAC's 50 Percent Rule even though neither blocked person individually reaches 50 percent.

For an EU asset-freeze analysis, the Council's 2024 Best Practices state that aggregated ownership by designated persons should be taken into account and expressly use a 30 percent plus 25 percent example. Subject to the relevant Council Regulation and facts, the ownership analysis therefore points toward Northstar being owned by designated persons.

For a UK analysis, the result is intentionally different. OFSI says it would not simply aggregate separate designated minority holdings unless, for example, the rights are held jointly, are subject to a joint arrangement or one designated person controls another's rights. On the facts given, the share-ownership limb is not met by adding 30 and 25. The analyst still tests the board and reasonable-expectation control limbs.

The lesson is not that one regime is stricter in every case. It is that aggregation mechanics differ and must remain regime labelled.

Case 2: the blocked intermediate company

Blocked Person X owns 60 percent of Holding Company H. H owns 25 percent of Target Company T. Another blocked person, Y, owns 30 percent of T directly.

A common OFAC calculation mistake is to say X's indirect interest is 60% × 25% = 15%, producing a total of 45 percent. FAQ 401 points to a different method. Because X owns 60 percent of H, H is itself blocked. H's 25 percent ownership of T is therefore a blocked-person interest. Combined with Y's direct 30 percent, blocked ownership of T is 55 percent and T is blocked under the 50 Percent Rule.

Now reverse the first percentage: X owns only 25 percent of H while H owns 50 percent of T. Assuming no other blocked ownership of H, H is not itself blocked from X's 25 percent holding. OFAC's examples do not treat X as indirectly owning 12.5 percent of T merely by multiplying percentages through the non-blocked intermediate.

The EU and UK analyses should be run separately. The bank should not reuse the OFAC blocked-intermediate calculation as though it were a universal indirect-ownership rule. Each system output should display the graph path and the specific regime rule that produced the conclusion.

Case 3: exactly 50 percent with governance rights

A joint venture is owned exactly 50 percent by Designated Person D and 50 percent by an unrelated company. D has two of four board seats. Major decisions require three votes, so D cannot make decisions unilaterally but can prevent some actions. There is no separate right to appoint a majority of directors.

Under OFAC, if D is a blocked person, exactly 50 percent ownership is enough for the 50 Percent Rule. The entity is blocked regardless of whether D can direct the board.

Under the EU Best Practices, the asset-freeze ownership criterion uses 50 percent or more, so exactly 50 percent is materially relevant to the ownership assessment. The applicable regulation and facts still need to be checked.

Under UK guidance, the share/voting ownership limb requires more than 50 percent, so exactly 50 percent does not satisfy that limb on its own. The analysis then moves to the other control criteria. The two-of-four board arrangement does not equal a right to appoint or remove a majority. The reasonable-expectation limb still requires a fact-specific assessment; the ability to block selected reserved matters should not automatically be equated with an ability to ensure that the company's affairs are conducted in accordance with D's wishes.

This case is a good test of whether an engine has encoded >=50 and >50 correctly and whether it can separate negative rights from broader control.

Case 4: divestment after designation

A designated shareholder owned 70 percent of a manufacturing company. After designation, the shareholder proposes to sell the entire stake to an apparently independent buyer. The sale agreement includes a buyback option exercisable at a favourable price, a five-year consulting agreement for the designated seller and a requirement that the buyer obtain the seller's approval before replacing the chief executive.

The bank should not decide this case from the new share percentage alone. It first asks whether the transaction itself is legally permitted and whether an authorisation or licence is required. It then examines purchaser independence, funding for the acquisition, payment of sale proceeds, governance rights, the buyback mechanism and the actual post-sale relationship.

The EU Council Best Practices specifically identify favourable buyback options, transfers close to designation and front-person arrangements as circumstances that can indicate retained control and warrant further analysis. The Commission's firewall guidance also shows that structural separation of a designated person's influence may require competent-authority involvement in relevant EU cases.

For the UK, the analyst applies the statutory ownership and control tests to the post-sale facts rather than assuming that a lower shareholding proves absence of control. For OFAC, if ownership falls below 50 percent, the 50 Percent Rule may cease to apply to the company, but the bank must still check whether assets remain blocked, whether the seller remains involved in the transaction, whether another sanctions prohibition applies and whether OFAC has separately designated the entity. The bank must not unfreeze property that remains legally blocked merely because an organisation chart changed.

The lesson is that divestment is both a legal-permission question and an evidence question.

Case 5: minority financing rights

A non-listed trading company has no designated shareholder above 10 percent. Its main lender, however, is owned by a designated person. The loan agreement gives the lender consent rights over new borrowing, extraordinary asset sales and changes to the company's line of business. A default would allow the lender to appoint a restructuring adviser and exercise security over substantial assets.

This is not enough information to pronounce the trading company controlled under every sanctions regime. Some creditor protections are ordinary features of financing and do not amount to direction of the company's affairs. Other packages can become much more intrusive, particularly where rights are exercisable in ordinary circumstances rather than only after default.

For an EU control analysis, the bank maps the actual rights to the control criteria in the Best Practices, including dominant influence, rights over assets and other relevant factors. For the UK, it asks whether the rights support either the board-appointment test or the reasonable-expectation test. For OFAC, the lender relationship does not convert the company into a blocked entity under the 50 Percent Rule merely because the lender or its owner has influence; other sanctions provisions and the blocked lender's involvement still need review.

The correct operational response may be information gathering, legal review, transaction restrictions relating to the lender itself, or a broader control conclusion depending on the facts. A rules engine should therefore output control assessment required rather than pretending every covenant has a universal legal value.

Case 6: a trust with different kinds of power

A private-bank customer is a corporate trustee. A designated settlor created the trust years earlier. The settlor no longer has legal title to trust assets but retains a power to appoint and remove the protector. The protector can replace the trustee and must consent to distributions. Beneficiaries are non-designated family members.

The sanctions question cannot be solved by asking only who legally owns the shares or securities held by the trust. The analyst needs the trust deed, amendments, protector powers, trustee discretion, distribution rights, revocation or amendment rights and actual instruction history.

Different jurisdictions can treat these powers differently. A bank should avoid using AML beneficial-ownership labels as a substitute for sanctions ownership/control analysis. The FATF beneficial-ownership framework is useful for understanding transparency and control concepts, but it does not replace OFAC, EU, UK or domestic sanctions rules.

The bank also separates entity/control analysis from asset analysis. Particular trust assets may be considered owned, held or controlled by a designated person under an applicable asset-freeze rule even where no corporate entity is being tested. Distributions to non-designated beneficiaries can raise a separate question about whether funds or economic resources are being made available to or for the benefit of the designated person.

The lesson is to model powers, assets and beneficiaries separately rather than compressing the trust into a single ownership percentage.

Case 7: a fund with a blocked 12 percent investor

A fund has a blocked person holding a 12 percent limited-partner interest. The remaining investors are non-blocked, and the blocked investor has no special governance rights. The fund itself is not separately designated.

The blocked investor's interest is important, but it does not automatically mean the entire fund is blocked under OFAC's 50 Percent Rule. The interest is below the ownership threshold and there is no basis in the facts for aggregating it with other blocked interests. The bank still needs to determine how the blocked person's fund interest, capital calls, distributions and any voting or consent rights must be treated.

Similarly, a bank should not assume that an EU or UK fund is automatically owned or controlled merely because one designated investor holds a modest percentage. The actual applicable ownership/control rules, investor rights and any indirect holdings must be assessed.

This case corrects a common 'look-through equals contamination' misconception. Look-through analysis identifies legal and risk exposures; it does not mean every designated person anywhere in a structure automatically sanctions the whole structure.

Case 8: corporate action changes the answer overnight

A listed company has a designated shareholder at 49 percent and unrelated public shareholders at 51 percent. A share buyback cancels enough public shares to lift the designated person's percentage to 51 percent without that person acquiring a single additional share.

The bank's monitoring should treat the corporate action as an ownership event. Under OFAC, if the shareholder is blocked, the company can cross into blocked status when aggregate blocked ownership reaches 50 percent. Under the UK share-ownership limb, moving above 50 percent can change the result. EU ownership analysis can also change.

This is why percentage monitoring cannot rely only on transfers into a designated person's account. Denominator changes caused by buybacks, cancellations, conversions and other corporate actions can alter the ownership ratio. Custody, corporate-actions and KYC systems therefore need event feeds capable of triggering sanctions recomputation.

Case 9: same group, different applicable regimes

A multinational group has a UK parent, an EU subsidiary and a U.S. branch of another group company. All three work with the same non-listed supplier whose ownership is the 30/25 structure from Case 1.

The ownership facts are shared, but legal applicability differs by entity and transaction. The U.S. branch cannot rely on the UK non-aggregation outcome where OFAC's 50 Percent Rule applies. The UK parent should not label the supplier UK-sanctioned solely because OFAC aggregates the two blocked owners. The EU subsidiary applies the relevant EU regulation and Council guidance.

Group policy may decide to refuse the supplier globally for risk-management simplicity, but policy should be recorded as policy. That distinction matters for customer communication, legal advice, regulator interaction and future policy changes.

The lesson is that global consistency is not achieved by pretending every jurisdiction has the same law. It is achieved by common facts, separate legal analysis and a transparent group-policy layer.

Case 10: missing information is not a clean result

A customer provides a structure chart showing 70 percent ownership by named shareholders and labels the remaining 30 percent 'other investors'. The bank's screening engine finds no designated person among the named holders and returns a green status.

That is not a valid ownership conclusion. The graph is incomplete. The missing 30 percent could contain one owner, several owners, nominees or persons whose holdings change aggregation results. The correct system state is insufficient ownership data or an equivalent unresolved status, with follow-up determined by the applicable legal and risk standard.

Data-quality controls should prevent missing ownership from being treated as zero. The same principle applies to unknown voting rights, missing shareholder agreements and stale registry information.

What good case documentation looks like

For each case, the analyst should be able to reconstruct the decision in a consistent order:

1. the ownership and control facts and their evidence;
2. the sanctions status of relevant people and entities by regime;
3. the bank entity, transaction, asset or service being assessed;
4. each applicable ownership/control test and its rule version;
5. any permissions, exceptions or licences;
6. unresolved facts or legal questions;
7. the operational action and its legal or policy basis;
8. the review trigger if the conclusion depends on changing facts.

That format is more valuable than a long narrative with no separation between facts, law and policy. It lets a second analyst, auditor or regulator see why the same company can receive different legal conclusions across regimes without assuming that one team made a mistake.

Practice close: the cross-regime analyst's playbook

Cross-regime ownership work is safest when facts, legal tests, policy choices and operational actions stay visibly separate. The following playbook converts that discipline into a repeatable workflow for investigators, sanctions operations, business analysts, architects and testers.

Step 1: define the object being assessed

Start by naming the exact object of the decision. It may be a legal entity, a shareholding, a bank account, a security, a payment, a trust asset, a vessel or another economic resource. Ownership of a company and ownership of a particular asset are related but not identical questions.

Also identify the bank entity, branch or person performing the activity. Sanctions law applies through jurisdictional rules, so a conclusion cannot be detached from who is acting, where and under which programme.

Step 2: build the ownership and control fact set

Collect the direct and indirect shareholders, voting rights, board appointment rights, joint arrangements, shareholder agreements, trust powers, material financing rights and other evidence that may affect control. Record effective dates and source dates.

Do not convert missing information into zero. If 20 percent of a structure is unknown, the graph is incomplete. The case should remain unresolved until the information gap is handled according to the applicable legal and risk standard.

Step 3: attach sanctions status by regime

A person may be designated or blocked under one framework and not another. Record the exact list or legal basis and effective date. Do not create a generic 'sanctioned person' label and then assume every regime produces the same result.

Step 4: apply each ownership test separately

For OFAC, apply the 50 Percent Rule and the indirect-ownership logic in the current FAQs. Aggregate blocked ownership interests. Do not replace OFAC's method with generic beneficial-ownership multiplication.

For the EU, apply the relevant Council Regulation together with current Council and Commission guidance. The 2024 Best Practices use 50 percent or more and say aggregated designated ownership should be taken into account.

For the UK, apply the relevant sanctions regulation and OFSI guidance. The share/voting threshold is more than 50 percent, and different designated persons' separate minority holdings are not simply aggregated without the additional relationships described by OFSI.

For UN-derived measures, identify both the Security Council measure and the domestic implementation applicable to the bank's conduct.

Step 5: perform the control analysis where the framework requires it

Control should be evidence based. Board appointment powers, voting agreements, dominant influence, rights over assets, joint arrangements and actual direction can matter. Ordinary minority-protection rights do not automatically equal sanctions control.

Do not create a universal control score and treat it as law. A score may help triage or organise evidence, but the legal conclusion must map back to the applicable framework.

For OFAC specifically, remember that sub-50-percent control does not automatically block an entity under the 50 Percent Rule. FAQ 398 requires that distinction to remain explicit.

Step 6: check the actual prohibition or permission

An ownership/control result is not the end of the analysis. Identify what the applicable measure prohibits: dealing with frozen property, making funds or economic resources available, providing specified services, entering certain transactions or another restriction.

Then check exceptions, licences, authorisations or derogations. A bank should not assume that a licence in one jurisdiction changes the result in another.

Step 7: build an obligation matrix

Instead of saying 'the strictest regime wins', record each applicable conclusion independently.

A simple matrix can contain:

Where applicable obligations are compatible, the bank chooses an action that satisfies them all. Where laws genuinely conflict, the case goes to legal review. Internal group policy is recorded separately from the legal conclusion.

Step 8: communicate the result precisely

Customer communication should explain what the bank can or cannot do without overstating the legal position. 'Our policy does not permit us to process this payment' is different from 'your company is legally sanctioned under UK law.' The latter requires an actual UK legal basis.

If the bank needs ownership evidence, ask for the information required to decide the case. Avoid revealing investigative details unnecessarily, but do not use 'confidentiality' as a reason to give the customer no meaningful path to provide missing evidence.

Failure modes to watch

The most common failures are predictable.

Using one threshold globally. This causes exactly-50-percent errors and UK aggregation errors.

Multiplying percentages through every OFAC chain. FAQ 401 uses the blocked status of intermediate entities, not a generic beneficial-ownership formula.

Treating control as automatic under OFAC. Control below the ownership threshold is not automatic blocking under the 50 Percent Rule.

Ignoring EU aggregation. The 2024 Best Practices expressly include aggregate designated ownership.

Aggregating separate UK designated minorities automatically. OFSI expressly says it would not simply do so absent the relevant joint or controlled-rights relationship.

Treating ordinary veto rights as universal control. The legal effect depends on the scope of the rights and the applicable framework.

Using today's structure to decide yesterday's transaction. Historical cases require effective-dated facts and rule versions.

Treating missing data as clean. Unknown ownership is an unresolved fact, not a zero.

Calling policy a legal requirement. Group risk appetite may be broader than law, but the distinction should remain visible.

BA acceptance criteria

A business analyst can use the following acceptance criteria when defining ownership functionality:

1. The system stores direct ownership and voting rights separately.
2. Indirect ownership paths retain the intermediate entities rather than storing only a final percentage.
3. The system can represent joint ownership, joint arrangements and control of another holder's rights.
4. Rules are versioned by regime and effective date.
5. OFAC calculations follow current FAQ logic and aggregate blocked interests.
6. EU calculations can apply aggregate designated ownership and a separate control assessment.
7. UK calculations do not simply aggregate different designated minority holders without the additional facts required by OFSI guidance.
8. Exactly 50 percent can produce a different UK percentage-limb result from OFAC/EU.
9. Missing ownership or control information returns an unresolved state rather than clearance.
10. The result identifies whether it is a fact, legal-rule output, risk indicator or policy decision.
11. Each conclusion shows the evidence and graph path that contributed to it.
12. A designation or ownership event can trigger recomputation across affected connected entities.
13. Historical assessments can be reconstructed using effective-dated data and rule versions.
14. Human escalation is available for control, conflict-of-laws and uncertain attribution questions.

Tester scenarios

Testing should include both positive and negative cases. Test not only structures that clearly cross thresholds, but also structures that should not be automatically restricted.

A strong regression pack includes a 30/25 aggregate case, an exactly-50 case, a 51-percent case, a blocked intermediate company, a non-blocked intermediate with a sub-50 blocked owner, a UK joint arrangement, separate UK minority holders without a joint arrangement, a board-appointment control case, ordinary minority veto rights, an incomplete ownership graph and a historical ownership change.

Negative tests are essential. If the engine labels every company with a designated 20-percent shareholder as blocked, it is not conservative; it is legally inaccurate.

Analyst development

Ownership analysis is a specialist skill because it combines corporate structures, sanctions law, data quality and operational consequences. Training should progress from direct ownership to indirect chains, aggregation, control, trusts, funds, corporate actions and multi-regime conflicts.

Reviewers should challenge the reasoning, not only the final disposition. A correct result reached through the wrong method is a latent defect. The next case may expose it.

Final practitioner checklist

Before closing the case, the analyst should be able to answer these questions clearly:

What exactly is being assessed? Which bank entity or person is acting? Which sanctions regimes apply? What are the verified ownership and control facts as of the relevant date? How does each regime treat those facts? What prohibition or permission follows? Is any legal conflict unresolved? What is the operational action? Is the action law, licence, or internal policy? What event will cause the decision to be reviewed again?

If any answer is hidden inside a generic 'sanctions match' field, the analysis is not yet ready for closure.

Masterclass: governing multi-regime ownership analysis

Ownership and control analysis becomes unreliable when legal interpretation, customer data, sanctions operations and rule-engine logic evolve separately. A strong bank treats the capability as a governed product: legal sources are versioned, ownership data is quality-controlled, calculations are explainable, difficult control questions have a defined escalation path and operational teams can show exactly why an entity or asset was treated in a particular way on a particular date.

Methodology ownership

A named sanctions methodology owner should maintain the comparative framework across U.S., EU, UK and other material regimes. The role is not to decide every case personally. It is to make sure procedures state the right questions, source material is current, regime differences remain visible and legal changes are translated into requirements before systems and analysts drift apart.

The methodology inventory should identify, for each supported regime, the authoritative source, rule version, ownership threshold or method, aggregation logic, control criteria, indirect-ownership method, relevant exceptions or permissions, required evidence, operational consequences and legal-referral triggers. Programme-specific rules should sit below the general framework where necessary. A generic global threshold is not acceptable simply because it is easier to code.

Material interpretive changes should be assessed for three impacts: new decisions going forward, existing open cases and historical positions that may require lookback. A change to an ownership calculation can affect customers, securities positions, payments and correspondent exposures simultaneously, so change governance needs an impact map rather than a sanctions-policy memo alone.

Legal interface

Legal involvement is most valuable where facts are clear but the consequence is not. Examples include ambiguous control rights, unusual trusts, competing interpretations of a joint arrangement, conflicts between applicable regimes, post-designation restructuring, a proposed firewall, and whether a licence or authorisation covers the precise transaction.

Case referrals should contain the ownership graph, effective dates, sanctions status by regime, the exact bank activity being assessed and the competing possible conclusions. Sending counsel a vague question such as 'is this entity sanctioned?' wastes time and encourages an answer detached from the transaction.

Legal advice should be implemented as a rule or case decision with scope. If advice covers one programme, one entity chain or one fact pattern, the system should not silently generalise it to all programmes. Advice should also have review triggers where a guidance update, designation, ownership event or contractual change can make the earlier conclusion stale.

Assurance of calculation logic

Independent assurance should test the reasoning path, not only whether the final disposition happened to be correct. A sample should include threshold-boundary cases, indirect OFAC chains, multiple designated owners, EU aggregation, UK non-aggregation, control cases, restructuring and historical reconstructions.

A particularly useful assurance technique is parallel re-performance. The reviewer rebuilds the result from the source ownership graph and the cited rule version without looking at the analyst's conclusion first. Differences can then be classified as data defects, rule defects, interpretation defects or documentation defects.

Technology assurance should include unit tests for rule logic and scenario tests for end-to-end outcomes. The following defects should be treated as high severity because they can create systematic legal errors:

• a universal >=50% threshold across all regimes;
• ordinary multiplication through OFAC indirect chains;
• a universal aggregate-designated-percentage field driving UK decisions;
• control indicators automatically converting an OFAC sub-50 entity to blocked status;
• missing ownership being treated as zero;
• rules running without an effective date or version;
• an entity conclusion being reused for a specific asset without testing the asset's ownership or control.

The group-policy layer

Global banks often adopt policies that are broader than the minimum legal requirement in one jurisdiction. That can be sensible for operational simplicity, correspondent expectations, risk appetite or reputational reasons. The problem begins when policy is described as though every jurisdiction legally requires it.

A well-designed system keeps three layers visible:

1. Facts: ownership, voting rights, governance rights, sanctions status and effective dates.
2. Legal conclusions: the result of each applicable regime and programme.
3. Policy decision: the bank's chosen group restriction where policy goes beyond law.

That separation allows the bank to explain a refusal accurately, update policy without rewriting legal history and demonstrate to regulators that the underlying sanctions analysis was correct even where the bank chose a more conservative commercial position.

Data governance

Ownership data comes from customers, registries, corporate documents, vendors and investigations. Every source has limitations. Governance should define what evidence is acceptable for low-risk routine structures and what needs independent corroboration for high-consequence conclusions.

The minimum quality dimensions are completeness, freshness, identity resolution, effective dating and provenance. Completeness asks whether all relevant owners and rights are known. Freshness asks whether a source could have become stale after a corporate event. Identity resolution confirms that the shareholder is the same person or entity as the sanctions-list subject. Effective dating establishes when the relationship existed. Provenance records where the fact came from.

Vendor data can accelerate discovery but should not become an unexplained legal truth. If a provider supplies an 'owned or controlled' flag, the bank should know which regime, rule version, ownership chain and evidence produced it. Black-box conclusions are particularly risky when frameworks disagree.

Change events and recomputation

Ownership analysis should behave like a graph-monitoring capability, not an annual KYC exercise. Designations, delistings, share transfers, buybacks, conversions, board-right changes, mergers, insolvency, trust amendments and shareholder agreements can all change the result.

The change architecture should identify affected downstream entities and rerun relevant regime tests. A new designation of one natural person may require hundreds of connected-company assessments. Conversely, a divestment can reduce exposure but should not automatically release frozen property where legal conditions or authority approval remain unresolved.

The recomputation record should show the trigger, before-and-after ownership graph, rule version, new conclusion and operational actions generated. That becomes valuable evidence during audit and enforcement review.

Customer challenge and contrary legal opinions

Customers may dispute ownership findings and provide their own legal opinions. The bank should have a fair process for reviewing contrary evidence without allowing commercial pressure to bypass controls.

A fresh reviewer should test whether the customer presents new facts, a different interpretation of the same law or a different view of which regime applies. Material legal disagreement should be escalated to the bank's legal process. If the bank maintains a policy restriction beyond the legal minimum, the customer communication should say so accurately rather than stretching the legal analysis to justify the policy.

The review record should preserve both positions and the reason for the final decision. This is particularly important where the issue concerns control rather than a simple percentage because reasonable interpretations may depend on detailed contractual facts.

Confidentiality and evidence handling

Ownership investigations can involve personal data, confidential corporate agreements, legal advice and sensitive sanctions intelligence. Handling rules depend on jurisdiction and the nature of the material. The operational principle is not that one confidentiality rule always overrides another; it is that evidence should be collected, accessed, retained and disclosed under the bank's applicable legal and information-governance framework.

Analysts should not make independent conclusions about legal professional privilege, data-subject rights or disclosure exceptions where those questions are material. They should use the bank's legal and privacy procedures. Likewise, confidentiality concerns should not be used as a reason to keep insufficient evidence for a sanctions conclusion: the bank still needs a defensible record, stored with appropriate access controls.

Management information that reveals control quality

Useful MI measures the capability, not raw alert volume. Examples include ownership-data completeness, age of critical ownership evidence, number of unresolved control cases, time to recompute after a designation, percentage of decisions with explainable graph paths, overturn rate in QA, defects by regime, and cases where group policy rather than law determined the outcome.

A rising number of ownership alerts can mean more risk, better detection or poorer data. MI should therefore combine volume with quality and outcome. Threshold-boundary cases and legal-referral ageing deserve particular attention because they concentrate both legal and customer-impact risk.

Skills and succession

Cross-regime ownership analysis is specialised enough that capability should not depend on one experienced analyst. Training should progress from direct shareholding through OFAC indirect ownership, EU and UK divergence, control rights, trusts, funds, corporate actions and complex restructuring.

Competence should be demonstrated through worked cases with divergent expected outcomes. An analyst who can memorise '50 percent' but cannot explain why a 30/25 structure differs across OFAC, EU and UK is not yet ready for independent complex-case decisions.

Senior reviewers should document recurring reasoning patterns and convert them into scenarios, procedures and rule-engine tests. That is how specialist judgement becomes institutional capability rather than disappearing when people change roles.

Architecture roadmap

A practical technology roadmap begins with the ownership graph, not artificial intelligence. Stage one is reliable effective-dated entity and ownership data. Stage two adds regime-specific rule engines and explainable calculation paths. Stage three adds automated change-event propagation and case orchestration. Only after those foundations are reliable should advanced analytics be used to discover hidden links or extract governance rights from documents.

Any machine-assisted extraction should preserve the source text and confidence, allowing a human to verify material rights before they drive legal conclusions. A model can identify a clause that appears to give veto power; it should not silently decide that the clause satisfies a sanctions-control test.

The objective is not maximum automation. It is controlled automation: machines handle repeatable graph traversal and arithmetic, while specialists decide genuinely interpretive questions with evidence and legal support.

Connecting the surrounding course

This chapter sits between customer ownership due diligence and operational sanctions controls. Customer screening needs the ownership result to identify entities absent from sanctions lists. Payment screening and interdiction need to know whether a counterparty is legally restricted even without a name hit. Licensing needs the exact legal basis of the restriction. Asset management and corporate-actions teams need to distinguish a frozen shareholding from the status of the issuer. Investigators need the effective-dated graph to explain what the bank knew at the time of a transaction.

That is why ownership and control cannot be treated as a specialist spreadsheet attached to a case. It is shared control infrastructure across customer, payment, custody, trade and reporting processes.

Masterclass close

A mature bank can answer five questions quickly: what are the verified ownership and control facts; which regimes actually apply; how does each regime treat those facts; what legal or policy obligation follows; and can the decision be reconstructed later from the rule version and evidence used.

If the answer is instead 'the screening vendor marked the company sanctioned,' the control is not mature enough for a cross-regime ownership decision.

Knowledge checks with explained answers

1. An entity is 45 percent owned in aggregate by OFAC-blocked persons, and one blocked person has strong influence over management. Is the entity automatically blocked under OFAC's 50 Percent Rule?

No. The 50 Percent Rule requires direct or indirect aggregate ownership of 50 percent or more by blocked persons. OFAC FAQ 398 states that an entity controlled by blocked persons but not owned 50 percent or more in the aggregate is not automatically blocked under that rule. The influence still matters: the bank should check whether another sanctions prohibition applies, whether blocked persons are participating in the transaction, whether the entity has been separately designated and whether the facts warrant escalation. But the system should not convert the control indicator into an automatic 50 Percent Rule result.

2. Why can a 30 percent plus 25 percent ownership structure produce different results in OFAC, EU and UK analysis?

Because aggregation rules differ. OFAC aggregates direct and indirect ownership interests of blocked persons, so 30 plus 25 reaches 55 percent. The Council of the EU's 2024 Best Practices state that aggregated ownership by designated persons should be taken into account and use a 30 plus 25 example. Current UK OFSI guidance, however, says it would not simply aggregate different designated persons' separate minority holdings unless, for example, the rights are held jointly, are subject to a joint arrangement or one designated person controls another's rights. The UK control limbs must still be assessed separately.

3. Why is ordinary multiplication through a corporate chain unsafe for OFAC's 50 Percent Rule?

OFAC FAQ 401 uses the blocked status of intermediate entities. If blocked Person X owns 60 percent of Company H, H is itself blocked. If H owns 25 percent of Target T, H's full 25 percent interest is a blocked-person ownership interest for the next step. It is not reduced to 15 percent by multiplying 60 percent by 25 percent. Conversely, if X owns only 25 percent of H, H is not blocked from that holding alone, and OFAC's published examples do not simply treat X as indirectly owning 25 percent of every company H owns by mathematical look-through. A rule engine must reproduce the sanctions rule, not a generic beneficial-ownership formula.

4. Does exactly 50 percent mean the same thing in the three major frameworks discussed in this chapter?

No. OFAC's rule is 50 percent or more in the aggregate. The EU Council Best Practices use 50 percent or more for the asset-freeze ownership criterion. UK OFSI guidance uses more than 50 percent for the share or voting-right ownership limb. Exactly 50 percent can therefore satisfy the U.S. and EU percentage criterion while not satisfying the UK percentage limb by itself. Other control tests and programme-specific provisions may still affect the final result.

5. A minority shareholder has veto rights over extraordinary asset sales and new debt. Does that automatically mean sanctions control?

No. The analyst must understand the scope and practical effect of the rights and map them to the applicable control framework. Some vetoes are ordinary minority or creditor protections; others can contribute to dominant influence or an ability to ensure that the entity's affairs follow the person's wishes. EU and UK control analyses are fact specific. Under OFAC, sub-50-percent control does not automatically make the entity blocked under the 50 Percent Rule.

6. A trustee says a post-designation restructuring removed the designated settlor's influence. Can the bank release frozen assets on that statement alone?

No. The bank should first establish whether the restructuring and any release are legally permitted and whether a licence or authorisation is required. It then verifies the actual change: independence of new officeholders, amendment validity, retained powers, buyback or side arrangements, benefit flows and behaviour after restructuring. A new organisation chart does not itself prove that control ended, and the status of particular frozen assets must be assessed separately from the status of the entity or trust arrangement.

7. A convertible instrument could give a designated investor majority ownership in the future, but the conversion right is not yet exercisable and the investor has no current control rights. Is the company already owned or controlled merely because of the future possibility?

Not necessarily. Contingent rights need to be analysed under the applicable legal framework and their current legal effect. A future conversion possibility should trigger monitoring and effective-date controls, but it should not automatically be treated as present ownership or control without a legal basis. If the instrument also carries current voting, appointment, consent or other influence rights, those present rights are assessed separately. The system should distinguish current rights from contingent future rights.

8. Why must the bank distinguish a frozen shareholding from the sanctions status of the company that issued the shares?

Because an asset and an entity are different legal objects. A designated person's shares can be frozen even where the issuer is not itself owned or controlled at the threshold required for restrictions to extend to the issuer. Conversely, an owned or controlled entity may itself be restricted even though the bank does not hold the designated person's personal assets. Custody, dividends, corporate actions and payments therefore need the conclusion attached to the correct asset or legal entity.

9. How should historical ownership questions be answered when the current structure is different?

Use effective-dated reconstruction. The bank needs the ownership and control facts that existed at the relevant time, the sanctions status of the parties then, the rule or guidance version applied and the evidence available. Applying today's organisation chart to last year's payment can produce a false answer. Historical rule versions matter because thresholds and guidance can also change.

10. A fund has a blocked investor holding 12 percent and no special governance rights. Is the whole fund automatically blocked under OFAC's 50 Percent Rule?

No, not from those facts alone. The blocked investor's interest needs appropriate frozen-property treatment and the bank should review capital calls, distributions and any other rights, but a 12 percent interest does not satisfy the 50 Percent Rule by itself. The fund still requires analysis for other blocked interests, indirect ownership, control and other sanctions provisions. Look-through identifies exposure; it does not mean every designated interest contaminates an entire structure automatically.

11. What should happen when the bank has identified only 70 percent of a customer's ownership and the remaining 30 percent is unknown?

The result should remain unresolved according to the bank's applicable due-diligence and sanctions standard. Unknown ownership is not zero ownership. The system should carry an information gap and prevent a green legal conclusion that depends on assuming the missing shareholding is harmless.

12. What should the bank do when a customer invokes commercial confidentiality and refuses to provide ownership information needed for sanctions analysis?

The bank should explain the information required and apply its legal, regulatory, contractual and risk-management procedures for insufficient due diligence. The outcome may include restricting or declining the activity if the bank cannot establish that it can lawfully proceed, but the response should not be framed as a universal rule that confidentiality is legally overridden in every jurisdiction. Data-protection, confidentiality and disclosure obligations differ, while the bank still needs enough evidence to make a defensible sanctions decision.

Glossary of working terms

50 Percent Rule: OFAC's rule under which an entity owned directly or indirectly 50 percent or more in the aggregate by one or more blocked persons is itself considered blocked, even if not separately named on the SDN List.

Aggregate ownership: the combination of relevant ownership interests under the rules of a particular sanctions framework. OFAC, EU and UK treatment must not be assumed identical.

Control: the ability or legal right to direct or materially determine an entity's affairs under the criteria of the applicable sanctions framework. Control is not one universal global test.

EU ownership criterion: under the Council's 2024 Best Practices for asset-freeze measures, ownership generally means 50 percent or more of proprietary rights or a majority interest; aggregated designated ownership should also be taken into account.

UK ownership limb: under OFSI general guidance, more than 50 percent of shares or voting rights held directly or indirectly by a designated person. Separate control limbs include majority board appointment/removal rights and the reasonable-expectation test.

Joint arrangement: an arrangement under which parties exercise rights jointly. In UK guidance it can be relevant to whether holdings of different designated persons are considered together; it should be established from facts rather than inferred merely because shareholders are related or aligned commercially.

Indirect ownership: ownership through one or more intermediary entities. The method for attributing indirect ownership is regime specific. OFAC FAQ 401 should not be replaced with generic percentage multiplication.

Ownership graph: the effective-dated network of natural persons, entities, ownership percentages, voting rights and governance relationships used as factual input to regime-specific sanctions tests.

Rule version: the dated legal or guidance logic used for a sanctions conclusion. Retaining the rule version supports historical reconstruction and controlled change management.

Obligation matrix: a record showing which regimes apply, the ownership/control conclusion under each, the resulting prohibition or permission and the operational action. It is preferable to an unexplained 'strictest regime wins' severity score.

Policy overlay: a bank restriction or risk-appetite decision that is broader than the minimum legal conclusion. Policy should be labelled as policy rather than described as though it were a legal requirement in every jurisdiction.

Effective dating: recording when ownership, control rights, sanctions status and rule versions became effective so the bank can reconstruct the position at a past transaction or decision date.

Firewall: a structural safeguard intended to prevent a designated person from exercising ownership or control in circumstances recognised by the relevant authority or legal framework. It is not a universal self-help mechanism and may require competent-authority involvement.

Unresolved ownership: a state in which material ownership or control information is missing or insufficiently verified, so a defensible legal conclusion cannot yet be made.

References and further reading

The ownership and control rules compared in this chapter are not one global standard. Live cases should be decided from the current sanctions measure and authoritative guidance applicable to the relevant bank entity, person, asset and transaction. The sources below were reviewed for this chapter on 17 September 2026.

United States — OFAC

• U.S. Treasury, Office of Foreign Assets Control — FAQ 398: control below 50 percent does not automatically block an entity under OFAC's 50 Percent Rule: https://ofac.treasury.gov/faqs/398
• U.S. Treasury, Office of Foreign Assets Control — FAQ 399: aggregation of blocked persons' ownership interests: https://ofac.treasury.gov/faqs/399
• U.S. Treasury, Office of Foreign Assets Control — FAQ 401: indirect ownership and complex ownership structures: https://ofac.treasury.gov/faqs/401
• U.S. Treasury, Office of Foreign Assets Control — Entities Owned by Blocked Persons, 50 Percent Rule FAQ topic: https://ofac.treasury.gov/faqs/topic/1521
• U.S. Treasury, Office of Foreign Assets Control — Sanctions Programs and Country Information for programme-specific measures: https://ofac.treasury.gov/sanctions-programs-and-country-information

European Union

• Council of the European Union — EU Best Practices for the effective implementation of restrictive measures, document ST 11623/2024 INIT, 3 July 2024. See the asset-freeze ownership and control discussion, including the 50-percent-or-more criterion, aggregated designated ownership example and control criteria: https://data.consilium.europa.eu/doc/document/ST-11623-2024-INIT/en/pdf
• European Commission — Guidance on firewalls, 29 November 2023, on safeguards intended to remove designated-person control in appropriate authorised circumstances: https://finance.ec.europa.eu/publications/guidance-firewalls_en
• European Commission — Asset freeze and prohibition to provide funds or economic resources, current sanctions FAQ collection: https://finance.ec.europa.eu/publications/asset-freeze-and-prohibition-provide-funds-or-economic-resources_en
• European Commission — Overview of sanctions and related resources: https://finance.ec.europa.eu/eu-and-world/sanctions-restrictive-measures/overview-sanctions-and-related-resources_en

United Kingdom

• HM Treasury, Office of Financial Sanctions Implementation — UK financial sanctions general guidance, updated 12 May 2026. Chapter 4 covers ownership and control, joint interests, aggregation and due diligence: https://www.gov.uk/government/publications/financial-sanctions-general-guidance/uk-financial-sanctions-general-guidance
• HM Treasury, Office of Financial Sanctions Implementation — UK Financial Sanctions FAQs, including FAQ 4 on separate designated minority shareholders and aggregation: https://www.gov.uk/government/publications/uk-financial-sanctions-faqs/uk-financial-sanctions-faqs
• UK Government — Ownership and Control: Public Officials and Control guidance, updated 20 August 2024: https://www.gov.uk/government/publications/ownership-and-control-public-officials-and-control-guidance/ownership-and-control-public-officials-and-control-guidance
• UK Government — UK sanctions guidance for non-UK businesses, including ownership and control explanations: https://www.gov.uk/guidance/uk-sanctions-guidance-for-non-uk-businesses
• UK Government — The U.S. and UK Economic Sanctions Authorities: A Comparative Overview, published in 2026, including an official comparison of OFAC and OFSI ownership approaches: https://www.gov.uk/government/publications/the-us-and-uk-economic-sanctions-authorities-a-comparative-overview/the-us-and-uk-economic-sanctions-authorities-a-comparative-overview

United Nations

• United Nations Security Council — Explanation of terms relating to asset freezes, including owned, held or controlled funds and economic resources: https://main.un.org/securitycouncil/sites/default/files/eot_assets_freeze_-_english.pdf
• United Nations Security Council — Sanctions Committees and other subsidiary organs for the current wording of programme-specific measures and designation information: https://main.un.org/securitycouncil/en/sanctions/information

Background on beneficial-ownership transparency

• Financial Action Task Force — Guidance on Beneficial Ownership of Legal Persons: https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Guidance-Beneficial-Ownership-Legal-Persons.html

FATF beneficial-ownership guidance is useful for customer transparency, evidence and corporate-structure understanding, but it is not a substitute for the ownership and control test in an applicable sanctions regime.

Accuracy note

Thresholds, aggregation methods, control guidance, licences, programme scope and enforcement positions can change. This chapter deliberately distinguishes U.S., EU, UK and UN-derived approaches rather than presenting one rule as universal. Before a live decision, confirm the current legal measure and authoritative guidance for every applicable regime and obtain legal advice where ownership or control is genuinely ambiguous.