A technology exporter clears its trade-compliance checklist, confirms the goods carry a low-risk classification, and ships. Six months later, a BIS audit reveals the classification was wrong. The Export Control Classification Number (ECCN – a five-character alphanumeric code on the Commerce Control List that determines which licence requirements and exceptions apply to a given item) was assigned by the product team without a proper technical review. The shipment went to a jurisdiction that required a licence. The exporter now faces a potential enforcement action under the Export Administration Regulations.
ECCN classification is the gateway decision in US export-control compliance. Under the EAR (the Export Administration Regulations, administered by the Bureau of Industry and Security, BIS), every item subject to US jurisdiction must be classified before export. OFAC's sanctions programmes operate in parallel: they block or restrict transactions with designated parties and territories regardless of the ECCN outcome. The two regimes are not alternatives – they are cumulative screens, and a passing score on one does not eliminate exposure under the other.
This analysis explains how BIS and OFAC classification and screening interact, where businesses systematically go wrong, and what a sound cross-border programme looks like. As of April 2026, the regulatory environment for dual-use goods remains one of the most actively enforced areas of US trade law.
What is ECCN classification and who administers it?
ECCN classification is the process by which an exporter determines whether an item – goods, software, or technology – appears on the Commerce Control List (CCL, the master schedule of controlled items maintained by BIS) and, if so, which ECCN governs it. BIS administers the EAR under authority delegated through the Export Control Reform Act and the International Emergency Economic Powers Act (IEEPA). The legal basis for controls on dual-use items flows primarily from IEEPA, supplemented by the Export Control Reform Act framework.
An ECCN has five characters: a single letter indicating the product category (e.g., A for munitions-related, B for test and production equipment, C for materials, D for software, E for technology), followed by a digit indicating the product group, followed by a three-digit sequence number. The combination determines the Reasons for Control – the policy bases (national security, nuclear non-proliferation, chemical and biological controls, anti-terrorism, and others) that trigger licence requirements for specific destinations, end-uses, and end-users.
Items not on the CCL are classified as EAR99. EAR99 is not an exemption from all controls: it is a residual classification meaning that no CCL entry covers the item. BIS licence requirements can still apply to EAR99 items in specific circumstances – for example, if the end-use or end-user is subject to a restriction. Many businesses treat EAR99 as a green light. It is not.
Where does OFAC fit in the ECCN picture?
OFAC administers economic and trade sanctions under separate legal authority from BIS, and its analysis runs in parallel with, not instead of, ECCN classification. OFAC's SDN List (the list of Specially Designated Nationals and blocked persons) blocks transactions with designated individuals and entities. OFAC's country and thematic programmes impose additional prohibitions on transactions with certain territories, governments, and sectors regardless of the item's classification.
This parallel structure creates a two-screen obligation. A shipment must first clear BIS (is a licence required for this item, to this destination, for this end-use?), and then clear OFAC (is any party to the transaction blocked, or does the transaction touch a sanctioned territory or sector?). An EAR99 item shipped without a BIS licence may still be prohibited under OFAC if the buyer is on the SDN List or is located in a comprehensively sanctioned territory. Conversely, a correctly licensed BIS transaction can still violate OFAC if the exporter fails the sanctions screen.
In our practice, this duality is the single most common source of compliance gaps. Exporters build ECCN classification workflows and assume the export-control screen covers sanctions. It does not. The two agencies have different lists, different legal bases, different licensing authorities, and different enforcement postures. An OFAC licence does not substitute for a BIS licence, and vice versa.
The position above covers the standard case. Your specific goods, technology, software, end-user profile, and transaction structure change the analysis materially. For an assessment of your exposure across both regimes, contact Calder & Vance at info@caldervance.com.
Where do the regimes diverge on ECCN classification?
The regimes diverge most sharply on three points: classification methodology, the treatment of technology and software, and the application of extraterritorial reach.
On classification methodology, BIS classification is item-centric. The exporter determines the technical parameters of the item and matches them against CCL descriptions. The analysis is technical: controlled parameters, performance thresholds, and technical characteristics determine which ECCN applies. OFAC's screening is party-centric and transaction-centric. OFAC asks whether a person, entity, vessel, or territory is designated or restricted – not what the item is. An OFAC violation can arise from a transaction involving entirely uncontrolled goods if the buyer is designated.
On technology and software, BIS controls extend to deemed exports – the release of controlled technology or source code to a foreign national within the United States, which is treated as an export to that person's home country. This is a significant exposure for technology companies, universities, and manufacturers with international workforces. OFAC has no direct deemed-export doctrine, but OFAC restrictions on transactions with nationals of sanctioned territories can produce analogous results when technology or services are provided.
On extraterritorial reach, both regimes have significant reach outside US borders, but the mechanism differs. BIS's de minimis rule and foreign-produced direct product rule (FDPR) extend US export controls to foreign-made items that incorporate controlled US-origin content beyond defined thresholds, or that are the direct product of certain US technology or software. OFAC's extraterritorial reach operates through secondary-sanctions risk and through the 50 percent rule (OFAC's rule treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked), which can capture foreign-incorporated subsidiaries of designated persons.
Practical divergence also arises in licences and exceptions. BIS offers a structured set of licence exceptions (standing authorisations for defined categories of transactions that do not require a separate application) that reduce the licence burden for low-risk destinations and end-users. OFAC's equivalent instruments are general licences (standing authorisations permitting defined categories of transactions) and specific licences (case-by-case authorisations for otherwise prohibited transactions). The two systems are not interchangeable: a BIS licence exception does not authorise an OFAC-prohibited transaction, and an OFAC general licence does not waive a BIS licence requirement.
Which regime is stricter – and does that framing miss the point?
The question of which regime is "stricter" is less useful than it appears, because the two regimes govern different things. BIS controls the movement of items; OFAC controls transactions with designated or restricted persons and territories. A transaction can be fully licensed under BIS and still be absolutely prohibited under OFAC. The more productive question is: where does each regime generate the greatest residual risk for a given business?
For technology exporters, BIS classification risk is front-loaded. Getting the ECCN wrong – or failing to classify at all – exposes the business to enforcement before the transaction is even complete. The EAR imposes a positive obligation to classify and to verify the classification is current. Classification is not a one-time exercise: changes to the CCL, advances in the technical capabilities of a product, and changes in the product's intended use can all require reclassification.
For financial institutions and intermediaries, OFAC exposure tends to dominate. The item being financed, cleared, or insured may be entirely uncontrolled under BIS, but if any party in the payment chain is on the SDN List or the transaction touches a sanctioned territory, the exposure is immediate and strict-liability in character. OFAC civil penalty enforcement does not require wilful intent: a transaction that objectively violates a prohibition can give rise to a penalty even if the firm was unaware of the violation.
For manufacturers and distributors of dual-use goods – items with both commercial and potential military or proliferation applications – both regimes generate concurrent risk, and a matrix approach to classification and screening is necessary. In our experience, businesses that score well on one regime while underinvesting in the other are the most exposed when enforcement action follows.
The cross-border dimension adds a further layer. The EU's dual-use export-control regime, administered by competent authorities in each member state under EU rules, uses its own control list with substantial overlap with the CCL but material differences in thresholds, parameters, and licensing routes. The UK, following its departure from the EU, now operates its own export-control list and licensing regime through the Export Control Joint Unit (ECJU). Items controlled under the CCL are not automatically controlled at the same level – or at all – under the EU or UK lists, and vice versa. A business that classifies only against the CCL may be compliant in the US but exposed under the applicable EU or UK regime, or may be applying a stricter classification than the EU or UK requires.
How does ECCN classification interact with the foreign-produced direct product rule?
The foreign-produced direct product rule (FDPR) is among the most frequently misunderstood aspects of BIS's extraterritorial reach. Under the FDPR, certain foreign-made items are subject to the EAR if they are the direct product of US-origin technology or software that is controlled at specific levels on the CCL. The FDPR means that a foreign manufacturer whose production process uses US-controlled technology may find that its finished goods are subject to BIS licence requirements for export to certain destinations – even if the finished goods themselves contain no US-origin components.
ECCN classification interacts with the FDPR because the applicability of the rule depends in part on the ECCN of the US technology or software used in production, and on the ECCN of the foreign-produced item itself. If the foreign item would require a licence to the destination in question, and it is the direct product of a sufficiently controlled US technology or software, the FDPR may bring it within the EAR.
For businesses operating global supply chains – particularly in semiconductors, advanced manufacturing, and telecommunications equipment – the FDPR analysis can be more consequential than the standard CCL classification exercise. In a recent matter, a multinational manufacturer in a third market discovered that its production equipment used US-origin software at a controlled level, and that its finished goods were therefore subject to BIS licence requirements for certain destinations it had been shipping to without restriction. The matter required a full mapping of the production inputs, a reclassification exercise, and the preparation of a voluntary self-disclosure (VSD) to BIS. Outcomes in VSD matters are not guaranteed, but early action and a structured approach consistently produce better results than reactive defence.
If a transaction has already been flagged, or a classification issue has surfaced in an audit, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential initial assessment.
What are the most common ECCN classification errors?
Classification errors cluster around five patterns. Each is preventable with the right process, but each also produces real enforcement exposure when it is not caught.
First, stale classifications. An ECCN assigned at product launch is not necessarily valid five years later. The CCL is updated periodically; a product's technical capabilities may have been expanded through software or hardware updates; and the regulatory treatment of certain technologies changes with policy. Businesses that classify once and never revisit are operating on assumptions that may no longer hold.
Second, self-classification without technical depth. The CCL's control parameters are technical documents. Accurate classification requires engineering input: a legal or compliance team working from a product description alone will frequently assign the wrong ECCN. Under-classification (assigning a lower-control or EAR99 classification to a controlled item) is the more common and more serious error. Over-classification (treating an uncontrolled item as controlled) wastes resources and can create unnecessary friction with customers, but it is rarely an enforcement risk.
Third, ignoring software and technology components. Many businesses classify their physical goods carefully but do not classify the embedded software, operating firmware, or technology (know-how, design files, specifications) that accompanies or enables the goods. The EAR controls technology and software separately from the hardware they relate to. A hardware item that clears controls on its own may be re-examined when the associated technology is considered.
Fourth, the EAR99 assumption. As noted above, EAR99 is not a clearance. It means only that the item does not appear on the CCL. BIS retains the authority to impose ad hoc controls on EAR99 items in specific circumstances. End-use controls, end-user orders, and entity-specific restrictions can all apply to EAR99 goods. An exporter who sees EAR99 and stops the analysis has not completed the exercise.
Fifth, decoupling BIS and OFAC screening. Classification is completed, the ECCN is confirmed, and the licence exception is verified – but no one runs the buyer, the freight forwarder, the end-user, or the financial intermediary through an OFAC screen. Or conversely, the OFAC screen is run, but the ECCN analysis is bypassed on the assumption that a cleared buyer means a cleared transaction. Neither shortcut holds.
When does a business need external counsel for ECCN classification?
Classification can be handled in-house for standard commercial items with clear CCL parameters and stable product lines. External counsel adds disproportionate value in six situations.
The first is classification of items at or near the boundary of controlled parameters. Where a product's technical specifications sit close to a CCL threshold, the classification turns on technical and legal judgment. A defensible position requires documented analysis, not just a conclusion.
The second is the deemed-export analysis for technology transfers to foreign nationals. Deemed-export exposure is frequently underestimated, and the consequences of getting it wrong extend to criminal enforcement in wilful-violation cases.
The third is FDPR analysis for global manufacturers and supply-chain participants. The FDPR's application to foreign-produced goods requires both a CCL classification of the US-origin technology inputs and an assessment of the finished goods themselves.
The fourth is classification review in the context of a transaction, acquisition, or joint venture. When a business acquires a product line or a company, it inherits the classification history. If classifications were wrong, the liability can transfer with the deal.
The fifth is preparation for or response to a BIS audit. Audits will test the classification methodology, the documentation, and the screening records. A classification position that was reached informally and lacks documentation is difficult to defend.
The sixth is any situation where a VSD to BIS or OFAC is under consideration. VSD preparation requires a structured analysis of the apparent violation, an assessment of the aggravating and mitigating factors, and a considered decision on timing and scope. The decision whether to disclose, and how, has significant consequences for the outcome of any subsequent enforcement action.
Could your current classification process withstand a BIS audit today? That is the question a sound in-house programme should be able to answer affirmatively – with documentation.
The myth: ECCN classification is a one-time product-launch task
A persistent myth in trade-compliance circles is that ECCN classification is a product-launch exercise: classify the item once, record the result, and move on. The correction is more demanding. Classification is a live obligation that must be maintained throughout the product lifecycle.
Several events require a classification review even if the product itself has not changed. A revision to the CCL may reclassify the item, either by adjusting the technical parameters of an existing entry or by creating a new entry that covers goods previously classified elsewhere. A policy change may add or remove a Reason for Control, altering the licence requirements for specific destinations. A software update that changes a product's performance – increasing processing speed, adding encryption functionality, extending range or sensitivity – may bring the updated product within a different, higher-control ECCN.
Acquisitions introduce classification risk in a different form. When a business acquires a product line, it inherits the previous owner's classification history. In our cross-border practice, we have reviewed classification records inherited through acquisitions that contained material errors dating back several years, with corresponding export transactions that required VSD consideration.
The practical implication is that a sanctions and export-control programme needs a classification-maintenance procedure: a defined trigger list for when reclassification is required, a review cycle for active products, and a record-keeping system that documents each classification decision and its basis. Record-keeping under the EAR requires that export-control records be retained for a defined period; verify the current requirement under the applicable regime before relying on any specific figure.
Related practices
- Deemed Export and Technology Controls (BIS / EAR) – classifying technology transfers to foreign nationals and managing deemed-export exposure under BIS.
- ECCN Classification: OFAC vs Canada – how the US and Canadian export-control regimes compare on classification and licensing requirements.
- ECCN Classification: OFAC vs EU – points of divergence and convergence between the CCL and the EU dual-use control list.