🇪🇺Sanctions: a Route Map for the Individual, the Bank and the Structure

The sanctions landscape moves faster than any other subject touching private capital: lists grow weekly, EU packages arrive several times a year, and regulators rewrite their guidance. Every figure, package number and status below is therefore stated as at 2026-08-28 and needs checking against the primary source before it is relied on.

This map sets out the legal landscape and its compliance consequences for a bona fide holder of capital: which regimes exist, who runs them, and what exactly they prohibit. Circumventing a restriction is itself an offence in both the United States and the EU, and a formal re-registration of an asset sits on the list of indicators by which a regulator identifies precisely that kind of transaction.

A person enters the sanctions perimeter from one of five sides: their own name on a list, a payment stuck or frozen, a refusal by a bank, an ownership structure containing a designated participant, the country in which a counterparty is registered. In law these are five different procedures, with different authorities, deadlines and forms of application. The cost of choosing the wrong one is measured in months: a delisting petition will not release a frozen payment; a licence for a transaction will not reopen a closed account.

Concept

Restrictions fall into two groups that do not overlap. List-based measures strike a specific person: the American SDN List blocks property in which a designated person holds an interest, and the EU consolidated list under Regulation 269/2014 requires the freezing of funds owned or controlled by such a person. Sectoral measures prohibit a type of transaction, good or service regardless of whether the counterparty appears on any list; such a payment is rejected and returned to the sender rather than blocked.

The difference in consequences is fundamental. American blocking moves the money into a separate interest-bearing blocked account, and return to the sender is prohibited. The European and British freeze leaves the funds where they sit: the account remains the client's account, interest accrues, disposal is excluded. A freeze does not transfer title and has no expiry — it lasts until delisting or until a licence. Confiscation is a separate act on a separate legal basis, and conflating the regimes produces the wrong application. Both models are analysed in sanctions screening.

What sanctions are not

Four regimes are constantly conflated, although they rest on different rules, are run by different authorities and produce different consequences.

The practical conclusion: a bank refusal most often comes from the second row of that table rather than the first. A prohibition is addressed to specific categories of person; everything beyond it is the bank's own risk policy, a contractual decision that cannot be appealed on sanctions grounds. The procedure on the bank's side is described in AML and KYC for private clients, the composition of the dossier in source of funds, and the exit scenario in bank account closure.

Who is bound, and what must be reported unasked

Two questions come before the tests below, and a route map has to keep them apart: whether the rules reach you at all, and whether they oblige you to act rather than merely to abstain. Neither answer depends on being a target.

Reach follows nexus, not residence. Article 17 of Regulation (EU) No 269/2014 applies the freeze within Union territory, on board any aircraft or vessel under the jurisdiction of a Member State, to any national of a Member State inside or outside the Union, to any legal person incorporated or constituted under the law of a Member State, and to any legal person "in respect of any business done in whole or in part within the Union".

The American perimeter runs through the U.S. person, which 31 CFR 587.314 defines as any United States citizen, lawful permanent resident, entity organised under US law including its foreign branches, or any person in the United States. The British perimeter runs through the United Kingdom person — a UK national, or a body incorporated or constituted under the law of any part of the United Kingdom — whom section 21 of the Sanctions and Anti-Money Laundering Act 2018 reaches for conduct outside the UK. A Cyprus company directed from Dubai is still inside the EU perimeter, and a British national living there is still inside the British one; where the corporate layer sits is worked through in holding structures.

The second question produces duties with clocks attached, owed whether or not anyone asks for them.

Read the table as a calendar rather than a list: each row runs from an event, not from a request. Two of them bite hardest inside a private structure. A designated person's own report is not a courtesy — Article 9(3) of Regulation 269/2014 provides that failing to make the Article 9(2) report counts as participation in activities whose object or effect is to circumvent the measures, which turns silence into the very thing this page warns against.

And Article 8a of Regulation (EU) No 833/2014 requires EU persons to "undertake their best efforts to ensure that any legal person, entity or body established outside the Union that they own or control does not participate in activities that undermine" the measures: the duty sits on the EU parent, and it is discharged by governance and documented procedure rather than by distance. Directive (EU) 2024/1226 of 24 April 2024, for transposition by 20 May 2025, makes both circumvention and a designated person's failure to report criminal offences across the Union. Who inside a private structure actually carries these duties — the trustee, the corporate director, the family office — is set out in trustee and protector, and the policies, screening and audit that evidence them in the compliance stack.

The US 50 Percent Rule and the EU ownership/control criterion

This is where the most expensive structuring error lives, because the two tests sound alike and work differently.

The diagram below shows two ownership configurations: aggregated holdings passing the block down the chain, and control without a holding, which bites only in the EU.

The American 50 Percent Rule is set out in OFAC's Revised Guidance of 13 August 2014: an entity is blocked where designated persons own 50 percent or more of it in the aggregate, directly or indirectly. The holdings of several designated persons are added together — 25 percent plus 25 percent produce a blocked entity. Control without ownership does not trigger the rule itself: OFAC states expressly that an entity controlled by a designated person but not owned 50 percent or more is not automatically blocked, although OFAC may designate it separately, while transactions by US persons with a designated person acting on behalf of a non-designated entity remain prohibited in any event.

The European test is wider. Under the Council of the EU Best Practices ST 11623/24 of 3 July 2024, funds belonging to, held by or controlled by a designated person must be frozen. Ownership means 50 percent or more of the proprietary rights or a majority interest, with the same aggregation: 30 percent held by one designated person and 25 percent by another amount to ownership.

Control is assessed against eight criteria, any one of which suffices:

1. The right to appoint or remove a majority of the administrative, management or supervisory body.
2. Having in fact appointed such a majority through one's own votes.
3. Controlling a majority of voting rights under an agreement with other shareholders.
4. The right to exercise dominant influence under a contract or the constitutional documents.
5. The de facto ability to exercise such influence without holding the right, including through a front company.
6. The right to use all or part of the assets.
7. Managing the business on a unified basis with consolidated accounts.
8. Sharing jointly and severally or guaranteeing the liabilities.

A finding of ownership or control is rebuttable on a case-by-case basis.

The difference reduces to one point: in the United States control alone does not block, in the EU it does, so a structure that passes the American test may fail the European one. A formal transfer of a shareholding is no answer: OFAC's guidance on sham transactions of 31 March 2026 sets out seven indicators, among them a transfer to a family member or close associate and a transfer close in time to a designation — two separate red flags — and the continued involvement of the blocked person in the use, management or disposition of the property. The conceptual groundwork is in beneficial ownership, and what the registers show is in UBO registers.

Who keeps the lists and why they do not match

The United States works through programmes founded on executive orders: for the Russia direction that means E.O. 14024 and the acts connected with it, and OFAC keeps the lists. Removal and licensing procedures are analysed in OFAC sanctions removal.

The EU packages

The EU moves in packages. The twenty-first package was adopted on 23 July 2026 and was the largest by volume of listings in four years: 218 entries, of which 48 individuals and 170 entities (Council Implementing Regulation (EU) 2026/1843). On the financial side it froze the assets of 94 banks and financial institutions and imposed transaction bans on a further 33 Russian credit institutions, bringing more than a hundred Russian banks within the prohibitions; a Kyrgyz bank and three further non-Russian banks were designated separately for circumvention.

The crypto perimeter expanded most of all: transaction bans on 14 crypto platforms from Georgia, Panama, the UAE, the Marshall Islands, Kyrgyzstan and Belarus, the first mechanism for a full ban on transactions with the crypto-asset service providers of an entire third country (the new Article 5bc), and the widening of a prohibition already in place: since 18 January 2024 it has been forbidden to allow Russian nationals or natural persons residing in Russia to own or control, or to hold posts in the governing bodies of, a company constituted under the law of a Member State that provides crypto-asset wallet, account or custody services, and from 25 August 2026 the same prohibition covers any other crypto-asset service as defined in Regulation (EU) 2023/1114 — Article 5b(2a) of Regulation 833/2014 as amended by Council Regulation (EU) 2026/1848 of 23 July 2026.

Automatic adjustment of the oil price cap was paused until 15 July 2027, and the number of designated shadow-fleet vessels reached 673. The private-capital side of holding crypto — custody, tax and structures — is in crypto for private wealth.

The United Kingdom and Switzerland

The United Kingdom keeps its own UK Sanctions List; a listing is reviewed ministerially with subsequent judicial review, and OFSI issues licences. Switzerland is outside the EU and adopts the packages with a lag: the EU's twentieth package was adopted on 23 April 2026, while Swiss implementation was completed in substance on 19 August 2026 — by which point the EU had already adopted its twenty-first. Switzerland also keeps its own exceptions, licensing grounds and calendar: the first implementing step was taken on 22 May 2026 and the remaining measures took effect on 20 August 2026.

The Swiss perimeter may change wholesale within months. A vote on the neutrality initiative, which would confine Swiss participation to sanctions mandated by the United Nations, is scheduled for 27 September 2026; as at 2026-08-28 it has not taken place. Adoption would separate the Swiss list from the European one — the single status here capable of changing in a day. The seven regimes that a cross-border chain actually meets, Japan, Canada and Australia included, are set against each other on common axes in the regime matrix below.

What reaches the private client

The deposit threshold is the rule encountered most often. Article 5b of Regulation 833/2014 prohibits accepting deposits exceeding EUR 100,000 in total from Russian nationals and natural persons residing in Russia, and from legal persons established in Russia, and under the European Commission's guidance the prohibition applies wherever the person resides and falls away only for those holding a temporary or permanent residence permit in a Member State, an EEA country or Switzerland, or the nationality of one of those States. The threshold is computed as the sum of all accounts at one credit institution, whatever the type of account.

The services prohibition is narrower than commonly assumed. Article 5n covers accounting, audit, tax, consulting, legal advisory and a range of other services, but under the European Commission's guidance as of 22 January 2026 the prohibitions in paragraphs 1 and 3 are addressed to the Russian government and to legal persons established in Russia, and do not extend to natural persons in Russia. Services to a company outside Russia owned by Russian residents are permitted provided they are not for the benefit of the Russian parent. Services strictly necessary for the exercise of the right of defence in judicial proceedings are carved out separately.

The remaining circuits sit in dedicated write-ups: the goods perimeter with its thresholds and CN codes in goods under EU sanctions; bank refusal and its consequences in account closure and correspondent banking; the choice of custody venue in booking centres.

Secondary sanctions and payment routes

E.O. 14114 of 22 December 2023, which amended E.O. 14024, gave OFAC two instruments against a foreign financial institution: blocking sanctions, or a prohibition or conditions on maintaining correspondent and payable-through accounts in the United States. The trigger is a determination that the institution conducted or facilitated a significant transaction involving Russia's military-industrial base. OFAC assesses significance by the size, number and frequency of the transactions, their nature, management awareness, the nexus to designated persons and the use of deceptive practices.

A foreign bank is under no formal obligation to apply the American rule — it faces the risk of losing dollar settlement, which in practice weighs more than an obligation. Third-country banks therefore narrow their acceptance of Russian payments long before appearing on any list, and it is compliance rather than the legislature that takes the decision. Individual episodes are covered in Zhejiang Chouzhou Commercial Bank, a comparison of destinations in Russia to the UAE or Singapore, and the wider context in the Russia hub. What a bank tests in a structure, and which posture survives that test, is described in sanctions-resilient structures and economic substance.

Delisting and licences

Removal from an American list runs through a petition for administrative reconsideration under 31 CFR 501.807 on two permissible grounds: an insufficient basis for the listing, or circumstances that have since fallen away. OFAC checks completeness in 7–10 business days, and usually issues its questionnaire within 90 days. There is no deadline for the substantive review: 31 CFR 501.807 fixes none, and reconsideration runs for as long as OFAC takes.

A licence solves a different problem — it permits a specific transaction without lifting the listing. A general licence operates for everyone who meets its conditions and requires no application; a specific licence is issued on application, and a refusal is issued without reasons. The decision is reversible: the licence granted to Dan Gertler on 15 January 2021 was revoked on 8 March of the same year. The scale of British licensing is visible from OFSI's 2024–2025 review: 904 decisions on specific licences and 19 general licences. The procedural detail is in OFAC sanctions removal and sanctions screening.

Side by side, the four systems a private client meets most often split along the same lines: who receives the request, whether any deadline binds the decision-maker, and what a court may examine afterwards.

The Swiss row follows the account in the Global Investigations Review guide to Swiss sanctions. Two consequences follow. Only the EU puts a hard clock on the applicant, and only the EU forces the authority to revisit the list on a fixed cycle: a Council renewal date is the natural moment to file, because the file is being reopened anyway. Switzerland is the only system that issues a formal, appealable decision on every request with the burden on the state, which makes a Swiss refusal the most litigable of the four, while the American route is the least bounded — no deadline for OFAC and a court that defers to it.

Qualifying the event: six situations that get confused

Everything downstream — which office to write to, what evidence helps, whether there is any remedy at all — depends on naming correctly what has happened. The lead described five sides from which a person enters the perimeter; the legal characterisation of the adverse event is a finer and separate question, and six of them are routinely treated as one. A payment that stops can be a mandatory prohibition, an asset freeze, or a false match at the screening desk; a bank that says no can be obeying the law or exercising its own risk appetite. The remedy that fixes one does nothing for another.

Two distinctions run underneath all six. The first is between denial of service and loss of title. A refusal to transact, the closure of an account and even a freeze all leave ownership where it was: the funds remain the client's funds, and only confiscation or forfeiture — a separate act on a separate legal basis, reached through its own procedure — transfers title away. The second is between the right to the funds and the ability to dispose of them. A freeze suspends the second while leaving the first intact; that is why a frozen balance still accrues interest, still belongs to the holder, and is released in full on delisting or under a licence, while a blocked balance in the American model is moved to a segregated account but is still nobody else's property. Conflating "I cannot move it" with "I have lost it" produces the wrong application and wastes the months the right one takes.

The table's discipline is the whole point: read across the row before choosing an office. The single most expensive error is to treat a bank's policy refusal as a sanctions problem and spend a year seeking a licence that was never the obstacle.

Remedy routes: complaint, regulator, licence, delisting, court

Five routes exist, addressed to different bodies, on different legal bases, producing different results. Delisting and licences is set out from the American side above; the full set, and the reasons they do not substitute for one another, are these.

Information and complaint is the first move in almost every case and the only move in a false positive. The productive request is a written statement of the status of the transaction or the account — needed later for any licence or claim — together with, where the block is a screening match, the identity evidence that separates the holder from the listed entry. OFAC directs a person mistaken for a listed name to its Compliance Hotline rather than to the delisting process, because there is nothing to delist. The internal complaint to the operator is also the procedural precondition for the ombudsman.

Regulator or ombudsman addresses the fairness of an operator's conduct, not the lawfulness of a measure. In the United Kingdom the Financial Ombudsman Service will look at an account closure for bias, discrimination, inadequate notice and the loss it caused, and can direct compensation; for accounts opened from 28 April 2026 a bank must give at least 90 days' notice and detailed, specific reasons, with a carve-out for suspected serious crime. What the ombudsman cannot do is override a lawful freeze or reopen an account the bank was entitled to exit on a genuine financial-crime basis — it tests process, not risk appetite. The banking side of an exit is set out in bank account closure and AML and KYC for private clients.

Licence or authorisation permits a specific transaction without touching the underlying measure. In the EU a competent national authority may, under Article 4 of Regulation 269/2014, release frozen funds for basic needs, reasonable legal fees, routine account-maintenance charges or — on prior notice to the Commission — extraordinary expenses; OFSI licenses in the same registers, and OFAC issues general and specific licences. A licence never delists, and — the point that must not be promised — it never reopens an account closed on policy grounds, because there is no prohibition there for a licence to lift. Turning a licence into an actual release of securities is worked through in Euroclear and Clearstream.

Delisting and administrative reconsideration removes the measure at its root and runs through a different door in each system. OFAC takes a petition under 31 CFR 501.807 on two grounds — an insufficient basis, or circumstances that have since changed. The EU takes a reasoned request to the Council, which must have stated its reasons for the listing and keeps the Russia list under periodic review. The United Kingdom takes a request to the appropriate Minister under section 23 of the Sanctions and Anti-Money Laundering Act 2018 to vary or revoke, with a repeat request limited to a significant matter not previously considered. None of these carries a fixed decision deadline.

Court is the route once the administrative door has been used or refused. In the EU a listed person may bring an annulment action before the General Court under the second paragraph of Article 275 and Article 263 of the Treaty on the Functioning of the European Union, subject to the two-month limit Article 263 sets. In the United Kingdom section 38 of the 2018 Act sends the challenge to the High Court, which applies the principles of judicial review and may grant the relief judicial review allows. In the United States a designation is reviewable in federal court under the Administrative Procedure Act, where the court applies a deferential arbitrary-and-capricious standard and has upheld OFAC's broad discretion to deny delisting. Separately from all of this, a civil claim against the bank lies where a refusal or closure was a contractual decision rather than a legal requirement — the architecture of bringing and enforcing such a claim across borders is in cross-border disputes — but it fails where the bank was obeying a mandatory prohibition.

Four situations worked through

Same name at the screening desk. A person shares a name, or a close spelling, with an entry on a list, and a payment or onboarding stops. Nothing has been frozen and no measure applies to them; the legal actor is the screening operator, whose only question is identity. The evidence that moves it is documentary proof of who the holder is — full name, date and place of birth, identifiers — set against the listed entry, and OFAC's Compliance Hotline exists precisely to verify a suspected match. No body has power to "delist" a person who was never listed; the file is corrected where the match was made.

A designated person in the ownership chain. The client is not listed, but an entity in the structure is caught because a listed person owns 50 percent or more of it (the American test) or controls it on one of the eight EU criteria. The legal actor is OFAC or the EU competent authority, but the first assessment is made by the operator applying the test; its power is to freeze or refuse, not to adjudicate title. The evidence is the ownership and control map — who holds what, who appoints whom — and, where the presumption is wrong, the material to rebut it, since both the American 50 percent finding and the EU ownership/control finding are rebuttable on the facts. Where the entity is genuinely caught, only a licence or the listed person's own delisting changes the position; restructuring after the fact runs into the sham-transfer indicators. The concepts are in beneficial ownership and UBO registers.

A bank refusal with no mandatory freeze. The bank declines to onboard, or gives notice to close, citing risk appetite rather than any list. No measure applies; the legal actor is the bank alone, exercising a contractual and commercial power. The evidence that helps is not sent to any regulator but to the next provider — a clean source-of-funds dossier and a manageable risk picture — while the fairness of the closure itself (notice, reasons, loss) is the province of the ombudsman. This is the situation most often misread as a sanctions problem; it is analysed as a banking exit in bank account closure, and the dossier that travels between banks in source of funds.

Funds frozen under an applicable regime. The holder is listed, and an EU or UK freeze, or a US block, bites. Title stays with the holder; disposal is suspended. The legal actor is the designating authority, and its powers run to freezing, licensing and delisting — not to taking the asset, which would require the separate act of confiscation. Two routes run in parallel: a licence from the competent authority for defined needs (basic living costs, legal fees, maintenance) under Article 4 of Regulation 269/2014 or its OFSI and OFAC equivalents, and a challenge to the listing itself — a reasoned request to the Council, a section 23 request to the Minister, or a 31 CFR 501.807 petition, followed if refused by the General Court, the High Court or a federal court. The securities-unfreezing path in particular is in Euroclear and Clearstream.

The Russian perimeter

The Russian circuit is no mirror of the Western one and runs on a different trigger — jurisdiction rather than name. The list of unfriendly states was approved by Government Directive No. 430-r of 5 March 2022; the sale of a Russian asset to a person from that list goes through the Government Commission, where the benchmark since October 2024 has been a discount of no less than 60% to the valuation plus a contribution of 35% of the price, transactions above RUB 50bn require presidential approval, and obligations to such creditors exceeding RUB 10m a month are discharged in roubles through a type "C" account.

The tax side of the same status is Decree No. 585 of 8 August 2023, which froze the distributive articles of the treaties with 38 states, after which payments run at domestic rates. The detail is in unfriendly countries for Russia and the suspension of the tax treaties.

Regime Matrix: Seven Jurisdictions on Common Axes

The sections above take the four Western regimes one at a time, which is how a lawyer reads them and not how a transaction meets them. A single payment can touch an American correspondent, a European counterparty, a British insurer and a Swiss custodian in one afternoon, and each of them applies a different test to the same facts. The matrix sets seven regimes against the axes that decide whether a transaction is permitted at all. Japan, Canada and Australia are here because they routinely sit in the chain — a shipowner, a reinsurer, a mining counterparty — and because their tests are not the American ones.

The second half of the matrix is procedural, and in practice it decides more than the listing itself: what can be permitted, what must be volunteered, what a breach costs and how an attempt to work around it is treated.

What the two tables decide

Four differences do the work. The first is the ownership test, and it is the only place where a structure can pass one regime and fail another on identical facts: aggregate ownership in the United States, ownership or any one of eight control criteria in the EU, a three-limbed test in the United Kingdom that ends in "conducted in accordance with the person's wishes", and, in Japan and Australia, no published percentage at all, which means the answer is a designation rather than a calculation.

The second is reach. Only the American regime reaches persons with no connection to the country that imposed it, and it does so through one instrument rather than through extraterritorial prohibitions: the power under E.O. 14114 to cut a foreign financial institution off from dollar correspondent accounts. Everything commonly called "secondary sanctions" in the other six regimes is really the listing of a third-country person for circumvention — the EU's twenty-first package designated a Kyrgyz bank and three further non-Russian banks on precisely that ground. The practical consequence is that a compliance department in Almaty or Dubai is answering to an American rule that does not bind it, and to a European listing risk that does.

The third is what must be volunteered. Three regimes put a clock on it: two weeks and six weeks in the EU, ten business days in the United States, ten weeks for a designated person's own assets in the United Kingdom. Missing those deadlines is not a paperwork failure — art. 9(3) of Regulation 269/2014 makes a failure to report circumvention in its own right, which converts an administrative default into the most serious category of breach.

The fourth is remedy. A licence is available everywhere, but only in the EU is it decided by a national authority rather than a central one, so the same transaction can be permitted in one Member State and refused in another; and only in Canada does the state have a route beyond freezing, since forfeiture transfers title rather than suspending its use.

Worked example: the same shareholding, four answers

An operating company has two shareholders, each a designated person, holding 30% and 25%. A third shareholder holds 40% and is not designated, but a shareholders' agreement gives that third shareholder the votes to appoint the board.

Cut one designated holding to 20% and the American answer changes while the European and British answers do not — and the manner of the cut is itself evidence: a transfer to a family member, or one made close in time to the designation, sits on OFAC's published list of sham indicators.

Third Jurisdictions: Where the Restriction Is Not the Law but the Bank

The nine jurisdictions below are routinely described as open. Legally that is broadly accurate: none of them, Singapore apart, has adopted autonomous restrictions against Russia, and several have statutes pointing the other way. Operationally it is misleading, because the binding constraint is rarely the local list. It is the correspondent chain, the local bank's own risk appetite and the possibility of being listed by the EU or designated by OFAC for circumvention.

Read as a group, the table says something the usual framing obscures. The absence of a local list does not make a jurisdiction usable; it moves the decision from a public rule to a private one. A public rule can be read in advance, licensed around and litigated. A bank's risk appetite can be neither read nor appealed, changes without notice, and applies retrospectively to a relationship already open — which is why a refusal in these jurisdictions arrives as a closed account rather than as a reasoned decision, and why the remedies set out above mostly do not reach it.

Singapore is the instructive exception, and for the opposite reason to the one usually given. Having adopted its own measures, it made the perimeter legible: a transaction either falls inside the local prohibition or it does not, and the correspondent has less to add. A jurisdiction with rules is easier to operate in than a jurisdiction with only discretion.

Which regime governs a given chain

Risks