A UK-based engineering group exports precision components to a distributor in a third market. Months later, an internal audit flags that the goods may have been re-exported to an end-user of concern. The UK Export Control Joint Unit and the Office of Financial Sanctions Implementation both make enquiries. At the same time, the group's German subsidiary receives correspondence from the relevant competent authority under the EU dual-use rules. Two regimes. Two sets of criminal thresholds. One corporate group with nowhere to hide.
Criminal exposure in export-control cases under OFSI and the EU turns on distinct legal bases, different mental-element tests, and separate enforcement authorities – yet both regimes can operate simultaneously against the same transaction chain. As of March 2026, the UK maintains strict-liability civil penalties alongside criminal prosecution routes under SAMLA and the Export Control Order, while the EU relies on Member State criminal law underpinned by Council regulations and the EU dual-use rules. The gap between the two regimes is consequential: a disclosure that resolves UK exposure may not extinguish EU criminal risk.
This analysis maps the divergence criterion by criterion: the governing authorities, the mental-element tests, the penalty bases, the interaction with US secondary-sanctions risk, and the practical decisions a cross-border business must take when both regimes are engaged at once.
Governing authorities and legal bases: where each regime sits
Criminal exposure in export-control cases under the UK regime flows from two parallel tracks – financial-sanctions offences administered by OFSI under the Sanctions and Anti-Money Laundering Act (SAMLA) and export-control offences administered by the Export Control Joint Unit (ECJU) under the Export Control Order – and the two can run concurrently against a single transaction.
OFSI administers financial-sanctions enforcement. It may impose a monetary penalty notice (a civil route) or refer a case to His Majesty's Revenue and Customs or the National Crime Agency for criminal prosecution. The criminal route is reserved for the most serious breaches, but the referral threshold is not published as a bright line. OFSI's published enforcement guidance signals that aggravating factors – concealment, deliberate breach, repeat conduct, commercial gain – drive the referral decision. Practitioners advising on OFSI matters must therefore treat the civil and criminal tracks as genuinely parallel rather than sequential.
The ECJU handles export-licensing enforcement separately. A criminal prosecution for an unlicensed export under the Export Control Order is an HM Revenue and Customs matter. Both ECJU/HMRC and OFSI may investigate the same shipment: the export-licensing question (did the goods require a licence?) and the financial-sanctions question (did the transaction benefit a designated person?) are legally distinct, even when they share a factual matrix.
On the EU side, criminal exposure does not flow from a single supranational authority. The relevant Council regulations and the EU dual-use rules create the prohibitions; Member States are obliged to adopt effective, proportionate, and dissuasive criminal sanctions to enforce them. The result is a patchwork: prosecutors in Frankfurt, Paris, Amsterdam, or Warsaw each apply their own procedural law, their own threshold for bringing charges, and their own sentencing range. Competent authorities in the Member States exchange information through formal cooperation channels, but a defendant facing parallel proceedings in two Member States will engage two separate criminal justice systems.
What unifies the EU side is the substantive prohibitions themselves. The relevant Council regulations are directly applicable across the Member State in which the exporter or intermediary is established. A holding company incorporated in the Netherlands with a branch in Poland can face Dutch and Polish enforcement simultaneously. In our cross-border practice, this layering of national criminal exposure onto a single EU-level prohibition is one of the first structural points we map for any client with intra-EU group operations.
Mental-element tests: strict liability, knowledge, and wilful blindness
The UK civil-penalty track under SAMLA is a strict-liability regime – the absence of intention or knowledge does not preclude a civil monetary penalty, though it bears on the amount. Criminal prosecution under the same statute requires proof of the requisite mental element, which OFSI's referral practice and the relevant criminal statutes treat as knowledge or reasonable cause to suspect. That asymmetry matters: a business that cannot prove it lacked knowledge is exposed on both tracks simultaneously.
The EU dual-use rules introduce an explicit knowledge test on the licensing side: an exporter who has been informed by its competent authority that goods are intended for a prohibited end-use must obtain a licence or refuse the transaction. Failure after such notification significantly reduces the room to argue absence of knowledge in a subsequent criminal proceeding before a Member State court. Where no notification has been issued, the mental-element standard reverts to national criminal law – and that standard varies materially between Member States.
Consider the divergence in practice. A UK exporter supplying a dual-use item without a licence will face ECJU/HMRC enforcement on an objective standard: was the licence required? Did the exporter obtain it? Intent affects sentence, not guilt. A German exporter facing prosecution under the applicable German implementing legislation must face a court applying the relevant mental-element standard under German criminal procedure. The two proceedings demand different evidence, different disclosure strategies, and different expert inputs.
Does the difference in mental-element standards mean that a business is safer under one regime than the other? Not straightforwardly. The UK's strict-liability civil route means that a well-intentioned but negligent business may face a significant civil penalty even where criminal prosecution would fail. The EU's reliance on national criminal law means that the effective standard depends on the Member State – and some jurisdictions apply a lower threshold than others. In our experience, clients who map only the formal statutory text without modelling the enforcement practice of the relevant national authority systematically underestimate their exposure.
How do penalty bases and escalation paths differ?
Under OFSI's civil route, a monetary penalty may be calculated as a percentage of the value of the breach or by reference to a statutory maximum, both of which OFSI's published guidance addresses – but the specific current figures should be verified against OFSI's current enforcement guidance before reliance, as Parliament may amend them. The civil and criminal tracks are not mutually exclusive: OFSI may impose a monetary penalty and refer to prosecutors. Individuals within a corporate group can face personal criminal liability.
The criminal penalty for a conviction under the Export Control Order – an unlicensed export or a false-statement offence – exposes an individual defendant to a custodial sentence and an unlimited fine. Corporate defendants face an unlimited fine. Courts in recent enforcement actions have emphasised that the export-control criminal offences are not regulatory technicalities; they are treated as serious economic offences.
On the EU side, Member State criminal penalties span a wide range. Some jurisdictions impose custodial sentences of up to several years for knowing violations of the relevant Council regulation's export prohibitions; others treat first offences with substantial fines and non-custodial outcomes. The EU Council's framework requires that penalties be effective and dissuasive, but it does not harmonise quantum. A business with operations in multiple Member States therefore faces an asymmetric penalty environment: the same underlying shipment may attract materially different criminal exposure depending on where the corporate entity involved is incorporated or where the goods physically departed from.
One escalation path common to both regimes deserves particular attention. Where a criminal investigation is opened – whether by HMRC in the UK or by a national prosecutor in the EU – associated proceeds-of-crime and asset-recovery proceedings can follow. Confiscation orders under the UK's proceeds-of-crime regime can extend to the gross receipts of the transaction, not merely the profit. Several EU Member States have equivalent instruments. This secondary financial exposure is frequently larger than the primary criminal fine and is a risk that in-house teams under-model in the early stages of an investigation.
The position above covers the standard case. Your facts – the goods, the end-user, the route, the group structure, and the regimes simultaneously engaged – change the analysis significantly.
For a confidential review of potential criminal exposure across the UK and EU regimes, contact Calder & Vance at info@caldervance.com.
What is the US secondary-sanctions dimension?
A UK or EU exporter of goods with a US-origin content or technology above the applicable threshold under the Export Administration Regulations (EAR) faces a third layer of exposure that operates independently of OFSI and EU enforcement. The de minimis rule and the foreign direct product rule under the EAR extend BIS jurisdiction to items that were never physically present in the United States, provided they incorporate a specified proportion of controlled US content or were produced using controlled US technology.
A shipment that triggers a UK ECJU investigation and an EU Member State prosecution may simultaneously constitute an apparent violation of the EAR, giving the US Bureau of Industry and Security (BIS) a basis to place the exporter on the Entity List (BIS's list of parties subject to licence requirements for all items subject to the EAR) or to pursue civil or criminal enforcement in the United States. BIS and the US Department of Justice have both pursued enforcement actions against non-US persons in exactly these circumstances.
The practical consequence for a cross-border business is that the disclosure and voluntary self-disclosure strategies appropriate for OFSI or the EU may conflict with BIS expectations. A voluntary self-disclosure (VSD) – a proactive notification to BIS of an apparent EAR violation – carries procedural requirements, timing windows, and mitigating effects under BIS's enforcement guidelines that differ from OFSI's framework and from the national-law frameworks of EU Member States. Coordinating disclosures across three regimes simultaneously is one of the most operationally demanding tasks in export-control enforcement work. We regularly advise corporate groups on exactly this coordination challenge, and the sequence of disclosures can affect outcomes materially.
Does US secondary-sanctions risk apply to every UK or EU export-control case? No. It applies where the goods, technology, or software in question is subject to the EAR – which requires a correct classification of the item and an assessment of US content. But where US jurisdiction is engaged, ignoring it is not a viable strategy: BIS has demonstrated a willingness to act against non-US exporters, and the cumulative penalty exposure across three regimes can be severe.
Divergence on disclosure, cooperation credit, and enforcement mitigation
Disclosure and cooperation reduce criminal exposure under both regimes, but the mechanisms, timing windows, and evidentiary standards for cooperation credit diverge in ways that matter to a cross-border defendant.
OFSI's published enforcement guidance sets out the factors it considers when calibrating a monetary penalty. Prompt voluntary disclosure, cooperation with the investigation, and implementation of remedial compliance improvements all operate as mitigating factors. The guidance does not promise a fixed reduction for disclosure, and OFSI retains discretion on weighting. Where OFSI refers a matter to criminal prosecutors, the decision on whether and how disclosure is treated as mitigation passes to the prosecuting authority and ultimately the court. The criminal mitigation framework under English law – including the credit given for early guilty pleas – applies in the standard way, but OFSI's pre-referral conduct remains relevant context.
In the EU, cooperation credit is Member State-specific. Some national prosecutors operate a formal leniency or cooperation framework that can reduce a criminal charge or sentence; others do not. The EU does not impose a harmonised cooperation-credit mechanism on national criminal proceedings. An internal investigation report prepared for the purpose of a UK self-disclosure may be disclosable in a parallel EU Member State proceeding, and the privilege and confidentiality protections that attach to such a report under English law may not be recognised in the same way in another jurisdiction's court. This is an area where in-house counsel regularly encounter unexpected risk.
For a fuller treatment of enforcement mitigation under EU regulations, see our analysis at Enforcement mitigation factors: BIS/EAR vs EU. For the parallel US analysis comparing OFAC and BIS mitigation frameworks, see Enforcement mitigation factors: OFAC vs BIS/EAR.
A further divergence concerns internal investigation privilege. Under English law, documents prepared for the dominant purpose of obtaining legal advice in connection with anticipated litigation attract legal professional privilege. Several EU Member States apply a narrower privilege doctrine – in some jurisdictions, in-house counsel communications do not attract the same protection as advice from external lawyers. A corporate group conducting a single internal investigation to serve both UK and EU disclosure processes must, from day one, structure that investigation with both privilege regimes in mind.
Risk flags for cross-border businesses: where exposure compounds
Criminal exposure in export-control cases does not accumulate uniformly. Certain structural features of a transaction, a group, or a compliance programme systematically worsen the position. In our experience, the following are the points at which the risk compounds most sharply.
Goods with dual-use potential that have not been formally classified. An unclassified item creates ambiguity about whether a licence was required, but ambiguity is not a defence: a prosecutor or regulator will apply its own classification analysis. Where a UK and an EU authority classify the same item differently – which can occur where UK and EU control lists have diverged since the end of the Brexit transition period – a transaction that required no EU licence may have required a UK licence, or vice versa. The lists are not identical. Businesses that relied on pre-2021 classification advice should re-validate it.
Intermediate distributors and end-user uncertainty. A supply-chain structure that interposes a distributor between the exporter and the end-user limits visibility, but it does not limit legal responsibility. If the exporter had reasonable cause to suspect that the goods were destined for a prohibited end-user or a sanctioned person, both UK and EU rules may apply. Distributor indemnities do not extinguish criminal liability.
Group structures spanning UK and EU jurisdictions. A parent incorporated in the UK with subsidiaries in EU Member States faces both OFSI exposure and EU-level exposure on the same facts. The parent's decision-makers may be individually liable in the UK; the subsidiary's directors may be personally liable under the applicable national criminal law of their jurisdiction. Coordination of defence strategy across group companies is essential – and conflicts of interest between the parent's interests and the subsidiary's can emerge.
Failure to identify a designated person in the ownership chain. The ownership and control test under OFSI – and the equivalent EU test – can catch a transaction even where no listed person appears on the face of the documents. If a supplier's beneficial owner is a designated person, the transaction with the supplier may breach the prohibitions regardless of whether the designation was known at the time. Screening that reaches only the first layer of ownership will miss this.
Post-transaction discovery without a disclosure plan. A business that discovers a potential breach after the transaction has completed faces a time-sensitive decision about disclosure. Delay in the face of known or suspected exposure can itself be an aggravating factor, and in some jurisdictions a failure to report a known breach is a separate criminal offence. Acting without a legal strategy for the disclosure decision – including which regime to report to first and how to sequence disclosures – can worsen the ultimate outcome.
If a transaction has already been flagged, or an internal audit has surfaced a potential breach, an early legal review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com to discuss your situation.
Addressing a common misconception: "EU enforcement is more predictable than UK enforcement"
A myth in general circulation among in-house teams is that EU export-control enforcement is more predictable than UK enforcement because the EU operates through published Council regulations that are directly applicable and uniformly worded across the bloc. The corollary is that UK enforcement – particularly post-Brexit, when the UK's sanctions and export-control lists began to diverge from EU lists – is seen as less predictable and therefore more dangerous.
This is the wrong mental model. EU enforcement predictability is limited precisely by the decentralised criminal-prosecution structure. The relevant Council regulation creates the prohibition, but enforcement is a national matter. A competent authority in one Member State may be significantly more active than that in another. Prosecutorial thresholds, the practice on corporate versus individual liability, the use of deferred prosecution or settlement mechanisms, and the availability of cooperation credit all vary. The apparent uniformity of the EU substantive rules masks substantial variation in enforcement practice.
UK enforcement, by contrast, is more centralised. OFSI and the ECJU are single authorities with published enforcement guidance, known escalation paths, and a track record of published penalty decisions. The UK courts apply a well-developed body of criminal export-control case law. That predictability is an asset for a defendant managing a disclosure and mitigation process. It does not mean UK enforcement is lenient – recent actions demonstrate that it is not – but it does mean the decision tree for a UK disclosure is more structured than navigating the prosecution practice of several EU Member States simultaneously.
Neither regime is categorically safer. Each demands a tailored strategy based on the specific facts, the jurisdictions engaged, and the goods and parties involved. A cross-regime comparison that produces a simple ranking misses the point: the task is to manage both simultaneously.
When to involve counsel: the decision sequence
The threshold for involving specialist counsel in a potential criminal export-control matter is earlier than most in-house teams instinctively set it. An internal audit finding, a regulator enquiry letter, a customs hold, or an end-user notification from a counterparty are all events that can precede a formal investigation by months – and the decisions made in that window significantly affect the outcome.
A practical decision sequence for a cross-border business facing potential criminal exposure in export-control cases looks as follows.
Step one: scope the apparent breach. Before any external disclosure, establish with external counsel what conduct is at issue, which regimes are engaged, whether there is a US dimension under the EAR, and what the disclosure obligations are under each regime. An uncoordinated disclosure to one authority may trigger obligations or risks under another.
Step two: preserve and structure privilege. Decide immediately how the internal investigation will be conducted, who will direct it, and how documents will be handled. Privilege decisions made at the outset are much easier to defend than those improvised mid-investigation.
Step three: assess the voluntary self-disclosure decision. Both the UK and the US have published frameworks under which a timely, accurate, and complete VSD can operate as a significant mitigating factor. The EU does not have a harmonised VSD mechanism, but several national prosecutors recognise proactive cooperation. The decision whether to self-disclose, to whom, and in what sequence requires a careful assessment of the specific facts and the likely enforcement posture of each relevant authority.
Step four: model the asset-recovery and proceeds-of-crime risk. Where the transaction was commercially significant, the proceeds-of-crime exposure may dwarf the headline criminal penalty. Early modelling of this exposure is essential to any settlement or plea discussion.
Step five: coordinate group-wide defence strategy. Where multiple group entities in different jurisdictions are exposed, conflicts of interest between entities must be identified early and managed through separate representation where necessary.
We have acted for corporate groups and individuals at each stage of this sequence, from the initial audit finding through to enforcement resolution. Our practice covers the UK regime, the EU Member State level, and the US export-control dimension. For a confidential assessment of your apparent violation, contact our team at info@caldervance.com. We also offer a structured assessment of EU apparent violations at Apparent violation assessment – EU.
Related practices
- Apparent violation assessment – EU – structured review of EU export-control and sanctions breach exposure
- Enforcement mitigation factors: BIS/EAR vs EU – comparative analysis of mitigation credit across US and EU export-control regimes
- Enforcement mitigation factors: OFAC vs BIS/EAR – US-focused comparison of OFAC and BIS enforcement mitigation pathways