Sanctions exposure through ownership and control chains

The name clears. The ownership chain does not.

A sanctions screen answers a narrow question: did the identity submitted to the screening service match a listed person or entity closely enough to require review?

That is an important question. It is not the whole investigation.

An unlisted company can still be subject to restrictions because of who owns it, who controls it, or who may benefit from the transaction. Those conclusions do not sit in a single list entry. They have to be assembled from corporate records, shareholder information, governance rights, contractual arrangements, dates, and the rules of each applicable sanctions regime.

This is why a clean screening result can be correct, but insufficient. The screen may have performed exactly as designed. The failure begins when the result is treated as proof that the counterparty is clear.

The operational question is not simply, "Is this name listed?" It is:

Under the sanctions regimes that apply to this relationship or transaction, does a listed or blocked person own, control, direct, or benefit from the counterparty, and what evidence supports that conclusion at the relevant time?

That is an investigation. It has an evidence path, points of uncertainty, and a decision that remains accountable to a human.

The launch article argued that compliance teams were meant to make decisions, not gather evidence. Ownership and control analysis is the first operational test of that model: the work can be prepared systematically, but the legal consequence still has to be owned.

A name screen is the first probe

A direct screen should establish what was actually checked. That means more than keeping a green result.

The record should identify the legal name submitted, aliases, registration number, jurisdiction, address, and any other identifiers used to distinguish the counterparty from possible matches. It should also preserve the lists or datasets checked, the provider or official source, the list version or timestamp where available, the query terms, the time of execution, and the disposition of any result.

Without that context, "clear" is not reproducible. A later reviewer cannot tell whether the right legal person was screened, whether a transliteration was omitted, or whether the result reflects the list as it stood before or after a designation.

Identity resolution comes before relationship analysis for the same reason. If the investigator connects the wrong Oriole Industrial B.V. to an owner, every calculation after that point can be internally consistent and still be wrong. Registration identifiers, jurisdiction, legal form, addresses, directors, and filing references are not administrative details. They are the anchors that stop one entity's evidence from being attached to another.

Once the subject has been resolved, the direct screen becomes the first node in a wider inquiry. The next questions are who owns the subject, through which intermediaries, under what rights, and as of which date.

The unit of analysis is a sourced relationship

An ownership chart is useful. It is not proven fact.

Every line in that chart is a claim: Entity A owns 60 percent of Entity B; Person C can appoint three of five directors; Trust D holds shares for an unidentified principal; a transfer reduced an interest before a designation. Each claim should carry its own source, effective date, retrieval date, reliability assessment, and status.

That changes how the investigator works. Instead of asking whether the chart looks complete, the investigator asks whether each material edge is supported.

• Is the percentage based on a current shareholder register, an older annual return, a customer declaration, or a commercial database?
• Does the percentage describe issued capital, voting rights, economic rights, or a different class of shares?
• Is the relationship direct, indirect, held jointly, or subject to an agreement?
• Does a nominee hold legal title for someone else?
• Did a transfer occur, and was it effective at the time relevant to the transaction?
• Do board appointment rights, vetoes, financing terms, or side agreements alter control even when ownership is below a threshold?

A useful relationship map therefore shows uncertainty as well as structure. A missing owner is not an empty box to ignore. A stale share register is not equivalent to a current one. A machine-translated filing should remain linked to the original document and be labelled as a translation. Two contradictory percentages should remain visible until one is resolved. If an investigator silently selects the convenient number, the chart becomes cleaner while the decision becomes weaker.

The practical source order usually starts with the strongest available authority: the applicable sanctions list and legal act, official registry records, current constitutional documents and shareholder registers, then executed agreements that establish rights. Customer declarations, reputable commercial data, and credible public reporting can fill gaps or trigger questions, but they should not be allowed to impersonate a more authoritative source.

No source class is infallible. A registry can be current but limited in what it discloses. A certified shareholder register can omit an undisclosed side agreement. An adverse-media report can reveal a relationship but misstate the legal percentage. The point of a source hierarchy is not to appoint one database as truth. It is to make the weight given to each claim explicit and to seek independent corroboration where the consequence is material.

This aligns with the FATF's beneficial-ownership guidance, which describes the value of combining information from multiple mechanisms rather than relying on a single source.

The rules do not collapse into one global threshold

The same relationship structure can produce different legal consequences under different regimes. That is not a software defect. It is the reality the investigation must preserve.

For a US analysis, the instruction is precise: Apply the OFAC 50 Percent Rule. OFAC states that entities owned 50 percent or more in the aggregate by one or more blocked persons are themselves considered blocked, whether that ownership is direct or indirect. Its FAQ 401 explains that qualifying indirect ownership runs through entities that are themselves owned 50 percent or more by blocked persons. Its FAQ 398 also draws a deliberate boundary: control without 50 percent ownership does not automatically block the controlled entity under that rule.

The boundary matters. A tool that labels every control indicator "OFAC blocked" overstates the rule. A tool that ignores a 49 percent interest and current control rights understates the operational risk. The first is a legal error. The second discards facts that OFAC itself says warrant caution and that may be decisive under another regime.

The EU analysis must remain equally bounded. The Council's 2024 Best Practices are non-binding recommendations, not a substitute for the applicable regulation or national advice. They describe ownership at 50 percent or more and list control indicators, including board appointment or removal rights, dominant influence under an agreement, or the right to use all or part of an entity's assets. 2024 Best Practices are non-binding recommendations, not a substitute for the applicable regulation or national advice. They describe ownership at 50 percent or more and list control indicators, including board appointment or removal rights, dominant influence under an agreement, or the right to use all or part of an entity's assets. Board appointment rights are a control indicator assessed case by case. They also say that ownership or control conclusions may be refuted on a case-by-case basis. The European Commission's May 2026 asset-freeze FAQ similarly describes a rebuttable presumption in the context of Regulation 269/2014.

The UK adds another comparison. OFSI's general guidance, updated 12 May 2026, covers more than 50 percent ownership, board appointment rights, and the ability to ensure that an entity's affairs follow the designated person's wishes. It also warns that the applicable legislation and facts govern each case.

The investigation therefore needs a regime column. "Sanctions exposure" without jurisdiction, legal act, relevant date, transaction nexus, and exception or licensing analysis is not a complete conclusion.

A synthetic case: when new evidence changes the finding

The following scenario is synthetic. It is not a customer case, performance claim, or legal opinion.

Meridian Process Controls AG, a Swiss manufacturer, is being onboarded for a supply relationship involving payments in euros and US dollars. Its legal name, registration number, directors, and known trading names produce no direct sanctions match.

The direct result is correct. It is also insufficient.

The intake chart says Meridian is owned 60 percent by Oriole Industrial B.V. and 40 percent by three founders. Oriole's chart shows 45 percent held by Varo Capital Ltd, 10 percent by Lev Saren, 25 percent by a foundation, and 20 percent by management. In this synthetic example, Saren is listed under the relevant US and EU measures and owns 70 percent of Varo.

The first ownership calculation produces a serious finding. Because Saren owns 70 percent of Varo, Varo is treated as blocked for purposes of the OFAC 50 Percent Rule. On the submitted chart, Oriole is owned 45 percent by Varo and 10 percent directly by Saren. The aggregate is 55 percent. Oriole would therefore be treated as blocked under the rule. Oriole in turn owns 60 percent of Meridian, extending the result to Meridian.

A weak process would stop at the red flag. A defensible process tests the edges that created it.

The evidence record shows that the customer chart has no effective date. A Dutch registry filing confirms Varo as a shareholder but does not establish the current percentage. A commercial database reports 45 percent, copied from a filing eighteen months old. Another source says Varo transferred part of its stake before Saren's designation. The board appointment rights are not in the articles of association available to the investigator.

The agents prepare four RFIs:

1. A certified current shareholder register for Oriole, including the effective dates of recent transfers.
2. The executed transfer agreement and evidence of consideration for Varo's reported divestment.
3. Current shareholder, financing, and side agreements that create appointment, veto, or economic rights.
4. Current board composition and minutes showing how those rights have been exercised.

The compliance officer challenges the provisional finding before accepting it. The officer asks whether the 55 percent existed on the relevant date, whether the divestment was genuine, whether any property had already become blocked in US jurisdiction, and which legal regimes actually apply to the proposed relationship. Those are not clerical questions. They determine the legal consequence.

The returned evidence changes the ownership finding. A certified register and notarized transfer documents show that Varo's interest fell from 45 to 39 percent before the relevant designation and before the proposed transaction. Payment evidence supports that the transfer had economic substance. Saren still holds 10 percent directly. On the established facts, the aggregate interest for the OFAC calculation is 49 percent, not 55 percent.

That does not restore a universal green result. OFAC FAQ 402 specifically calls for sufficient due diligence to establish that a purported divestment occurred and was not a sham. It also distinguishes future dealings from property already blocked while the threshold was met. Here, the evidence supports the earlier transfer and no already-blocked property has been identified. The officer records that Meridian is not automatically treated as blocked under the OFAC 50 Percent Rule on the established 49 percent chain. The officer also records the residual caution associated with a significant sub-threshold interest.

The control evidence moves in the other direction. A current side agreement gives Saren the right to appoint three of Oriole's five directors and veto its annual budget until a shareholder loan matures. Recent minutes show that the appointment right was exercised. Under the OFAC rule, those facts do not convert 49 percent ownership into automatic blocking. Under the relevant EU measure and facts in this synthetic case, they create a material control analysis that has not been refuted.

The human reviewer, supported by legal counsel, confirms the EU nexus, checks the exact legal act, considers whether the presumption is rebutted, and determines whether an exception or authorisation is available. None is established for the proposed transaction. The reviewer rejects the relationship and records why:

• the direct counterparty did not match a list;
• the initial 55 percent OFAC ownership finding changed after dated transfer evidence established 49 percent;
• current governance evidence still demonstrated an unrefuted control route under the applicable EU analysis;
• no relevant exception, licence, or authorisation supported proceeding;
• the decision was made by the accountable reviewer, with the evidence and legal basis preserved.

The final outcome is not "the agent found a sanctioned company." It is a set of regime-specific findings and a human disposition. The new evidence changed one conclusion without erasing the other.

What the agents prepare, and what the human decides

This is where agentic compliance becomes tangible.

cmpliance is assembling this chain-review operating model around source-linked facts, recorded relationship paths, evidence quality, contradictions, RFIs, screening dispositions, and reviewer state. The purpose is to produce decision context that shows the officer what is established, inferred, conflicting, or open. The claim here is the governed operating model and the verified components behind it—not that acquisition, extraction, screening, RFIs, review, audit capture, and evidence-pack assembly already run as one continuous production path.

The agents do not declare the law applicable to a transaction. They do not decide that an EU control presumption has been rebutted. They do not choose whether reliance on an exception is prudent, apply for a licence, accept an unresolved nominee, or approve a relationship because the commercial deadline is close.

Those calls remain with the human who has the mandate, context, and accountability to make them.

That division is stronger than either extreme. A name-screening tool leaves the relationship investigation to people and spreadsheets. An opaque automated verdict hides which evidence or legal test produced the result. The agentic workforce prepares the evidence-intensive work while preserving the point at which human judgment changes, accepts, or rejects the recommendation.

The result should be reviewable as a chain:

Identity resolved -> sources captured -> relationships dated -> ownership calculated -> control assessed -> gaps challenged -> regimes applied -> human decision recorded.

If any link is missing, the final disposition may still be right. It is simply harder to defend.

A sanctions decision is only as strong as its weakest material edge

The buyer problem is not a lack of screening capacity. It is that a green name result can enter a workflow as if it settled a relationship question it never examined.

The better operating model treats the direct screen as one evidence event. It investigates ownership and control as sourced, dated claims. It keeps contradictory and missing evidence visible. It distinguishes regimes instead of forcing them into one global risk label. It lets agents carry the investigative workload and reserves legal consequence, exceptions, licensing, and final disposition for an accountable human.

That is what it means to investigate sanctions exposure rather than merely screen a name.

Next: KYC evidence review beyond name screening

Agents do the work. Humans make the call.

Talk to cmpliance