A US technology company finalises a distribution agreement with a trading partner in a third market. The compliance team screens the end-user. No SDN hit appears. The export proceeds. Eighteen months later, a government enquiry reveals that the goods reached a prohibited end-use – a weapons-development programme the exporter never knew about. Was there a violation? Which authority is asking the question: OFAC or BIS? And does the answer differ depending on which desk picks up the file?
End-use and end-user controls under OFAC and BIS operate from different legal foundations, enforce through different mechanisms, and apply distinct standards of culpability. OFAC targets the identity of the counterparty – whether a person or entity is listed or subject to a programme – while BIS targets the activity: what the item is, what it will be used for, and by whom. A transaction can clear OFAC screening and still fail the BIS end-use test. As of April 2026, both regimes are active and their interaction is a live compliance question for any cross-border exporter of goods, technology, or software with US-origin content.
This analysis maps the two regimes criterion by criterion, identifies the points where they diverge and where they overlap, and sets out the practical steps a cross-border business should take before it approves a shipment or a technology transfer.
What is the legal foundation of each regime?
OFAC administers economic-sanctions programmes under the authority of statutes including the International Emergency Economic Powers Act (IEEPA) and the Trading with the Enemy Act (TWEA). Its prohibitions are entity- and programme-based: a transaction is prohibited when it involves a listed person, a blocked entity, or a jurisdiction subject to a comprehensive or targeted programme. The end-user matters to OFAC primarily as the person in the transaction – is that person on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons), subject to an ownership test, or otherwise caught by a programme?
BIS administers the Export Administration Regulations (EAR) under the authority of the Export Control Reform Act. The EAR are activity-based: they regulate the export, re-export, and in-country transfer of items on the Commerce Control List (CCL), and they impose a separate layer of end-use and end-user restrictions that apply regardless of whether the item itself is controlled. The EAR's end-user provisions – including the Entity List and the broad end-use rules – operate independently of OFAC's lists. An item can be EAR99 (meaning it has no CCL classification and no specific licence requirement) and still be blocked from export to a particular end-user or end-use under the EAR's catch-all controls.
In our cross-border practice, we regularly advise clients who treat "passed OFAC screening" as the end of the export compliance analysis. It is not. The two regimes share enforcement geography but they ask entirely different questions.
How does the OFAC end-user test work?
OFAC's core question is whether the counterparty – the buyer, the freight intermediary, the end-user, or any party in the transaction chain – is a blocked person, a listed entity, or a person caught by the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked, whether or not they appear on any list by name).
The end-user analysis under OFAC therefore begins with identity. Screening against the SDN List, the Sectoral Sanctions Identifications List, and the relevant programme lists is the first step. It is not sufficient. Ownership must be traced: a clean name on the face of a contract does not resolve the question if a blocked person holds a sufficient ownership stake in the counterparty. The aggregation point is critical – two blocked persons each holding below the 50 percent threshold can together breach it.
OFAC also applies a knowledge standard. Its strict-liability position on sanctions violations means that the absence of knowledge does not automatically eliminate liability, though it is relevant to penalty mitigation. Red flags – unusual payment routes, requests to omit end-user details, mismatches between the stated use and the goods – are treated as constructive notice. Proceeding in the face of a red flag is an aggravating factor in an enforcement review.
What the OFAC framework does not do, by design, is assess the use to which the goods will be put. OFAC does not impose a general-purpose end-use prohibition equivalent to the BIS catch-all. If the end-user is clean under the applicable programme and the ownership test, OFAC's analysis is largely complete. The question of whether those goods will be diverted to a prohibited military or proliferation end-use is, in the first instance, a BIS question.
How does the BIS end-use and end-user test differ?
BIS addresses end-use and end-user risk through two principal mechanisms: the Entity List (a list of persons subject to licence requirements imposed by BIS because of their involvement in activities that raise proliferation or national-security concerns) and the EAR's catch-all end-use rules, which can impose a licence requirement even for EAR99 items.
The catch-all rules work prospectively and retrospectively. They impose a licence requirement when an exporter knows or has reason to know that an item – irrespective of its classification – will be used in certain prohibited end-uses, including the development of weapons of mass destruction, certain military applications, or activities supporting listed parties. "Reason to know" is a lower threshold than actual knowledge: it encompasses circumstances where the exporter received information sufficient to put a reasonable person on notice and failed to act on it.
The Entity List imposes mandatory licence requirements on exports, re-exports, and transfers to named persons. Unlike the SDN List, an Entity List designation does not necessarily prohibit all transactions: BIS specifies, for each entry, the applicable licence requirement and the licensing policy (which may range from presumption of denial to case-by-case review). This is a structural difference. An SDN designation under OFAC generally means a hard prohibition. An Entity List entry under BIS means a licence is required, and the availability of that licence depends on the stated policy for that entry.
BIS also maintains the Denied Persons List – a list of persons against whom BIS has issued a denial order, making them ineligible to participate in any transaction subject to the EAR. Transactions with denied persons are prohibited outright, which brings the BIS outcome closer to the OFAC model for those specific entries.
In our experience, the gap between "not on the SDN List" and "cleared under the EAR" is where evasion schemes often operate, and it is also where well-intentioned exporters are most exposed. A thorough end-user analysis screens all three: the SDN List, the Entity List, and the Denied Persons List – and it then applies the catch-all test to the facts of the proposed transaction.
Where do the two regimes diverge most sharply?
The sharpest divergence is in the nature of the prohibition. OFAC prohibitions are status-based: the identity of a person triggers the restriction, and that restriction generally admits no transaction unless a specific or general licence applies. BIS prohibitions are, in many cases, activity- and knowledge-based: the restriction turns on what the exporter knows or should know about the end-use, which means the analysis is inherently fact-specific and can change as new information emerges about a transaction.
A second divergence is in the licensing mechanism. OFAC's specific licence (a case-by-case authorisation to conduct an otherwise prohibited transaction) and general licence (a standing authorisation that permits a defined category of transactions without a separate application) are the tools for managing OFAC prohibitions. BIS uses a comparable structure – individual validated licences and licence exceptions – but the threshold criteria, the processing timelines, and the available exceptions are governed entirely separately. A general licence that authorises a transaction under OFAC does not resolve the EAR licence requirement, and vice versa.
The third divergence is extraterritorial reach. OFAC's programmes, particularly secondary-sanctions provisions, can reach non-US persons transacting outside the United States in certain circumstances. BIS's reach is anchored to the concept of US-origin content: the EAR applies to items subject to the EAR wherever they are located, including through the de minimis rule (which can capture foreign-made items containing a defined threshold of controlled US content) and the foreign direct product rule (which can capture foreign-produced items that are the direct product of certain US technology or software). Both mechanisms extend BIS jurisdiction beyond the US border, but through a different analytical route than OFAC's secondary-sanctions provisions.
The practical consequence: a non-US business exporting a foreign-made product to a non-US end-user may simultaneously face an OFAC secondary-sanctions risk and a BIS foreign-direct-product-rule requirement. The two analyses must be run in parallel, not sequenced. Does your compliance programme treat them as separate workstreams?
What do UK and EU end-user controls add to the analysis?
Cross-border businesses rarely operate under a single jurisdiction's rules. The UK and EU regimes impose their own end-use and end-user control obligations, and in important respects they diverge from both OFAC and BIS.
In the United Kingdom, the Export Control Joint Unit (ECJU) administers export licensing under the Export Control Order and relevant thematic regulations. The end-user undertaking – a formal commitment from the consignee and, where relevant, the end-user, confirming the stated end-use and committing not to re-export without approval – is a standard feature of UK open and individual export licences. The UK end-user controls operate alongside the Office of Financial Sanctions Implementation's (OFSI) financial-sanctions prohibitions, which are regime-based in a manner closer to OFAC than to BIS: the question under OFSI is primarily whether the counterparty is a designated person or an entity subject to ownership-and-control analysis.
The EU dual-use rules, implemented through the applicable Council Regulation, impose a knowledge-based catch-all obligation that is structurally closer to the BIS catch-all than to the OFAC model. An EU exporter that knows or is informed by its competent authority that items – including uncontrolled items – are intended for certain prohibited end-uses must apply for an export authorisation even if the items are not listed. The EU regime also requires a formal end-user statement for many controlled exports, and competent authorities have discretion to impose ad hoc licence requirements on specific transactions.
The comparison matters for a business operating under multiple regimes simultaneously. Where OFAC, BIS, OFSI, and the EU all apply, the strictest prohibition governs each element of the transaction. A permissive OFAC general licence does not override a BIS licence requirement, and neither overrides an EU competent authority's decision to impose a prior authorisation requirement on a specific shipment.
We regularly advise multinationals that assume their US export compliance programme satisfies their UK and EU obligations. It does not. The underlying tests – entity-based, activity-based, knowledge-based, list-based – differ enough that each regime requires its own assessment. For UK-specific end-user controls and OFSI licensing obligations, see our analysis at End-use and end-user controls: OFAC vs OFSI compared. For the Canadian position, which presents a distinct set of divergences, see End-use and end-user controls: OFAC vs Canada compared.
What are the principal risk flags in practice?
End-use and end-user risk in cross-border transactions tends to cluster around a recognisable set of patterns. Identifying them early – before a shipment is approved – is materially better than identifying them in an enforcement review.
The first pattern is the trading-company intermediary. A buyer that is itself a trading company, a freight forwarder, or a sales intermediary, rather than the ultimate end-user, creates a gap between the screened party and the party actually receiving the goods. Both OFAC and BIS require the exporter to look through to the end-user where it knows or has reason to know that the stated buyer is not the final destination. BIS imposes specific know-your-customer requirements in its published guidance; OFAC's red-flag framework treats the same gap as a warning sign.
The second pattern is geographic mismatch. A buyer in a jurisdiction with no plausible commercial need for the goods in question, or a routing through a transshipment hub associated with diversion risk, is a red flag under both regimes. The EAR specifically identifies certain transshipment and diversion-concern destinations; OFAC's programme structure assigns elevated risk to transactions involving certain geographic corridors even where the direct counterparty is not listed.
The third pattern is payment and documentation irregularity. Requests to alter end-user certificates, to omit or alter the stated end-use, or to pay through third-party accounts without clear commercial rationale are red flags that, under both regimes, a compliance officer is expected to act upon. Proceeding without resolution of the red flag is treated as an aggravating factor in an OFAC penalty review and as evidence of constructive knowledge in a BIS enforcement matter.
A fourth, less obvious pattern is post-export diversion. Both OFAC and BIS can open an enforcement matter based on post-export use. The exporter's obligations do not end at the point of shipment if it subsequently receives information indicating that goods have been diverted or mis-used. Acting promptly on that information – including through a VSD (voluntary self-disclosure to a regulator) where appropriate – is consistently treated as a significant mitigating factor by both OFAC and BIS.
In a recent matter, a manufacturing company in the industrial sector received post-shipment information suggesting that components had been redirected to an end-user it had not screened. We advised on scoping the potential violation, assessed both the OFAC and BIS exposure, and structured a voluntary disclosure to the relevant authority. The matter was resolved at the administrative level. Early action preserved options that would not have been available had the disclosure been delayed.
What is the myth about US export compliance and OFAC?
The most persistent misconception we encounter is that a clean OFAC screen is the same as export compliance. It is not, and the cost of that conflation can be severe. OFAC administers economic sanctions; BIS administers export controls. They use different lists, different standards, and different enforcement mechanisms. A transaction can be entirely clean under OFAC – no listed parties, no blocked property, no programme prohibition – and simultaneously require a BIS licence, breach the catch-all rules, or involve an Entity List party that BIS has identified as a concern.
The reverse is also true. A transaction that requires and obtains a BIS licence is not thereby authorised under OFAC. An OFAC programme prohibition is not displaced by a BIS approval. The two regimes run in parallel. A compliance programme that treats them as alternatives rather than concurrent requirements has a structural gap. For businesses that transfer technology as well as goods – particularly through deemed exports, where technology is released to a foreign national in the United States – the gap between the two regimes is especially acute. Our service for deemed-export and technology-transfer compliance under the EAR addresses this directly.
A related misconception is that end-use certificates alone satisfy the end-user obligation under either regime. They do not. An end-user certificate is a useful documentary control; it is not a due-diligence analysis. Both OFAC and BIS expect the exporter to assess the plausibility of the stated end-use in light of all available information, not merely to collect a signed form.
When should a cross-border business involve counsel?
Three situations call for early legal involvement rather than in-house resolution.
The first is a transaction involving a counterparty with any connection to a jurisdiction or sector subject to elevated scrutiny under either OFAC or BIS. "Plausible but complicated" is the scenario where experienced export-control counsel earns its value: the analysis turns on specific facts, specific regime provisions, and specific licensing options, all of which require a structured assessment rather than a checklist.
The second is a post-export concern – a diversion indicator, an unexpected end-user, a request from the end-user to re-export to a third party. At that point the question is no longer transactional; it is an enforcement-risk question. The window for a voluntary self-disclosure is defined and not unlimited. Acting quickly, with the benefit of counsel who has handled disclosures before both OFAC and BIS, is materially better than acting slowly or not at all.
The third is a compliance-programme audit or redesign. Businesses that have grown through acquisition, entered new markets, or added new product lines frequently find that their screening and end-user controls were designed for a narrower risk profile. A gap analysis conducted proactively – before a regulatory enquiry – puts the business in a substantially stronger position.
The position above covers the standard analytical framework. Your specific facts – the goods, the technology, the end-user, the route, and the regimes in play – change the analysis materially. For an assessment of your exposure under OFAC, BIS, or both, contact Calder & Vance at info@caldervance.com.
Related practices
- Deemed export and technology transfer – BIS / EAR compliance for technology releases to foreign nationals
- End-use and end-user controls: OFAC vs OFSI – how the UK regime diverges from the US approach