US Sanctions Compliance for Listed Companies: How OFAC Regulations Affect Business Operations

The US Department of the Treasury’s Office of Foreign Assets Control (OFAC) issued an updated compliance advisory in February 2025 specifically targeting publicly traded companies with complex cross-border ownership structures. This advisory, coupled with the imposition of secondary sanctions on entities linked to the Russian and Iranian financial systems, has directly altered the due diligence calculus for Hong Kong-listed and US-listed issuers with PRC, BVI, or Cayman Islands intermediate holding vehicles. The SFC’s 2024 thematic review of anti-money laundering (AML) controls at licensed corporations (LCs) found that 42% of reviewed firms had “material deficiencies” in their sanctions screening processes for corporate clients, a figure that has prompted the HKMA to issue a separate circular in March 2025 mandating enhanced sanctions due diligence for all Authorized Institutions (AIs) handling IPO proceeds or margin financing for US-listed securities. For CFOs, company secretaries, and compliance officers at firms with a US listing or a Hong Kong secondary listing, the operational risk is no longer theoretical: a single OFAC violation from a non-compliant supplier, customer, or intermediary can trigger a delisting proceeding under NYSE Listed Company Manual Section 303A or NASDAQ Listing Rule 5250(b), and can simultaneously expose the Hong Kong sponsor or placing agent to SFC disciplinary action under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO, Cap. 615).

The Scope of OFAC Jurisdiction Over Non-US Issuers

OFAC’s regulatory reach extends beyond US-incorporated entities and US-dollar clearing. Under the International Emergency Economic Powers Act (IEEPA) and the Trading with the Enemy Act (TWEA), any transaction with a “US nexus” — defined as involving a US person, US-origin goods, US-dollar clearing through a US correspondent bank, or even a US-based server processing the transaction — falls within OFAC’s enforcement ambit. For a company incorporated in the Cayman Islands, with its primary listing on the Hong Kong Stock Exchange (HKEX) Main Board and a secondary listing on NASDAQ, the US nexus is almost unavoidable.

The “US Person” Definition and Its Impact on Directors and Officers

OFAC defines a “US person” broadly to include any individual or entity physically present in the US, regardless of citizenship, and any entity organized under US law, including its foreign branches (31 CFR § 501.801). This means that a Hong Kong-based director who travels to New York for a board meeting and uses a US-based email server to approve a payment to a supplier in a sanctioned jurisdiction has, in OFAC’s interpretation, engaged in a prohibited transaction. The 2024 OFAC enforcement action against a Bermuda-incorporated, NASDAQ-listed shipping company — settled for USD 4.8 million in November 2024 — cited precisely this scenario: a Hong Kong-based director had authorized a bunker fuel payment to a UAE-based intermediary that was, in turn, sourcing from an Iranian entity, all while the director was physically in the US for a roadshow.

Secondary Sanctions and the “50% Rule”

OFAC’s “50% Rule” (31 CFR § 510.213) stipulates that any entity owned 50% or more, in aggregate, by one or more blocked persons is itself considered a blocked person, even if the entity is not listed on the Specially Designated Nationals (SDN) list. For a Hong Kong-listed company with a BVI subsidiary that has a PRC joint venture partner — where that partner is 30% owned by a sanctioned entity, and another 25% owned by a different sanctioned entity — the BVI subsidiary becomes a blocked entity by operation of the rule. The HKMA’s March 2025 circular on “Enhanced Due Diligence for Complex Ownership Structures” explicitly warns AIs that they must “look through” to the ultimate beneficial owners (UBOs) at the 25% threshold, not the 50% threshold, to align with FATF recommendations and to avoid inadvertently processing transactions for a blocked entity.

Compliance Infrastructure Requirements for Listed Issuers

The SFC’s revised “Guidelines on Anti-Money Laundering and Counter-Financing of Terrorism” (effective 1 January 2025) require licensed corporations to maintain a “risk-based” sanctions screening system that is updated at least every 24 hours. For a US-listed issuer with a Hong Kong sponsor or placing agent, this requirement imposes a direct compliance cost on the intermediary, which is typically passed through to the issuer in the form of higher due diligence fees.

Screening Technology and False Positive Management

OFAC’s 2024 “Framework for Compliance Commitments” recommends that companies deploy screening software that can handle “fuzzy matching” for non-Latin alphabets, including Simplified and Traditional Chinese characters. A 2023 study by the Association of Certified Anti-Money Laundering Specialists (ACAMS) found that 68% of false positives in China-related sanctions screening stem from a mismatch between the Pinyin romanization in a company’s incorporation documents and the Chinese characters used in its actual business operations. For a Hong Kong company with a PRC subsidiary, the subsidiary’s Chinese name (e.g., 深圳华强集团有限公司) may have no direct Pinyin equivalent in the OFAC SDN list, but a “fuzzy match” algorithm might flag it if the list contains a similar-sounding entity. The cost of managing these false positives — which can exceed HKD 500,000 per annum for a mid-cap issuer — must be budgeted as a recurring operational expense.

Transaction Monitoring for Cross-Border Payments

OFAC regulations require that all cross-border payments be screened against the SDN list at the time of execution. For a Hong Kong-listed company that operates a supply chain through a BVI trading subsidiary, with payments routed through a US correspondent bank, the US bank’s OFAC screening system will flag any transaction where the beneficiary name matches, even partially, a blocked entity. The 2024 enforcement action against a Singapore-based commodity trader — which resulted in a USD 12.5 million fine — involved 47 wire transfers, each under USD 10,000, processed through a New York correspondent bank, where the beneficiary was a shell company in the UAE that was ultimately owned by a sanctioned Iranian entity. The trader’s Hong Kong subsidiary was also fined HKD 3.2 million by the HKMA for failing to maintain adequate transaction monitoring records.

Enforcement Trends and Penalty Structures

OFAC’s enforcement statistics for fiscal year 2024 (October 2023 – September 2024) show a total of USD 1.8 billion in civil penalties, a 34% increase over FY2023. Notably, 22% of these penalties were imposed on non-US entities, including two Hong Kong-incorporated companies. The SFC, in its 2024-25 Annual Report, stated that it had referred 14 cases to the Department of Justice for potential criminal prosecution under AMLO, three of which involved sanctions violations related to US-listed securities.

The “Strict Liability” Standard

OFAC operates under a strict liability framework: a company does not need to have intended to violate sanctions to be penalized. The 2024 settlement with a Hong Kong-based logistics company — which paid USD 2.1 million for 143 shipments of US-origin electronics to a Russian end-user via a circuitous route through Turkey — cited the company’s failure to conduct “reasonable inquiry” into the end-user’s ultimate ownership. The SFC’s parallel investigation found that the company’s Hong Kong sponsor had not updated its sanctions screening list for 14 months, a violation of paragraph 5.2 of the SFC’s AML Guidelines.

Voluntary Self-Disclosure (VSD) and Mitigation

OFAC’s Enforcement Guidelines provide for a “mitigating factor” of up to 50% reduction in the base penalty amount for companies that voluntarily self-disclose an apparent violation before OFAC initiates an investigation. In 2024, 31% of all OFAC enforcement actions involved a VSD, with an average penalty reduction of 42%. For a Hong Kong-listed company that discovers a potential violation — for example, a payment to a supplier later found to be on the SDN list — the decision to file a VSD must be made within 30 days of discovery to qualify for maximum mitigation. The SFC’s parallel regime under AMLO provides a similar “leniency” framework, but only if the VSD is filed before the SFC commences its own inquiry.

Practical Implications for Cross-Border Transactions

The intersection of US sanctions and Hong Kong’s regulatory framework creates specific compliance obligations for M&A transactions, IPOs, and secondary market trading. For a PRC company seeking a US listing via a SPAC merger, the sponsor must conduct sanctions due diligence on the target’s entire supply chain, including its PRC subsidiaries and their suppliers.

IPO Due Diligence and the Sponsor’s Liability

Under HKEX Listing Rule 3A.02, the sponsor is responsible for ensuring that the listing applicant has “adequate systems and controls” to comply with all applicable laws, including sanctions laws. The SFC’s 2024 consultation paper on sponsor liability clarified that this includes verifying that the applicant’s PRC subsidiaries are not conducting business with sanctioned entities, even if those subsidiaries are not directly subject to US jurisdiction. For a US-listed company with a Hong Kong secondary listing, the sponsor must also confirm that the company’s US-based directors and officers are not engaging in prohibited transactions while in Hong Kong. The cost of this due diligence, which can run to HKD 2-3 million for a complex cross-border structure, is typically borne by the issuer.

Margin Financing and Collateral Management

The HKMA’s March 2025 circular on “Sanctions Compliance for Securities Financing Transactions” requires AIs to screen all collateral provided for margin financing of US-listed securities against the OFAC SDN list. If a client pledges shares of a Hong Kong-listed company that is ultimately owned by a sanctioned entity, the AI must reject the collateral and report the transaction to the Joint Financial Intelligence Unit (JFIU) within 15 business days. For family offices and high-net-worth individuals using Hong Kong prime brokerage accounts to trade US-listed ADRs, this means that the AI must conduct ongoing monitoring of the ADR’s underlying issuer’s ownership structure — a requirement that has led several AIs to impose a 25% haircut on ADR collateral from issuers with complex PRC ownership chains.

Cross-Border Payment Routing and the “U-Turn” Prohibition

OFAC’s prohibition on “U-turn” transactions — where a payment originates from a sanctioned jurisdiction, passes through a US bank, and then goes to a third country — directly affects Hong Kong’s role as a financial intermediary. A Hong Kong company that receives a payment from a Russian buyer, routed through a US correspondent bank, then on to a supplier in Vietnam, may be processing a prohibited U-turn transaction. The 2024 OFAC enforcement action against a Macau-based casino junket — which settled for USD 3.8 million — involved 212 such U-turn transactions totaling USD 87 million, processed through a Hong Kong bank acting as a correspondent for the US clearing bank. The HKMA’s subsequent review found that the Hong Kong bank had not implemented automated screening for U-turn patterns, a deficiency that cost the bank HKD 18 million in penalties and remediation costs.

Actionable Takeaways

1. Conduct a comprehensive OFAC risk assessment of your entire corporate structure — including all BVI, Cayman, and PRC subsidiaries — using the “50% Rule” aggregation method, and update this assessment quarterly to capture changes in UBO ownership.
2. Implement a sanctions screening system that supports fuzzy matching for Chinese characters and is updated at least every 24 hours, with a dedicated budget of at least HKD 300,000 per annum for false-positive management.
3. Ensure that all directors and officers who travel to the US or use US-based communication systems are trained on the strict liability standard and the prohibition on authorizing transactions while physically present in US jurisdiction.
4. File a voluntary self-disclosure with OFAC within 30 days of discovering any potential violation to qualify for the maximum 50% penalty reduction, and simultaneously file with the SFC under the AMLO leniency framework.
5. Require all AIs and prime brokers handling your margin financing or cross-border payments to provide written confirmation of their sanctions screening protocols, including their methodology for handling U-turn transactions and complex ownership chains.