Introduction
OFAC screening catches names. Sanctions exposure lives in ownership. The 50 Percent Rule blocks entities owned in aggregate by blocked persons even when the entity itself is not listed. Add fuzzy matching thresholds tuned for convenience, onboarding-only screening, and no documented escalation path, and a compliant-looking program misses the hits that matter.
As of March 2026, ownership is no longer the outer boundary of the analysis either.
Key takeaways
OFAC's 50 Percent Rule blocks any entity owned 50 percent or more, directly or indirectly, individually or in the aggregate, by one or more blocked persons, even when that entity has never appeared on any list. Aggregation crosses sanctions programs. A 30 percent stake held by a Russia-program SDN and a 20 percent stake held by an Iran-program SDN combine to reach the threshold. On March 31, 2026, OFAC issued guidance on sham transactions confirming that formal ownership analysis alone is insufficient, because OFAC evaluates interests in property by economic reality rather than legal form. The statute of limitations for IEEPA and TWEA violations is now ten years, and OFAC extended its recordkeeping requirement to ten years to match, effective March 12, 2025. Voluntary self-disclosure results in a base penalty at least 50 percent lower, but only if the disclosure precedes discovery by OFAC or any other government agency.
How OFAC screening is supposed to work
The mechanics are simple enough to describe in a sentence and are where most programs stop. Names of customers, counterparties, vendors, and transaction parties are compared against the Specially Designated Nationals and Blocked Persons List and other OFAC lists. Matches are reviewed. True hits are blocked or rejected and reported.
That process, executed perfectly, still leaves substantial exposure. The reason is that the SDN List is not a complete inventory of parties you are prohibited from dealing with. It is a list of designated persons. The population of blocked parties is considerably larger, and the difference is where enforcement actions come from.
Mistake one: screening names instead of ownership
The 50 Percent Rule is the most consequential provision in U.S. sanctions and the least reflected in operational screening.
Any entity owned in the aggregate, directly or indirectly, 50 percent or more by one or more blocked persons is itself considered a blocked person. It does not need to be designated. It will not appear on the SDN List. It is blocked as a matter of law from the moment the ownership threshold is met.
This creates a large population of blocked entities that no list will ever show you. A screening program that clears counterparties on the basis of list absence is not producing a clean result. It is producing an incomplete one.
Three failure patterns account for most of it.
Per-person analysis instead of aggregate analysis. Two shareholders, one at 29 percent and one at 22 percent, each fall below the threshold. Together they reach 51 percent and the entity is blocked. A reviewer applying the rule person by person clears a blocked entity and documents the clearance.
Single-program filtering. Aggregation is not limited to one sanctions program. A stake held by an SDN designated under a Russia-related program combines with a stake held by an SDN designated under a different program. Compliance teams that screen program by program will not see the combination.
The one-level stop. Verifying the ownership of the entity immediately above the counterparty and stopping there. Sanctioned parties layer holdings through intermediate companies specifically because one level of verification is common practice. The chain has to be walked to beneficial ownership.
A practical consequence worth building into policy: a stake held by a blocked person that falls below 50 percent, at 49 percent or 40 percent or 25 percent, is not blocked, but it is not clean either. Entities with meaningful sanctioned-party ownership below the threshold warrant enhanced diligence and a documented approval decision rather than an automatic clear.
Mistake two: treating ownership as the outer boundary
This is the newest and most significant change in the discipline.
On March 31, 2026, OFAC issued a sanctions advisory titled Guidance on Sham Transactions and Sanctions Evasion. The advisory addresses arrangements in which blocked persons, often operating through proxies or intermediaries, effectuate transfers that conceal rather than genuinely extinguish a continuing interest in property. In OFAC's framing, blocked persons give up their property on paper only.
The reasoning matters more than the examples. OFAC applies functional definitions of "interest" and "property interest" that look beyond legal formalities to underlying practical and economic realities. A transfer that satisfies a formal ownership test while leaving the blocked person's actual interest unchanged does not terminate the blocked interest. The property remains blocked.
OFAC identifies the mechanisms it has encountered: opaque legal structures including trusts, proxies, straw owners, and front businesses, used to conceal continuing interests in investment vehicles, bank accounts, real estate holdings, private jets, and yachts.
For a compliance officer, the operational implication is direct. An ownership calculation that comes out at 49 percent is no longer an answer. It is one input. Where a divestment or restructuring is recent, where consideration appears commercially unreasonable, where the transferee is a family member or close associate of a blocked person, or where the blocked person appears to retain practical control despite formal transfer, the diligence obligation continues past the arithmetic.
The 50 Percent Rule remains in force. It is now the floor of the analysis rather than the whole of it.
Mistake three: fuzzy matching thresholds tuned for convenience
Screening systems apply fuzzy matching to catch transliterations, alternate spellings, name orderings, and deliberate obfuscation. Sensitivity is configurable, and configuration is where risk gets transferred.
Set the threshold tight and false positives drop to a manageable volume. Set it loose and the queue becomes unworkable. Every institution makes this tradeoff. The question is whether it was made deliberately, documented, tested, and revisited, or whether it was made once by whoever was clearing the backlog that quarter.
Two tests reveal the answer. Can you produce the analysis supporting the current threshold settings? And has anyone run below-the-line testing to determine what the current configuration fails to catch?
If the answers are no, the institution has a screening system calibrated to its staffing capacity rather than its risk profile. That is the same failure pattern that produces transaction monitoring findings, addressed in our companion article on where AML compliance programs break under examination.
Mistake four: screening at onboarding only
Sanctions lists change constantly. Ownership changes constantly. A counterparty screened clean at onboarding in 2024 may be majority-owned by a blocked person today, through no change in your records.
Two distinct exposures follow, and they need different controls.
List changes require re-screening the existing portfolio against updated lists. This should be automated and frequent, not periodic and manual.
Ownership changes are harder, because the trigger is external and invisible. A counterparty acquired by a sanctioned party will not notify you. Controls here include periodic refresh on risk-tiered schedules, event triggers such as material transactions or contract renewals, and ongoing monitoring for high-risk relationships and jurisdictions.
The March 2026 guidance raises the stakes on this specifically, since restructurings designed to obscure a continuing interest happen after the relationship is established, not before.
Mistake five: no documented escalation path
Screening produces alerts. Alerts require decisions. Decisions require a record.
Programs frequently have well-built screening and no defined path from alert to resolution. Who reviews a potential match. What information must be gathered before clearing. Who has authority to clear a true hit versus a false positive. What triggers legal involvement. What timeframe applies. How the decision and its basis get recorded.
Documentation is not administrative here. Good-faith, documented compliance effort is a mitigating factor under OFAC's enforcement guidelines. The institution that can produce its data sources, its ownership calculation, and its written rationale for clearing a counterparty is in a materially different position from the institution that cleared the same counterparty and recorded nothing.
Mistake six: misreading the disclosure math
Voluntary self-disclosure is the single largest mitigating factor available, and the window for it is narrower than most compliance officers assume.
What OFAC's enforcement guidelines provide. Under 31 CFR Part 501, Appendix A, an apparent violation involving a voluntary self-disclosure results in a base penalty amount at least 50 percent lower than in comparable cases without disclosure. Substantial cooperation in a disclosed matter is a further mitigating factor. In cases involving a first violation, the base penalty generally will be reduced up to 25 percent.
What disqualifies a disclosure. The definition is exacting. Voluntary self-disclosure means self-initiated notification to OFAC of an apparent violation prior to or at the same time that OFAC, or any other federal, state, or local government agency or official, discovers the apparent violation or another substantially similar apparent violation.
Read the scope of that carefully. Discovery by any other government agency forecloses the credit. So does discovery of a substantially similar apparent violation rather than the specific one you intended to disclose. If a counterparty's compliance function files first, or a correspondent bank reports, or a regulator surfaces a related matter, the reduction is gone.
The practical effect is that the decision to disclose competes with the investigation needed to disclose intelligently, and it does so on a clock the institution does not control. That tension is the reason this decision belongs with counsel on day one rather than at the end of an internal review.
The penalty and records structure
Civil penalty calculation Framework: Economic Sanctions Enforcement Guidelines, 31 CFR Part 501, Appendix A Base amount: Determined by a matrix keyed to whether the conduct was egregious and whether a voluntary self-disclosure was made Statutory maximums: Set by the enabling statute for each program and adjusted for inflation under the Federal Civil Penalties Inflation Adjustment Act Adjustment: The base amount moves up or down based on the General Factors for Administrative Action
Voluntary self-disclosure Effect: Base penalty at least 50 percent lower than comparable non-disclosed cases Qualifying condition: Notification precedes or coincides with discovery by OFAC or any other government agency Additional mitigation: Substantial cooperation, and up to 25 percent reduction where it is a first violation Disqualifier: Prior government discovery of the violation or a substantially similar violation
Statute of limitations and recordkeeping Limitations period: Ten years for civil and criminal IEEPA and TWEA violations, extended from five years by Section 3111 of the 21st Century Peace through Strength Act Recordkeeping: Ten years, extended from five to align with the limitations period, effective March 12, 2025 Source: Reporting, Procedures and Penalties Regulations final rule
The recordkeeping change deserves more attention than it received. A ten-year limitations period paired with a ten-year records obligation means conduct from 2019 remains actionable, and the institution is required to retain the evidence either way. Records retention policies built around a five-year assumption are now out of alignment with both the exposure and the rule.
The first 24 hours after a potential hit
Stop the transaction. Do not complete, return, or reverse pending assessment. Blocking and rejecting are different obligations with different reporting consequences, and choosing wrong creates a second violation.
Preserve everything. Screening alert, underlying transaction records, counterparty file, correspondence, ownership documentation. The ten-year retention obligation applies.
Engage counsel before investigating. The disclosure clock and the privilege posture are both set in the first hours.
Determine what you actually have. Confirmed designated party, entity blocked through the 50 Percent Rule, potential sham transaction, or false positive. These carry different obligations.
Do not notify the counterparty. Tipping off risks obstruction exposure and can convert a manageable matter into an aggravated one.
Assess the population. A single hit is rarely a single instance. Determine whether the same counterparty, structure, or control gap produced other transactions before deciding what to disclose.
A note on export controls
Sanctions screening and export controls run on parallel tracks, and compliance officers frequently own both.
The Commerce Department's Bureau of Industry and Security issued an interim final rule on September 29, 2025 extending a 50 percent ownership concept to Entity List and Military End User List parties under the Export Administration Regulations. BIS subsequently suspended that rule effective November 10, 2025 for one year, through November 9, 2026, following a U.S. agreement with China.
Two points for planning purposes. The suspension is scheduled to lapse within months of this article's publication, and institutions with export exposure should be prepared rather than surprised. And the BIS rule is distinct from OFAC's 50 Percent Rule despite the surface similarity. They arise under different authorities, reach different lists, and are administered by different agencies. Treating them as one rule produces gaps in both directions.
Frequently asked questions
What is the OFAC 50 Percent Rule? Any entity owned in the aggregate, directly or indirectly, 50 percent or more by one or more blocked persons is itself treated as blocked, even if the entity never appears on the SDN List or any other OFAC list. Ownership interests held by multiple blocked persons are combined, including across different sanctions programs.
Does screening against the SDN List satisfy OFAC compliance? No. The SDN List identifies designated persons. It does not identify entities blocked by operation of the 50 Percent Rule, and as of OFAC's March 2026 guidance, formal ownership analysis alone is also insufficient where a transaction may conceal a continuing interest by a blocked person.
What is a sham transaction under OFAC guidance? A transfer or arrangement in which a blocked person appears to relinquish property while retaining a continuing interest in it. Because OFAC applies functional definitions of interest and property interest that look past legal form to economic reality, such transfers do not terminate the blocked interest, and the property remains blocked.
How much does voluntary self-disclosure reduce an OFAC penalty? A qualifying voluntary self-disclosure results in a base penalty amount at least 50 percent lower than in comparable cases without disclosure. Substantial cooperation provides further mitigation, and a first violation generally receives up to an additional 25 percent reduction.
When is a disclosure no longer voluntary? When OFAC or any other federal, state, or local government agency has already discovered the apparent violation, or a substantially similar apparent violation. Discovery by any government agency, not only OFAC, forecloses the credit.
How long is the statute of limitations for sanctions violations? Ten years for civil and criminal violations of IEEPA and TWEA, extended from five years by Section 3111 of the 21st Century Peace through Strength Act. OFAC extended its recordkeeping requirement to ten years to match, effective March 12, 2025.
How often should sanctions screening be refreshed? Continuously against list updates, and on a risk-tiered schedule for ownership. Onboarding-only screening leaves the institution exposed to every designation and every ownership change occurring after the relationship opens.
Where Falcon fits
Falcon conducts AML investigations, compliance program reviews, and in-house training with former FBI and IRS-CID agents and CAMS-certified specialists.
Sanctions exposure is fundamentally an ownership and control question, which makes it an investigative problem before it is a screening problem. Falcon associate Lionel Baren spent 22 years as an FBI Special Agent working money laundering, terrorism, and national security matters, then served with the U.S. Department of the Treasury Office of Technical Assistance on assignments in Afghanistan, Jamaica, and Suriname. Founder Thomas W. Raftery III worked white collar crime, money laundering, and public corruption across 22 years with the FBI. Falcon associates use a global network built over decades to establish beneficial ownership where public records stop. Meet the team.
For counterparty diligence before a relationship opens, see our guidance on vetting a foreign business partner before you sign the deal and on building an FCPA compliance program that holds up under DOJ scrutiny.
Contact Falcon to discuss a sanctions program review or beneficial ownership investigation.
About the author. Thomas W. Raftery III is the Founder and Managing Partner of The Falcon Consulting Group. A former FBI Special Agent with 22 years in law enforcement, he was the first appointed Inspector General for the Delaware River Port Authority and deployed to Afghanistan with SIGAR. He specializes in white collar crime, money laundering, public corruption, and FCPA compliance. He is a Certified Fraud Examiner and holds an M.B.A. from Drexel University with a concentration in accounting.