This article originally appeared in Compliance Monitor, September 2025.

Sanctions due diligence has long evolved from checking names against lists to conducting investigative research to reveal an often-hidden sanctions nexus. Two main drivers of this change are the growing complexity of US, EU and UK sanctions regimes, and the increasingly sophisticated techniques of sanctions evasion and circumvention. Recent regulatory actions, especially in the USA, demonstrate that the landscape is intricate and non-compliance can be costly. As a result, sanctions due diligence can no longer follow a single template and should be tailored to specific risks and applicable regulatory requirements.

This article explores two complex diligence scenarios: performing the ownership and control test, and investigating potential fronting for a designated person. It then discusses a third, often overlooked diligence area — assessing a product’s end-user and end-use.

Ownership and control test

Under the UK and EU sanctions regimes, an entity can become targeted by financial sanctions if it is ‘controlled’ by a designated person (“DP”) even where the DP owns an interest of less than 50%. The respective official guidance notes set out non-exhaustive lists of ‘control’ criteria as well as multiple ‘red flags’ to watch.[1] Solely relying on these ‘red flags’ as a checklist would not ensure a risk-based and defensible ownership and control test.

Approaching the test systematically involves considering how ‘control’ over an entity can manifest itself. The UK and EU guidance suggest that ‘control’ may or may not be backed by legal ownership rights, and may exist at present or become possible in the future. The English High Court organised these different options into four distinct categories of ‘control’ in Hellard & Ors v OJSC Rossiysky Kredit Bank & Ors [2024] EWHC 1783 (Ch), which could serve as a helpful test framework.[2]

After establishing a company’s legal ownership, it is advisable to probe whether any of these ‘control’ categories exist, inter alia looking for related ‘red flags.’ The table below sets out examples of such indicators for the four ‘control’ categories as per Hellard.

There is no legal requirement for the ownership and control test in the USA, with OFAC’s 50 Percent Rule defining the regime for companies owned by sanctioned parties.[4] However, in June 2025, the OFAC imposed a record monetary penalty on a US VC firm for managing an investment for a blocked individual while formally transacting with a company owned by their representative.[5] The enforcement release states that even where an asset or investment is on paper owned by an innocent party, the degree of real influence and control exerted by a blocked party must be carefully evaluated.

Investigating potential fronting for a DP

Entering into a commercial relationship with a party that secretly acts on behalf of a DP is a major risk for multinationals and financial institutions, especially private wealth managers.

It is generally rare when sanctions due diligence would produce documentary evidence of someone fronting for a DP, thereby enabling them to evade financial sanctions. Conversely, well-executed research is likely to pick up on at least some inconsistencies and indicators that a target may not act independently. Taken collectively and placed in context, such ‘red flags’ would often be sufficient to make an informed decision and safeguard your business from regulatory and reputational consequences.

Diligence should therefore be tailored to not only assess possible direct links between a target individual and a DP, but also ascertain a wider fact pattern. For a target individual, research areas should include at least the following:

• background and reputation
• overall suitability for a proposed business relationship
• motivations for possible DP fronting
• historical links with a DP
• ongoing business, personal or other ties with a DP
• evidence of current dependence on a DP

Focus on a product’s end-use and end-user

Sanctions due diligence traditionally concentrates on investigating companies and individuals. Especially when performing diligence on a direct customer, this exercise should be deemed incomplete without scrutinising the end-user and the end-use of supplied goods.

Responses to a due diligence questionnaire and supporting documentation are a critical source of data about a product’s end-use and end-user, which should be probed for inconsistencies and anomalies. The US, UK and EU official guidance highlight indicators and ‘red flags’ to watch that should further help to detect circumvention of trade sanctions and export controls.[6]

Public information about the end-user and the end-use in a specific transaction is ordinarily very limited, if at all available. However, there are still investigative steps that can be taken in the public domain to ascertain a customer’s trading patterns. Government procurement records, global import-export data and other public data points can provide valuable insights and yield signs of past behaviours, including:

• re-exporting goods to restricted destinations
• using known diversion hubs
• supplying goods to intermediaries or proxies acting on behalf of sanctioned parties
• using or supplying goods for unauthorised (restricted) purposes
• employing complex webs of affiliated companies for transactions with goods

Performing investigative research of this nature is also recommended for distributors of goods.

Sanctions enforcement remains high on the US agenda and is on the rise in the EU, with the UK also advancing its efforts. As a result, the cost of poorly designed or executed sanctions due diligence continues to increase. However, there is no one-size-fits-all solution. Understanding regulatory expectations, industry- and country-specific risks, and evasion and circumvention methods are key to organising a robust and proportionate diligence process.

[1] EU Council – Update of the EU Best Practices for the effective implementation of restrictive measures, No. 11623/24 of 3 July 2024, https://data.consilium.europa.eu/doc/document/ST-11623-2024-INIT/en/pdf; UK OFSI – UK financial sanctions general guidance, section 4: Ownership and control, https://www.gov.uk/government/publications/financial-sanctions-general-guidance/uk-financial-sanctions-general-guidance#ownership-and-control

[2] Hellard & Ors v OJSC Rossiysky Kredit Bank & Ors [2024] EWHC 1783 (Ch), https://knyvet.bailii.org/ew/cases/EWHC/Ch/2024/1783.html

[3] In Hellard, the High Court argues that the existence of potential future de facto control will be ‘very rare’. It is still advisable to give consideration to this scenario as part of wider horizon scanning for emerging risks.

[4] OFAC’s 50 Percent Rule stipulates that if one or more sanctioned (‘blocked’ in US terms) parties own in the aggregate, directly or indirectly, 50% or more of a company, this entity is itself considered to be blocked.

[5] US OFAC – Enforcement release, 12 June 2025, https://ofac.treasury.gov/media/934366/download?inline

[6] Trade sanctions and export controls have different purposes, legal mechanisms and responsible regulatory agencies, but related circumvention techniques have a lot in common. See, for example, UK OTSI – Countering Russian sanctions evasion, guidance for exporters, 25 February 2025, https://www.gov.uk/government/publications/countering-russian-sanctions-evasion-and-circumvention/countering-russian-sanctions-evasion-guidance-for-exporters; G7 – Preventing Russian Export Control and Sanctions Evasion: Updated Guidance for Industry, 24 September 2024, https://finance.ec.europa.eu/document/download/ae2e63e2-4c4d-4f77-9757-c408ddbcede1_en?filename=240924-preventing-russian-export-control-sanctions-evasion%20.pdf; US FinCEN & BIS – Joint Alerts, https://www.bis.gov/identify-red-flags

—
If you have any questions or would like to discuss this topic please reach out to Dmitry Sachkov.

To receive StoneTurn Insights, sign up for our newsletter.