Spreadsheet ownership math goes stale when the graph changes. This walkthrough is a composite illustration, not a customer case.
Picture a normal vendor onboarding. Good website, clean paperwork, solid pricing. They were not on the Entity List, not on the MEU List, and nothing in the initial name screen popped.
So the team did what most teams do: they approved the supplier and moved on.
Two weeks later, somebody asked a simple question: “Who owns them?”
That question changed the whole story.
Most screening programs are name-first. You type in an entity name, you check lists, you move on. But the BIS affiliates rule shifts the real risk into ownership and control. That means an entity can look clean by name, while being owned by someone you absolutely cannot touch.
And the kicker is this: the trigger is not only direct ownership. It can be indirect ownership through layers. It can also be aggregate ownership across multiple restricted parties. That is where spreadsheet math starts to break down.
Here is the pattern we see constantly:
Parent company is restricted (on the Entity List or similar).
Subsidiary is not listed by name.
Subsidiary becomes the “front door” for purchasing, sourcing, or contracting.
The business feels safe because the name checks out.
If your workflow stops at list matching leading to a "No Hit", you miss what matters.
Say you have a supplier called “Blue Harbor Components.”
Your screening returns clear. No list hits.
But ownership data shows:
Aggregate restricted ownership.
even if neither owner is a majority by themselves, in aggregate the company is now inside the 50% scope.
Now add one more layer:
Calculation: Holding is 60% owned by a restricted parent, so Holding is itself restricted. Holding’s full 50% of Blue Harbor is attributed. The target is covered. Do not multiply 60% × 50% into 30%.
OFAC FAQ 401 attributes ownership through blocked intermediaries on a threshold basis: once the intermediary is 50% or more owned by blocked persons, its entire downstream stake counts. A sub-threshold intermediary contributes nothing, not a fraction. Real chains still get messy (multiple paths, missing slices, and incomplete cap tables), but the arithmetic is not hop-by-hop multiplication.
Even when the 50% threshold is not met, significant minority ownership is not “no big deal.” It is a due diligence alarm bell.
Operational Rule: Treat 25% as a serious red flag that triggers extra review. This is not about panic, it is about not being blind.
Aggregate restricted ownership: Hold for review
Minority ownership: Red Flag, Due Diligence
Unknown ownership: Red Flag (Unknown is Risk)
And we do not stop at a number. We show the chain. If someone asks “why did we flag this,” you can answer with:
That is the difference between “we think” and “we can prove it.”
If you want to sanity-check a case fast, use our tool. It lets you add owners and percentages, mark restricted parties, see aggregate ownership instantly, and flag minority red flags.
Open CalculatorAsk for parent company, subsidiaries, and major shareholders.
Do list screening, but do not stop there.
Direct, indirect, aggregate. Catch multi-owner math.
50% scope, 25% minority red flag, unknown ownership gaps.
If you cannot prove it later, it did not happen.
Ownership changes, affiliates appear, risk flips overnight.
It is ownership-based scope: if restricted parties own 50% or more of an entity, including through affiliates and aggregate ownership, risk extends beyond the named list entry.
Multiple restricted parties can collectively cross the threshold, even if none individually hits 50%.
Yes. If a restricted party owns 50% or more of an intermediary, that intermediary is itself treated as restricted and its full stake in the next company is counted. Do not multiply percentages along the chain. OFAC FAQ 401 is the verified example of this threshold-gated rule.
A significant minority stake can indicate influence or control risk; it should trigger extra due diligence.
No, a calculator helps you triage and document math, it does not replace legal review.
A quick disclaimer: Educational content only, not legal advice.
Get occasional notes on sanctions, export controls, and visitor compliance when we publish them.
No spam. Unsubscribe anytime.
Related posts
More guidance on sanctions, export controls, and visitor management for regulated facilities.
DDTC's October 1, 2026 proposed rule would shrink four U.S. Munitions List entries, add two new specially designed releases, create a new section listing items excluded from the USML and add a repair exemption. What would change, what would not, why items that leave the ITAR still face deemed-export rules under the EAR, and what to do before comments close November 30.
A $2.1M NASA/NSF settlement executed the same day thirty universities owed the Department of War a research security audit. The contended failure was not a hidden relationship; it was a disclosed one, reported internally since 2014, that never reached the certification. Why linkage and elapsed time, not screening, decide these cases.
Under ITAR (22 CFR 120.50), releasing controlled technical data to a foreign person is an export, even inside the U.S. Here's why foreign-national visitor access is the regulated event, who counts as a foreign person, and how to screen, escort, and document it.
