My prompt:

let’s assume I see a new set of designations from a regulator who has some sort of ownership and control sanctions requirement. How would I research to find the additional entities implicated by this? What sources would I be looking at – both global coverage and ones with more targeted geographic coverage (e.g. Iran or Crimea)? And how much of this can you do, and what are you not able to , and why?

and the response:

Good question, and the timing is useful because there’s a live example running right now: BIS just built a brand-new automatic O&C mechanism into the export control system. The Affiliates Rule automatically extends the Entity List and Military End-User List to entities owned 50 percent or more by listed entities, modeled explicitly on OFAC’s rule. It was adopted as an interim final rule with immediate effect in September 2025, then stayed by BIS until November 9, 2026 – so it reactivates in three months. That’s a genuinely useful anchor for this answer since it’s exactly the “new O&C requirement, now go find the implicated universe” scenario you’re describing.

First, the framing question that determines your whole approach: is this regime self-executing or discretionary?

• Self-executing/arithmetic regimes (OFAC’s 50% Rule, OFSI’s 2022 update, and BIS’s Affiliates Rule once it’s live) don’t require the regulator to take further action – an entity is captured the moment aggregate ownership crosses the threshold, regardless of whether it’s ever named. Your research task here is essentially corporate math: build the ownership tree and sum the stakes held by listed/blocked parties.
• Discretionary/control-test regimes (the EU’s “owned or controlled by” doctrine, and UK guidance beyond the pure ownership percentage) require an affirmative designation or a documented control assessment – board composition, contractual control, negative control rights, etc. Here you’re not doing arithmetic, you’re building an evidentiary case, and “implicated” doesn’t mean “automatically caught,” it means “worth flagging as a candidate.”

Worth noting on the BIS rule specifically, since it’s new: if Company A, an Entity List party, owns 50 percent of Company B, which owns 50 percent of Company C, Company C is subject to the same restrictions as Company A – so it chains through multiple tiers, and the rule applies regardless of the foreign country in which the affiliate is located. It also creates an affirmative duty to determine ownership rather than letting silence default to clear.

Research workflow, roughly in order:

1. Start with the regulator’s own materials – the designation notice, Federal Register/OJEU entry, and any accompanying press release or FAQ. Regulators frequently name known subsidiaries in the announcement itself (Treasury in particular tends to do this for network-style designations, e.g. IRISL-related actions), which shortcuts a lot of downstream work.
2. Pull the existing entry’s own metadata – AKAs, “linked to,” prior addresses, registration numbers. This is the cheapest signal and gets skipped constantly.
3. Confirm the exact threshold mechanic for that regime (aggregate vs. per-owner, direct vs. indirect, does it chain through unlisted intermediate tiers).
4. Build the tree in both directions – not just subsidiaries down, but parents and sibling entities, since aggregation across multiple blocked co-owners can trip the threshold even when no single owner does.
5. Cross-check each node against the list itself – a subsidiary you find might already be separately listed under a different name.
6. Validate anything load-bearing against a primary-source document (registry filing, share register, annual report), not a secondary aggregator’s summary.
7. Flag and document anything where ownership can’t be resolved – under a rule like BIS’s this is now itself a compliance-relevant fact, not a dead end.

Sources – global coverage:

• OpenCorporates – aggregates official company registries, decent free tier
• Moody’s Orbis/Bureau van Dijk, Sayari Graph, LSEG World-Check, LexisNexis Risk Solutions (Dow Jones’s old risk data now sits inside RELX alongside your former employer Accuity) – all paid, all built for exactly this
• OpenSanctions.org – free for non-commercial use, and genuinely useful here: it structures identifying information consistently so that relationships between entities, like company ownership or control, can be easily identified, integrating data from 444 global sources
• OCCRP Aleph and ICIJ’s Offshore Leaks Database – investigative-journalism-sourced, unusually good at surfacing offshore shell layers that official registries don’t show
• Open Ownership (the BODS standard) – complements OpenSanctions for beneficial-ownership-specific queries
• Primary registries where they’re genuinely free: UK Companies House + PSC register, SEC EDGAR, EU member-state beneficial ownership registers (coverage is uneven post-rollback in some states)

Targeted – Iran:

Iran-linked evasion structures are disproportionately asset-based (vessels, shipping management companies) rather than pure holding-company trees, so vessel data matters as much as corporate data:

• Equasis – free, gives registered owner/manager/flag history, essential for IRISL-descendant fleets
• Lloyd’s List Intelligence / Windward – AIS tracking and beneficial-ownership-behind-flag analysis, paid
• UANI and TankerTrackers.com – track Iran-linked shadow fleet vessels and front companies specifically
• C4ADS – has published detailed network maps of IRISL/NITC successor structures
• Treasury’s own past IRISL-related press releases and designation packages, since OFAC did a lot of this mapping itself over 15+ years

Targeted – Russia/Crimea:

• EGRUL/EGRIP-based aggregators (Kontur.Focus, SPARK-Interfax, Rusprofile) – the authoritative underlying data, but increasingly hard to access from outside Russia and typically require Russian payment/phone verification
• OpenSanctions and OCCRP Aleph both scrape a meaningful amount of EGRUL data already, so they’re often the more practically accessible route to the same underlying facts
• KSE Institute’s Leave Russia tracker – useful for corporate exit/restructuring signals
• YouControl – Ukrainian-sourced data with good Russia-adjacent coverage
• Ukraine’s own NSDC/”War and Sanctions” designations – frequently anticipate or run parallel to Western lists and come with their own ownership rationale worth cross-referencing
• RUSI and Transparency International UK – both have done sustained investigative work specifically mapping Russian elite ownership networks

What I can and can’t do here, honestly:

I can search the open web, read regulator press materials and FAQs, pull from freely accessible registries, and synthesize investigative/NGO reporting – and I can help you build and document the research workflow itself, with citations kept separate from inference.

What I can’t do, and the reasons matter for how you’d rely on this:

• No login or API access to any paid platform – Sayari, Orbis, World-Check, LexisNexis Risk, Kontur/SPARK. I have no account, no credentials, and no way to acquire them mid-session even if you have a license, so anything behind those walls I simply cannot see.
• No independent verification of an ownership percentage. If I surface a number from a news article or aggregator, that’s secondhand until checked against a primary document – I’ll flag it as such rather than presenting it as established.
• No guaranteed completeness. Web search samples the indexed internet; it doesn’t exhaustively traverse a six-tier ownership graph the way a purpose-built product claims to, and coverage of non-English-language and offshore-secrecy-jurisdiction filings is systematically thin. Absence of a hit from me is not evidence the entity isn’t captured.
• Can’t get past geo-blocking or verification walls (EGRUL-adjacent systems requiring Russian phone/payment being the clearest case).
• Can’t make the actual compliance determination – whether to block, whether the evidence meets your institution’s risk threshold – that’s a licensed judgment call, not a factual output, and especially with a discretionary-control regime like the EU’s, it’s inherently a judgment exercise, not a lookup.
• On genuinely obscure multi-hop chains, an LLM’s biggest risk is producing a plausible-sounding structure that isn’t actually sourced. I’ll cite as I go specifically so that risk stays visible to you rather than hidden in confident prose.