Advanced: sanctions evasion and ownership.

Beneficial ownership under the FATF Standards

Companies, partnerships and trusts are lawful and useful. They can also be used to hide who is behind money. FATF guidance lists sanctions evasion alongside money laundering, bribery, tax fraud and terrorist financing among the ways they are misused.

The FATF Glossary defines the beneficial owner of a legal person as "the natural person(s) who ultimately owns or controls a customer and/or the natural person on whose behalf a transaction is being conducted", including those who exercise ultimate effective control. Three points follow from the definition:

• Only a human being, never another company, can sit at the end of the chain, and a company can have several such owners.
• "Ultimately" includes ownership or control through a chain of companies, or by means other than direct control.
• For a trust, the beneficial owners include the settlor, the trustees, any protector, each beneficiary (or class of beneficiary), and anyone else with ultimate effective control.

The 25% figure. In the customer due diligence rules, 25% appears only as an example of a threshold for a controlling ownership interest. Since the 2022 revision of Recommendation 24, it is a ceiling: a country sets its threshold based on its own risk, at no more than 25%. Due diligence works as a cascade: first who holds a controlling ownership interest; then who controls the company by other means; and if no one is found, the senior managing official.

What countries must do (Recommendation 24, revised 2022). Beneficial ownership information must be adequate (enough to identify the person and how they own or control), accurate (verified against reliable, independent sources) and up to date (changed within a reasonable period, for example a month). Countries must use a multi-pronged approach: companies hold their own information; a public authority such as a registry holds it, or an equally effective alternative exists; and supplementary sources such as regulators and stock exchanges fill the gaps. FATF guidance stresses that a register does not replace an institution's own due diligence; institutions should not rely on it alone.

Two old tools of concealment are now targeted directly. New bearer shares must be prohibited and existing ones converted or immobilised. Nominee shareholders and directors, people who act on the instructions of someone else, must disclose their status and their nominator, or be licensed, or be prohibited.

How ownership is hidden

In 2018 the FATF and the Egmont Group studied 106 cases in which beneficial ownership was concealed. Their findings describe the toolkit.

• Shell companies, with no real operations, assets or employees, were the most common vehicle. Front companies are working businesses used to disguise illicit activity; shelf companies are set up and left dormant until needed.
• Layering: owners rarely held assets directly. They combined direct ownership with chains of companies across several jurisdictions.
• Nominees, especially informal ones such as spouses, children, other relatives and associates, appeared in a large majority of cases.
• Professional intermediaries appeared in most cases, and about half of them were assessed as complicit. Trust and company service providers appeared most often; accountants appeared least often but were the most likely to be complicit and to design the schemes; lawyers were most often involved in buying real estate. Only four intermediaries in all the cases reported suspicious activity as the FATF Standards require.
• The overall strategy was to hide in plain sight, using the ordinary infrastructure of trade and commerce.

Dropping below a threshold. Sanctions add a specific motive: if ownership falls below the test used by a sanctions authority, the company may no longer be caught automatically. The EU's 2024 sanctions best practices list warning signs that ownership or control has only been moved on paper:

• a share transfer close to the date of designation, including small transfers that take the seller just below the threshold;
• a new owner who is a family member, a former employee or another person close to the designated person, a sale at an abnormal price, or decisions still taken by the designated person;
• a buy-back option in the seller's favour;
• the designated person remaining the largest shareholder, for example 40% against several holders of 10%;
• needlessly complex structures with shell companies or trusts set up around the time of designation.

FATF guidance makes the same point about informal nominees and shadow directors: people who control a company without appearing on any register.

Ownership and control in sanctions

A sanctions list names people and entities. The harder question is what else is caught because a listed person owns or controls it. The three main Western regimes answer differently, and you need to know which applies to your business.

United States: the OFAC 50 Percent Rule (2014 guidance).

• If blocked persons together hold 50% or more of an entity, directly or indirectly, that entity is treated as blocked too, even if it is not on the list.
• Stakes are added together: two blocked persons with 25% each block the entity, even if they are designated under different programmes.
• "Indirectly" means through other entities that are themselves 50% or more owned by blocked persons.
• The rule covers ownership, not control. An entity controlled but not 50% owned by a blocked person is not automatically blocked, but OFAC urges caution and may designate it.
• If blocked owners sell below 50%, the entity is no longer automatically blocked, but property already blocked stays blocked, and OFAC expects firms to check the sale was not a sham.

European Union (Council best practices, updated 2024).

• Ownership means holding 50% or more of the proprietary rights, or a majority interest. Holdings of different designated persons should in principle be added together.
• Control is a separate test, with criteria such as the right to appoint most of the board, control of most voting rights, the power to exert dominant influence, including through a front company, or the right to use the entity's assets. If a criterion is met, control is presumed, but this can be rebutted case by case.
• Making funds available to an owned or controlled entity is in principle making them available to the listed person indirectly.
• These best practices are guidance from the Council, not law. Separately, since June 2024, EU Regulation 833/2014 on Russia requires EU operators to use best efforts to stop companies they own or control outside the EU from undermining those sanctions.

United Kingdom (OFSI general guidance).

• An entity is owned or controlled if a designated person holds more than 50% of its shares or voting rights, can appoint or remove a majority of the board, or if it is reasonable to expect that they can make the entity act in line with their wishes.
• OFSI does not simply add together the holdings of different designated persons, unless they hold them jointly or one controls the other's rights.
• Owned or controlled entities may not appear on the list themselves.
• Since 15 June 2022, OFSI can impose civil penalties on a strict liability basis: it does not need to prove the firm knew or suspected.

The FATF and UN view. The FATF Standards on targeted financial sanctions require freezing assets owned or controlled, wholly or jointly, directly or indirectly, by designated persons, and assets of anyone acting on their behalf. They set no percentage.

Evasion typologies, red flags and controls

After the 2022 invasion of Ukraine, US agencies published joint guidance on how sanctions and export controls on Russia were being evaded. The patterns apply far more widely.

• Third-party intermediaries and transhipment. A 2023 compliance note from the US Departments of Commerce, Treasury and Justice called the use of intermediaries and transhipment points one of the most common tactics for hiding the involvement of sanctioned parties and the real end user.
• Layered fronts. FinCEN and the Bureau of Industry and Security described front companies in third countries, owned on paper by a shell company, paying through foreign banks that clear in US dollars, and splitting purchases into small volumes across many suppliers.
• Priority goods. With the EU, the UK and Japan, the US identified nine customs codes covering electronic components found in Russian weapons, as a high-priority list for screening exports.

Red flags from those alerts include:

• a customer that is reluctant to say who the end user is or how the goods will be used;
• a company with little or no web presence, or a residential or shared address;
• payment from a third country or a business not named in the deal;
• last-minute changes to shipping or payment instructions, or a freight forwarder named as the final customer;
• routes through known transhipment points that make no commercial sense;
• shipments or payments that were previously destined for the sanctioned country.

The lists of transhipment countries in these alerts are explicitly not exhaustive, and they date from 2022 and 2023. Use them as prompts, not as a list of guilty countries.

Controls. OFAC's 2019 framework says every risk-based sanctions programme needs at least five components: management commitment, risk assessment, internal controls, testing and auditing, and training. Among the root causes of past violations it lists faulty screening software, such as lists not updated or spelling variations missed, and poor due diligence on customers, including their ownership. Three lessons follow:

• Screen owners, not just names. Owned entities may not be on any list.
• Keep checking. Ownership changes after onboarding; due diligence has to be ongoing.
• Own the result. Registers and third-party data help, but regulators hold the institution responsible for the outcome.

Cases and lessons

These cases are taken from official enforcement notices and press releases.

• A 51% subsidiary that screening missed (OFAC, 2018). Cobham Holdings settled for US$87,507 over shipments by its Aeroflex/Metelics business to a company that was not on the US list but was 51% owned by a designated company. Its screening software, although set to "fuzzy" matching, failed to match the shorter listed name when the longer company name was searched.
• A proxy and a trust (OFAC, 2025). GVA Capital was penalised US$215,988,868, the statutory maximum, for managing an investment for a designated individual through his nephew, whom the firm knew acted as his proxy, and through a structure including a trust. A legal opinion had concluded the investment was not blocked because it was not owned 50% or more by a listed person; OFAC found the designated person kept an interest in the property all the same.
• An owner who changed after onboarding (OFSI, 2026). Apple Distribution International was penalised £390,000 for two 2022 payments to a company whose new owner had just been designated. Its controls relied on self-certification and third-party ownership data that did not pick up the change in time, although it had been reported publicly. It was OFSI's first settled case.
• A wholly owned subsidiary (OFSI, 2025). A Moscow law firm, Herbert Smith Freehills CIS, was penalised £465,000 for payments in 2022 that included payments to a company wholly owned by a designated bank. OFSI said that failing to identify clear ownership is viewed more seriously than a good-faith mistake about control.
• A superyacht behind shell companies (US Department of Justice, 2023, allegations only). In a civil forfeiture complaint, prosecutors alleged that a 348-foot yacht reportedly worth over US$300 million was beneficially owned by a designated individual with ownership passed from one shell company to another, one of them formed about 30 days before the sale, and maintained with US dollar payments.

What the cases teach:

• The list is the start. Every case turned on an entity or asset that was not itself listed.
• Arithmetic is not the whole test. Proxies, trusts and control can bring property within sanctions even where a 50% calculation says otherwise.
• Ownership moves. Checks at onboarding are not enough when owners change and designations follow.

In Kenya: a beneficial owner is a natural person who holds at least 10% of a company's shares or voting rights, can appoint or remove a majority of the board, or exercises significant influence or control (Companies (Beneficial Ownership Information) Regulations, 2020, as amended in 2023). Changes must be notified within 14 days, nominees must disclose their nominators, and the register is not public: reporting institutions can ask the Registrar for information, for a fee. The 2022 ESAAMLG evaluation rated Kenya's effectiveness on beneficial ownership low and Recommendation 24 partially compliant; after the 2023 reforms, ESAAMLG re-rated Recommendation 24 largely compliant in 2024. UN sanctions are implemented through the Counter Financing of Terrorism Inter-Ministerial Committee. Check the current regulations and ratings.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF. A certificate is issued once per completion of the course.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.