A multinational exporter operating across transatlantic supply chains discovers that its principal correspondent bank has begun declining payment instructions linked to certain goods categories – specifically items that appear on the US Commerce Control List. The bank has not received a blocking notice. No counterparty has been designated. Yet the payments stop. The reason, once traced, is correspondent-banking de-risking (the practice by which financial institutions withdraw from relationships or transaction types to manage perceived sanctions and export-control exposure) applied through a US-law lens that the exporter's EU-based compliance team did not anticipate.
As of January 2026, the BIS / EAR regime and the EU dual-use and financial-sanctions regimes treat the correspondent-banking de-risking question from structurally different starting points. The BIS / EAR applies US export-control obligations extraterritorially and imposes licence requirements tied to the nature of the item and its destination, not the payment channel alone. The EU regime operates through a combination of Council sanctions regulations and the EU dual-use rules, with a distinct ownership-and-control test and a materially different licensing architecture. Where the two regimes overlap on the same transaction, the stricter prohibition governs – and identifying which that is requires regime-by-regime analysis before the payment is instructed.
This analysis maps the key divergences across five dimensions: legal basis and extraterritorial reach, the de-risking trigger and what banks actually act on, the ownership-and-control tests that catch non-listed entities, the licensing architecture and the practical paths to authorisation, and the enforcement posture each regime applies to correspondent banks. It closes with a decision matrix for cross-border businesses and the risk flags that counsel most frequently encounter.
What drives correspondent-bank de-risking under BIS / EAR, and how does the EU starting point differ?
Correspondent-banking de-risking under the BIS / EAR is driven primarily by the extraterritorial reach of US export controls. The Export Administration Regulations, administered by the Bureau of Industry and Security under the Export Control Reform Act, apply to items that are subject to the EAR – a broad category covering US-origin goods, software, and technology, and foreign-made items that incorporate US-origin content above a de minimis threshold or that are the direct product of certain US-controlled technology. A bank processing a payment that facilitates the export, re-export, or transfer of an item subject to the EAR is potentially participating in an unlicensed export. That exposure is real regardless of where the bank is incorporated.
The EU's starting point is structurally different. EU dual-use controls, set out in the relevant Council Regulation on dual-use items, apply to goods, software, and technology listed on the EU Common List of Dual-Use Items when they leave EU customs territory. An EU-incorporated bank processing a payment for an EU exporter is operating within a regime that is territorial in its primary application, subject to exceptions for catch-all controls and brokering. The EU financial-sanctions layer adds an asset-freeze dimension tied to designated persons under Council Decisions and Regulations, but the payment-facilitation question under dual-use rules is distinct from the designation-screening question.
In practice, this means that a correspondent bank with a US nexus – US dollar clearing, a US branch, or US-person involvement in the transaction – applies a BIS / EAR lens that an EU-only bank would not apply in the same way. The divergence is sharpest for items that are controlled under the EAR but not listed on the EU Common List, or items controlled under both lists but with different classification numbers and different licence exceptions available.
How does the extraterritorial reach of BIS / EAR create de-risking pressure that EU rules do not replicate?
The extraterritorial architecture of the BIS / EAR creates a category of de-risking pressure that has no direct EU equivalent. The de minimis rule (the principle that foreign-made items incorporating more than a specified proportion of controlled US-origin content remain subject to the EAR) means that goods manufactured entirely outside the United States can still require US export licences for certain destinations and end uses. A correspondent bank that clears US dollars is considered, under US legal analysis, to be a participant in any transaction that moves such goods, even if the bank has no knowledge of the specific item and the goods never touch US soil.
The foreign direct product rule (the principle that foreign-made items produced using certain US-controlled technology or equipment are subject to the EAR) extends this exposure further for specific controlled-technology categories. These extraterritorial hooks give US authorities a basis to assert jurisdiction over banks incorporated and operating entirely outside the United States. Banks subject to US dollar clearing know this. Their response – refusing or suspending payments linked to certain goods codes, destinations, or counterparty profiles – is the mechanism that produces de-risking in the correspondent network.
The EU does not have a structurally equivalent extraterritorial mechanism for dual-use export controls. Where the EU does assert extraterritorial jurisdiction, it is primarily through the EU Blocking Regulation – a measure designed to neutralise the effect of specified US extraterritorial sanctions by prohibiting EU operators from complying with them and providing a legal defence for non-compliance. The Blocking Regulation creates a direct conflict of obligations for EU-incorporated banks with US operations, and that conflict is itself a de-risking driver for certain transaction categories. Have you assessed whether the Blocking Regulation creates any compliance obligation for your EU counterparties?
Where do the ownership-and-control tests diverge, and why does it matter for payment decisions?
The ownership-and-control tests applied by the BIS / EAR and EU regimes diverge significantly on how a non-listed entity can become caught by restrictions through its relationship to a listed person. Under OFAC's parallel regime – which correspondent banks invariably apply alongside BIS / EAR screening – the 50 percent rule (OFAC's rule treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked) is mechanical: aggregate the listed ownership, and if it reaches that threshold the entity is treated as blocked. The test does not require proof of control.
The EU test is framed as ownership and control (the EU standard for determining whether a non-listed entity is caught through a listed person's ability to direct its actions). Under the relevant Council Regulations, a non-listed entity can be caught if a listed person owns it at a threshold lower than fifty percent, provided the listed person exercises control through other means – board composition, contractual rights, veto mechanisms, or economic dependency. The threshold guidance issued under the EU regime has historically referenced fifty percent as a presumptive indicator, but the control dimension means that a minority stake coupled with control rights can be sufficient. That is a broader test in structural terms, though its application depends heavily on the underlying facts.
For a correspondent bank making a real-time payment decision, the EU test is harder to apply mechanically than the OFAC fifty-percent rule. In our experience, banks under time pressure default to the more predictable rule – which in practice means US-standard screening – and decline payments where the ownership chain generates any doubt, regardless of which regime technically governs. This over-application of the OFAC threshold to EU-law situations is a documented source of incorrect de-risking decisions for cross-border businesses. The practical implication: an EU exporter whose buyer has a minority listed-person shareholder may find payments declined on OFAC-standard grounds even if the EU analysis would not require that result.
How does the licensing architecture differ, and what paths to authorisation exist under each regime?
The BIS / EAR licensing architecture operates through a combination of licence exceptions and specific licences. Licence exceptions are standing authorisations that permit defined categories of exports, re-exports, and transfers without a separate application – but their availability depends on the item's ECCN (Export Control Classification Number under the US Commerce Control List), the destination, and the end use. Where no licence exception applies, a specific licence is required, and BIS adjudicates applications against a set of review policies that vary by item type and the receiving party's identity.
For correspondent banks, the relevant licence-exception analysis is rarely straightforward. A bank receiving a payment instruction does not typically have visibility of the full export-control classification for the underlying goods. Its de-risking decision is therefore made on the basis of the counterparty profile, the stated goods category, and the destination – proxies rather than the actual ECCN. This is a structural mismatch between the licence-exception system, which is designed for exporters, and the correspondent-banking context, which requires the bank to make a decision in the absence of the exporter's full compliance file.
The EU licensing architecture is administered by national competent authorities in each member state, with coordination through the relevant Commission structures. General trade authorisations (standing EU-level permissions for lower-risk dual-use exports to certain destinations) are available for some categories and destinations, reducing the need for individual national licences. Individual licences are required for items outside the scope of general authorisations, and the assessment criteria differ by member state, creating a patchwork that a pan-European business must map carefully. Under the EU regime, the licensing burden falls clearly on the exporter. The bank's obligation is to screen the transaction against the sanctions lists; it does not typically hold a separate dual-use licence. This division of obligation is clearer in the EU than in the BIS / EAR context, where the bank's potential participation theory can be read more broadly.
The position above covers the standard case. Your facts – the specific item classification, the destination, the ownership chain of the bank and the buyer, and the currency and clearing route of the payment – change the analysis. For an assessment of your exposure under the BIS / EAR or EU regimes, contact Calder & Vance at info@caldervance.com.
What is the enforcement posture of each regime against correspondent banks, and what risk flags should exporters monitor?
BIS enforcement against financial institutions for export-control facilitation is less frequent than OFAC enforcement for sanctions violations, but the legal basis is present and BIS has demonstrated willingness to use it. The relevant enforcement framework treats any party that knowingly, wilfully, or with reckless disregard participates in an unlicensed export as potentially liable under the Export Control Reform Act. For a correspondent bank, this exposure is most acute where the bank has received a denial order notification – a notice that a specific entity has been added to the Denied Persons List or the Entity List – and continues processing payments to that entity. The Entity List (BIS's list of foreign parties subject to specific licence requirements because of their assessed involvement in activities contrary to US national security or foreign policy interests) and the Denied Persons List (parties denied export privileges) are distinct from OFAC's SDN List and require separate screening.
EU enforcement of dual-use controls is conducted by national competent authorities and, in the financial-sanctions dimension, by bodies such as OFSI's UK equivalent and the relevant member-state authorities. The EU's enforcement posture on dual-use controls has historically been more export-focused than payment-focused: the primary enforcement target is the exporter who ships without a licence, not the bank that processed the payment. Financial-sanctions enforcement – asset-freeze violations, dealing with designated persons – follows a different path and can engage banks directly. The EU General Court has jurisdiction over annulment challenges to designations, and the enforcement decisions of member-state authorities can be subject to domestic judicial review.
Risk flags that counsel encounter most frequently in cross-border correspondent-banking matters include:
- Payments linked to dual-use goods categories where the ECCN is not established or disclosed to the bank, creating an unknown-classification exposure under the EAR.
- Counterparties incorporated in jurisdictions where the Entity List and the EU asset-freeze list overlap imperfectly – a party caught by one but not the other.
- Ownership chains where a minority listed-person stake is argued not to trigger the OFAC fifty-percent rule but the EU control test has not been separately assessed.
- Transactions involving items subject to the foreign direct product rule for certain technology categories, creating BIS / EAR exposure for non-US goods that the exporter had not classified under the EAR at all.
- EU operators receiving de-risking decisions from US-clearing banks and accepting them without challenging the legal basis of the refusal – potentially forgoing rights under the EU Blocking Regulation where the refusal is driven by specified US extraterritorial sanctions.
If a transaction has already been flagged, or a payment has been refused without a clear legal basis being stated, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential review.
Is the BIS / EAR de-risking regime stricter than the EU? A comparative assessment for cross-border decision-making
There is no single answer to whether the BIS / EAR or EU regime is stricter on correspondent-banking de-risking, because the two regimes are not measuring the same thing across all dimensions. The BIS / EAR regime is stricter in terms of extraterritorial reach: it engages banks and exporters with no US presence through the de minimis and foreign direct product rules in ways the EU regime does not replicate for dual-use controls. The Entity List and Denied Persons List controls are also more granular and more frequently updated than the EU dual-use catch-all controls, creating a higher administrative burden for screening.
The EU regime applies a broader ownership-and-control test for financial-sanctions purposes. A minority stake combined with control rights can catch an entity under EU law that would not be blocked under the OFAC fifty-percent rule. For a bank conducting payment screening, this means that a clean OFAC result does not automatically produce a clean EU result. The two analyses must be run separately, and the stricter prohibition governs.
A decision matrix for cross-border businesses:
- Situation A: the item is subject to the EAR with an ECCN that requires a licence for the destination, and the payment clears through a US correspondent. Route: BIS licence application or applicable licence exception. The payment cannot proceed until the export-control position is resolved. Risk: US enforcement against the exporter, and potential de-listing of the exporter's correspondent relationship.
- Situation B: the item is not subject to the EAR (non-US origin, below de minimis) but is on the EU dual-use list and requires a national licence for the destination. Route: national authority licence application in the relevant EU member state. The US correspondent bank should not hold a residual BIS / EAR concern, but its screening protocols may flag the destination regardless. Risk: EU enforcement if the item is exported without a licence; bank de-risking based on destination rather than item classification.
- Situation C: the buyer has a listed-person shareholder below fifty percent but with control rights. Route: a full ownership-and-control analysis under both the OFAC fifty-percent test and the relevant EU control test. The OFAC analysis may be clean; the EU analysis may not. Risk: incorrect de-risking decision by a bank applying only the OFAC test; EU enforcement exposure for dealings with a non-listed but controlled entity.
In our cross-border practice, we regularly advise on the Situation C pattern. The combination of a structurally different control test and an over-reliance by banks on OFAC-standard screening produces a class of transactions that are incorrectly declined on one legal basis and inadequately scrutinised on another. Resolving that pattern requires a parallel analysis under both regimes before the deal structure is finalised.
A common misconception: the EU Blocking Regulation means EU businesses can ignore BIS / EAR
A recurring misconception in our practice is the belief that EU operators are protected from BIS / EAR consequences by the EU Blocking Regulation, and can therefore disregard US export-control requirements entirely. This is not correct, and acting on it creates serious exposure.
The EU Blocking Regulation applies to a specified list of US measures. It requires EU operators not to comply with those specified measures and provides a procedural defence in EU courts. It does not nullify US jurisdiction over items subject to the EAR. An EU exporter that ships US-origin goods, or goods incorporating US-origin technology above the de minimis threshold, without a required BIS licence remains exposed to US enforcement regardless of the Blocking Regulation's protections in the EU context. The two obligations co-exist, and the Blocking Regulation resolves the EU-law compliance question – it does not resolve the US-law exposure question.
For the correspondent bank sitting between the two systems, the Blocking Regulation creates an obligation not to comply with certain US measures and a corresponding risk of US enforcement if it maintains US dollar-clearing operations. That conflict is real. We have acted for EU-incorporated institutions working through precisely this tension, assessing on a transaction-by-transaction basis which obligation takes priority given the institution's presence in each jurisdiction and the specific US measure being applied. There is no universal answer – the analysis is institution-specific and transaction-specific. Does your institution have a documented position on how it handles the Blocking Regulation conflict for BIS / EAR-adjacent transactions?
Related practices
- OFAC correspondent-banking de-risking service – assessing OFAC exposure in correspondent and payment relationships
- OFAC vs BIS / EAR: correspondent-banking de-risking compared – comparing the two principal US regimes for payment-channel compliance
- OFAC vs EU: correspondent-banking de-risking compared – how OFAC and EU financial-sanctions regimes diverge on de-risking decisions