Sanctions ownership research: who traces each layer at a bank

Sanctions ownership research is the work of finding out who owns and controls a counterparty, layer by layer, and adding up what blocked persons hold in it. It exists because of one rule: under OFAC's guidance, an entity owned 50 percent or more in the aggregate by blocked persons is itself blocked, whether or not it appears on any list (OFAC, August 13, 2014). Name screening cannot find such a company, because its name is on no list. Done by hand, the research runs across four seats, from registry extracts, a customer's certification and a spreadsheet. Botminds' Sanctions Ownership & Control is an agentic solution for that desk: agents pull the registries, build the ownership tree, add the blocked shares the way OFAC does and cite every number, while a sanctions analyst prepares and a sanctions officer decides.

The worked examples on this page come from the solution's sample data: a fictional bank, Corvane National Bank, and a fictional counterparty, Varnholt Logistics FZE, whose $1,846,500 incoming payment is held on an ownership question. The rules and enforcement cases are real and linked where they appear.

What is sanctions ownership research?

Sanctions ownership research answers one question: do blocked persons, together, own 50 percent or more of this entity, directly or through other entities? It also records a second question beside it: does a blocked person control the entity by other means, such as a board seat, a signature or a proxy? OFAC's 50 Percent Rule turns only on the first. The second matters because OFAC "urges caution" with entities a blocked person may control, and because the EU and UK tests count control in their own right.

OFAC places the duty on the party doing the business. Its FAQ 401 "urges persons considering a potential transaction to conduct appropriate due diligence on entities that are party to or involved with the transaction or with which account relationships are maintained in order to determine relevant ownership stakes" (OFAC FAQ 401). Its 2019 compliance framework lists the failure as a root cause of violations by name: "Improper Due Diligence on Customers/Clients (e.g., Ownership, Business Dealings, etc.)" (A Framework for OFAC Compliance Commitments).

The research is not the same as collecting beneficial owners for customer due diligence. That work, under FinCEN's rule, identifies each individual who "owns 25 percent or more of the equity interests of a legal entity customer" (31 CFR 1010.230) and stops at people; how a beneficial ownership percentage is calculated through layers is a separate job with a separate threshold. Sanctions ownership research adds up every blocked holder, persons and companies alike, against a 50% line, and it has to be redone whenever a list changes.

Who does sanctions ownership research at a bank?

Four seats carry it, though at a smaller bank one person may sit in two of them. The onboarding or KYC analyst collects the ownership information and the customer's certification. The sanctions analyst traces each layer, matches every owner to the lists and does the arithmetic. An investigator takes the opaque structures. A sanctions officer decides whether the entity is blocked, and a head of sanctions owns the policy behind that decision.

Enforcement notices describe the same seats from the other side. OFSI's 2026 penalty notice against Citibank's London branch describes a backlog at the bank's third level of review, and "a member of staff responsible for identifying accounts exposed to sanctions applied to designated majority owners" who "did not identify some of the relevant subsidiary companies associated with the designated person" (OFSI, CBNA London, August 11, 2026). That is the sanctions analyst's seat, failing under volume.

Sanctions ownership research in Sanctions Ownership & Control: 41 reviews, sorted by clock

What registries do sanctions analysts use, and where they go dark?

Sanctions analysts work from five kinds of source: company registry extracts for each layer, the customer's own ownership certification, trade and contract documents, the sanctions list entries themselves, and third-party ownership data. Each gives something the others do not, and each has a known failure. The research is only as good as the weakest layer.

Regulators know the data is uneven. When the Commerce Department's Bureau of Industry and Security extended its own 50% rule to Entity List affiliates in 2025, it warned of "the opaque ownership structures and limited access to accurate ownership data in certain jurisdictions" (90 FR 47201). OFSI drew the lesson for banks in the Deutsche Bank case: "While third-party screening tools are often a vital component of a firm's control framework, firms must be aware of, and account for, the limitations of these" (OFSI).

In the sample case the gap is visible in one line. Varnholt's certification says its second shareholder, Halcyon Bay Ltd, is owned by "private investors, none sanctioned". Halcyon Bay's Cyprus registry extract, dated October 20, 2026, shows a designated person holding 600 of its 1,000 shares, and gives a registered office shared by 212 companies. The analyst's job is to find that line, prefer it to the certification, and say so.

How long does a sanctions ownership review take, layer by layer?

A deep review done by hand takes half a day to a day of an analyst's time, by our estimate; OFAC publishes no time standard. A direct owner listed in one registry extract can be checked in minutes. A three-layer tree with one offshore layer is where the day goes, and most of it is collecting and re-keying rather than judging.

The split says where the leverage is. Pulling registry extracts one layer at a time is the single largest block, and it is the least judgemental part of the job. The part that should not shrink much is the last one: reading what the answer hinges on, writing a memo another person can follow, and deciding. In the sample, the agents' run from hold to a cited tree took three minutes, from 6:58 to 7:01 AM; the analyst's preparation finished at 8:47 and the officer blocked the payment at 8:55.

The clock matters because the research often runs while money waits. OFAC sets a clock only after the decision: a blocking report is due 10 business days after the property is blocked (31 CFR 501.603; when that count really starts is in OFAC reporting in 10 business days). The time allowed for the research itself is the bank's own policy. The sample bank gives a held payment four business hours, trade finance one business day and an onboarding review five.

Who decides an entity is blocked?

The bank does, through a named officer; OFAC will not decide for it. OFAC's FAQ 5 says plainly that it will not confirm or rule out a match, and expects each organization to reach its own risk-based decision (OFAC FAQ 5). The same FAQ's chart puts companies blocked by the 50 Percent Rule in the block column, beside the people and companies on the SDN List itself (the whole chart is turned into a decision tree in OFAC block vs reject).

Because the decision freezes a counterparty's money and starts a reporting clock, a sound design keeps it away from the person who did the research. FAQ 5 itself advises that where an alert involves "another unlisted entity blocked by operation of law", staff should "consider escalating the issue to your supervisor or compliance department before taking action". In the sample, the preparer is shut out of the decision screen by design: the analyst who prepared the review cannot decide it, and a clear in the 40–50% watch band, or with a listed person in control, needs the head of sanctions as a third signature.

When does sanctions ownership research escalate to an investigator?

It escalates when the arithmetic stops being enough. OFAC said where that line sits in its December 2025 settlement with IPI Partners: an equity analysis under the 50 Percent Rule "may be sufficient" in some cases, but "especially situations involving opaque legal structures or the use of proxies that may obscure a party's interest in an entity or property—a more exhaustive analysis may be appropriate" (OFAC, IPI Partners).

Four triggers recur in the cases and the guidance. A layer is unknown, because a registry files nothing or did not answer. The customer's certification conflicts with a registry. Ownership moved near a designation, which the red flags of proxy ownership treat as a reason to look harder. Or a listed person sits in control without owning half, which the OFAC 50 rule and control covers in its own right.

What enforcement says each seat got wrong

Read together, recent cases fail at every seat, and rarely at the arithmetic. The failures are in collecting, in escalating and in deciding on incomplete facts.

At the officer's seat, CBNA London relaxed its own rule in May 2022, under the pressure of alert volumes: staff no longer had to restrict an account under investigation unless they had proof of majority ownership by a designated person. OFSI found that the change left accounts open for longer, and it treated the bank's conclusion that one company was only minority-owned as unreasonable on the information the bank had (OFSI). The bank processed 242 payments, about £5.9 million, for companies owned or controlled by one designated individual; the OFAC 50 rule and control sets out why that policy failed.

At the investigator's seat, IPI asked outside counsel whether it had to block. Counsel said no, because on paper the oligarch owned less than half of the investing entity. IPI had not told counsel that the banker who brought the deal had been described as Kerimov's "gatekeeper", or that its senior member had secured each commitment by meeting Kerimov or his nephew. OFAC's lesson: "for any advice to be effective, it must be based upon a complete picture of all material information available from across an organization" (OFAC). The penalty was $11,485,352.

At the onboarding seat, ALICO's screening generated alerts on a UAE entity, but staff "cleared the alerts as false positives because the Entity itself was not on the … SDN List", although its trade license said, in Arabic, that its owner was the Iranian embassy (OFAC, ALICO). The entity was blocked by ownership; the list was the wrong question.

What skills does a sanctions ownership analyst need, and what can agents take?

The seat needs four skills: reading registry extracts from many jurisdictions, including share classes and dated transfers; the arithmetic of indirect ownership, which OFAC's five worked examples lay out; recognising control and proxy indicators; and writing a memo that a second person, an auditor or an examiner can follow from each number to its source. The first two are mechanical once learned. The last two are judgement.

That division is where agents fit. In Sanctions Ownership & Control seven agents pull an extract no older than 30 days for every company in the chain, read the certification and trade documents, match every person to the SDN and non-SDN lists, apply the 50% method and replay transfers against designation dates. They do not decide, do not guess a missing layer and do not call a transfer evasion. Everything they produce cites a registry line or a document page.

The ownership tree Sanctions Ownership & Control builds before the analyst opens it

U.S. supervisors have so far left agentic tools outside their model-risk guidance: the Federal Reserve's SR 26-2 of April 17, 2026 puts generative and agentic AI outside its scope, while expecting a bank's own risk management and governance to set the controls for such tools (SR 26-2). For the ownership desk that argues for a design in which every agent output is checkable by a person before it counts, which is how the separation between preparer and decider is built here.

For the full picture of the work, from hold to report, see Sanctions Ownership & Control.

Questions people ask

Does OFAC publish a list of companies owned by sanctioned persons?

No. Under OFAC's 2014 guidance the property of an entity owned 50% or more by blocked persons is blocked whether or not the entity is named. OFAC may add such entities to the SDN List, but the duty to find unlisted ones sits with the party doing the business.

Is sanctions ownership research the same as beneficial ownership verification?

No. Beneficial ownership under FinCEN's customer due diligence rule identifies the individuals owning 25% or more of a legal entity customer. Sanctions ownership research adds up every blocked holder, people and companies, against a 50% line under OFAC's rule, and must be repeated when the lists change.

How often should a bank re-check ownership for sanctions?

Whenever the lists change, at a frequency set by risk. The FFIEC examination manual expects banks to have procedures for re-checking existing customers when names are added to or changed on the OFAC list, more or less often according to their risk (FFIEC). For ownership that means checking every tree on file at every layer, not only the counterparty's own name.

Do analysts have to look past the first layer of ownership?

Yes. OFAC's rule covers ownership "directly or indirectly", and FAQ 401 counts holdings through any entity that blocked persons themselves own 50% or more of. A blocked company two layers up can block the counterparty.

What is a sanctions ownership chart?

It is the ownership tree drawn for a sanctions decision: every owner at every layer, each edge with its percentage and source, blocked persons and blocked companies marked, and control relationships shown apart. A useful one lets a reviewer open the registry line behind any percentage on it.

Who should own the sanctions ownership and control policy?

A senior sanctions role, usually a head of sanctions or the sanctions officer, with management approval. OFAC's 2019 framework names "management commitment" first among five components of a sanctions compliance program, and the policy choices here, such as when to restrict pending research, are where CBNA London went wrong.