OFAC vs OFSI: Advanced computing and AI chip controls compared

A semiconductor manufacturer ships an advanced graphics processing unit to a distributor in a third market. The item has an Export Control Classification Number (ECCN – a designation on the US Commerce Control List that determines what licences an item needs and to what destinations) and sits firmly within the US Export Administration Regulations. The distributor's financing runs through a UK correspondent bank. The manufacturer's compliance team asks a single, urgent question: does the US regime and the UK regime treat this item the same way? The answer shapes the deal, the financing, and the manufacturer's exposure on both sides of the Atlantic.

The US and UK regimes governing advanced computing and AI chip controls diverge in architecture, authority, and scope. Under the US Export Administration Regulations, the primary instrument is a product-classification and licence-requirement regime administered by the Bureau of Industry and Security. The United Kingdom does not operate an equivalent chip-specific control architecture; OFSI, the UK financial-sanctions authority, addresses computing technology only where a designated person is involved in the transaction. That structural difference – export-control regime versus sanctions-enforcement body – is the starting point for any cross-border analysis of advanced computing and AI chip controls compared.

This analysis sets out the divergence thesis, works through the evidence across seven dimensions, and closes with the practical implication for businesses that operate between the two jurisdictions or that hold goods subject to both regimes simultaneously.

The core divergence: product control versus person control

The foundational difference between the US and UK approaches to advanced computing and AI chip controls is the level at which the control bites. The US Export Administration Regulations impose controls on the item itself: if a chip or associated technology meets a defined technical parameter and carries a relevant ECCN, a licence requirement attaches to its export, re-export, or in-country transfer regardless of who is involved in the transaction. OFSI, by contrast, controls the person: a transaction involving advanced computing goods is caught by OFSI only where a designated person is a party to it, owns the counterparty at the applicable threshold, or would otherwise receive the benefit.

This distinction has immediate operational consequences. A chip manufacturer selling advanced computing hardware to an undesignated, unconnected buyer in a jurisdiction that is not subject to a US comprehensive territorial programme may still require a BIS licence. The same sale, from a purely UK OFSI perspective, may involve no obligation at all – because no designated person appears anywhere in the chain. The UK export-control layer, administered by the Export Control Joint Unit, adds a further dimension: goods on the UK military and dual-use lists do require export licences, and the UK lists closely track the EU dual-use framework. However, the UK does not replicate the granular, technical-parameter-based architecture that BIS uses for advanced computing chips specifically.

In our experience, clients structured around a UK legal entity with US-origin technology frequently underestimate this asymmetry. They screen their counterparties carefully against UK and EU designation lists, conclude that no designated person is involved, and proceed – without asking whether the item itself triggers a US licence requirement through the Foreign Direct Product rules or through the item's ECCN.

What authorities govern each regime, and how do they differ?

BIS administers the Export Administration Regulations under the Export Control Reform Act, with authority rooted in IEEPA for certain controls; OFSI administers financial sanctions under the Sanctions and Anti-Money Laundering Act and the relevant thematic regulations. The two bodies have different mandates, different enforcement tools, and different jurisdictional reach.

BIS classifies items, maintains the Entity List and the Denied Persons List, issues licences and licence exceptions, and enforces the EAR against US persons and, through the Foreign Direct Product rules, against non-US persons dealing in specified foreign-made items. The Foreign Direct Product rules (FDP rules – a mechanism that extends the EAR's jurisdiction to certain items produced outside the United States when those items are the direct product of controlled US technology or software) mean that a non-US manufacturer of chips that uses controlled US chipmaking equipment or design software may find its own product subject to US export-control jurisdiction even before it reaches a US person. That extraterritorial reach is central to how advanced computing controls operate in practice.

OFSI does not classify goods and does not maintain a commerce control list. Its enforcement tools are financial-sanctions penalties, licence refusals, and information requests. OFSI can impose monetary penalties on a strict-liability basis – knowledge of the designation is not required for a violation to occur. The maximum OFSI monetary penalty is the greater of £1,000,000 or 50 percent of the breach value, as currently in force; verify the current position before relying on it. BIS's civil penalties operate on a different statutory footing, can be assessed per violation, and can be substantial. Criminal referral is available to both, and in the US context the Department of Justice handles criminal export-control prosecutions.

A business subject to both regimes therefore faces two separate enforcement risks with separate evidentiary standards, separate disclosure routes, and separate penalty frameworks. The regimes do not offset: a clean OFSI file does not reduce a BIS penalty, and a BIS licence does not satisfy an OFSI reporting obligation.

How do the licence and authorisation routes compare?

Under the EAR, a business that needs to export, re-export, or transfer a controlled advanced computing item must first determine whether a licence exception applies and, if not, apply for a specific licence from BIS. The specific licence (a case-by-case authorisation from BIS for a particular transaction or end-use) involves a review that considers the item's classification, the destination, the end-user, the end-use, and whether the transaction meets the applicable licence-review policy. As currently in force, BIS applies a case-by-case review to certain advanced computing chips for specified destinations, with conditions relating to delivery, security, and testing. Verify that policy before relying on it, as it remains subject to active regulatory change.

Licence exceptions under the EAR can, in defined circumstances, authorise an export without a separate application. Eligibility for any given exception is item-, end-use-, and destination-specific; an exception available for one chip classification may not be available for another. The practical discipline is to confirm exception eligibility at the classification stage, not as an afterthought.

OFSI's licensing regime operates on entirely different grounds. OFSI issues licences against defined licensing purposes set out in the relevant thematic regulations. A financial institution that needs to process a payment related to a transaction involving a designated person – not the computing goods themselves – may apply for a specific licence from OFSI. OFSI operates two licence types that correspond broadly to OFAC's distinction: specific licences (case-by-case) and licences by reference to a general licence (standing authorisations for defined categories of transaction). However, the subject matter of an OFSI licence is the financial or economic transaction, not the classification of goods. An OFSI licence does not substitute for a BIS licence, and vice versa.

For a business in the advanced computing supply chain, this means the licence workstream divides cleanly in two: one workstream with BIS for the goods, one workstream with OFSI (if any designated person is involved in the financial flows) for the payment or asset movement. In our cross-border practice, clients that conflate these two streams regularly experience delays that could have been avoided by addressing both applications in parallel from the outset.

Where do the Foreign Direct Product rules and the UK equivalent diverge most sharply?

The Foreign Direct Product rules are the mechanism through which US export controls reach non-US items made with controlled US technology, equipment, or software. The EAR can apply extraterritorially to certain re-exports and to foreign-produced items through these rules. A foreign-made advanced computing chip produced using US chip-fabrication technology or US-origin electronic design automation software may be a US-regulated item for export-control purposes, even though the chip itself was manufactured outside the United States by a non-US company.

The UK has no direct equivalent to the FDP rules. UK export controls govern items on the UK control lists; they do not, as a general matter, extend their jurisdiction to foreign-produced items on the basis of incorporated UK-origin technology. The EU dual-use framework, governed by the recast Dual-Use Regulation that the UK broadly tracked at the point of divergence, likewise does not contain a mechanism analogous to the FDP rules. There is a de minimis concept in the EAR that can bring foreign items containing a sufficient percentage of controlled US content within the EAR's scope; because the applicable thresholds are item- and destination-specific and have not been confirmed at a specific figure for current purposes, the analysis should be approached qualitatively and verified against the current EAR text before any transaction proceeds.

The practical asymmetry is significant. A UK exporter of a foreign-made AI chip that was produced using US-origin semiconductor manufacturing equipment may be exporting a US-regulated item without realising it. No UK licence is required for the act of export if the item is not on the UK control list. But the FDP rules may mean that BIS consent is required. The UK exporter is not a US person and has no direct BIS relationship – but if the item meets the FDP test, the export may be unlawful under the EAR regardless.

Does your export-compliance programme check the origin of the technology used to make the item, or only the origin of the item itself? For advanced computing products, that distinction is where exposure lives.

How does end-use and end-user control differ across the two regimes?

BIS administers end-use and end-user controls, including military end-use and end-user restrictions for specified destinations, as currently in force. These controls can prohibit or require a licence for transactions where the end-use is a military application, where the end-user is a military or government entity in a specified destination, or where the exporter has knowledge or reason to know that a prohibited end-use is intended. Red flags – a purchaser's unusual payment terms, a reluctance to state end-use, a delivery address that differs from the buyer's registered address – can impose an obligation to investigate or to refuse the transaction even where the item's classification alone would not require a licence.

OFSI's framework for end-use control is materially different. OFSI does not impose end-use conditions on goods transactions as such. What OFSI controls is the economic benefit: a transaction that ultimately benefits a designated person is prohibited, whether or not the goods involved are themselves controlled items. The asset-freeze prohibition under the relevant UK thematic regulations extends to making funds or economic resources available, directly or indirectly, to or for the benefit of a listed person. If an advanced computing chip is sold to an undesignated buyer that then resells it on terms that benefit a designated person, the original seller may be within scope of OFSI's rules – depending on the facts.

The interaction between the two control layers creates an overlap that neither alone covers completely. BIS's end-use controls apply regardless of whether a designated person is present; OFSI's asset-freeze rules apply regardless of whether the goods are controlled items. A clean BIS end-use check does not exhaust the OFSI analysis, and a clean OFSI screen does not eliminate the BIS end-use obligation.

In a recent matter, a technology distributor in a third market held what appeared to be a complete compliance file: a BIS licence for the relevant chip, an end-use certificate from the buyer, and a clean screening result against all major designation lists. A subsequent ownership analysis revealed that the buyer's parent entity held a significant interest in a designated company in another jurisdiction, creating an arguable economic benefit flowing to a listed person. The licence and the end-use certificate were real; the ownership layer had not been worked. We advised on a restructured transaction that addressed the benefit question before completion.

What are the highest-risk divergence points for cross-border businesses?

Four points of divergence generate the highest practical risk for businesses operating across the US and UK regimes on advanced computing and AI chip controls.

First, extraterritorial reach. The EAR's FDP rules can capture a transaction that has no connection to the United States at the goods level. UK export-control law does not replicate this reach. A compliance programme that assesses only the item's physical origin misses the technology-of-production question that the FDP rules address.

Second, the subject of control. BIS controls the item; OFSI controls the person. A transaction that is clean at the item level under the EAR may still be caught by OFSI if a designated person benefits. A transaction that is clean at the person level – no designated persons – may still require a BIS licence. The two analyses must run in parallel, not sequentially.

Third, re-export chains. A foreign distributor that receives a controlled item under a BIS licence may face separate re-export restrictions when it on-sells. Those restrictions flow with the item through the supply chain. A UK reseller of US-origin advanced computing goods therefore inherits the EAR's re-export restrictions even though the resale is governed by UK law for other purposes.

Fourth, classification currency. The ECCN of an advanced computing chip can change as BIS updates the Commerce Control List. A chip that was EAR99 – meaning it was subject to the EAR but not on the CCL and therefore subject only to minimal controls – at the time of original export may subsequently receive a specific ECCN as technology parameters shift. Compliance programmes must include a classification-review cycle, not just a one-time assessment at the point of first export.

The myth that commercial availability removes an item from control is one that our practice encounters regularly. An item does not become uncontrolled because it can be purchased in a consumer electronics catalogue. The ECCN turns on technical parameters, not on whether the item has a commercial use. If your compliance programme rests on the assumption that commercially available items are EAR99, that assumption needs to be tested against the current Commerce Control List before the next shipment.

What does the interaction between the regimes mean for compliance programme design?

A compliance programme adequate for the US-UK advanced computing environment must address both regimes as layered, not alternative, obligations. The programme should operate in five stages: classification, end-user and end-use screening, ownership and control analysis, licence and exception determination, and post-shipment monitoring.

Classification – assigning the correct ECCN and confirming whether the FDP rules apply – is the foundation. Items must be classified against the current CCL, not the version in force at the time of a previous shipment. Where an item was produced using licensed US technology, the technology-of-production question must be put to the manufacturer and the answer documented. Where UK export-control classification is also required, the UK military and dual-use lists must be checked independently; the UK list does not reproduce the US CCL structure.

End-user and end-use screening must cover the BIS Entity List, the Denied Persons List, the OFSI Consolidated List, and the relevant thematic designation lists. Screening against name lists alone is not a complete control. The UK financial-sanctions rules and OFSI's guidance confirm that sanctions screening obligations attach on a risk basis; a single name-match check is not sufficient where the transaction structure creates indirect exposure. Ownership chains to the 50 percent threshold under OFAC's aggregation rule, and the control test under the UK and EU frameworks, must be applied to the full counterparty structure.

Licence and exception determination follows classification. Where a BIS licence is required, the application must address the end-use conditions and, where the FDP rules are in play, the chain-of-custody documentation the regulator will expect. Where an OFSI licence is needed, the grounds must be identified in the relevant thematic regulation and the application made to OFSI directly. Both applications should be in progress concurrently if both are needed; waiting for a BIS outcome before filing with OFSI adds time that the business can avoid.

Post-shipment monitoring – tracking whether the item reaches the declared end-user, whether re-export notifications are required, and whether the counterparty's status has changed since the transaction was approved – is the stage that compliance programmes most commonly omit. Re-export restrictions follow the item; they do not expire when the initial export is completed. Sanctions records, including transaction records and screening results, must be kept for five years under OFAC's record-keeping requirements, as currently in force.

We regularly advise compliance teams on how to sequence these five stages and how to assign responsibility for each across legal, export compliance, trade finance, and commercial functions. The question is not whether to run the stages but who owns each one and what the escalation path looks like when a red flag appears. Where two regimes both apply, the stricter prohibition governs the conduct of a person subject to both; the programme should reflect that principle, not treat it as a tiebreaker of last resort.

When should a cross-border business involve counsel on advanced computing and AI chip controls?

The decision to involve sanctions and export-control counsel should be made early – at the classification stage or when a new supply chain structure is being designed – rather than after a shipment has been made or a flag has been raised. Early involvement allows the classification, the FDP analysis, and the counterparty ownership review to run as a single integrated exercise rather than as a sequence of escalations triggered by a potential violation.

Five situations call for immediate counsel involvement. First, where a product's technical parameters sit close to a control threshold and classification is genuinely uncertain. Second, where a counterparty in the supply chain is a manufacturer or distributor in a jurisdiction that is the subject of a US comprehensive programme or that has been identified in BIS guidance as a destination of concern for advanced computing goods. Third, where a transaction involves a technology-of-production question – the chip was made using US-origin equipment or software – and the FDP analysis has not been completed. Fourth, where a re-export from a non-US jurisdiction is contemplated and the original shipment was subject to a BIS licence. Fifth, where a financial institution has raised concerns about the transaction's compliance posture or declined to process a payment.

A voluntary self-disclosure (VSD – a self-initiated disclosure to BIS or OFAC of an apparent violation, which is a recognised mitigating factor in OFAC's Enforcement Guidelines and in BIS's penalty framework) is available where a violation is discovered. Disclosure must be made accurately and promptly; an incomplete or misleading VSD can be treated as an aggravating factor. The decision whether to disclose, how to frame the disclosure, and what remedial steps to take concurrently requires legal advice before any communication is made to the regulator.

Is the compliance programme that worked for your business two years ago still adequate for the current advanced computing control environment? The technical parameters under the CCL have moved, the FDP rules have been extended to new categories, and the regulator's published guidance on end-use red flags has been updated. A programme that has not been tested against the current rules may be creating exposure that the business does not yet know exists.

Related practices

• Advanced computing controls: BIS and EAR service – practical classification, licensing, and FDP analysis for advanced chip transactions
• Anti-circumvention: EU vs BIS/EAR analysis – how the EU anti-circumvention instrument and the EAR interact on third-country diversion risk
• Cloud and remote-access controls: OFAC vs EU analysis – deemed-export and access-control obligations in cloud and remote-delivery contexts

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.