Sanctions Screening for Private Equity: Beyond the 50% Rule
Michael Harris | Financial Crime and Regulatory Compliance Specialist, Neotas
Last reviewed: October 2026 | Reading time: 13 minutes
In December 2025, a US private equity firm agreed to pay OFAC $11,485,352.[1] Its third-party screening platform had returned no matches. Its counsel had concluded that the sanctioned investor did not own 50% or more of the investing vehicle. OFAC penalised it anyway.
That case defines the problem with sanctions screening for private equity today. Most firms test names and ownership percentages. The risk sits in relationships: who acts for whom, whose money it is, and who takes the decisions. This guide explains what PE firms must screen, where politically exposed person (PEP) and ownership risk hides, and how to decide when a screen is enough and when a deal party needs investigation.
Quick answer
Sanctions screening for private equity checks a target, its owners, management, sellers, co-investors and key counterparties against sanctions lists and PEP data, before signing and throughout the hold period.
OFAC’s 2025 cases show a list check and a 50% ownership test are not enough where trusts, proxies or family representatives obscure control.
Key takeaways
- OFAC settled with IPI Partners for $11,485,352 on 2 December 2025, even though its screening returned no matches and the sanctioned investor held less than 50%.[1]
- OFAC imposed a $215,988,868 penalty on GVA Capital on 12 June 2025 for managing an investment for a sanctioned oligarch through his nephew, whom GVA knew acted as his proxy.[2]
- US sanctions violations now carry a 10-year statute of limitations, so an acquirer can inherit a decade of a target’s history.[3]
- Under the DOJ M&A Safe Harbor, acquirers generally have 180 days after closing to disclose a target’s violations, and the clock runs from closing, not from discovery.[4]
- Since August 2026, most US companies no longer report beneficial owners to FinCEN, so target ownership must be established independently.[6]
- The OFAC 50 percent rule tests ownership, not control, so a party can pass the threshold and still be directed by a sanctioned person.
In this guide
What changed for private equity sanctions compliance in 2025 and 2026
Five developments moved sanctions risk from the compliance file into the deal team’s model.
| Date | Development | Why it matters to a PE firm |
|---|---|---|
| 11 Aug 2026 | FinCEN final rule limits beneficial ownership reporting to foreign entities registered in the US[6] | No federal register of US-company owners to check against |
| 2 Jan 2026 | FinCEN delays the investment adviser AML rule to 1 January 2028[5] | Advisers will become Bank Secrecy Act “financial institutions”; the bar is rising, not falling |
| 2 Dec 2025 | OFAC settles with IPI Partners for $11,485,352[1] | A clean screen and a sub-50% stake did not protect the firm |
| 16 Jun 2025 | DOJ declines to prosecute White Deer Management after a post-acquisition disclosure[4] | First declination under the M&A Safe Harbor; disclosure timing decides outcomes |
| 12 Jun 2025 | OFAC penalises GVA Capital $215,988,868[2] | Statutory maximum for managing a sanctioned person’s investment through intermediaries |
Why sanctions risk is now a deal-team problem
US sanctions are strict liability. A firm can breach them without knowing it dealt with a blocked person, and OFAC weighs what the firm had reason to know. Four figures define the exposure a PE firm now carries.
$11.49m[1]
OFAC settlement with PE firm IPI Partners, December 2025
$215.99m[2]
OFAC statutory maximum penalty on GVA Capital, June 2025
10 years[3]
US sanctions statute of limitations and OFAC recordkeeping period
180 days[4]
Typical post-close window to disclose under the DOJ M&A Safe Harbor
Two changes raise the stakes for acquirers. The 21st Century Peace through Strength Act, signed on 24 April 2024, extended the OFAC statute of limitations from five to ten years. OFAC’s matching ten-year recordkeeping requirement took effect on 12 March 2025.[3] A target’s past conduct, and your evidence of what you checked, now has to survive a decade.
Successor liability: in a stock purchase or merger, the target’s historical violations travel with it into your portfolio. The investment committee’s question is no longer only “is this company clean today?” It is “what has it done since 2016, and can we prove we looked?”
What the IPI Partners settlement teaches PE firms about sanctions due diligence
The IPI case matters because the firm did what most PE firms still treat as sufficient, and OFAC penalised it anyway.
According to OFAC’s enforcement release of 2 December 2025, Suleiman Kerimov was designated on 6 April 2018. IPI’s counsel concluded that no blocking was required because Kerimov did not formally own 50% or more of the investing vehicle. A third-party screening platform returned no positive matches. OFAC still found 51 apparent violations between July 2018 and June 2022: 18 capital calls, 20 distributions and 13 management-fee payments.[1]
| What the screen and the legal analysis saw | What OFAC’s release describes |
|---|---|
| No name match on the investor | Funds traceable to a designated person through a trust structure |
| Ownership below the 50% threshold | Benefit and direction exercised through representatives, including a family member |
| An attestation from the investor side | An attestation OFAC said the firm had reason to know was inaccurate |
| A legal opinion on ownership | An opinion built on an incomplete fact base |
The base penalty was $14,356,690. OFAC treated the case as non-egregious and not voluntarily self-disclosed, and the settlement came to $11,485,352.[1]
Nothing in IPI’s process was careless on paper. Every control tested names and percentages, while the risk sat in relationships. That is the gap a database cannot close by adding another list.
OFAC’s GVA Capital enforcement release of 12 June 2025 shows the egregious end of the same pattern. Between April 2018 and May 2021, GVA knowingly managed an investment for Kerimov by working through his nephew, Nariman Gadzhiev, whom GVA knew served as Kerimov’s proxy. OFAC imposed the statutory maximum of $215,988,868.[2]
Our view: both cases turned on proxies and family representatives. Neither would have been caught by a larger sanctions database. Both would have surfaced by asking who stands behind the vehicle, in the languages and local records where that answer lives.
Find the sanctions exposure your screen cannot see
Closed a deal in the last six months? A Neotas specialist will review one live or recent deal against the ownership and control indicators OFAC cited in 2025, and show you which parties your current process misses.
What is the OFAC 50 percent rule, and where does it stop protecting you?
The OFAC 50 percent rule states that any entity owned 50% or more, directly or indirectly, individually or in aggregate, by one or more blocked persons is itself blocked, even if it does not appear on the SDN List.[10] It is an ownership test. It says nothing about control.
That gap is the trap. OFAC’s guidance on entities owned by blocked persons tells firms to exercise caution where a blocked person holds a significant minority stake or exercises control below 50%. Control without ownership does not automatically block an entity, but it is a strong signal that the money or the decisions may belong to a sanctioned person.
| Test | What it captures | What it misses |
|---|---|---|
| SDN name screening | Listed persons and entities by name and alias | Unlisted entities, proxies, transliteration variants |
| OFAC 50 percent rule | Entities owned 50% or more, in aggregate, by blocked persons | Control through boards, vetoes, family members, trusts and nominees |
| Control indicators | Who directs the asset, funds it or benefits from it | Requires investigation, not a database |
How do UK and EU rules treat ownership and control?
The UK and EU apply “owned or controlled” tests that reach control as well as ownership. In its annual review for 2024 to 2025, OFSI states that it views a failure to properly consider and identify ownership more poorly than an incorrect but good-faith assessment of control.[8] A documented investigation is mitigating. An undocumented assumption is not.
The EU’s 21st Russia sanctions package, adopted on 23 July 2026, widened ownership-and-control language in several measures.[9] UK portfolio companies above the size thresholds also face the Economic Crime and Corporate Transparency Act (ECCTA) failure-to-prevent-fraud offence, in force since 1 September 2025.
What is the BIS Affiliates Rule?
The BIS Affiliates Rule extends US export-control restrictions to entities owned 50% or more by listed parties. It took effect on 29 September 2025 and was suspended for one year from 10 November 2025.[7] For portfolio companies that export, ownership tracing now matters for export controls as well as sanctions.
Status as of October 2026: US officials indicated in September 2026 that the suspension will run with the US-China trade truce to 10 January 2027. No Federal Register notice confirming that extension had been published at the time of review.
Who should a private equity firm screen across the deal lifecycle?
A PE firm should screen every party whose money, control or reputation attaches to the deal, at the stage where that party enters it. Scope matters more than any single tool.
| Deal stage | Parties in scope | Typical gap |
|---|---|---|
| 1. Origination and LOI | Target, parent, material subsidiaries, sellers, founders | Screening the target name only |
| 2. Confirmatory diligence | Ultimate beneficial owners, directors, senior management, their relatives and close associates | Relying on the seller’s structure chart |
| 3. Structuring and signing | Co-investors, SPVs, lenders, minority holders with board rights | Treating co-investors as “known” |
| 4. Post-close and hold | Portfolio companies’ distributors, resellers, agents and key suppliers in high-risk transit jurisdictions | No re-screening after closing |
| 5. Exit | Buyers, their financing and their owners | Assuming the buyer’s bank did the work |
This scope sits inside the wider workstreams covered in our private equity due diligence checklist. Sanctions and PEP checks are the part most likely to be reduced to a single database search.
Scope note: LP and investor onboarding runs on a separate track, usually with a fund administrator. It raises the same ownership questions IPI faced, but it is a know-your-customer process that the FinCEN investment adviser AML rule, now effective 1 January 2028, will formalise.[5] This guide focuses on the deal side, where most firms have the thinnest controls.
How should PE firms treat politically exposed persons in a target?
A politically exposed person (PEP) is someone entrusted with a prominent public function, along with their relatives and close associates (RCAs), as set out in FATF Recommendation 12. A PEP link in a target is not a prohibition. It is a pricing, governance and reputational risk that the investment committee needs to see before signing.
In a buyout, PEP exposure usually hides in three places:
Founders and sellers
Particularly in emerging markets, where they may hold, or recently have held, regional office.
State-owned enterprises
Appearing as customers, suppliers or minority holders.
Management teams
Including relatives of officials whose names never reach a commercial PEP database.
The last gap matters most. Commercial PEP data is strongest for national figures in English-language markets and weakest for regional officials, family members and recent appointments. Neotas documented this pattern in a PEP screening case study where standard checks missed undisclosed political links.
The Neotas Hidden Control Index: when is a screen enough?
The Hidden Control Index is a triage model Neotas built from the control indicators in OFAC’s 2025 enforcement releases and OFSI’s ownership guidance. It answers one question per deal party: can automated screening carry this party, or does it need an analyst?
Score each party from 0 (no signal) to 3 (strong signal) on six indicators.
1
Ownership opacity
Trusts, nominees, or layered vehicles in Guernsey, the BVI, Cyprus or similar jurisdictions. Start with how to trace ultimate beneficial owners.
2
Proxy or representative signals
A family member, gatekeeper or adviser acting for an undisclosed principal.
3
Source-of-funds link
Capital traceable to a designated, sanctions-adjacent or high-risk person.
4
PEP and RCA proximity
Current or former public office in the ownership or management chain.
5
Jurisdiction and sector exposure
Operations, customers or transit routes in sanctioned or circumvention-risk markets.
6
Local-language adverse media density
Allegations in non-English press, court records or social media that do not appear in English sources. See what adverse media screening misses.
Score 0-4
Automate
Structured screening and continuous monitoring.
Score 5-9
Escalate
Analyst-reviewed enhanced due diligence before signing.
Score 10-18
Investigate
Full OSINT and beneficial ownership investigation before committing capital.
Override rule: a score of 3 on ownership opacity, proxy or representative signals, or source-of-funds link moves the party directly to Investigate, whatever its total. A party can score low overall and still sit behind a trust funded by a designated person. That is the IPI lesson.
The index tells you where depth is needed. It does not supply the depth. Tracing control through foreign registries, reading local-language court filings and mapping family relationships is OSINT investigation work that no questionnaire or seller attestation can replace.
Apply the Hidden Control Index to a real deal party
Bring one target, seller or co-investor. Neotas will score it with you and show where automated screening is enough and where deeper investigation has to begin.
What happens after closing: successor liability and the 180-day window
After closing, the acquirer owns the target’s sanctions history and its future exposure. Two obligations follow: deciding quickly whether to disclose, and monitoring the portfolio for change.
How does the DOJ M&A Safe Harbor work?
The DOJ National Security Division announced its M&A Safe Harbor on 5 October 2023 and added it to its voluntary self-disclosure policy on 7 March 2024. Acquirers who disclose a target’s misconduct generally have 180 days from closing to disclose and one year to remediate.[4]
On 16 June 2025 the DOJ issued its first declination under that policy. White Deer Management disclosed sanctions and export-control violations at Unicat Catalyst Technologies about ten months after the acquisition, and the DOJ still treated the disclosure as timely in the circumstances. Firms should not plan around that flexibility. The ones that benefit are the ones that find the problem early.
Day 0
Closing. The disclosure clock starts.
Day 90
Sanctions and PEP review of the target’s counterparties complete.
Day 180
Disclosure decision taken, with advice.
Day 365
Remediation complete.
In practice, post-close integration should include a sanctions and PEP review of the acquired company’s counterparties within the first 90 days. That leaves time to investigate, take advice and decide on disclosure inside the window.
Why does portfolio monitoring need to be continuous?
A risk score at closing is not static. Designations, ownership changes, new PEP appointments and fresh allegations arrive throughout a four-to-seven-year hold, and an annual re-screen can surface them up to 11 months late.
Continuous monitoring re-checks portfolio companies, their owners and their critical third parties as lists and media change, with alerts routed to a named owner. For portfolio-company procurement and risk teams, this is third-party risk management applied to the companies you own.
Related: how to tier and assess portfolio-company counterparties is covered in our guide to third-party risk assessment.
Where are US, UK and EU expectations heading?
Across all three jurisdictions, the direction is the same: more emphasis on ownership and control, and less tolerance for undocumented assumptions.
| Regime | Status as of October 2026 | Relevance to PE |
|---|---|---|
| FinCEN investment adviser AML rule | Effective 1 January 2028; scope under review[5] | Formalises AML programmes, including sanctions controls, for advisers |
| FinCEN beneficial ownership reporting | Final rule 11 August 2026, effective 14 August 2026; US companies exempt[11] | Target ownership must be verified independently |
| BIS Affiliates Rule | Suspended; reimposition date tied to the US-China truce[7] | Ownership tracing for export-controlled portfolio companies |
| OFSI enforcement approach | Reduced maximum discount for voluntary disclosure confirmed in January 2026 | Early, documented findings matter more |
| UK ECCTA failure to prevent fraud | In force since 1 September 2025 | Large UK portfolio companies need reasonable prevention procedures |
| EU Anti-Money Laundering Regulation (AMLR) | Applies from 10 July 2027 | Tighter beneficial ownership expectations across EU structures |
Common mistakes in private equity sanctions screening
Each of these mistakes looks reasonable on its own. Together they describe the control environment OFAC penalised in 2025.
| Mistake | Why it fails |
|---|---|
| Screening the target, not its owners | IPI’s investor produced no name match; the exposure sat one layer up. |
| Treating the 50% rule as the finish line | It is an ownership test, not a control test. |
| Relying on attestations | OFAC asks what you had reason to know, and a representation does not answer that. |
| Searching adverse media in English only | Allegations about regional officials and family networks rarely appear in English first. |
| Stopping at closing | Successor liability looks back ten years, and new designations arrive every month. |
| Keeping no evidence trail | Under ten-year recordkeeping, an undocumented check is close to no check. |
The same pattern appears in the wider private equity due diligence risks the data room won’t show you.
What good looks like: evaluation criteria for a PE sanctions programme
Use these questions to test your current process, or any provider you are assessing.
| Criterion | Question to ask | Weak answer |
|---|---|---|
| Coverage | Which sanctions, PEP and watchlist sources are screened, including UK, EU and UN lists? | “OFAC SDN” |
| Ownership depth | Can it trace control to natural persons through trusts and offshore vehicles? | “We rely on the seller’s structure chart” |
| Language reach | Does adverse media cover local-language sources in the target’s markets? | English news only |
| Analyst judgement | Who reviews ambiguous hits and proxy signals? | Automated scoring only |
| Monitoring | How quickly is a new designation or allegation flagged after closing? | At the annual review |
| Audit trail | Can you show what was checked, when and by whom, for ten years? | Emails and PDFs |
How Neotas supports sanctions and PEP due diligence for private equity
Neotas works on one principle: automate what you can, investigate what you must. Rated in the Chartis FCC50, it pairs structured screening with analyst-led intelligence, so the Automate band runs at speed and the Investigate band gets human judgement.
| Problem | Neotas capability |
|---|---|
| Sanctions and PEP coverage | Screening against premium data sources accessed through reseller agreements, in one workflow |
| Hidden owners and proxies | Enhanced due diligence with analyst-led beneficial ownership investigation |
| Foreign-language risk | OSINT and social media intelligence, with search in 30+ languages |
| Change during the hold | Continuous monitoring with configurable risk models and custom alerting |
| Regulatory defensibility | A full audit trail of every check, finding and decision |
Private equity firms already use Neotas for investment due diligence. The same platform answers the ownership and political questions that a database alone cannot.
Sanctions and PEP due diligence for private equity, tested on your own deal
Send one target, seller or co-investor. Neotas will return an example sanctions and PEP due diligence assessment covering ownership, control, political exposure and local-language findings that a database screen would not surface.
Frequently asked questions: sanctions screening for private equity
What is the 50 percent rule?
The OFAC 50 percent rule blocks any entity owned 50% or more, directly or indirectly, individually or in aggregate, by one or more blocked persons, even if the entity is not on the SDN List. It tests ownership only. OFAC guidance still urges caution where a blocked person holds a significant minority stake or exercises control below 50%.
What is the UK 50% rule for sanctions?
The UK treats an entity as subject to sanctions if a designated person owns more than 50% of it or controls it, for example by directing its affairs. Unlike the US rule, the UK test explicitly reaches control. OFSI treats a documented, good-faith control assessment more favourably than a failure to consider ownership at all.
What are the OFAC rules?
OFAC administers US economic sanctions under laws such as the International Emergency Economic Powers Act. US persons may not deal in the property or interests of blocked persons, and liability is strict. Since April 2024, violations carry a ten-year statute of limitations, and since March 2025 related records must be kept for ten years.
Do private equity firms have to screen for sanctions?
Yes. US sanctions apply to all US persons, including private equity firms and their funds, whether or not they are regulated as financial institutions. A firm that skips screening still carries strict liability for dealings with blocked persons, and an acquirer can inherit a target’s historical violations through successor liability.
Is a private equity firm liable for an acquired company’s past sanctions violations?
It can be. In a stock acquisition or merger, successor liability means the target’s historical violations stay with the business you now own. The DOJ’s M&A Safe Harbor offers protection to acquirers who generally disclose within 180 days of closing and remediate within one year.
Does the OFAC 50% rule cover control without ownership?
No. The 50% rule is an ownership test. Control by a blocked person below 50% does not automatically block an entity, but OFAC’s December 2025 settlement with IPI Partners shows that money and decisions routed through proxies and family representatives can still produce violations.
Who counts as a PEP in an acquisition target?
A politically exposed person holds or held a prominent public function, such as a senior official, legislator, judge or executive of a state-owned enterprise. Their relatives and close associates also count. In targets, PEP links most often sit with founders, sellers, family members of regional officials and state-owned customers.
How often should portfolio companies be re-screened?
Critical portfolio companies and their high-risk counterparties should be monitored continuously rather than annually. Sanctions designations, ownership changes and new allegations arrive throughout the hold period, and an annual review can surface them up to a year late, after payments or contracts have already gone through.
Related reading
Practical guides for PE deal teams, General Counsel and compliance leads working on ownership, political exposure and portfolio risk.
Private Equity Due Diligence Checklist
The full private equity due diligence checklist across financial, legal, commercial and integrity workstreams, with sanctions and PEP checks placed in deal-stage order.
How Neotas investment due diligence supports private equity firms assessing targets, management teams and co-investors before capital is committed.
Enhanced Due Diligence Services
Analyst-led enhanced due diligence combining structured data, OSINT and multilingual research for high-risk parties where a screen is not enough.
Ultimate Beneficial Owner (UBO) Explained
What an ultimate beneficial owner is, how ownership and control are traced through layered structures, and why UBO gaps create sanctions exposure.
Adverse Media Screening: What It Misses and How to Fix It
Why English-only adverse media screening misses local-language allegations, and how to close the coverage gap for high-risk jurisdictions.
PEP Screening Case Study: Undisclosed Political Links
A Neotas case study showing how investigation found political connections that standard PEP screening did not flag.
How open-source intelligence investigation traces people, entities and relationships across public records, media and social sources.
Third-Party Risk Management Guide
How to build a third-party risk management programme with risk tiering, due diligence depth by tier and continuous monitoring for portfolio companies.
Sources
- OFAC enforcement release, IPI Partners (2 December 2025)
- OFAC enforcement release, GVA Capital (12 June 2025)
- OFAC ten-year recordkeeping and statute of limitations (summary)
- DOJ NSD declination, White Deer Management, and M&A Safe Harbor (summary)
- Federal Register, FinCEN investment adviser AML rule delay (2 January 2026)
- US Treasury, beneficial ownership reporting final rule
- Federal Register, BIS Affiliates Rule suspension (12 November 2025)
- OFSI Annual Review 2024 to 2025
- European Commission, 21st package of sanctions against Russia (July 2026)
- OFAC FAQ 398, entities owned by blocked persons
- FinCEN, Beneficial Ownership Information Reporting
