Sanctions Exposure: Indirect Partners and UBOs

OFAC's $215.9 million penalty against GVA Capital in June 2025 traced back to a single failure: the firm managed investments for a Russian oligarch without verifying who actually owned the underlying fund structure (Treasury.gov, 2025). The oligarch wasn't listed as a direct investor. He was buried three layers deep in a UBO chain that GVA never bothered to chase down. Senior management knew the money came from Suleiman Kerimov. They kept managing it anyway.

This pattern repeats across enforcement actions. Haas Automation paid $1.04 million in January 2025 for supplying machine parts to entities owned by blocked Russian companies—entities that passed basic sanctions screening because the sanctioned parties held ownership indirectly (OFAC Enforcement Release, 2025). The screened names were clean. The ownership structures were not.

Key Takeaways

• OFAC's 50% rule applies to indirect ownership through layered structures—if a blocked person owns 50% of Entity A, and Entity A owns 50% of Entity B, Entity B is blocked (Treasury.gov, 2025)
• H1 2025 saw $1.23 billion in global sanctions fines, a 417% increase over H1 2024 (CoinLaw Financial Sanctions Statistics, 2025)
• BIS published a 50% "Affiliates rule" on September 29, 2025, but suspended it on November 10, 2025 for one year pending further review (90 FR 47201; BIS Final Rule, November 2025)
• 43% of compliance leaders cite limited ability to screen against sanctions lists as their biggest compliance problem (ComplyAdvantage State of Financial Crime, 2025)
• 79,830 individuals and entities appear on global sanctions lists as of March 2025 (Global Sanctions Index, 2025)

How Does Indirect Ownership Trigger Sanctions Liability?

OFAC treats any entity 50% or more owned by blocked persons as blocked itself, regardless of whether that entity appears on the SDN list (31 CFR 501). The ownership can be direct or indirect. Combined stakes from multiple blocked persons count toward the 50% threshold. OFAC does not publish a list of these derived blocked entities—compliance teams must calculate ownership themselves.

The math gets complicated fast. If Blocked Person X owns 50% of Company A, and Company A owns 50% of Company B, Company B is blocked. Blocked Person X's stake flows through the chain. But if Blocked Person X owns 49% of Company A—even if Company A owns 100% of Company B—neither entity is automatically blocked under the 50% rule. The calculation breaks at the first sub-50% link.

Aggregation changes the equation. Two blocked persons each holding 25% of an entity still trigger the rule. OFAC aggregates ownership across sanctions programs, so an Iran-listed individual and a Russia-listed company owning stakes in the same entity can combine to hit the threshold.

The Haas Automation case shows what happens when companies don't trace these chains. OFAC determined that Haas failed to conduct "sufficient due diligence regarding the ownership structures" of its customers. Eight of the 21 violations were classified as egregious—meaning Haas knew or should have known about the sanctioned ownership. The company screened the customer names. It didn't screen who owned those customers.

Why Standard Sanctions Screening Misses UBO Exposure

Name-matching against the SDN list catches direct listings. It misses derived blocked entities entirely. A subsidiary of a subsidiary of a sanctioned oligarch shows zero hits on a standard screen.

Most third-party screening workflows stop at the immediate counterparty. They verify the company name, perhaps the directors, occasionally the majority shareholder. Few trace ownership through holding companies, offshore trusts, or multi-layered corporate structures designed specifically to obscure beneficial ownership. The 2025 enforcement actions confirm this gap exists across industries—real estate, manufacturing, venture capital, commodity trading.

Commercial UBO databases help but carry their own limitations. Data quality varies by jurisdiction. Some countries don't require beneficial ownership disclosure. Others maintain registries that lag months behind actual ownership changes. A shell company in the Cayman Islands or a trust in Dubai may have no public UBO record at all. You're flying blind and hoping for the best.

The January 2025 Family International Realty settlement illustrates the shell company problem. OFAC alleged the Florida real estate firm transferred luxury condos owned by sanctioned Russian oligarchs to non-sanctioned family members through shell companies—73 apparent violations totaling $1.08 million in penalties (Treasury.gov, 2025). The firm's owner coordinated with the sanctioned individuals directly. Phone records between the parties proved it. The shell companies masked the ownership until investigators started pulling threads.

What Does the BIS 50% Affiliates Rule Change?

BIS published its own 50% ownership rule on September 29, 2025, intending to extend Entity List and Military End-User restrictions to affiliates owned by listed parties (90 FR 47201). Before this rule, BIS restrictions applied only to specifically named entities and their non-legally-distinct branches. Subsidiaries in other countries escaped coverage even when wholly owned by listed Chinese or Russian companies.

Here's the catch. BIS suspended the Affiliates Rule on November 10, 2025, staying implementation for one year until November 9, 2026 (BIS Final Rule, 90 FR). The suspension followed industry comments citing compliance burden and the practical difficulty of verifying ownership across global supply chains. The rule may return—BIS hasn't withdrawn it—but for now, the old "legally distinct" standard applies. Subsidiaries of Entity List parties remain unrestricted unless separately named.

The timing matters for planning purposes. Companies that invested in UBO verification infrastructure for BIS compliance now face uncertainty about whether that investment pays off. Those that held back must still prepare—the rule could resume in November 2026 without further notice. And OFAC's 50% rule remains in full force regardless of what BIS does.

What UBO Screening Actually Requires

Effective beneficial ownership screening goes beyond checking a box. It requires layered verification across multiple data sources, ongoing monitoring as ownership structures change, and documentation sufficient to demonstrate reasonable due diligence if regulators come asking.

Start with the counterparty's corporate registry filing—who appears as shareholders and directors. Cross-reference against commercial UBO databases that aggregate registry data across jurisdictions. Request ownership certifications from the counterparty directly, particularly for high-risk relationships. Document the chain of ownership to identify natural persons who control 25% or more. Then screen each beneficial owner against sanctions lists, not just the entity name.

That process breaks down at several points. Counterparties may refuse to disclose ownership. Registries may be incomplete. Commercial databases may show stale information. Shell companies exist specifically to frustrate this analysis. A serious counterparty risk screening program acknowledges these limitations and calibrates verification intensity based on risk—destination country, transaction size, product sensitivity, historical relationship.

The operational cost is real. Manual UBO verification for a single entity can take 2-4 hours depending on structure complexity and data availability. One compliance officer I spoke with described spending an entire afternoon tracing a Singapore distributor's ownership through three BVI holding companies before finally identifying a natural person shareholder. Multiply by hundreds of counterparties and the screening burden becomes unsustainable without automation. But automation introduces false positive management overhead—matching common names, disambiguating similar entities, chasing down corporate structures that turn out to be clean.

Where Indirect Partner Risk Concentrates

Certain transaction patterns and counterparty profiles carry elevated UBO risk. Intermediaries in transshipment hubs—UAE, Hong Kong, Singapore, Turkey—frequently appear in sanctions evasion investigations. Newly formed entities with limited operating history. Companies with complex multi-jurisdiction structures that don't match their stated business size. Trading companies without clear end-use explanations.

Russia-related enforcement since 2022 highlights the intermediary problem. OFAC designated a UAE-based shipper in 2025 who operated roughly 30 tankers in Iran's shadow fleet, using shell companies and falsified cargo manifests to mask Iranian crude (Treasury.gov, 2025). These aren't obscure corner cases. They're systematic networks that intersect with legitimate supply chain screening if you look hard enough.

The $3.88 million Unicat settlement from June 2025 involved catalyst sales to customers in Iran and Venezuela—a Texas-based company dealing in routine industrial products (OFAC Enforcement Release, 2025). The sanctions exposure came through the customer base rather than direct dealings with sanctioned governments. Unicat's regional distributor in the UAE was selling to Iranian end-users. The pattern scales down to mid-market exporters who may not realize their distributor's distributor has problematic ownership.

Third-party screening must extend beyond the immediate transaction party. Knowing your customer isn't enough when your customer's customer is the sanctions risk.

How EU and UK Rules Differ on Ownership and Control

The EU updated its sanctions best practices in 2024 to align with the 50% ownership threshold for asset freezes (EU Sanctions Guidelines, 2024). Ownership stakes from multiple designated persons aggregate. The methodology largely mirrors OFAC.

But the EU also considers control. An entity can be sanctioned if a designated person exercises dominant influence—through board appointment rights, voting agreements, or operational control—even without 50% ownership. The UK applies a similar "owned or controlled" test post-Brexit. OFAC's 50% rule speaks only to ownership, not control.

This divergence creates compliance complexity for companies operating across jurisdictions. An entity might be clean under OFAC's ownership analysis but caught under EU control provisions. The inverse scenario exists too—a designated person holding a 40% stake with no control mechanisms might escape EU restrictions but would need only an additional 10% from another designated person to trigger OFAC exposure.

Screening programs serving multi-jurisdictional operations need to accommodate both frameworks. The European Banking Authority's updated guidelines, effective December 2025, require enhanced due diligence on ownership structures and executive accountability for sanctions compliance. For financial institutions especially, supply chain screening now demands jurisdiction-aware analysis.

FAQ

What triggers OFAC's 50% rule for indirect ownership?

An entity becomes blocked if one or more blocked persons own 50% or more in aggregate, calculated through the ownership chain. If Blocked Person X owns 50% of Company A and Company A owns 50% of Company B, Company B is blocked. OFAC aggregates stakes from blocked persons across different sanctions programs. The entity doesn't appear on the SDN list—compliance teams must calculate derived blocked status themselves.

Can an entity be sanctioned if a blocked person owns less than 50%?

Not automatically under OFAC's 50% rule. However, OFAC may still designate the entity separately based on control or other criteria. OFAC urges caution when dealing with entities where blocked persons hold significant minority stakes or exercise control through non-ownership mechanisms. The EU and UK apply sanctions based on control even without majority ownership.

How often should companies re-screen counterparties for UBO changes?

Ownership structures change through sales, restructuring, and new designations. High-risk counterparties warrant quarterly or transaction-triggered re-screening. OFAC's 2025 expansion of recordkeeping requirements from 5 to 10 years reflects the long tail of sanctions enforcement. Stale ownership data creates gaps that regulators exploit years after the underlying transaction.

What penalties apply to UBO-related sanctions violations?

OFAC civil penalties reach $377,700 per violation under IEEPA, or twice the transaction value—whichever is greater (31 CFR 501.701, 2025 inflation adjustment). The GVA Capital penalty in June 2025 hit $215.9 million—near the statutory maximum for egregious, non-voluntarily disclosed violations. Criminal penalties for willful violations can reach $1 million and 20 years imprisonment. Voluntary self-disclosure typically reduces penalties by 50-75%.

Is the BIS 50% Affiliates rule currently in effect?

No. BIS published the rule on September 29, 2025, but suspended it on November 10, 2025 for one year. The suspension runs through November 9, 2026. During this period, the pre-existing "legally distinct" standard applies—subsidiaries of Entity List parties are not automatically restricted unless specifically named. Companies should monitor BIS announcements for any changes to this timeline.

The coordination gap between direct screening and ownership verification creates structural exposure that entity-name checks alone cannot address. Platforms that aggregate sanctions lists with UBO data—including Lenzo, Castellum, and Descartes—reduce the data source fragmentation, but the underlying ownership analysis still requires human judgment on complex structures. When OFAC publishes enforcement releases citing failures to verify "indirect users" and "ownership structures," they're describing a screening discipline that most mid-market exporters haven't fully built.