Sanctions Exposure and OSINT: What Legal Teams Miss

Standard sanctions screening checks the named counterparty against a list. It does not check who controls the counterparty, or what else they control.

The gap in standard compliance screening

Most corporate compliance screening processes check the entity name and key individuals against OFAC, EU, UN and relevant national sanctions lists. This is necessary. It is not sufficient.

Sanctions regimes are increasingly designed to target control rather than legal ownership. An entity is not sanctioned because its name appears on a list — it is sanctioned because an individual or organisation with adverse connections controls it, directly or indirectly. The entity's name may not appear anywhere on the list. The person who controls it does.

This is the gap. Standard list-based screening identifies the entity. It does not identify who controls the entity, through what structure, or what else that person controls.

What beneficial ownership analysis adds

OSINT-based beneficial ownership analysis traces the control structure of a counterparty beyond the registered layer. Starting from the named entity, the analysis maps intermediate holding companies, nominee arrangements, registered agents and jurisdictional structures to identify the ultimate beneficial owner.

This is done using public registries — EU national company databases, Companies House, Handelsregister, KvK, and equivalent authorities. It is supplemented by adverse media and professional network analysis to identify connections not visible in registry data.

The analysis is not designed to replace legal counsel. It is designed to surface the questions legal counsel should be asking — before the deal closes, not after.

Indirect connections and what they mean

Not all sanctions-adjacent connections are disqualifying. A beneficial owner with a prior directorship in an entity that was later placed under sanctions is different from a beneficial owner with a current financial relationship with a sanctioned person. Both are worth knowing. They are assessed differently.

The analytical standard matters here. A finding is not reported as a sanctions connection unless the link is documented and the evidence is rated. The difference between B/2 (usually reliable source, probably true) and D/4 (not usually reliable, doubtful) is the difference between a serious concern and a corroborated rumour. Both are included in the report. They are not treated the same.

When this matters most in practice

The pattern that creates the most post-signing problems is a counterparty in a jurisdiction with limited registry transparency — where the beneficial ownership chain is partially or completely opaque. This includes certain Eastern European jurisdictions, offshore incorporation centres, and jurisdictions where nominee arrangements are standard practice.

The answer is not to avoid these jurisdictions. It is to understand that standard list-based screening is less effective there, and to supplement it accordingly before the commitment is made.