Sanctions Compliance Checklist for M&A: 2026 Buyer's Guide

OFAC sanctions violations are strict liability: you can be penalized whether or not you knew about the exposure, which makes sanctions screening a closing condition, not a legal afterthought. In June 2025, a Cayman-registered venture firm paid a $215.9 million civil penalty, the statutory maximum, for continuing to manage a sanctioned individual's U.S. investment after his designation. The lesson for anyone buying a business isn't abstract: sanctions risk rides silently inside ownership structures, counterparties, and geographies, and it survives the closing table if you don't check for it.

This checklist walks through what to screen before you sign an LOI, which countries are actually embargoed in 2026 (the list has changed more than most guides reflect), the two different 50% ownership rules that can quietly block a deal, and what has to happen in your first 90 days as the new owner.

Key takeaways

• OFAC enforcement is strict liability. Intent is irrelevant to whether a violation occurred, only to the penalty amount.
• Two separate "50 percent" ownership rules apply to deals: OFAC's rule (blocked-persons ownership of the target) and BIS's newer Affiliates Rule (Entity List ownership of foreign affiliates), currently paused until November 10, 2026.
• Syria was lifted from comprehensive U.S. sanctions on July 1, 2025. Cuba, by contrast, is under an expanding sanctions program as of 2026. Treating them as equivalent embargoes, as most checklists still do, is now a factual error.
• Successor liability attaches when an acquirer continues the conduct that caused a violation. The clearest fix is rescreening every counterparty inside your first 90 days of ownership, before any inherited relationship keeps running unnoticed.
• Voluntary self-disclosure after finding a violation can be the difference between a declination and a prosecution. Consult sanctions counsel immediately rather than waiting.

Why Sanctions Risk Belongs on Every Deal Checklist

Sanctions compliance rarely feels urgent during a small business or lower-middle-market acquisition. There's no dedicated compliance team, no general counsel flagging the issue at kickoff, and the target itself may have no idea it carries exposure. That combination is exactly why it gets missed, and why regulators have started treating gatekeepers, meaning advisors, accountants, attorneys, and by extension search fund and independent sponsor structures, as an enforcement priority in their own right.

The GVA Capital case matters here because it wasn't an industrial conglomerate or a bank. It was a venture firm managing a private investment on behalf of an already-sanctioned individual, and it became the first public OFAC enforcement action of the current administration. The message to smaller deal teams is direct: sanctions exposure doesn't require size to become a liability, and there is no minimum deal value below which OFAC stops caring.

Pre-Sourcing: Screening Before You Sign an LOI

Build sanctions screening into your sourcing process before a target reaches serious diligence, not after. At minimum, screen against:

1. OFAC's Specially Designated Nationals (SDN) and Consolidated Lists — the core blocked-persons and blocked-entities registry
2. The Bureau of Industry and Security (BIS) Entity List and Military End-User (MEU) List — export-control restricted parties, distinct from OFAC's lists
3. EU, UK, and UN sanctions lists — relevant any time a counterparty, supplier, or investor touches a non-U.S. jurisdiction

Prioritize deeper scrutiny for industries where sanctions exposure clusters: defense and dual-use technology, oil and gas, shipping and logistics, aerospace, and financial services. Warning signs worth escalating immediately include operations near sanctioned regions, meaningful USD-denominated revenue from high-risk countries, government or state-owned-enterprise customers, and any linkage, even indirect, to a previously sanctioned intermediary.

Which Countries Are Actually Embargoed in 2026

This is the section where most sanctions checklists, including the most widely cited ones, are already out of date. The comprehensive-embargo list is shorter than it was eighteen months ago, and it has moved in different directions for different countries.

Do not carry forward a static country list from any source written before mid-2025. If a target, supplier, or counterparty has genuine Syria exposure, that fact needs re-evaluation against current, not legacy, sanctions status, and it needs its own documented conclusion rather than an inherited assumption.

The Two 50% Rules You Need to Know

Deal teams frequently conflate two different ownership-based rules that can each independently block or complicate a transaction.

OFAC's 50 Percent Rule governs whether a target itself is blocked. Any entity owned 50% or more, in aggregate, by one or more SDN-listed persons is treated as blocked, even if the entity's own name never appears on a sanctions list. Screening a target's name alone is not sufficient; you have to trace ownership up through parent entities, holding companies, and ultimate beneficial owners.

BIS's Affiliates Rule is newer and separate. Published September 29, 2025, it extends export license requirements to any foreign entity owned 50% or more by a party on the BIS Entity List, MEU List, or certain SDN-listed entities. This matters specifically for targets with foreign subsidiaries or joint-venture partners. BIS paused the rule on November 10, 2025, and it is expected to take effect around November 10, 2026, meaning a deal team closing in the second half of 2026 should treat it as an imminent obligation to plan around, not a live one to react to yet.

Due Diligence During Deal Evaluation

Once a target clears initial screening, due diligence should verify, not assume, that the picture holds up under scrutiny.

• Trace beneficial ownership past the cap table and into ultimate individual owners, especially for targets with holding companies, trusts, or offshore structures. OFAC and its European counterparts have both flagged beneficial-ownership tracing as an enforcement priority, since it's the most common way sanctioned persons hide behind a legitimate-looking entity.
• Screen the full counterparty universe: customers, suppliers, distributors, agents, and logistics providers, not just the seller and its direct owners.
• Review the target's existing compliance program, if one exists. Is screening manual or automated? Does it use fuzzy-name matching to catch transliteration variants and aliases? How does it handle and document false positives?
• Examine compliance history directly. Ask about past OFAC inquiries, denied-party matches, and any voluntary disclosures the target has made. A clean answer with no supporting documentation is not the same as a verified clean history.

If a target's screening process is manual, ad hoc, or undocumented, treat that gap itself as a due diligence finding, not just a future integration task.

Structuring the Deal to Allocate Risk

Sanctions-specific protections belong in the purchase agreement, not just the diligence memo.

Representations and warranties should cover the target's SDN and Consolidated List status (unqualified), whether it is 50%-or-more owned by any blocked person, and whether it has transacted with restricted parties or countries. Structure sanctions reps as fundamental representations, meaning they survive past the general indemnity cap and time limit rather than expiring with a standard 12-to-18-month escrow. Bring-down reps should require these representations to remain true at both signing and closing, not just at signing.

Closing conditions should include objective, checkable triggers: no material change in sanctions-list status between signing and closing, confirmation that no required export or OFAC license is outstanding, and a material-adverse-effect carve-out specific to a sanctions designation surfacing pre-close.

Escrow and holdback structure should reflect the actual risk level rather than a one-size-fits-all number. For a typical lower-middle-market deal in 2026, standard escrow runs roughly 8% to 12% of purchase price for 12 to 18 months. For a deal with elevated, specifically-identified sanctions risk, holding 15% to 20% for a longer survival period is reasonable, but the more durable protection is an uncapped or separately-capped sanctions indemnity, since a fixed escrow percentage can be too small relative to what a real violation actually costs.

Post-Closing: The First 90 Days

The first 90 days after closing are when successor liability risk is highest, because any prohibited relationship or shipment the target had running before acquisition keeps running unless someone actively stops it.

In July 2025, Key Holding, LLC agreed to pay $608,825 to settle an OFAC enforcement action after a Colombian subsidiary it had just acquired continued 36 unlicensed shipments to Cuba, activity that started under the prior owner and simply carried on, unnoticed, after the deal closed. Nobody at Key Holding intended to violate sanctions. The violation happened because integration didn't include an immediate compliance rescreen.

Within your first 90 days as the new owner:

1. Roll out your own sanctions policy to the acquired business immediately, don't wait for a full integration plan.
2. Rescreen every counterparty the target has, using your own screening process rather than inheriting the seller's.
3. Conduct a fresh sanctions risk assessment specific to the acquired operations, geographies, and customer base.
4. Integrate the target fully into your existing screening systems and reporting lines.
5. Assign a specific, named person as responsible for sanctions compliance at the acquired entity, even if that responsibility is one part of a broader compliance role.

If a violation surfaces after closing despite these steps, the response matters as much as the discovery. Stop the underlying conduct first, then consult sanctions counsel about voluntary self-disclosure. In a 2025 case, private equity firm White Deer self-disclosed to the Department of Justice that a portfolio company, Unicat, had pre-acquisition Iran-sanctions violations. White Deer itself received a declination, meaning no charges against the sponsor, while Unicat entered a non-prosecution agreement and settled with OFAC separately. Acting quickly and disclosing voluntarily changed the outcome for the acquiring firm specifically.

Building an OFAC-Aligned Compliance Program

OFAC's Framework for OFAC Compliance Commitments, published in May 2019, remains the current authoritative guidance for what regulators expect, and it factors directly into penalty mitigation when something does go wrong. It rests on five pillars:

• Management commitment: leadership visibly resources and prioritizes the program, not just a policy document
• Risk assessment: conducted at least annually, and more frequently after any acquisition, new market entry, or new product line
• Internal controls: documented screening procedures applied consistently across the business
• Testing and auditing: independent verification that controls actually work as designed, not just as written
• Training: role-specific, recurring, and covering the sanctions programs actually relevant to the business

A compliance program built around these five pillars, applied consistently from pre-sourcing screening through post-closing integration, is what regulators look for when deciding how to treat a violation that does occur. The difference between a declination and a multi-million-dollar penalty is frequently the presence, or absence, of exactly this kind of documented program.

FAQ

What is the OFAC 50 Percent Rule?

OFAC's 50 Percent Rule states that any entity owned 50% or more, in aggregate, by one or more blocked persons is itself treated as blocked, even if the entity does not appear by name on the SDN List. In M&A, this means you cannot clear a target by screening its name alone; you have to trace its ownership structure up through parent entities and beneficial owners.

Is OFAC sanctions enforcement strict liability?

Yes. OFAC can penalize a violation regardless of intent or knowledge. A buyer who unknowingly acquires a company with undisclosed sanctions exposure can still face civil penalties, because "we didn't know" is not a defense. This is why pre-closing screening and post-closing rescreening both matter, not just one or the other.

Can an acquirer inherit successor liability for a target's past sanctions violations?

Yes. Successor liability attaches when an acquirer continues the conduct that caused the violation, most commonly by keeping a prohibited relationship or shipment running after closing. OFAC's 2025 settlement with Key Holding, LLC is a direct example: the violations continued for months after acquisition before anyone caught them.

Is Syria still a comprehensively sanctioned country?

No, not since July 1, 2025. The U.S. lifted comprehensive Syria sanctions, delisted over 500 individuals and entities including the Central Bank of Syria, and Congress repealed the Caesar Act in December 2025. Syria now carries targeted sanctions on specific Assad-era officials and other named actors, not a blanket embargo like Cuba, Iran, or North Korea.

What should a buyer do if a sanctions violation is discovered after closing?

Stop the underlying conduct immediately, then consult sanctions counsel about a voluntary self-disclosure to OFAC. In 2025, private equity firm White Deer self-disclosed a portfolio company's pre-acquisition Iran violations and received a DOJ declination, meaning no charges, while the operating company itself settled. Acting fast and disclosing voluntarily materially changes the outcome compared to sitting on the finding.