A technology exporter ships a dual-use component to a distributor in a third market. The US entity classifies the item under the Export Administration Regulations ("EAR") and records an Export Control Classification Number ("ECCN" – the alphanumeric code under the US Commerce Control List that determines which export-licence requirements apply). The UK affiliate of the same group routes a parallel shipment. Both teams believe their paperwork is in order. Then a compliance audit reveals the two entities applied different classification logic, generated different licence determinations, and one shipment may have cleared without the required authorisation. This is not a hypothetical. It happens in every sector that operates across the Atlantic.
ECCN classification is a US export-control concept administered by the Bureau of Industry and Security ("BIS") under the EAR. The Office of Foreign Assets Control ("OFAC") administers economic sanctions, not export classifications – yet OFAC sanctions exposure and BIS export-control obligations frequently arise from the same transaction. The UK regime, administered by the Office of Financial Sanctions Implementation ("OFSI") for financial sanctions and the Export Control Joint Unit ("ECJU") for export licensing, uses a separate classification system derived from the international dual-use control lists. Businesses operating across both regimes must manage two parallel classification frameworks that overlap in scope but diverge sharply in methodology, legal basis, and enforcement consequence.
This analysis maps where the two regimes align, where they split, and what cross-border businesses need to do before the next shipment clears.
What is ECCN classification, and which US authorities govern it?
ECCN classification determines whether an item, software, or technology requires a US export licence and, if so, for which destinations and end-uses. BIS administers the Commerce Control List under the EAR, which is enacted under the Export Control Reform Act and underpinned by the International Emergency Economic Powers Act ("IEEPA"). OFAC is a distinct agency within the US Treasury Department; it administers economic-sanctions programmes, not the Commerce Control List. The two agencies operate under separate statutory mandates.
The relationship matters because a single cross-border transaction can trigger both sets of obligations simultaneously. An item classified under the EAR may be subject to BIS export-licence requirements. The same transaction may also involve a counterparty, route, or end-user that implicates an OFAC sanctions programme. The stricter prohibition governs: a BIS licence does not override OFAC restrictions, and an OFAC specific licence does not relax a BIS requirement. In our experience, businesses that treat ECCN classification as a purely BIS-facing exercise underestimate the interplay.
Classification under the EAR follows a sequence. The exporter starts with the item's technical parameters, compares them against the Commerce Control List categories – which range from electronics and telecommunications to aerospace, sensors, and nuclear – and identifies the ECCN. Where no ECCN applies, the item may be designated "EAR99", meaning it is subject to the EAR but does not require a licence for most destinations absent end-user or end-use concerns. The classification drives the licence determination, the applicable exceptions, and the due-diligence obligations on the exporter. Misclassification at the start of the sequence cascades through every subsequent step.
How does OFSI and the ECJU classify the same item under UK rules?
Under the UK regime, OFSI handles financial-sanctions enforcement – the freezing of funds, the licensing of otherwise prohibited payments – while ECJU handles export licensing. ECJU uses a classification system based on the UK Strategic Export Control Lists, which are aligned to the Wassenaar Arrangement, the Nuclear Suppliers Group, the Australia Group, and the Missile Technology Control Regime. The UK lists use a distinct alphanumeric coding structure; they are not interchangeable with ECCN codes, though many entries track the same multilateral control-list items.
This is the first divergence that catches cross-border businesses off guard. A US exporter classifying an item as ECCN 3E001, for instance, is working from US-specific descriptions and parameters. A UK exporter classifying the same item works from the UK Strategic Export Control Lists and produces a different reference code. The item may be controlled under both, but the classification documents, the licence application processes, and the competent authorities are entirely separate. There is no automatic mapping between an ECCN and a UK export-licence code.
OFSI's role in the cross-border picture differs further. OFSI licensing addresses financial sanctions – specific situations where a payment or financial service would otherwise breach UK financial-sanctions regulations. An ECJU export licence permits the physical movement of the goods. A business may need both a financial-sanctions licence from OFSI and an export licence from ECJU for the same transaction, depending on whether the counterparty is subject to financial sanctions as well as whether the goods are controlled. Treating the two as alternatives is an error that routinely surfaces in enforcement reviews.
Where do the regimes diverge on ECCN classification?
The regimes diverge on four principal axes: the legal basis for control, the classification methodology, the licensing authority, and the enforcement consequence of misclassification.
On legal basis, the EAR draws its authority from the Export Control Reform Act and IEEPA; the UK Export Control Order draws on distinct primary legislation. The EU dual-use rules, relevant to businesses with EU operations, derive from an EU Council Regulation on dual-use items and were retained in amended form in UK domestic law after the UK left the EU. These are different statutory instruments with different scope provisions and different carve-outs.
On methodology, the EAR's Commerce Control List is arranged in ten categories with subcategories for equipment, test and inspection, materials, software, and technology. The UK Strategic Export Control Lists follow a similar multilateral-derived structure but apply UK-specific descriptions, national discretion items, and end-use controls that do not always mirror the US approach. The "deemed export" rule – which treats the release of controlled technology to a foreign national in the US as an export to that person's home country – applies under the EAR. The UK has an analogous concept, but the parameters and scope differ; cross-border technology-transfer programmes need both assessments independently.
On licensing authority, BIS handles EAR licences; ECJU handles UK export licences; OFAC handles US sanctions licences; OFSI handles UK financial-sanctions licences. A transaction that is permitted under a BIS licence may still require an OFAC specific licence if the counterparty is an OFAC-designated person. Similarly, an ECJU export licence does not discharge OFSI obligations. These are parallel tracks, not a single authorisation pathway.
On enforcement, BIS can impose administrative penalties and refer cases to DOJ for criminal prosecution. OFAC similarly has civil and criminal enforcement tools. OFSI's enforcement posture has intensified since OFSI was granted the power to impose monetary penalties on a strict-liability basis under SAMLA. The practical consequence is that a misclassification in a cross-border transaction can produce enforcement exposure in two jurisdictions simultaneously, under two separate agencies, potentially with different timelines for voluntary disclosure and penalty mitigation.
Which regime is stricter on ECCN classification?
Strictness is the wrong frame. The two regimes are designed for different primary purposes, and where they overlap, the stricter prohibition always governs. The correct question for a cross-border business is not which regime is easier to satisfy but whether both have been satisfied independently.
That said, the EAR's extraterritorial reach is notably broad. The de minimis rule and the foreign direct product rule ("FDPR") can bring non-US items into the EAR's scope if they contain US-origin controlled content above a certain threshold or if they are the direct product of US-controlled technology. This means a UK manufacturer using US-origin components or technology may be subject to BIS controls on its own exports even where ECJU has not required a UK licence. As of early 2026, BIS has used the FDPR expansively, extending it to a range of items linked to specific end-users and destinations.
ECJU, by contrast, operates a more jurisdictionally bounded regime. UK export controls apply to goods and technology exported from UK territory or by UK persons. There is no direct UK equivalent of the FDPR's extraterritorial reach, though UK sanctions can operate extraterritorially where OFSI designations track OFAC SDN designations – which they frequently do in practice. In our cross-border practice, the most common structural problem we see is a UK business that has correctly applied ECJU controls but has not assessed whether its products contain US-origin technology that independently triggers EAR obligations.
Does that mean the EAR is always the harder hurdle? Not necessarily. ECJU administers open general export licences, which permit a defined range of exports to permitted destinations without individual applications. The US has export licence exceptions under the EAR that serve a similar purpose. Both systems have tiers of authorisation, from open general instruments down to individual case-by-case licences. The compliance burden depends on the item, the destination, the end-user, and the applicable controls under each regime.
The extraterritorial dimension: US secondary sanctions and ECCN in the same transaction
Secondary-sanctions risk is the dimension of this analysis that most often surprises businesses operating outside the United States. OFAC's secondary-sanctions programmes – operating under IEEPA and other statutory authorities – can expose non-US entities to US-market consequences if they facilitate transactions with OFAC-designated persons or entities in certain sanctioned programmes, even if no US person, US-origin goods, or US jurisdiction is involved in the primary transaction.
This creates a layered problem. A non-US business exporting an item that is not itself subject to the EAR may still face OFAC secondary-sanctions risk if the end-user or recipient is connected to a sanctioned programme. Separately, if the item contains US-origin content above the de minimis threshold or was produced with controlled US technology, the EAR may independently require a BIS licence. The OFAC sanctions analysis and the BIS classification analysis are not the same exercise, but the commercial decision-maker needs the answer to both before the transaction proceeds.
The UK does not operate a secondary-sanctions regime in the same way. OFSI applies financial sanctions to persons and entities within the scope of UK sanctions regulations. ECJU export controls apply to controlled goods exported from UK territory. Neither OFSI nor ECJU reaches into non-UK transactions on a secondary basis in the manner that OFAC does. This divergence is practically significant for UK-headquartered groups with US subsidiaries or US-dollar clearing relationships: the US entity's OFAC obligations will frequently be more demanding, and a group compliance policy that treats OFSI as the ceiling will leave the US entity exposed.
The position above covers the standard case. Your facts – the item's technical specifications, the origin of its components, the counterparty's ownership chain, the route and end-destination, and the sanctions programmes in play – will all change the analysis materially.
To discuss the ECCN classification and sanctions exposure for a specific transaction, contact Calder & Vance at info@caldervance.com.
Risk flags: five patterns that expose the classification gap
In our experience advising exporters and multinationals on cross-border classification, the same five patterns generate the highest concentration of compliance risk.
First, assuming that an ECJU export licence covers all controls on the same transaction. A UK export licence from ECJU addresses UK export-control law. It does not relieve BIS obligations arising from US-origin content, and it does not address OFAC sanctions or OFSI financial-sanctions requirements. Each authorisation track must be run independently.
Second, applying ECCN codes to items without a formal commodity jurisdiction procedure where there is a genuine question about EAR versus ITAR coverage. Where a technology item sits at the boundary of Commerce and State Department jurisdiction, an informal classification is not sufficient. An incorrect assumption that an item is EAR-subject rather than subject to the International Traffic in Arms Regulations can be a serious compliance failure.
Third, failing to re-classify after a product update. An item that was EAR99 at the time of initial sale may have been upgraded – faster processors, improved encryption, refined optics – to a point where it now falls under a specific ECCN. Similarly, a UK-controlled item's parameters can shift relative to the Strategic Export Control List thresholds. Classification must be maintained as a live process, not a one-time determination.
Fourth, ignoring the deemed-export dimension for technology transfers. When controlled technology is shared electronically with a foreign national – an engineer at a US subsidiary, a subcontractor in another country, a collaborative research partner – that transfer can constitute an export requiring a licence, even if no physical goods move. This is an area where BIS and ECJU approaches diverge in scope and where the consequences of inadvertent transfer can be significant.
Fifth, treating OFAC and BIS as interchangeable in due-diligence workflows. The SDN List (OFAC's list of Specially Designated Nationals and blocked persons) is not the same as the BIS Entity List. An entity may appear on one and not the other. An OFAC compliance analysis that does not also check BIS lists – and vice versa – is incomplete for a cross-border exporter.
What should a cross-border business do about ECCN classification?
The answer is a structured, documented classification programme that runs the BIS and ECJU analyses in parallel and integrates the OFAC and OFSI sanctions screening at the transaction level. The steps are sequential but must be managed as a continuous cycle, not a pre-shipment checkbox.
The first step is product-by-product classification under the EAR. This means comparing each item's technical parameters against the Commerce Control List, recording the ECCN or EAR99 determination, and documenting the analysis. Where the item contains software or technology as well as hardware, each element may carry a separate classification. The same item may be classified differently by BIS and ECJU – that is expected and correct; they are different lists under different systems.
The second step is to run the same exercise under the UK Strategic Export Control Lists if the business has UK-based export activity. The results are recorded separately. Where both a US entity and a UK entity are involved in the same shipment, each entity is responsible for its own classification analysis under its own applicable rules.
The third step is to assess whether the EAR's extraterritorial provisions – the de minimis rule and the FDPR – apply to any items that are being exported from non-US territory but contain US-origin controlled content or are produced from controlled US technology. This assessment must be done before the shipment, not after a query from BIS.
The fourth step is counterparty screening: the full ownership chain against OFAC lists (SDN List, consolidated list) and BIS lists (Entity List, Denied Persons List, Unverified List), and against OFSI and ECJU-relevant lists. Screening results are documented, and any hits or near-hits are escalated for legal review before the transaction proceeds.
The fifth step is to identify which licences or authorisations are required, apply for them in sufficient time, and record the determination. Where no licence is required, the applicable exception or open general instrument should be recorded by reference.
If a transaction has already been flagged – by a freight forwarder, a bank's trade-finance desk, or an internal audit – an early review with experienced export-control counsel can preserve the option of a voluntary self-disclosure ("VSD" – a proactive notification to the relevant regulator of a potential violation, which is treated as a significant mitigating factor in penalty determinations) and protect against the escalation of a screening alert into a formal enforcement matter.
If a compliance review has identified a potential violation, prompt action on both the BIS and OFAC sides – with parallel awareness of OFSI and ECJU implications for UK-group members – is essential. Delaying while the facts are unclear is the pattern that most often converts a manageable disclosure into a contested enforcement case.
To discuss a review of your classification programme or an export-control matter, write to Calder & Vance at info@caldervance.com.
Common misunderstanding: "Our items are EAR99, so we have no export-control obligations"
This is the most widespread myth we encounter in cross-border compliance reviews. EAR99 is not a clean bill of health. It means the item does not fall under a specific ECCN and does not require a licence for most exports absent a prohibited end-user, a prohibited end-use, or a destination-based concern. But it does not mean the item is free of all export-control obligations under the EAR, and it says nothing about UK, EU, or other national obligations.
An EAR99 item can still be prohibited for export if the end-user appears on BIS lists, if the end-use is a prohibited programme, or if the transaction implicates a sanctions programme administered by OFAC. The item-based classification and the party-based and end-use-based checks are separate enquiries. Running only the first and skipping the second is a structural compliance failure.
More subtly, an item that is genuinely EAR99 for US purposes may nonetheless be controlled under the UK Strategic Export Control Lists or the EU dual-use rules if it meets the technical parameters for a listed entry on those lists. EAR99 status under US law is a US determination only; it has no effect on UK or EU classification obligations. Multinationals that export through multiple jurisdictions must run independent classification analyses in each one.
We regularly advise businesses that have relied on an EAR99 determination from a US subsidiary as the final word on their export-control position across the group. That reliance is incorrect, and it leaves UK and EU entities without the documented classification basis they need to defend themselves in an enforcement review.
Related practices
- Deemed export and technology controls under BIS/EAR – advice on technology-transfer controls, deemed exports, and the licence exceptions available under the EAR.
- ECCN classification: OFSI vs Australia compared – comparative analysis of classification methodology and licensing routes across the UK and Australian regimes.
- Encryption export controls: BIS/EAR vs EU – analysis of the divergent controls on encryption items under the US and EU dual-use rules.