Category: Ownership and Control

  • Followup prompt:

    Actually, I do have a question: If I provided an update, could you pull all the info you could, plus identify for each listing, where else I should look, based on the nature of the listing?

    and the response (ignore the fact that Claude and I already have a relationship):

    Yes – and it would layer naturally on top of your existing reformatting workflow rather than replace it.

    For each listing you pass along, I’d do two separate things. First, pull whatever’s publicly findable on it – press releases, prior designation history, news coverage, anything that adds context beyond the bare SDN entry. Second, and this is the part you’re actually asking about, tell you specifically where to go dig further, chosen by what kind of listing it is rather than handing you the same generic list every time.

    That second part is where the nature of the listing matters. A few examples pulled straight from the pattern in your own recent updates:

    • A vessel or shipping entity tied to an Iran designation (HormuzSafe, the shadow fleet tankers) – I’d point you to Equasis for registered owner, manager, and flag history, plus Windward or Lloyd’s List Intelligence and UANI or C4ADS for the network picture.
    • A crypto exchange entity like the Shelbit network – blockchain analytics platforms (Chainalysis, TRM Labs, Elliptic) and on-chain explorers matter more here than corporate registries, since the trail runs through wallets as much as paperwork.
    • A Cuba military-industrial entity tied to GAESA or MINFAR (Tecnoimport, UIM) – ASCE and Cuba Study Group research tend to go deeper than general corporate databases, since a lot of that structure never shows up in any commercial registry.
    • A Russia entity – OpenSanctions or OCCRP Aleph first, since they’ve already scraped a good deal of EGRUL, then the Ukrainian NSDC list and the KSE tracker for anything more recent than what’s been indexed.
    • A plain corporate or individual addition with no obvious sector hook – OpenCorporates and the registry of wherever it’s domiciled, plus a check of whether OFAC’s own AKA or Linked To fields already answer the question.

    One caveat, consistent with what I said earlier: the first half I can actually run myself. The second half means I’m handing you the right door, not opening it – I still can’t get past the paywalls on Orbis, Sayari, or Kontur/SPARK, so for anything that needs those, that’s where you’d take it from there.

  • My prompt:

    let’s assume I see a new set of designations from a regulator who has some sort of ownership and control sanctions requirement. How would I research to find the additional entities implicated by this? What sources would I be looking at – both global coverage and ones with more targeted geographic coverage (e.g. Iran or Crimea)? And how much of this can you do, and what are you not able to , and why?

    and the response:

    Good question, and the timing is useful because there’s a live example running right now: BIS just built a brand-new automatic O&C mechanism into the export control system. The Affiliates Rule automatically extends the Entity List and Military End-User List to entities owned 50 percent or more by listed entities, modeled explicitly on OFAC’s rule. It was adopted as an interim final rule with immediate effect in September 2025, then stayed by BIS until November 9, 2026 – so it reactivates in three months. That’s a genuinely useful anchor for this answer since it’s exactly the “new O&C requirement, now go find the implicated universe” scenario you’re describing.

    First, the framing question that determines your whole approach: is this regime self-executing or discretionary?

    • Self-executing/arithmetic regimes (OFAC’s 50% Rule, OFSI’s 2022 update, and BIS’s Affiliates Rule once it’s live) don’t require the regulator to take further action – an entity is captured the moment aggregate ownership crosses the threshold, regardless of whether it’s ever named. Your research task here is essentially corporate math: build the ownership tree and sum the stakes held by listed/blocked parties.
    • Discretionary/control-test regimes (the EU’s “owned or controlled by” doctrine, and UK guidance beyond the pure ownership percentage) require an affirmative designation or a documented control assessment – board composition, contractual control, negative control rights, etc. Here you’re not doing arithmetic, you’re building an evidentiary case, and “implicated” doesn’t mean “automatically caught,” it means “worth flagging as a candidate.”

    Worth noting on the BIS rule specifically, since it’s new: if Company A, an Entity List party, owns 50 percent of Company B, which owns 50 percent of Company C, Company C is subject to the same restrictions as Company A – so it chains through multiple tiers, and the rule applies regardless of the foreign country in which the affiliate is located. It also creates an affirmative duty to determine ownership rather than letting silence default to clear.

    Research workflow, roughly in order:

    1. Start with the regulator’s own materials – the designation notice, Federal Register/OJEU entry, and any accompanying press release or FAQ. Regulators frequently name known subsidiaries in the announcement itself (Treasury in particular tends to do this for network-style designations, e.g. IRISL-related actions), which shortcuts a lot of downstream work.
    2. Pull the existing entry’s own metadata – AKAs, “linked to,” prior addresses, registration numbers. This is the cheapest signal and gets skipped constantly.
    3. Confirm the exact threshold mechanic for that regime (aggregate vs. per-owner, direct vs. indirect, does it chain through unlisted intermediate tiers).
    4. Build the tree in both directions – not just subsidiaries down, but parents and sibling entities, since aggregation across multiple blocked co-owners can trip the threshold even when no single owner does.
    5. Cross-check each node against the list itself – a subsidiary you find might already be separately listed under a different name.
    6. Validate anything load-bearing against a primary-source document (registry filing, share register, annual report), not a secondary aggregator’s summary.
    7. Flag and document anything where ownership can’t be resolved – under a rule like BIS’s this is now itself a compliance-relevant fact, not a dead end.

    Sources – global coverage:

    • OpenCorporates – aggregates official company registries, decent free tier
    • Moody’s Orbis/Bureau van Dijk, Sayari Graph, LSEG World-Check, LexisNexis Risk Solutions (Dow Jones’s old risk data now sits inside RELX alongside your former employer Accuity) – all paid, all built for exactly this
    • OpenSanctions.org – free for non-commercial use, and genuinely useful here: it structures identifying information consistently so that relationships between entities, like company ownership or control, can be easily identified, integrating data from 444 global sources
    • OCCRP Aleph and ICIJ’s Offshore Leaks Database – investigative-journalism-sourced, unusually good at surfacing offshore shell layers that official registries don’t show
    • Open Ownership (the BODS standard) – complements OpenSanctions for beneficial-ownership-specific queries
    • Primary registries where they’re genuinely free: UK Companies House + PSC register, SEC EDGAR, EU member-state beneficial ownership registers (coverage is uneven post-rollback in some states)

    Targeted – Iran:

    Iran-linked evasion structures are disproportionately asset-based (vessels, shipping management companies) rather than pure holding-company trees, so vessel data matters as much as corporate data:

    • Equasis – free, gives registered owner/manager/flag history, essential for IRISL-descendant fleets
    • Lloyd’s List Intelligence / Windward – AIS tracking and beneficial-ownership-behind-flag analysis, paid
    • UANI and TankerTrackers.com – track Iran-linked shadow fleet vessels and front companies specifically
    • C4ADS – has published detailed network maps of IRISL/NITC successor structures
    • Treasury’s own past IRISL-related press releases and designation packages, since OFAC did a lot of this mapping itself over 15+ years

    Targeted – Russia/Crimea:

    • EGRUL/EGRIP-based aggregators (Kontur.Focus, SPARK-Interfax, Rusprofile) – the authoritative underlying data, but increasingly hard to access from outside Russia and typically require Russian payment/phone verification
    • OpenSanctions and OCCRP Aleph both scrape a meaningful amount of EGRUL data already, so they’re often the more practically accessible route to the same underlying facts
    • KSE Institute’s Leave Russia tracker – useful for corporate exit/restructuring signals
    • YouControl – Ukrainian-sourced data with good Russia-adjacent coverage
    • Ukraine’s own NSDC/”War and Sanctions” designations – frequently anticipate or run parallel to Western lists and come with their own ownership rationale worth cross-referencing
    • RUSI and Transparency International UK – both have done sustained investigative work specifically mapping Russian elite ownership networks

    What I can and can’t do here, honestly:

    I can search the open web, read regulator press materials and FAQs, pull from freely accessible registries, and synthesize investigative/NGO reporting – and I can help you build and document the research workflow itself, with citations kept separate from inference.

    What I can’t do, and the reasons matter for how you’d rely on this:

    • No login or API access to any paid platform – Sayari, Orbis, World-Check, LexisNexis Risk, Kontur/SPARK. I have no account, no credentials, and no way to acquire them mid-session even if you have a license, so anything behind those walls I simply cannot see.
    • No independent verification of an ownership percentage. If I surface a number from a news article or aggregator, that’s secondhand until checked against a primary document – I’ll flag it as such rather than presenting it as established.
    • No guaranteed completeness. Web search samples the indexed internet; it doesn’t exhaustively traverse a six-tier ownership graph the way a purpose-built product claims to, and coverage of non-English-language and offshore-secrecy-jurisdiction filings is systematically thin. Absence of a hit from me is not evidence the entity isn’t captured.
    • Can’t get past geo-blocking or verification walls (EGRUL-adjacent systems requiring Russian phone/payment being the clearest case).
    • Can’t make the actual compliance determination – whether to block, whether the evidence meets your institution’s risk threshold – that’s a licensed judgment call, not a factual output, and especially with a discretionary-control regime like the EU’s, it’s inherently a judgment exercise, not a lookup.
    • On genuinely obscure multi-hop chains, an LLM’s biggest risk is producing a plausible-sounding structure that isn’t actually sourced. I’ll cite as I go specifically so that risk stays visible to you rather than hidden in confident prose.
  • My initial prompt to Claude (had to re-orient its audience and remind it not to include anything related to ownership):

    First, look at the “ownership and control” regulations and guidance across the major sanctions regulators, including the US, UN, EU, UK, Switzerland, Canada, Australia, Singapore, New Zealand and Japan. Provide a list of what these regulators say constitutes “control” – don’t need to know differences between them, just give me a comprehensive list. Secondly, tell me how one would identify these elements of “control” in one’s research, including any commercial providers of such information. Check your work against your sources – identify anything in the response not supported by the sources, and then correct them. Finally, list your sources.

    and the final response:

    The control problem, in one paragraph

    Ownership is arithmetic. Control is judgment. Every major regime that extends sanctions beyond the named party does it through some version of “owned or controlled” – and while the ownership half has converged on a 50% math problem, the control half is where the regimes actually diverge, where the screening tools run out, and where the interesting compliance work lives. One clarification up front on the US: OFAC’s 50 Percent Rule speaks only to ownership and not to control – an entity controlled but not majority-owned by blocked persons is not automatically blocked, though OFAC may designate it and urges caution when dealing with entities that blocked persons control by means other than majority ownership. So for the US, control is a designation-risk and prudence question, not a legal test you apply yourself. Everywhere else below, it’s a test you apply yourself. Office of Foreign Assets Control

    And a status change that most compliance programs haven’t caught up with: for a decade, the EU’s control criteria lived only in non-binding Council guidance. As of 23 October 2025, they’re law. Council Regulation (EU) 2025/2037, part of the 19th Russia package, amended Regulation 269/2014 on the reasoning that it is appropriate to harmonise terminology across Union legal acts, that such coherence is essential to avoid ambiguity, enhance legal certainty and ensure the effectiveness of Union restrictive measures across various sanctions regimes, and that it is therefore appropriate to include in Regulation 269/2014 definitions of “owning” and “controlling” a legal person, entity or body, aligned with the definitions used in Regulation (EC) No 2580/2001. The control criteria quoted below are now Article 1(j) of the EU’s flagship asset-freeze regulation – directly applicable law in 27 member states. Global Investigations Review

    Part 1: What counts as “control” – the master list

    Pulling from the primary texts of the EU, UK, Canada, and Switzerland, plus the fact-based standards in Australia, Singapore, New Zealand, and the UN resolutions, here is everything the regulators say can constitute control without majority ownership.

    Voting power without equity

    • Now codified as Article 1(j)(iii) of Regulation 269/2014: controlling alone, pursuant to an agreement with other shareholders in or members of a legal person, entity or body, a majority of shareholders’ or members’ voting rights in that legal person, entity or body. The same concept appears in OFSI’s guidance examples. The point: a shareholder pact can hand someone majority voting power their share certificate doesn’t show. Global Investigations Review
    • Switzerland’s version drops the shareholder-agreement qualifier and adds two words that do a lot of work: per SECO FAQ 1.11(b), control exists where the person holds, formally or de facto, the majority of the voting rights of the company or organisation – with a footnote explaining that “de facto” includes acting through a straw person (Strohperson). SECOSECO
    • The UK counts majority voting rights under its first condition, and its Schedule 1 quietly extends the concept to entities that don’t vote at all: in relation to a person that does not have general meetings at which matters are decided by the exercise of voting rights, a reference to holding “more than 50% of the voting rights” is to be read as a reference to holding the right under the constitution of the person to block changes to the overall policy of the person or to the terms of its constitution. Read that again: for foundations, trusts-adjacent structures, and anything else without a general meeting, a blocking right is deemed equivalent to majority voting control. Schedule 1 also strips out treasury shares – voting rights in a person are to be reduced by any rights held by the person itself – which can push a designated holder over the line without them acquiring a thing. Legislation.gov.ukLegislation.gov.uk
    • Canada folds voting rights into its 50% prong rather than treating them as a separate control criterion.

    Board power

    • Article 1(j)(i): having the right or exercising the power to appoint or remove a majority of the members of the administrative, management or supervisory body of a legal person, entity or body. The UK’s first-condition version, from regulation 7(2)(c) as enacted: the person holds the right directly or indirectly to appoint or remove a majority of the board of directors of C. Global Investigations ReviewLegislation.gov.uk
    • The EU adds a backward-looking variant most people miss, Article 1(j)(ii): having appointed solely as a result of the exercise of one’s voting rights a majority of the members of the administrative, management or supervisory bodies who have held office during the present and previous financial year. Track record of appointments counts, not just the right on paper. Global Investigations Review
    • The UK legislation defines its board terms with unusual precision in Schedule 1: the right to appoint or remove a majority of the board means the right to appoint or remove directors holding a majority of the voting rights at board meetings on all or substantially all matters; where a person has no board, read it as the equivalent management body; and a person is treated as having the right to appoint a director if any person’s appointment as director follows necessarily from their appointment as a director of that person. A board seat that comes automatically with a parent-company directorship counts. Legislation.gov.ukLegislation.gov.uk
    • Canada’s board prong is the broadest in the world: the person is able, directly or indirectly, to change the composition or powers of the entity’s board of directors – SEMA s. 2.1(2)(b), verbatim from the consolidated statute. No “majority” qualifier at all. Commentators have flagged that read literally, the ability to appoint even one director out of many could arguably mean the person can “change the composition” of the board. Justice Laws WebsiteDentons
    • Switzerland, FAQ 1.11(a): the person can formally or de facto appoint and/or remove the majority of the members of the administrative or management body. SECO

    Dominant influence – contractual, de facto, and (in Switzerland) creditor-based

    • Article 1(j)(iv): having the right to exercise a dominant influence over a legal person, entity or body, pursuant to an agreement entered into with that legal person, entity or body or to a provision in its Memorandum or Articles of Association, where the law governing that legal person, entity or body permits its being subject to such agreement or provision. Control written into the corporate documents themselves. Switzerland mirrors this at FAQ 1.11(c). Global Investigations Review
    • And its shadow twin, Article 1(j)(v): having the power to, de facto, exercise the right to exercise a dominant influence referred to in point (iv), without being the holder of that right. This is the criterion that captures the person who sold the shares but still runs the show. One drafting note: the Best Practices version of this criterion carries a footnote – “including, for example, by means of a front company” – which the codified regulation text does not reproduce; the guidance example survives as interpretive color rather than statutory text. Switzerland’s FAQ 1.11(d) is the same provision, footnoted to the straw-person example. Global Investigations ReviewEuropean Union
    • Here’s one the law firm summaries missed entirely – SECO FAQ 1.11(h): control exists where the person, as a lender, formally and/or de facto exercises a dominant influence over the decisions of the management. A creditor-control criterion. If your debt covenants let you run the company, Switzerland says you control it. No EU, UK, or Canadian equivalent states this expressly. SECO

    The catch-alls: “wishes” and “direction”

    • The UK’s second condition is the famous one, and here it is straight from regulation 7 as enacted: a person who is not an individual (“C”) is “owned or controlled directly or indirectly” by another person (“P”) if either of the following two conditions is met (or both are met)… The second condition is that it is reasonable, having regard to all the circumstances, to expect that P would (if P chose to) be able, in most cases or in significant respects, by whatever means and whether directly or indirectly, to achieve the result that affairs of C are conducted in accordance with P’s wishes. The same wording appears across UK regimes – the quotation above is from the Misappropriation Regulations, identical to the Russia Regulations’ version. Note “if P chose to” – OFSI’s recent call for evidence spells out the implication: evidence that a designated person has not exercised control does not mean they lack the ability to do so; this may be referred to as hypothetical control. Legislation.gov.ukBlog
    • How far can “by whatever means” stretch? The UK courts spent late 2023 finding out, and the saga is worth telling properly because it’s the best available case study in what an open-textured control test does under pressure. In Mints v PJSC National Bank Trust, the question was whether a bank 99% owned by the Central Bank of Russia – itself not sanctioned – was nonetheless “owned or controlled” under regulation 7 by two designated persons: Mr Putin and Ms Nabiullina, the Central Bank’s governor. The Court of Appeal’s view, per Sir Julian Flaux C: the provision has no limit as to the means or mechanism by which a designated person is able to achieve the result of control, and the Court found that “in a very real sense… Mr Putin could be deemed to control everything in Russia.” When counsel objected that this was absurd, the Court’s answer was brutal: the absurd consequences arise not from giving the Regulation its clear and wide meaning but from the subsequent designation by the Government of Mr Putin without having thought through the consequences of Mr Putin being at the apex of a command economy – that he “called the shots.” BAILII + 4
    • The correction came in three waves. First, the FCDO issued a statement within days: the case was “not decided on this point” – emphasizing the control commentary was obiter – and “there is no presumption on the part of the Government that a private entity based in or incorporated in Russia or any jurisdiction in which a public official is designated is in itself sufficient evidence to demonstrate that the relevant official exercises control over that entity.” Second, the High Court in Litasco narrowed the test’s temporal reach: even though Putin had the power to place the Russian parent company under his control should he wish to, for the purposes of regulation 7(4) it is the current state of affairs of the entity and any existing influence that matters, not the state of affairs that an individual – including Putin – could bring about. Third, the government made it formal guidance: FCDO does not generally consider designated public officials to exercise control over a public body in which they hold a leadership function; the UK government does not consider that President Putin exercises indirect or de facto control over all entities in the Russian economy merely by virtue of his occupation of the Russian Presidency; and a person should only be considered to exercise control over private entities where this can be supported by sufficient evidence on a case-by-case basis. Where does that leave a practitioner? With a statutory test that is capability-based (“if P chose to”), a leading judgment reading it at maximum width, a follow-on judgment insisting on existing influence, and official guidance carving out political office – which is precisely why OFSI’s call for evidence (closing 13 April 2026) is now asking industry about its experience with the control test, while separately signposting that it continues to explore alignment with EU and US partners on aggregation and on moving the “more than 50%” threshold to a “50% or more” standard. The UK control test is, officially, under review. Matrix Chambers + 3
    • OFSI’s guidance gives the operational example of the catch-all in action: having the ability to direct another entity in accordance with one’s wishes, through any means, directly or indirectly – for example, a designated person may have control or use of another person’s bank accounts or economic resources and may be using them to circumvent financial sanctions. And note the individual-as-front example: if Person A is a family member or friend of designated Person B and there is evidence Person B is using Person A to enter into transactions, Person A is also subject to the same restrictions as Person B. Control isn’t only over companies. GOV.UKGOV.UK
    • Canada’s equivalent: it is reasonable to conclude, having regard to all the circumstances, that the person is able, directly or indirectly and through any means, to direct the entity’s activities – SEMA s. 2.1(2)(c). Global Affairs Canada has taken the position in its guidance scenarios that “considerable influence over strategic decision-making” is enough to trigger it – language that appears nowhere in the statute and arguably broadens its plain wording, and GAC’s updated guidance also appears to take the view that the mere presence of a listed person on an entity’s board could amount to control. Justice Laws Website + 2

    Asset and finance-based control

    These are now Article 1(j)(vi)-(viii) of Regulation 269/2014, mirrored in Switzerland’s FAQ 1.11 – and they have no UK or Canadian equivalent, which matters if you’re building one control checklist for a multi-regime program:

    • Having the right to use all or part of the assets of a legal person, entity or body; Switzerland’s version is broader – the person can formally or de facto dispose of all or part of the funds and economic resources of the company or determine their use (FAQ 1.11(e)). Global Investigations ReviewSECO
    • Managing the business of a legal person, entity or body on a unified basis, while publishing consolidated accounts; (Switzerland FAQ 1.11(f) matches.) Global Investigations Review
    • Sharing jointly and severally the financial liabilities of a legal person, entity or body, or guaranteeing them. (Switzerland FAQ 1.11(g) matches.) Global Investigations Review

    Plain-English translation of that last pair: if the books are consolidated, or if someone is on the hook for the company’s debts, that’s a control signal. The codified EU list is expressly open-ended – “controlling” a legal person, entity or body means, but is not limited to the eight criteria – and note what the regulation did not import from the guidance: the Best Practices’ rebuttable-presumption language stayed behind. The guidance says if any of these criteria are satisfied, it is considered that the entity is controlled, unless the contrary can be established on a case by case basis – Switzerland states the same presumption-and-rebuttal at the close of FAQ 1.11: if one of these criteria is met, it is to be assumed that the company or organisation is controlled, unless the contrary can be demonstrated in the individual case – but the regulation’s definition is silent on rebuttal. Whether that silence changes anything in practice is exactly the kind of question the EU courts will eventually get. Global Investigations Review + 2

    Fact-based regimes with no criteria list

    • Australia has no entity-level control test at all – the question is control of the asset: ownership and control of an asset is determined according to the factual circumstances, including the kind of asset and the laws of the jurisdiction in which it was created, and it is not necessary for the asset to be directly held by the designated person. ASO guidance adds that control can be indicated by a designated person’s command or direction over the asset – for example, through possession or the ability to dictate how it may be dealt with – and the guidance does not reveal whether any particular percentage is indicative. Australian Government Department of Foreign Affairs and TradeMinterEllison
    • Singapore’s statutory hook is simply funds, financial assets or economic resources owned or controlled, directly or indirectly, by a designated individual or entity, with no published criteria for what “controlled” means. Monetary Authority of Singapore
    • New Zealand’s regime is likewise asset- and dealing-based with minimal control guidance; one industry survey notes that APAC government bodies provide very limited guidance, and in practice the finance industry there tends to observe the OFAC approach when dealing with OFAC frameworks. SymphonyAI
    • Japan effectively drops out of a control-only analysis: its extension of Russia/Belarus asset freezes runs on 50% or more of shares directly held – pure ownership, no qualitative control test. Global Investigations Review

    The UN layer underneath everything

    UN resolutions are where the “owned or controlled” formula originates, and they add the third leg every practitioner should treat as part of this family. UNSCR 1373’s designation criteria cover any entity owned or controlled directly or indirectly by designated persons, and any person or entity acting on behalf of, or at the direction of, them – and Singapore’s IMC-TD applies exactly those criteria domestically. The UN never defines control or sets criteria; the ownership and control requirements sit in the asset freeze sections of the individual regime resolutions (the Haiti regime under Resolution 2653 is one example) and are implemented by all UN member states. IMF eLibrary + 2

    Part 1b: The non-ownership concepts that aren’t quite “control”

    Three adjacent doctrines deserve their own entries, because they catch parties the control criteria miss.

    “Acting on behalf of or at the direction of.” The EU treats this as a distinct concept whose effects can be placed on an equal footing with ownership and control, but which should be determined in and of itself. Since the concept has no definition, the EU offers four assessment criteria: the precise ownership/control structure including links between the parties; the nature and purpose of the transaction, coupled with the stated business duties of the entity; previous instances of acting on behalf or at the direction of the listed party; and disclosure from credible, reliable and independent sources and/or factual evidence indicating that directions were given. Switzerland bakes the same idea into the freeze itself – Article 15(1) of the Ukraine Ordinance freezes assets of natural persons, companies and organisations acting on behalf of or on the instructions of listed parties. And it shows up in specific UK prohibitions – the Russia regime’s “prohibited persons” definition covers a person owned or controlled directly or indirectly by the Central Bank of the Russian Federation, the National Wealth Fund, or the Ministry of Finance, or a person acting on behalf of or at the direction of these entities. European Union + 3

    “Holding or controlling” someone else’s funds. Separate from controlling an entity, the EU freezes funds a designated person merely holds or controls: all situations where, without having a title of ownership, a designated person is able lawfully to dispose of or transfer funds or economic resources he, she or it does not own, without any need for prior approval by the legal owner – including holding bearer instruments, having powers of representation allowing them to order transfers from accounts they don’t own, or administering a bank account as a parent or guardian. A power of attorney over a non-sanctioned relative’s account is squarely in scope. This is the mechanism behind the classic “assets parked with family” evasion pattern. European Union

    Transfers to third parties – Switzerland’s test for whether the assets ever really left. SECO FAQ 1.12 addresses the scenario head-on: where there is reasonable suspicion at the time of assessment that funds or economic resources were formally transferred to third parties – for example, sales of company shares or gifts to family members or other connected natural persons – but the sanctioned person still exercises control over them, those funds must be frozen; and it is not decisive when the transfer took place. That last clause deserves a highlight: a transfer completed before sanctions ever existed can still leave the assets under the sanctioned person’s control. SECO’s non-exhaustive assessment criteria: the closeness of the relationship (family, business, personal) between the sanctioned person and the third party; the economic and/or professional independence of the third party who is now nominal owner; the value and frequency of the transfers compared with transfers made to that person before the sanctions; the existence and content of formal agreements between them; and whether the transfer respected the arm’s length principle – for example, the sale conditions of company shares. The footnote grounds this in case law: the Federal Administrative Court’s judgment B-3925/2023 of 29 July 2024 on the concept of indirect control. SECO + 2

    The EU’s control red flags. The 2024 Best Practices added a set of circumstances that don’t establish control but tell you to go check the criteria above – and note these red flags stayed in the guidance rather than moving into the regulation. Verbatim from paragraph 67: a designated person who is the largest shareholder compared to others (the worked example is 40% against 10% holders); a management buyout where the designated previous owner can buy back the company under favourable conditions; a transfer of a relevant number of shares shortly before or after designation – where “relevant” includes smaller transfers that let the seller fall below the ownership threshold; front persons – a new owner closely connected to the designated previous owner such as a family member or former employee or business partner, possibly with an abnormal sale price, or an advisor with ultimate decision power even though the title doesn’t suggest it, or a written agreement giving a non-shareholder sole authority over the business, or nominal managers whose decisions are made by designated persons; and needlessly complex structures involving shells, LLCs or trusts linked to a designated person, especially ones set up or renamed around the time of designation or with no credible business activity. European Union

    One structural note worth internalizing: the UK does not aggregate for the ownership prong the way the EU does, but its guidance immediately pivots to control as the backstop – if each designated person’s holding falls below 50% and there’s no joint arrangement, the company isn’t owned by a designated person – but ownership and control also relates to voting rights, board appointment rights, and it being reasonable to expect a designated person could ensure the company’s affairs are conducted per their wishes. If any of these apply, the company could be controlled. And Schedule 1 quietly claws back some of what the no-aggregation position gives away: shares or rights held jointly are treated as held by each holder; shares or rights subject to a “joint arrangement” – an arrangement that the holders will exercise all or substantially all their rights jointly in a pre-determined way – are treated as the combined holding of each party; a share held by a nominee is treated as held by the principal; and where a person controls a right, the right is treated as held by that person rather than by whoever formally holds it. Nominees and voting pacts don’t launder control in the UK. Where the math clears, the control test is what’s left standing. GOV.UKLegislation.gov.uk

    Part 2: How you actually find this stuff

    The awkward truth about control research is that most of the evidence lives in documents, not databases. Here’s the map from criterion to source.

    Match the criterion to its paper trail. Voting rights that diverge from equity – through dual-class shares, voting agreements, or proxies – are evidenced by the articles of association, the shareholder register, and shareholder agreements; a board-control right can sit with a minority shareholder as a contractual term. Consolidated accounts and guarantee arrangements (EU Article 1(j)(vii)-(viii), SECO 1.11(f)-(g)) live in audited financial statements and their notes. Dominant-influence agreements live in the constitutional documents – and for UK purposes, so do the blocking rights that Schedule 1 deems equivalent to majority voting control in entities without general meetings. Switzerland’s creditor-control criterion points at loan agreements and covenants. The “wishes” and “direct the activities” tests live in the messier record: who actually shows up in board minutes, who signs, who the press says runs the place – and, post-Litasco, evidence of current influence carries more weight in the UK than evidence of what a designated person could theoretically do. SECO’s third-party transfer test points at a distinctive evidence set: relationship mapping, the transferee’s own economic standing, pre- versus post-designation gift patterns, and whether the sale price would survive an arm’s length comparison. Adjuvanto

    Use OFSI’s due diligence list as your evidence checklist. When OFSI updated its enforcement guidance, it listed what it considers relevant research, and it reads like a control-investigation template: the circumstances of board and management appointments including backgrounds, relevant experience, and relationships with designated persons; board or shareholders’ meeting minutes concerning recent changes in ownership and control; ongoing financial liabilities directly related to a designated person such as personal loans, loan guarantees, property or equipment; shareholder agreements, voting agreements, put or call options or other coordination agreements; and any benefits conferred to the designated person by the entity or transactions between them. OFSI also lists as mitigating examination of formal ownership and control mechanisms, examination of actual or potential de facto control, open-source research on persons able to exercise control, and – because ownership and control is not static – regular checks and ongoing monitoring. DLA PiperDLA Piper

    Ask the questions the EU Helpdesk says to ask. Collect information from the counterparty and public sources – corporate registries, beneficial ownership records, financial statements, governance documents – then verify when you see red flags, and ask targeted questions on beneficial ownership, voting rights, board appointment powers, shareholder agreements, financing and guarantees, consolidated accounting, and rights to use assets. Document your steps, findings, and decisions. That documentation line isn’t filler – in a strict-liability environment like the UK’s, the file you build is the mitigation. Financialcrime

    Layer the workflow. A sensible sequence: screen against the relevant sanctions lists; request beneficial ownership disclosure, ideally certified or backed by corporate registry extracts, down to natural persons for high-risk jurisdictions; consult corporate registries and data aggregators for shareholder information; then screen every identified owner against the lists – then extend beyond ownership with checking board members’ biographies for links to sanctioned persons, reviewing shareholder agreements and trust documents for hidden control mechanisms, and analyzing funding flows. Accept the known obstacles going in: nominee shareholders and layered holding companies, registries that are unreliable or unavailable in some countries, and structures that shift quickly – so one-off checks aren’t enough. One field report on this kind of research is worth quoting for realism: ownership relationships sometimes don’t appear in the subsidiary’s own corporate documents and have to be established from the parent’s website, news stories, or shared directors; registry addresses turn out to be out of date or belong to a school; and private citizens can be listed anonymously in corporate documents, totally obscuring their beneficial ownership. Sanctions Lawyers + 3

    Commercial providers. The vendor landscape splits roughly into three layers:

    • Curated sanctions-nexus datasets – built specifically to answer “is this unlisted entity caught anyway?” Kharon offers Sanctions 50-Plus and Control datasets identifying entities that may be considered blocked under US, EU, and UK regulations, built by collecting and analyzing corporate records, securities and regulatory filings, company websites and press releases, global media, and social media to trace chains across jurisdictions, with analyst-verified ownership chains mapped down to the securities level by ISIN and CUSIP. Dow Jones Risk & Compliance offers Sanctions Control and Ownership (SCO) data for identifying indirect links to sanctioned individuals or entities. These products are strongest on ownership math; the “Control” components are the part to interrogate in a demo, since control determinations are exactly what resists automation. Kharon + 2
    • Ownership-graph platforms – Sayari uses graph analytics to pre-compute ownership structures and flag indirect or beneficial owners on sanctions lists, supporting 50% rule and “shadow SDN” compliance and EU equivalents, with an entity resolution and ownership graph covering 500M+ companies across 250+ jurisdictions. SayariSayari
    • Registry aggregators and raw corporate data – OpenCorporates, Orbis, and Refinitiv are the aggregators typically cited for shareholder information alongside national registries. Sanctions Lawyers

    Flagged plainly as general knowledge rather than something verified against this session’s sources: LSEG World-Check, LexisNexis WorldCompliance, and Moody’s Grid also serve this market, though they are primarily screening lists rather than ownership-graph products (Orbis, in the Moody’s stable, is the ownership dataset). And a structural caveat that applies to every vendor: databases are built from filings, and criteria like “de facto dominant influence,” creditor control, blocking rights, or “affairs conducted per their wishes” often leave no filing at all. Vendor data narrows the field; it doesn’t finish the job.

    Part 3: Source re-check

    Comparing this version against the primary texts now in hand:

    1. EU codification – now verified from EUR-Lex. Regulation (EU) 2025/2037 is quoted directly: recital 6 (the harmonization rationale and the 2580/2001 alignment), the full Article 1(j)(i)-(viii) control definition, and the “means, but is not limited to” open-endedness. Comparing the codified text against the Best Practices confirmed three things the secondary memos glossed over: the criteria are substantively identical to guidance paragraph 64; the front-company footnote did not travel into the regulation; and neither did the rebuttable-presumption language of paragraphs 65-66 or the paragraph 67 red flags, which all remain guidance-level. Also note scope: the codification is to Regulation 269/2014 (the Russia/Ukraine asset-freeze regulation); the Best Practices remain the cross-regime articulation.
    2. UK regulation 7 – now sourced to legislation.gov.uk directly, replacing the law firm consolidation used in the prior pass (the wording matched). The identical reg 7 text across regimes is confirmed by the Misappropriation Regulations on the same site. New Schedule 1 findings from the primary text: the blocking-rights deeming rule for entities without general meetings, and the treasury-share reduction – neither appeared in any secondary source consulted.
    3. Mints – substantially verified, one honest limitation. BAILII refused a direct fetch, but the search index returned text from the judgment itself (including the reg 7 wording as set out in it and the case posture), and the official judiciary.uk PDF is linked in the sources. The Flaux quotations (“no limit as to the means or mechanism,” “called the shots,” the “absurd consequences” passage, “control everything in Russia”) are sourced to four independent law firm and chambers commentaries that agree with each other; the FCDO statement is quoted via Matrix Chambers, which reproduces it verbatim; Litasco is sourced to commentary, not the judgment. For publication, paragraph-level pinpoints (the control discussion sits at [225]-[233]) should be checked against the judiciary.uk PDF.
    4. The Mints-to-guidance arc – corrected and completed. The prior pass compressed this into one sentence sourced to a single commentary. It’s now told in sequence with the FCDO statement, Litasco, and the public officials guidance quoted from gov.uk directly – including the government’s explicit position that Putin’s presidency alone does not establish control over the Russian economy, which is the operative counterweight to the Mints dicta.
    5. SEMA s. 2.1 – verified against the consolidated statute, including the foreign-state carve-out. GAC’s “considerable influence” position remains framed as an interpretive stance that arguably outruns the statute.
    6. SECO FAQ – verified from the document itself (FAQ 1.10-1.13), including criterion (h) (creditor control) and the FAQ 1.12 transfer criteria that the English-language secondary literature missed. Translations from the German are mine and should be checked before publication. One residual note: the fetched edition is the “Korrekturmodus” (tracked-changes) version showing the February and June 2026 states; the control criteria at 1.11 are not among the marked changes, but the clean current PDF should be the citation of record.
    7. OFSI call for evidence – the closing date (13 April 2026) and the aggregation/”50% or more” alignment exploration are sourced to Crowell commentary on the call for evidence, consistent with the OFSI blog post.
    8. Japan remains characterized as having effectively no control test, per the GIR chapter. Provider claims – Kharon, Sayari, Dow Jones SCO, and the OpenCorporates/Orbis/Refinitiv trio are source-backed; World-Check, WorldCompliance, and Grid remain explicitly labeled as unverified general knowledge.
    9. Nothing now rests on an unfetched primary except the Mints and Litasco judgments themselves (commentary-corroborated, with the Mints PDF located) and the Best Practices’ cross-checks noted above.

    Sources

    Primary texts fetched and quoted verbatim this session

    Case law

    Regulator and official sources

    Commentary and secondary sources

    Vendor materials

  • Office of Financial Sanctions Implementation HM Treasury

    Ownership and control: insights from the call for evidence

    OFSI would like to thank every respondent who offered their views on the call for evidence on the ownership and control Test in UK Financial Sanctions Regulations that closed on 20 April.

    As part of the Review of Sanctions Implementation and Enforcement published in May 2025, HMG committed to delivering measures to provide further clarity on ownership and control. The call for evidence delivers on our commitment by reviewing in further detail concerns from industry by gathering targeted insights about the control test in financial sanctions legislation.

    We focused on hypothetical control as a direct response to industry feedback, which has highlighted greater implementation challenges associated with the control element of the ownership and control test rather than the ownership element.

    OFSI received 42 responses, with many providing valuable and in-depth insights.

    Responses clearly communicated where hypothetical control appears most often in practice, reporting that it was most commonly encountered under the Russia regime and in cases involving state-linked entities, politically connected individuals, and trusts. The insights provided have helped to expand OFSI’s understanding of how frequently firms encounter hypothetical control scenarios and the impact on their business operations.

    For example, respondents report that costs increase when there is need to make assessments on limited information. This includes enhanced due diligence, engaging external legal advice and delaying or escalating business decisions for senior review. A number of firms provided clear and quantifiable costs for these measures, which has further supported OFSI’s understanding of the impacts.

    Many responses also set out clear examples of tools and legal concepts relevant to control assessments. It was noted that these can be helpful for understanding the nature of control, though not always reliable for implementing the test itself.

    The responses to the call for evidence will play an important role in informing UK Government’s ongoing work. While respondents expressed differing views on the most appropriate way to address reported challenges, the evidence provided will help support potential next steps.

    In the meantime, firms are still expected (and required by law) to assess ownership and control in line with existing UK financial sanctions guidance.

    The factors for establishing whether an entity is owned or controlled are set out in relevant UK sanctions regulations, including a schedule that provides rules for interpretation. However firms should also consult relevant guidance for support, such as:

    As this remains an ongoing policy under review, we continue to monitor feedback we receive from our industry stakeholders and international partners on ownership and control, and will continue to explore our options to provide greater clarity to industry through established channels.

  • Office of Financial Sanctions Implementation HM Treasury

    Call for evidence on ownership and control in financial sanctions regulations

    OFSI has extended the deadline for its call for evidence on how UK financial sanctions regulations on ownership and control are applied in practice. The call for evidence will now close at 11:59pm on Monday 20th April 2026.

    We have extended the deadline to allow firms and other stakeholders more time to prepare and submit evidence, including practical examples from real cases. 

    The Call for Evidence seeks industry views on how the ownership and control test is applied in practice, including where firms face challenges. The test is designed to stop designated persons from sidestepping UK sanctions by hiding behind complex company structures, trusts or proxies. However, assessing the ability of a designated person to control an entity — even if they are not actively doing so — can be difficult in practice and may create additional costs and legal risk.

    We are particularly interested in evidence and examples on:

    • How often ‘hypothetical control’ is present in real financial sanctions cases; 
    • The impact it has on compliance costs, legal risk and business decisions (including derisking); 
    • Whether existing legal concepts and typologies of control are helpful in applying ownership and control regulations.  

    Read the full call for evidence and how to respond here.   

    Read more about the background and scope of the exercise in our blog here.