A technology company based in London employs software engineers who hold citizenship of a country subject to active export-control restrictions. The same company is finalising a licensing agreement with an Australian distribution partner that will grant access to controlled source code. Two parallel questions arise at the same moment: does releasing that code to the engineers constitute a transfer under UK export-control rules? And does the Australian partner's onward access trigger obligations under the Australian autonomous sanctions regime? These questions are not theoretical. They arise in routine R&D and commercial operations, and the consequences of missing either are serious.
Both the UK regime administered by the Export Control Joint Unit (ECJU) and the Australian autonomous sanctions regime administered by the Department of Foreign Affairs and Trade (DFAT) impose controls on the transfer of controlled technology to persons of concern – but the mechanisms, thresholds, and enforcement postures diverge significantly. Understanding where they converge and where they split is the practical starting point for any cross-border compliance analysis involving deemed exports and technology transfer under OFSI and Australian rules.
This analysis sets out the legal basis for each regime, maps the principal points of divergence, identifies the risk flags that compliance teams most frequently miss, and explains when cross-border counsel is needed before the transfer occurs rather than after.
What is a deemed export, and how does each regime define it?
A deemed export is a transfer of controlled technology that occurs without physically moving goods across a border – typically because the recipient is a national of a country to which a direct export would be controlled, or because the technology is made accessible in a way that constitutes a release even if no file attachment changes hands. The UK regime, operating under the Export Control Order and the relevant thematic export-control regulations, recognises that access to controlled technical data by a person in a specified category constitutes a controlled transfer regardless of physical location.
Under the UK rules, the ECJU is the licensing authority for export controls on dual-use and military goods, software, and technology. The Sanctions and Anti-Money Laundering Act 2018 (SAMLA) provides the statutory underpinning for financial sanctions administered by the Office of Financial Sanctions Implementation (OFSI), while export controls operate through a separate but overlapping instrument. In practice, a single transaction can engage both regimes: a payment to a restricted counterparty engages OFSI; the accompanying technical transfer engages ECJU.
Australia's regime operates differently in structure. DFAT administers both export controls under the Defence Export Controls programme and autonomous financial sanctions. The Australian autonomous sanctions regime draws on a broadly drafted ministerial-power model: controls apply to the export, supply, and transfer – including intangible transfer – of goods and technology listed in the relevant regulations. The definition of transfer is explicitly broad and encompasses making technology available through electronic means, oral disclosure, and visual inspection. In our experience, Australian-based businesses routinely underestimate how far this definition reaches into cloud-access and demonstration scenarios.
The critical structural difference at this level is that the UK and Australian regimes both capture intangible transfers, but the trigger tests differ. The UK test focuses primarily on the controlled status of the technology and the destination or person. The Australian test adds a parallel inquiry into whether the transfer would, in effect, circumvent a sanctions prohibition – meaning that the financial-sanctions overlay can bite even where the export-control classification is ambiguous.
How do the licensing and authorisation pathways compare?
Under the UK regime, a business seeking to transfer controlled technology to a person or destination that would otherwise be prohibited must obtain an export licence from the ECJU. Licences may be open general export licences (standing authorisations for defined categories of activity) or standard individual export licences (case-by-case authorisations for specific transactions). Technology transfers – particularly intangible transfers of dual-use software via cloud platforms or remote access – must be assessed against the UK's dual-use control list, which tracks the EU dual-use framework as it stood at the end of the transition period.
The position above covers the standard UK case. Your facts – the technology's classification, the nationality of the person receiving access, the platform involved, and the financial relationship with any sanctioned entity – change the analysis materially. For advice on a specific transfer, contact Calder & Vance at info@caldervance.com.
Australia operates a comparable but structurally distinct licensing system. The Defence Export Controls office within DFAT processes licence applications for controlled goods and technology. Australia's Defence and Strategic Goods List (DSGL) sets out the controlled items; transfers of DSGL-listed technology, including by intangible means, require a permit. The DSGL is aligned broadly with the Wassenaar Arrangement and other multilateral export-control regimes, as is the UK control list.
The divergence appears at the margin. First, Australia does not maintain a deemed-export licence category equivalent to the US BIS model; instead, the transfer prohibition applies directly to the act of making the technology available, and a permit is required where the technology is controlled and the recipient triggers concern. Second, DFAT's permit-processing timeline and its approach to permit conditions differ from ECJU practice. In our cross-border practice, we have seen compliance teams assume that a UK SIEL covering a technology transfer is automatically acceptable evidence of authorisation for the corresponding Australian step – it is not, and parallel Australian permit obligations must be assessed independently.
For businesses considering similar cross-jurisdictional licensing structures, our analysis of the EU comparator is also relevant: Deemed exports and technology transfer: OFSI versus the EU regime addresses the alignment and divergence between UK and EU practice post-transition.
Where do the regimes diverge on deemed exports and technology transfer?
The deepest divergence sits in four areas: the relationship between financial sanctions and export controls, the treatment of cloud and remote-access scenarios, the ownership-and-control test for restricted end-users, and the voluntary-disclosure and enforcement posture of each authority.
Financial sanctions overlay. In the UK, OFSI administers financial sanctions (asset freezes, payment prohibitions) under SAMLA and the relevant thematic regulations. Export controls sit with ECJU. The two regimes run in parallel: a company can comply fully with ECJU licensing requirements and still face an OFSI breach if a payment in the same transaction flows to a designated person. Australia integrates its financial sanctions and export controls more tightly at the point of enforcement: DFAT has responsibility for both strands, and a transfer of controlled technology to a sanctioned person can be analysed simultaneously as an export-control violation and a sanctions violation without the institutional division that characterises the UK model.
Cloud and remote-access scenarios. Both regimes capture intangible transfers, but neither has issued definitive guidance on all cloud-access scenarios. The UK's ECJU guidance acknowledges that making technology accessible via a cloud platform can constitute a transfer; the question turns on whether the person receiving access is in a controlled destination or is a person to whom a direct export would be controlled. DFAT's approach to the same question references the broad statutory definition of transfer but has not published equivalent scenario-based guidance. In our experience, this gap creates real uncertainty for software-as-a-service businesses with Australian distribution arrangements: they cannot rely on ECJU guidance as a safe harbour for their Australian obligations.
Ownership and control. The UK applies an ownership and control test (whether a non-listed entity is caught through a listed person's ownership or control) that is relevant both to financial sanctions under OFSI and to assessing the end-user in an export-control transaction. Australia applies a broadly comparable test for its autonomous sanctions purposes, but the formulation differs at the margin. A corporate group in which a sanctioned person holds a significant but sub-majority interest may be treated differently under the two regimes, requiring a parallel analysis rather than a single answer.
Enforcement posture. OFSI has published a detailed enforcement guidance document setting out its approach to penalty decisions, the role of disclosure, and the factors it considers in mitigation. The ECJU operates its own compliance and enforcement function. Australia's DFAT enforcement posture is less publicly documented in comparable detail, though the statutory penalties available are substantial. The practical implication is that a business planning a voluntary self-disclosure (VSD – proactive disclosure to a regulator of a potential breach, typically before the regulator becomes aware) will be working with a well-documented UK framework and a less-prescribed Australian process.
Which regime creates the greater technology-transfer risk for a cross-border business?
Risk depends on the specific fact pattern, not on an abstract hierarchy between regimes. That said, there are structural features of each regime that create asymmetric exposure for particular business models.
Businesses with significant UK operations and a workforce including nationals of countries subject to active controls face a pronounced UK risk. The ECJU's deemed-export framework, combined with OFSI's financial-sanctions reach, means that a single employment or collaboration relationship can engage multiple UK obligations simultaneously. The absence of a clear safe harbour for intra-company technology sharing adds to the compliance burden.
Businesses exporting from Australia or using Australia as a distribution hub for technology into the Asia-Pacific region face Australian risk that can be underestimated precisely because the DSGL and the autonomous sanctions controls are less frequently discussed in global compliance training than their US or EU equivalents. Have you mapped your Australian distribution arrangements against the DSGL, or has the compliance analysis stopped at the BIS or ECJU level?
The extraterritorial dimension is also relevant. Neither the UK nor the Australian regime has the same extraterritorial reach as US export controls under the EAR, which can apply to foreign-produced items that incorporate a threshold proportion of US-controlled content. However, a technology product that has US content above the relevant threshold is subject to BIS rules regardless of where the company doing the transfer is based – meaning that a UK or Australian business transferring technology with US-origin content must also assess BIS obligations. For a full analysis of the BIS and EAR dimension, see our service page on deemed exports and technology transfer under BIS and the EAR.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential assessment.
What are the critical risk flags that compliance teams miss?
In our practice, the following patterns generate the most significant exposure in deemed-export and technology-transfer matters involving the UK and Australian regimes.
Nationality-based analysis applied only at onboarding. Both regimes require a current assessment of whether a person's nationality or the destination to which they have access creates a control trigger. A nationality check performed at hiring or at contract signature, but not refreshed when the control-list or sanctions-list position changes, produces a compliance gap. Sanctions designations change without notice; a person who was not a concern at onboarding may become one mid-contract.
Assuming software is uncontrolled. The classification of software and technology under dual-use control lists is a technical exercise. Software that incorporates encryption, that is designed for specific industrial or defence applications, or that enables certain categories of manufacturing or testing may appear on the relevant control list even if the underlying product appears commercial. In our experience, businesses that assess goods carefully but treat accompanying software and technical data as automatically uncontrolled generate the most avoidable exposure.
Demo and evaluation access. Providing a prospective customer – including an Australian distribution partner – with access to controlled software for evaluation purposes constitutes a transfer. The fact that no licence fee has been paid, no deal signed, and no source code delivered does not alter the analysis if the technology accessed is controlled and the person accessing it is in a restricted category.
Cloud storage and multi-tenant environments. Storing controlled technical data on a cloud platform accessible from multiple jurisdictions without access controls that effectively restrict retrieval by persons in controlled destinations creates a deemed-export risk that is frequently not captured by standard screening processes. The question is not where the server is; it is who can access the data and from where.
Post-transfer obligations. Both regimes impose obligations that do not end at the point of transfer. Record-keeping, end-use monitoring, and – in the UK – certain reporting obligations continue after the technology has been transferred. Compliance programmes that treat a licence grant or permit as the end of the obligation, rather than the beginning of an ongoing monitoring requirement, leave the business exposed in any subsequent review.
How does OFSI financial sanctions exposure interact with the technology-transfer analysis?
A technology transfer can trigger OFSI exposure in three distinct ways that are separate from the export-control analysis. First, if the counterparty receiving the technology is a designated person, or is owned or controlled by a designated person, any transfer that constitutes the provision of economic benefit may breach the financial sanctions prohibition. Second, the licensing fee or royalty paid in connection with the transfer may constitute a payment to a designated person even if the transfer itself is export-control compliant. Third, a UK-nexus transaction – one involving a UK person, UK-incorporated entity, or conduct in the UK – is caught by OFSI's reach regardless of where the technology ends up.
The interaction between these two regimes is one of the areas where legal advice is most frequently sought too late. We regularly advise businesses that have completed a technology-licensing transaction having obtained an ECJU licence, only to discover that the payment structure of the licence agreement separately engages OFSI. The export-control licence does not authorise the payment; OFSI authorisation must be sought independently where a payment prohibition applies.
Australia does not have this institutional division, but the substantive risk is equivalent: a transfer of controlled technology to a sanctioned entity engages both the export-control prohibition and the financial sanctions prohibition under the Australian autonomous sanctions framework, and the defences or exceptions available under one strand do not automatically carry over to the other.
A note on the myth that is most commonly raised in this context: some businesses assume that because a technology transfer is structured as a licence rather than a sale, it falls outside both the export-control regime and the financial-sanctions regime. This is incorrect under both the UK and the Australian rules. The form of the transaction does not determine whether a control applies; the nature of the access, the status of the counterparty, and the technology's classification determine that.
When should a cross-border business involve sanctions and export-control counsel?
The point at which a business should involve external counsel is earlier than most compliance teams assume. The trigger is not an investigation notice or a licence refusal; it is the transaction-structuring stage, when the facts are still malleable and the options are widest.
Specific triggers that should prompt an immediate review include: any hiring or contracting decision that brings nationals of a controlled country into contact with controlled technology; any cloud-access arrangement that does not currently have a jurisdiction-specific access-control analysis; any licensing or distribution agreement with an Australian partner covering technology that has not been assessed against the DSGL; any discovery that a payment or royalty stream involves a person who may be subject to OFSI prohibitions; and any dual-use technology product line that has not been formally classified against the current UK and Australian control lists.
In a recent matter, a software business with UK and Asia-Pacific operations engaged us after identifying that its standard cloud-access arrangement for product demonstration had been extended to users in jurisdictions subject to active control. The technology involved had not been formally classified. We assessed the classification, reviewed the access-control architecture, identified the licences required under the applicable regimes, and advised on a restructured access model that addressed both the UK export-control obligations and the Australian permit position. The matter was resolved before any enforcement contact was made.
For a business at the structuring stage, the cost of a classification review and a cross-regime access-control analysis is a fraction of the cost of an enforcement response. For a business already facing a potential breach, early involvement of counsel preserves the voluntary-disclosure option and allows the most effective mitigation argument to be developed.
For a comparative view of how the EU regime handles equivalent dual-use and deemed-export questions, see our analysis on EAR99 determination: BIS/EAR versus EU analysis.
Related practices
- Deemed exports and technology transfer – BIS and EAR – US export-control classification and licence assessment for technology transfers
- Deemed exports and technology transfer: OFSI versus the EU – comparative analysis of UK and EU intangible-transfer controls