Sanctions Screening and Beneficial Ownership: Why a Clean Entity Check Doesn’t Catch a Sanctioned Owner
A company can pass sanctions screening cleanly and still be majority-controlled by a sanctioned person. Nothing about that outcome is a failure of the screening tool. The name-match ran correctly, returned no hit, and closed the file — because the question it asked was never “who owns this company,” only “does this company’s name appear on a list.” Those are different questions, and only one of them catches an undisclosed beneficial owner sitting a layer or two above the entity being checked.
The gap has a name inside compliance teams: entity-level screening versus ownership-level screening. It is the difference between checking a company against the U.S. Treasury’s Office of Foreign Assets Control (OFAC) Specially Designated Nationals list, the EU’s consolidated sanctions list, or the UK’s OFSI list — and checking who is entitled, directly or through intermediate holding companies, to more than half of it. A beneficial owner is the natural person who ultimately owns or controls a company, as distinct from whoever is named as its legal owner on a registry filing or share certificate; the two are not interchangeable, and sanctions exposure follows the beneficial owner even when the legal owner of record is someone else entirely. This piece maps that gap: where entity-level sanctions screening stops, how OFAC, the EU, and the UK each try to extend it through ownership aggregation, and what that means procedurally for a compliance team that has to act on it.
01Two questions, one shared assumption
Sanctions screening, in its most common deployment, is a list-matching exercise. A company name, and sometimes its officers, gets checked against consolidated designation lists — OFAC’s SDN and Non-SDN lists, the EU’s consolidated list, the UK’s OFSI list, and whatever national lists apply. The check is fast, auditable, and near-instant to re-run. It is also, by design, blind to anything that isn’t a name on the list.
Ownership-level screening asks a structurally different question: who is entitled to the economic or voting interest in this company, traced up through however many holding entities sit between the operating company and the person who ultimately controls it. That question doesn’t resolve in a single lookup. It requires a shareholder register, or several, chained together across jurisdictions that don’t always disclose them.
Both checks can run on the same company on the same day and produce opposite answers. Figure 1 lays out why: one path terminates at a name match, the other terminates at an aggregated percentage.
02A worked example: Meridian Freight Holdings
The following walkthrough is illustrative — “Meridian Freight Holdings,” “Atlas Cargo Partners,” “Nordholm Trading,” “Silverpoint Ventures,” “Dariel Holdings,” and “V. Kastrov” are constructed names, not a real filing or designation. The mechanics, however, mirror how aggregation actually cascades through a chain under OFAC’s 50 Percent Rule.
- Layer 0. Meridian Freight Holdings LLC, a US freight-forwarding company, is the entity a bank’s onboarding team screens. Its own name returns no hit on any list.
- Layer 1. Meridian is 60% owned by Atlas Cargo Partners Ltd, registered in Cyprus. Atlas’s name also returns no hit.
- Layer 2. Atlas Cargo Partners is 92% owned by Nordholm Trading AG, a Swiss holding company. Still no name hit at this layer.
- Layer 3. Nordholm Trading is owned by two entities: Silverpoint Ventures Inc. (BVI), holding 30%, and Dariel Holdings SA (Panama), holding 25%. Neither individually crosses a 50% threshold, and neither name is listed.
- Layer 4. Both Silverpoint and Dariel are wholly controlled by the same individual, an SDN-listed person under this illustration. Aggregated, that person’s indirect stake in Nordholm Trading is 30% + 25% = 55%.
Under OFAC’s aggregation approach, a 55% combined stake makes Nordholm Trading itself a blocked entity — not because Nordholm is named anywhere, but because a blocked person owns a majority of it in aggregate. That blocked status cascades: Nordholm’s 92% stake makes Atlas Cargo Partners blocked; Atlas’s 60% stake makes Meridian Freight Holdings blocked. Four layers down, an entity that never appears on any list is, in substance, subject to the same restrictions as if it did. A name-only screen run at onboarding, and never re-run against a refreshed ownership chain, would never surface any of this.
03Why sanctions screening hasn’t caught up to layered ownership
Entity-level list screening was built for a specific threat model: a named person or organisation transacting under a name that would show up if checked. That model matches how sanctions lists themselves are published — row after row of named individuals and entities. It works well against a designated person who transacts directly, or under a shell that is itself designated.
It was never designed to reason about aggregation across holding structures, and the tooling reflects that. Standard screening infrastructure runs string-matching and fuzzy-matching against a name field. It does not, by default, ingest a shareholder register, walk it up multiple levels, sum percentages held by the same beneficial owner across sibling entities, and re-evaluate the result every time a shareholding changes. That is a different data problem — closer to corporate registry research than to list matching — and most compliance stacks were not built to solve both with the same tool.
The mismatch would matter less if ownership structures were still mostly flat. They are not. In a live sample of 240 companies drawn from Zavia’s own dataset, a real multi-entity ownership tree runs 3.79 layers deep on average where one exists, and 70.9% of those trees run three layers or more (Zavia’s live dataset, 30 September 2026). A screening process calibrated for a flat structure is, on average, one to three layers short of where the exposure actually sits.
For the mechanics of one specific aggregation rule referenced throughout this piece, see The OFAC 50 Percent Rule in 2026. This article treats that rule as one example among several approaches to the same underlying problem, not as its subject.
04OFAC: aggregate first, ask questions later
OFAC’s 50 Percent Rule guidance, first set out on 13 August 2014, holds that any entity owned in the aggregate, directly or indirectly, 50% or more by one or more blocked persons is itself treated as blocked — automatically, without a separate listing action. The word “aggregate” is doing the heavy lifting: two blocked persons each holding 25% combine to trigger the rule, even though neither alone would.
The rule is mechanical rather than judgment-based, which is precisely what makes it enforceable without waiting for OFAC to add every downstream entity to the SDN list by name. It also means the compliance burden of tracing ownership sits entirely with the screening party. OFAC does not publish a list of every entity that is 50%-plus owned by a blocked person; it publishes the blocked persons, and expects firms to do the arithmetic on request. The narrower mechanics of that rule — sham transactions, restructurings undertaken specifically to dodge the 50% line, and how “aggregate” is calculated across ownership tiers — are covered in depth in the dedicated post linked above.
05The EU: a converging, non-binding aggregation rule
The EU’s approach sits in its Best Practices for the effective implementation of restrictive measures — Council guidance rather than binding regulation, though EU member state competent authorities generally follow it for a uniform interpretation. The Council updated this guidance in 2024 to align more closely with the US approach: an entity is considered owned by a designated person where that person holds 50% or more of the proprietary rights, or a majority interest, and — critically — ownership interests of multiple EU-designated persons are aggregated to reach that threshold, mirroring OFAC’s combined-holdings logic.
The practical distinction from OFAC is enforceability rather than method. Because the EU rule lives in best-practice guidance rather than in the sanctions regulations themselves, its application can vary slightly by member state authority, even though the underlying 50%-aggregate test now closely tracks the US model.
06The UK: a stricter threshold, no aggregation, plus a control test
The UK’s Office of Financial Sanctions Implementation (OFSI) diverges from both OFAC and the EU in two specific ways, set out in its ownership and control guidance, updated most recently in August 2024 after first being issued in 2023. First, the threshold is “more than 50%,” not “50% or more” — a difference that matters exactly at the boundary. Second, and more significant, OFSI does not aggregate interests held by separate designated persons: an entity in which several designated persons each hold a minority stake is generally not automatically caught under the ownership test, unless the structure appears designed to obscure control.
That second point sounds like a narrower net than the US or EU version — and by the ownership test alone, it is. But OFSI pairs it with a separate “control” test that neither OFAC’s rule nor the EU’s ownership test formalises in the same way: an entity is treated as owned or controlled where a designated person can appoint or remove a majority of its board, or where it is reasonable to expect that person can ensure the entity’s affairs are conducted according to their wishes, regardless of shareholding percentage. A structure engineered to stay under 50% on paper while the same person still controls the board fails the UK test even where it might pass a pure percentage check elsewhere.
07How OFAC, the EU, and the UK compare
The three regimes converge on the same underlying concern — that a designated person shouldn’t be able to launder sanctions exposure through a holding structure — but differ enough in mechanics that a structure passing one test can still fail another.
| Issue | OFAC (US) | EU (Council Best Practices) | UK (OFSI) |
|---|---|---|---|
| Ownership threshold | 50% or more | 50% or more | More than 50% |
| Aggregates multiple designated persons? | Yes, always | Yes, since the 2024 update | Generally no, unless structured to obscure control |
| Separate control test beyond ownership % | Limited; focus is ownership percentage | Referenced but less codified | Yes — board appointment rights or de facto control |
| Legal status of the guidance | Binding interpretive guidance | Non-binding best practice, widely followed | Formal guidance under UK sanctions regulations |
| Effect of crossing the threshold | Entity automatically blocked | Entity treated as designated | Entity treated as designated |
| Last major guidance update | 13 Aug 2014 (reaffirmed since) | 2024 Best Practices revision | 2023 ownership and control guidance |
Sources: U.S. Department of the Treasury, OFAC 50 Percent Rule guidance (13 Aug 2014); Council of the EU, Best Practices for the effective implementation of restrictive measures (2024 revision); UK Office of Financial Sanctions Implementation, ownership and control guidance (2023).
08The prior problem: ownership often isn’t visible at all
Every aggregation rule above assumes a compliance team can actually see the ownership chain to aggregate across it. That assumption fails more often than it should. In a live sample of 240 companies drawn from Zavia’s own dataset on 30 September 2026 — deliberately spread across 15 jurisdictions, from the US and UK to Germany, Poland, and Singapore — 51.7% (124 of 240) returned no public shareholder list at all: not a redacted one, not a partial one, none. For just over half of the companies sampled, an ownership-based sanctions check has no register to start from until a firm goes looking beyond the default public filing. (An earlier fixed-sample analysis, run once in September 2026 against a static internal dataset, had put this figure at 86%. Querying Zavia’s live dataset across a jurisdiction-diverse sample shows meaningfully better disclosure overall, concentrated in registries — the UK, New Zealand, Norway, Ireland, Germany, Denmark — that mandate shareholder or beneficial-ownership filing, and offset by jurisdictions such as the US, Singapore, Spain, and Sweden where none of the sampled companies had a public filing at all.)
Even where a shareholder list exists, a named natural person remains a minority outcome. In the same live sample, roughly 1 company in 6 — 41 of 240, 17.1% — yields a named natural-person owner from the public record alone, more than three times the 4.9% found in the earlier fixed-sample analysis, though still well under half. The rest either disclose no ownership data, or disclose only corporate shareholders, which pushes the question of who is actually behind the company up another layer that the public filing doesn’t answer.
A sanctions check is only as complete as the ownership data feeding it, and most public filings stop short of a named individual. Zavia connects directly to official company registries in 173 countries, so a screening workflow can pull the shareholder chain behind an entity — corporate parents, intermediate holdcos, and named individuals where the registry discloses them — instead of stopping at whatever the company itself chose to file. That matters most exactly where this article’s numbers show the public record thins out: multi-layer, cross-border structures where the aggregation math has to run on real registry data, not on a single domestic filing.
09Layered, cross-border structures multiply the blind spot
Where a real multi-entity ownership tree exists, it is rarely confined to a single country. In the same live sample drawn from Zavia’s own dataset, 179 of 238 companies with a usable group-structure response (75.2%) have a genuine multi-entity ownership tree; of those, 62.6% (112) cross two or more countries, and 70.9% (127) run three layers or more, with average depth 3.79 layers and a deepest observed chain of 19 layers in this sample (Zavia’s live dataset, 30 September 2026). Every border crossing in that chain is also a jurisdiction boundary for sanctions purposes — a point where the applicable aggregation rule can change from OFAC’s to the EU’s to the UK’s, or to a jurisdiction with no equivalent ownership-aggregation concept at all. The prevalence of a multi-entity tree at all (75.2%) is far higher here than the 26.5% found in the earlier fixed-sample analysis — largely a function of this sample’s jurisdiction mix — but the shape of those trees, once one exists, lines up closely with the earlier figures: a broadly similar cross-border share (62.6% vs. 64%) and an almost identical average chain depth (3.79 vs. 3.74 layers).
This is where the three-regime comparison in the table above stops being an academic distinction. A chain that passes through a UK holding company, then a Cyprus one, then resolves to a US-designated individual, is subject to OFAC’s aggregation rule at the US end regardless of what the UK entity’s own local test would conclude about the UK entity in isolation. Screening a single entity against a single list was never going to resolve a chain that spans three legal regimes.
10Building an ownership-aware screening workflow
Closing the gap doesn’t mean replacing entity-level screening — it means adding a second, ownership-based pass and defining when each one runs.
- Screen the entity and its named officers first. This remains the fast, cheap, high-recall first pass, and it should still run at onboarding and on a recurring schedule regardless of what follows.
- Pull the shareholder register, not just the entity filing. Where the entity’s home registry discloses shareholders, retrieve that layer before assuming a clean entity-level result is the whole answer.
- Trace ownership up through intermediate holding entities. Treat a corporate shareholder as a pointer to another registry lookup, not as a terminal answer, until a natural person or a documented control party is reached.
- Aggregate stakes held by the same beneficial owner across sibling entities. Two 25% stakes held by the same person are not two immaterial minority positions; under OFAC and the current EU approach, they are one 50% position.
- Apply the aggregation logic of the correct jurisdiction at each link. A chain crossing US, EU, and UK entities needs the OFAC test applied where a US nexus exists, the EU test where an EU nexus exists, and OFSI’s ownership-and-control test — not just its percentage threshold — where a UK entity sits in the chain.
- Document why the chain terminates where it does. Whether it ends at a named individual, a discovered control right, or a jurisdiction that simply does not disclose further, the file should show that the chain was followed to its actual end rather than to wherever the data happened to run out.
11When a clean screen goes stale
A screening result is a snapshot, not a standing fact. Ownership changes; sanctions lists change; aggregation status can flip without any transaction touching the entity being monitored at all — a new designation two layers up is enough. The events below should each trigger a re-screen of the full ownership chain, not just the named entity.
| Trigger event | Why it invalidates the prior screen |
|---|---|
| New designation added to any applicable list | A previously clean upstream owner may now be a blocked person, changing the aggregate at every level below |
| Change in shareholding at any layer of the chain | A stake shifting across the 50% line, in either direction, changes the aggregation outcome even if the named entity is untouched |
| New intermediate holding entity inserted into the structure | Extends the chain the screening team must trace, and is itself a documented pattern for obscuring aggregation |
| Board or director appointment change at an upstream entity | Can trigger the UK’s control test independently of any change in ownership percentage |
| Periodic review cycle elapses | Ownership data ages, and a registry-level change may not otherwise reach the compliance file |
12Patterns that predict an undisclosed sanctioned owner
None of the following proves a sanctions problem on its own. Together, or in combination with a jurisdiction known for weak beneficial ownership disclosure, they are reasons to run the ownership-level pass rather than rely on the entity-level result.
- Ownership split across multiple entities in a pattern that keeps each individual stake just under a reporting or aggregation threshold.
- A shareholder register listing only corporate shareholders, with no natural person named at any disclosed layer — the more common pattern, since 64.7% of the 116 companies in a live sample drawn from Zavia’s own dataset that disclose any shareholder data name only corporate shareholders, not individuals (Zavia’s live dataset, 30 September 2026) — closely in line with the 64% found in the earlier fixed-sample analysis.
- Intermediate holding entities registered in jurisdictions that do not require, or do not enforce, beneficial ownership disclosure.
- A recent restructuring that reduces a single shareholder’s stake to just under 50% without any change in who sits on the board.
- Nominee shareholders or nominee directors standing in for an undisclosed principal — a distinct concealment pattern covered in depth in Zavia’s guide to nominee directors and nominee shareholders.
13Glossary
14Frequently asked questions
If a company’s name isn’t on any sanctions list, can it still be sanctioned?
Yes. Under OFAC’s 50 Percent Rule, an entity aggregately owned 50% or more by one or more blocked persons is itself blocked automatically, whether or not OFAC has separately added its name to a list. The EU’s Best Practices guidance reaches a similar result through aggregated ownership interests of EU-designated persons. Neither approach requires a fresh, named designation of the downstream entity.
Do UBO disclosure thresholds and sanctions ownership thresholds match?
Not necessarily, and treating them as the same number is a common mistake. Many UBO disclosure regimes set a 25% ownership threshold for who must be reported as a beneficial owner. OFAC’s and the EU’s sanctions aggregation tests use 50%; the UK’s uses more than 50%, plus a separate control test unrelated to any percentage. A stake that clears a 25% UBO disclosure threshold does not automatically clear, or fail, a 50% sanctions aggregation threshold.
Why doesn’t the UK aggregate ownership across multiple designated persons the way the US and EU do?
OFSI’s published position is that, absent evidence the structure is designed to obscure control, each designated person’s stake is assessed on its own rather than summed with other designated persons’ stakes. The stated rationale is to keep the test tied to actual ownership or control rather than to a mechanical sum that could catch structures with no real common control. The UK compensates for the narrower ownership test with a separate, non-percentage-based control test.
How often does a public company registry actually disclose enough to run this analysis?
It varies enormously by jurisdiction, and less often than many screening workflows assume. In a live sample of 240 companies drawn from Zavia’s own dataset on 30 September 2026, spanning 15 countries, 51.7% returned no public shareholder list at all, and only 17.1% yielded a named natural-person owner from the public record alone. (An earlier fixed-sample analysis had put these figures at 86% and 4.9% respectively; the live, jurisdiction-diverse sample shows meaningfully better disclosure overall, concentrated in registries that mandate ownership filing.) An ownership-based sanctions check frequently has to go beyond the entity’s home-country filing to reach a usable answer.
Is a multi-layer, multi-country ownership structure itself a red flag?
Not on its own — genuine multinational groups routinely have holding companies in several jurisdictions for tax, financing, or regulatory reasons. It becomes relevant to sanctions risk when combined with other patterns: stakes split just under an aggregation threshold, corporate-only shareholders with no named individual, or intermediate entities in jurisdictions with weak disclosure requirements.
How frequently should an ownership-based sanctions screen be re-run?
At minimum, on the same periodic review cycle as the entity-level screen, plus immediately on any of the trigger events in the retesting section above — a new designation on any applicable list, a shareholding change at any layer of the chain, a new intermediate entity, or a board change upstream. A screen run once at onboarding and never refreshed only reflects the ownership structure as it existed on that date.
Does entity-level screening still matter if ownership screening catches more?
Yes. Entity-level screening remains the fastest way to catch a designated person or entity transacting directly, and it costs little to run continuously. Ownership-level screening is not a replacement; it is the second pass needed for the specific failure mode where the transacting entity’s own name was never going to appear on any list.
What’s the difference between a beneficial owner and a legal owner in this context?
The legal owner is whoever is named on the share register or corporate filing as holding title to a stake. The beneficial owner is the natural person who ultimately owns or controls the economic or voting interest, which may sit behind a nominee, a trust, or a chain of holding companies rather than appearing as the legal owner of record. Sanctions aggregation rules are aimed at beneficial, not merely legal, ownership.
Screen the entity. Then trace who is actually behind it.
Zavia connects directly to official company registries in 173 countries, so an ownership-based sanctions check can run on real shareholder data instead of stopping at the entity’s own filing.
For deeper reading on adjacent topics covered only briefly here: the mechanics of OFAC’s own aggregation rule are in The OFAC 50 Percent Rule in 2026; the underlying concept of beneficial ownership is covered in What Is a UBO?; the end-to-end process of establishing and monitoring ownership is in UBO Verification Workflow; concealment structures that specifically frustrate this kind of tracing are covered in Nominee Directors and Nominee Shareholders and Circular Ownership Structures; and jurisdiction-specific mechanics for two of the regimes discussed above are in UK Beneficial Ownership & UBO Data and EU Beneficial Ownership in 2026.
For the regulatory standard behind the ownership-aggregation rules discussed here, see FATF Recommendation 24 and 25 Explained. See also Entity Resolution and Ownership Graphs for why screening depends on matching the right entity first, and Adverse Media Screening vs. Beneficial Ownership Verification for how sanctions screening compares to that adjacent discipline.
Sanctions screening is one layer of a broader customer due diligence process — see Customer Due Diligence (CDD): The Complete Process, from Standard to Enhanced for the full standard-to-enhanced CDD framework this screening step sits inside.
A sanctioned beneficial owner and a politically exposed one are different risks that can sit behind the same name — see PEP Screening: How Politically Exposed Person Checks Actually Work for how that second check runs, its four PEP tiers, and where it overlaps with this one.
