A licence leaves the proof with the firm

Bottom line

A sanctions program spends most of its effort on prohibitions, and prohibitions arrive as data. The lists are published, versioned, and machine readable, and a screening system consumes them. Permissions work the other way around. OFAC calls its general licences self-executing and leaves the firm to determine that a transaction meets the terms. OFSI takes no applications for a general licence and places the responsibility on the party using one. Both regimes can withdraw the authorization where the firm’s own reports arrive late. The Union’s default runs the other way: a permission granted by an act addressed to the applicant, through a national competent authority that sets its own conditions. The licence layer is therefore the one part of a sanctions program where the firm itself supplies the evidence that the decision was sound, and running it as a flag on an account produces permission the firm is unable to prove.

1. A prohibition arrives as data, a permission arrives as a claim

Screening against a list is a data problem with a supplier. OFAC publishes the Specially Designated Nationals List, the Union publishes its consolidated list, the United Kingdom publishes its consolidated list of asset freeze targets, and each arrives on a schedule a system can ingest. The firm’s obligation is to hold the current version and match against it well, which is the subject of One person, several spellings.

A licence has no feed. It is a published text describing a class of activity, and somebody inside the firm reads it and concludes that a particular payment sits inside that class. The US and UK regimes both say so in their own words.

OFAC’s Frequently Asked Question 74 calls general licences public and “self-executing”, meaning that persons who determine their transactions meet the terms and conditions described in the general licence require no further authorization from OFAC. The licensing regulation supplies the part that matters more for control design: it is OFAC’s policy to decline applications for specific licences covering transactions to which a general licence already applies. A firm that wants its reading confirmed in writing therefore has nowhere to ask.

OFSI is more explicit still. Its general guidance states that OFSI takes no applications for general licences, and that it falls to any party using a general licence to ensure that its activities sit within the terms and meet the conditions. Where a licence asks for prior notification, OFSI’s own publication notice tells the notifying firm that the notification stops short of verifying that the activity is permitted. The record-keeping condition in the same notice is drafted around the same idea: records must be kept “of any activity purporting to have been permitted under this licence”. The word carrying the weight there is “purporting”. The regulator is treating reliance as the firm’s claim, awaiting support.

2. One service charge, three permissions

Take the most ordinary act available: a monthly maintenance fee on an account the firm has frozen. Commercially it involves no judgment at all, and all three regimes reach it.

Regime	Who says yes	When	What the firm holds afterward
United States	the regulation itself, at 31 CFR 587.505	already, for the whole class	its own transaction record, available for examination for at least 10 years
United Kingdom	HM Treasury, by a licence issued under regulation 64 of the Russia Regulations	before the debit, under a general or a specific licence	the licence it selected, any prior notification, a report inside the licence’s window, and records for the period the licence states
European Union	the competent authority of a Member State, under Article 4(1)(c) of Regulation 269/2014	in advance, case by case, on conditions the authority sets	the authorisation and its conditions, with the Member State informing the Commission that it was granted

Under the Russian Harmful Foreign Activities Sanctions Regulations, a US financial institution is authorized to debit a blocked account for normal service charges owed to it, and the regulation lists what those include. No filing precedes the debit and no instrument is issued for it. In the United Kingdom, the prohibitions on dealing with frozen funds yield to anything done under the authority of a Treasury licence, and Schedule 5 of the Russia Regulations supplies the purpose the Treasury may license for: reasonable fees or service charges arising from the routine holding or maintenance of frozen funds. In the Union, Article 4(1) of Regulation 269/2014 lets the competent authorities of the Member States authorise a release “under such conditions as they deem appropriate, after having determined” that the funds are intended exclusively for one of the listed purposes, among them fees or service charges for the routine holding or maintenance of frozen funds. Article 4(2) then requires the Member State to inform the other Member States and the Commission of any authorisation granted.

One debit, three artifacts: in the United States a ledger entry and a retention duty, in the United Kingdom an instrument the firm chose plus the notifications it generated, and in the Union a decision taken by a public authority and recorded at Union level. A program holding one status field per account holds the right evidence for one of the three.

3. What binds, and what advises

Read by layer, as From rule to workflow uses the word:

• Law. 31 CFR 587.505 authorizes a US financial institution to debit a blocked account for normal service charges. 31 CFR 501.801(a) establishes that general licences carry terms and conditions, that OFAC’s policy is to decline specific licence applications where a general licence applies, and that a failure to file required reports on time may nullify the authorization the general licence otherwise provided. 31 CFR 501.601 requires a full and accurate record of each transaction, “regardless of whether such transaction is effected pursuant to license or otherwise”, available for examination for at least 10 years. Regulation 64 of the Russia (Sanctions) (EU Exit) Regulations 2019 is the power under which the Treasury issues licences, and provides that a licence may authorise acts for a particular period; Schedule 5, Part 1 lists the purposes, including legal services at paragraph 3 and the routine holding or maintenance of frozen funds at paragraph 4. Article 4 of Council Regulation (EU) No 269/2014 holds the Union derogations and the duty to inform the Commission of each authorisation granted.
• Guidance. OFAC’s FAQ 74 describes general licences as self-executing and reminds users that the terms include recordkeeping and reporting conditions. OFSI’s general guidance states that it takes no applications for general licences, that the party using one is responsible for staying inside it, that a payment above a cap is a breach, that activity after expiry or above a cap may lose its lawful basis, and that a failure to meet reporting conditions may lead to revocation. Guidance of this kind binds nobody by itself, and it is the clearest available statement of what each regulator expects to see.
• Policy. Which licences the firm relies on at all; which it declines to use even where it qualifies; who holds authority to conclude that a licence covers a transaction; and whether the firm sets a cap of its own below the licence’s. Each of those is risk appetite, and belongs in writing with an owner and a reason.
• Convention. A status on the customer record reading “licensed”, maintained by whoever last corresponded with the regulator. This is the layer the piece argues against, because it stores a conclusion and discards the basis for it.

4. Where the clock lives

Each regime puts the expiry in a different place, and that decides what a firm has to watch.

A general licence codified in the regulations runs until it is amended. A licence OFAC issues as a standalone document carries its own end time, and a wind-down authorization is dated by design. OFSI’s licences carry an effect date and usually an expiry, and the publication notice reserves HM Treasury’s power to vary, revoke, or suspend the licence at any time. In the Union the deadline is frequently drafted into the regulation itself, and it comes in pairs: each wind-down derogation in Article 6b of Regulation 269/2014 names the listed entities it covers, the date by which the termination of operations and contracts has to finish, and the earlier date before which those contracts had to have been concluded. A firm reading one of these has two dates to hold, and the second one reaches backward into the relationship’s history.

1. Each licence relied on recorded with its version, conditions, caps, and expiry
2. Each condition mapped to the system that enforces it
3. Each use recorded against the paragraph relied on
4. Expiry, cap, and revocation treated as events that stop the activity

An expiry is therefore a product event rather than a policy event. A recurring debit, a scheduled payout, or a standing instruction keeps running on the schedule it was given, while the authorization behind it lapses on a date held somewhere else entirely. The stop has to reach the thing that moves the money, which is the same structural point Knowledge arrives after the payment makes about a finding that arrives once a payment has already settled.

5. One reliance record for each use

In the US model the reliance record is the only artifact in existence. Nobody issued an instrument, nobody confirmed the reading, and the general licence covers an entire class of persons. What distinguishes a firm that relied correctly from a firm that relied wrongly is the record it wrote at the time. One entry holds the licence and its version, the paragraph relied on, the facts that satisfied each condition, the amount counted against any cap, the person who decided, the date, and each report filed.

The retention period makes the point concrete. OFAC moved the period in 31 CFR 501.601 from five years to ten in September 2024, to align with the longer limitations period Congress enacted that April. A reliance decision taken in 2026 stays examinable into 2036, well after the people who took it have moved on, and the only thing answering for it then is what they wrote down.

Naming the person who may reach that conclusion matters as much as keeping the record. A reviewer with authority over licence reliance needs the brief that A human in the loop needs a job description describes: what the conclusion rests on, what evidence is in hand, and the point at which the question leaves that person’s authority.

6. What the regulators report going wrong

The Financial Conduct Authority published findings in May 2026 drawn from assessments of more than 150 supervised firms since February 2022, and listed compliance with specific and general licences among the most common root causes of reported sanctions breaches, alongside due diligence, alert management, transaction and name screening, and the management of frozen assets. Its illustration carries the section: a retail bank monitored a designated person’s licence for basic-needs expenses while holding no policy defining which expenses qualified. The licence was tracked. The judgment it called for stayed undefined. Good practice, in the FCA’s own wording, is clear policies and controls for compliance with sanctions licences, covering when a licence is needed and how its permissions are followed.

The remaining failure modes come straight from the licensing texts. OFSI treats a payment above a cap as a breach, and warns that a failure to meet reporting conditions may lead to revocation. OFAC’s rule is sharper in form: filing required information late may nullify the authorization the general licence otherwise provided and leave apparent violations of the underlying prohibition. In each case the firm acted inside the scope of a genuine permission and lost it through its own administration.

A worked hypothetical

The following scenario is hypothetical and is included only to illustrate the framework. The companies and people below are invented.

A payments firm runs three legal entities: one in the United States, one in the United Kingdom, and one established in the Union. A corporate customer, a logistics operator, holds an account with each and pays a monthly platform fee from all three. Two minority shareholders of the customer’s parent are designated, and the ownership arithmetic described in One cap table, several answers aggregates their stakes past the threshold, which puts the parent inside the blocking test for each regime. All three entities freeze.

The platform fee keeps falling due.

• The US entity debits it. 31 CFR 587.505 covers normal service charges owed to the institution, so the firm takes the fee, writes the basis beside the entry, and retains the record.
• The UK entity finds the purpose in Schedule 5, then establishes whether a published general licence reaches it. Where one does, the firm gives any prior notification the licence asks for, reports each debit inside the licence’s window, and keeps records for the stated period. Absent a general licence, the fee waits for a specific one.
• The Union entity applies to its national competent authority, which authorises the release on conditions of its own, and the Member State informs the Commission.

Three months on, the UK general licence reaches its expiry. The firm’s licence register holds that date. The recurring fee schedule holds a different one. The debit runs on the fourth of the month and the licence ended on the last day of the third. The sum is trivial, and the activity continued inside a scope that had lapsed, which is exactly the case OFSI’s guidance describes. The register and the scheduler needed to be one control.

The same hypothetical read from the other side shows the cost of the opposite error. Had the firm treated the Union authorisation as group-wide cover, the US and UK debits would have run on an instrument addressed to one entity for one purpose on one authority’s conditions. Permission is specific to the regime that granted it, and to the paragraph it was granted under.

What this changes operationally

A sanctions owner keeps a register of every licence and authorisation the firm relies on, each carrying its version, the paragraph relied on, its conditions, its caps, its expiry, and the named person with authority to conclude it applies.

A product or payments lead ties each automated flow running under a licence to its register entry, so that an expiry or an exhausted cap stops the flow, rather than surfacing as a question afterward.

A data engineer stores the basis beside the transaction, the way A passport answers one question stores evidence beside each attribute, and counts each use against whatever cap the licence sets.

An operations lead files every report a licence conditions itself on, inside the licence’s own window, and treats a missed report as an incident against the authorization rather than as a late administrative task.

A knowledge owner publishes the firm’s reading of each licence it relies on, with a date and an owner, so that the next reader inherits the basis instead of re-deriving it, which is what From recurring question to durable control asks of any decision that recurs.

Limitations

This concerns evidence and control design for licences and authorisations a firm relies on. It offers no view on whether any licence covers any particular activity, which is a question for counsel against the current text, and it describes no institution’s program. Licence texts are amended, renewed, and revoked often, so the examples here hold as of the dates given. Which regimes bind a firm turns on where its entities are established and where its business is done. Specific licences, issued to a named applicant and frequently carrying conditions tighter than a general licence’s, raise these same evidence questions along with several of their own. Regimes beyond the three discussed, and the parallel measures on Belarus, are left aside.

Member State practice under Regulation 269/2014 varies, and some competent authorities publish general authorisations implementing a derogation for a whole class, which moves their model closer to the UK’s. The three-way contrast describes the default architecture of each regime rather than a uniform rule, and the register has to record which model actually applied to each use.

Primary sources

• US Department of the Treasury, OFAC. 31 CFR 501.801(a), on general and specific licensing procedures, including the nullification of authority for late reports; 31 CFR 501.601, on records and recordkeeping requirements.
• US Department of the Treasury, OFAC. Reporting, Procedures and Penalties Regulations, interim final rule, 89 FR 74832 (September 13, 2024), effective March 12, 2025, extending the recordkeeping period from five years to 10 years; adopted without change as a final rule, 90 FR 13286 (March 21, 2025). The statutory change is the 21st Century Peace through Strength Act, Public Law 118-50, division D (April 24, 2024), which set a 10-year limitations period codified at 50 USC 1705(d) and 4315(d).
• US Department of the Treasury, OFAC. Russian Harmful Foreign Activities Sanctions Regulations, 31 CFR Part 587, Subpart E, in particular 31 CFR 587.501 and 587.505 (entries in certain accounts for normal service charges).
• US Department of the Treasury, OFAC. Frequently Asked Question 74, on what an OFAC licence is, describing general licences as public and self-executing.
• United Kingdom. The Russia (Sanctions) (EU Exit) Regulations 2019, regulation 64 (Treasury licences) and Schedule 5, Part 1, paragraphs 3 and 4.
• HM Treasury, Office of Financial Sanctions Implementation. UK Financial Sanctions General Guidance, chapter 6, on exceptions and licensing.
• HM Treasury, Office of Financial Sanctions Implementation. General Licence INT/2020/059, publication notice (issued January 1, 2021), cited for its standard prior notification, reporting, and record-keeping conditions.
• Council of the European Union. Council Regulation (EU) No 269/2014, Article 4 (derogations and the duty to inform the Commission) and Article 6b (the wind-down derogations and their dates), in the consolidated text of February 24, 2025.
• Financial Conduct Authority. Sanctions systems and controls: our findings (May 28, 2026).