A Canadian exporter with a US-incorporated subsidiary ships technology to a distributor in a third market. The US parent screens the buyer against the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) and finds nothing. The Canadian parent checks Global Affairs Canada's lists and also finds nothing. Six months later, the distributor re-exports the item to an end-user that both OFAC and Canada's export-control regime had reasons to be concerned about. Who bears liability? Under which regime? And what should have been done before the first shipment left the dock?
End-use and end-user controls under OFAC and Canada's export-control regime share a common purpose – preventing controlled technology from reaching prohibited parties or applications – but they apply different legal tests, use different list architectures, and impose different post-shipment obligations. As of April 2026, the two regimes are converging in enforcement posture but diverging in their procedural requirements, and most cross-border businesses are calibrated to only one of them.
This analysis sets out where OFAC and Canada diverge on end-use and end-user controls, which pressure points businesses most commonly miss, and what a practical compliance programme must address to satisfy both regimes simultaneously.
What governs end-use and end-user controls under each regime?
Under OFAC, end-use and end-user controls are embedded primarily in the licensing and diligence obligations that flow from the economic-sanctions programmes administered under IEEPA and TWEA. OFAC does not administer a standalone export-control statute in the way BIS does under the EAR; instead, OFAC's sanctions programmes prohibit transactions with designated persons and countries, and the end-user question is whether any party in the chain – buyer, freight forwarder, consignee, ultimate end-user – is blocked or located in a comprehensively sanctioned jurisdiction. The governing authority is OFAC itself, acting through its enforcement and licensing functions. Where a licence is granted, it will routinely carry end-use and end-user conditions that survive the initial transaction.
Canada's position is different in structure. The Export and Import Permits Act ("EIPA") and the autonomous-sanctions regulations made under the Special Economic Measures Act ("SEMA") together govern what Canada controls and to whom exports may be made. Global Affairs Canada ("GAC") administers both. The EIPA establishes a permit system tied to an Export Control List and an Area Control List; SEMA adds sanctions-driven prohibitions that can capture parties and jurisdictions independently of the permit system. Critically, Canada's regime imposes explicit end-use certification requirements for many controlled items: an exporter must document not merely who the buyer is, but what the buyer will do with the goods.
The structural divergence matters immediately. A business that screens only against OFAC's list architecture – the SDN List, the Non-SDN Menu-Based Sanctions List, and the Consolidated Sanctions List – without mapping GAC's Consolidated Canadian Autonomous Sanctions List may clear a counterparty under one regime while missing a designation under the other. In our experience, this gap is most common in mid-size manufacturers who built their compliance programme around a US parent's OFAC procedures and assumed the Canadian subsidiary's obligations were covered.
How do the end-user tests differ in practice?
OFAC's end-user analysis is anchored in the 50 percent rule (OFAC's rule treating entities owned 50 percent or more, in the aggregate, by one or more blocked persons as themselves blocked) and in the broader "owned or controlled" concept that applies across most OFAC programmes. The mechanical threshold is 50 percent or more of ownership, direct or indirect, in the aggregate. Control is a secondary lens: it can extend the prohibition even where formal ownership sits below the threshold, particularly where a blocked person exercises board-level or managerial control over a non-listed entity.
Canada applies an analogous ownership-and-control test under SEMA, but the articulation differs. GAC guidance requires exporters to assess whether a proposed end-user is "owned or controlled" by a designated person, and the assessment is expected to look through layered structures. What Canadian practice adds – and OFAC does not replicate in the same form – is a requirement, for many permit categories, that the foreign buyer produce an end-use certificate ("EUC"), a formal undertaking that the goods will be used only for stated purposes and will not be re-exported without GAC authorisation. OFAC licence conditions can impose analogous requirements, but they arise on a case-by-case basis from licence terms, not from a systematic permit-regime requirement.
Why does this distinction matter for a cross-border business? Consider a technology sale from a Canadian entity, with US-origin components, to a distributor in a third country. The OFAC analysis asks: is this distributor, or its ultimate beneficial owner, on a US list? The GAC analysis asks that question too – but also asks: what will this distributor do with the goods, can it prove it, and will it contractually commit not to re-export without permission? Satisfying OFAC does not automatically satisfy Canada, and vice versa. Both sets of conditions must be met before the first shipment is authorised.
Where do the regimes diverge on end-use and end-user controls?
The most operationally significant divergence is the treatment of re-export. Under OFAC, the re-export question is primarily a sanctions question: if a consignee re-exports to a sanctioned country or person, the original exporter may face exposure on a "facilitation" theory – that is, knowingly enabling a third party to conduct a transaction that would itself be prohibited. The standard is knowledge-based, and OFAC's enforcement guidance is explicit that wilful blindness does not protect an exporter who has red flags and ignores them.
Canada's approach is more procedural. Under the EIPA permit conditions, a Canadian exporter who has obtained a permit for an export to a specified end-user is typically prohibited from allowing re-export without seeking a fresh permit or demonstrating that the re-export falls within an exception. The obligation runs to the original exporter: it is not sufficient to argue that the re-export was the distributor's decision. GAC has made clear in its published guidance that permit holders bear ongoing responsibility for the downstream use of controlled exports.
A second significant divergence is the treatment of deemed exports. Under the US regime, BIS administers deemed export controls (the release of controlled technology to a foreign national within the United States, which is treated as an export to that national's home country). OFAC's sanctions programmes do not use the deemed-export concept in the same structural way, though the transfer of technology to a sanctioned-country national can engage OFAC prohibitions on services. Canada does not operate a formal deemed-export control regime of the same depth as the US EAR, though GAC is developing its position and practitioners should verify the current state before relying on any gap. For detailed analysis of the US deemed-export rules, see our service note on deemed export and technology controls under the BIS/EAR.
Third, the two regimes diverge on record-keeping timelines. OFAC's programmes generally require records to be kept for a period consistent with the relevant statutory framework; practitioners advise maintaining records for a period of not less than five years from the date of the transaction. GAC's record-keeping obligation for permit holders is similarly substantial. Both require records to be sufficient to demonstrate compliance at the point of the original export, the identity of the end-user, the stated end-use, and any subsequent re-export. A compliance programme that conflates these obligations – or keeps records only to the shorter of the two periods – risks a gap.
Which regime is stricter on end-use and end-user controls?
Neither regime is unambiguously stricter across every dimension; they are strict in different directions, and the answer turns on the specific transaction. OFAC is wider in geographic reach: its sanctions programmes carry extraterritorial effect under the secondary-sanctions architecture, meaning a non-US business that facilitates a prohibited transaction can face OFAC enforcement even if no US person or US-origin goods are directly involved. Canada's autonomous-sanctions regime under SEMA does not currently operate the same secondary-sanctions architecture, though the Canadian regime can still reach extraterritorial conduct through its designated-person prohibitions.
Canada is procedurally more demanding for controlled-goods exports. The permit system, the EUC requirement, and the re-export approval process impose affirmative documentary burdens that OFAC's transaction-based prohibitions do not replicate outside of licence conditions. A business that exports only occasionally to third markets may find the Canadian permit system the more operationally intensive of the two, whereas a financial institution processing dollar-denominated payments will feel OFAC's reach far more directly.
The practical answer for a cross-border business is that the stricter prohibition governs each dimension of a specific transaction. Where OFAC prohibits a transaction that Canada would permit, OFAC governs. Where Canada requires a permit that the OFAC analysis does not demand, the Canadian requirement still applies. This "stricter governs" principle is a cardinal rule of multi-regime export-control compliance, and it applies with equal force to end-use and end-user controls.
We regularly advise businesses that approach this question hoping for a single answer. There is not one. The analysis must be run against both regimes in parallel, not sequentially, and the result of each must be satisfied independently.
Red flags and risk factors that practitioners see most often
End-use and end-user controls generate a distinctive pattern of compliance failures. In our cross-border practice, the following risk factors appear with the greatest frequency.
First: single-layer ownership screening. Screening tools that check only the direct buyer against list databases will miss the 50 percent rule in any case where the blocked person's holding is layered through an intermediate entity. This is as true under Canada's SEMA designations as it is under OFAC's SDN List. The ownership chain must be mapped to the ultimate beneficial owner before a transaction clears.
Second: absent or deficient end-use certificates. Businesses operating under Canadian export permits frequently obtain EUCs from distributors without verifying that the stated end-use is credible or that the distributor has the capacity to enforce it downstream. A signed EUC from a distributor who has no compliance programme of its own does not discharge the Canadian exporter's obligation.
Third: failure to treat re-export as a new event. A distributor's re-export of Canadian-permitted goods, or of goods covered by an OFAC licence condition, is a distinct transaction requiring a fresh analysis. Exporters who treat re-export as the buyer's problem, rather than a continuing obligation of their own, are routinely the subject of enforcement inquiries under both regimes.
Fourth: US-origin technology embedded in Canadian exports. Where a Canadian product incorporates US-origin components or software above the applicable de minimis threshold, the EAR may require a BIS licence for the export even if the Canadian export-control analysis is satisfied. The OFAC analysis adds a further layer. Many Canadian exporters do not maintain an accurate record of US-origin content in their bills of materials, with the result that exports they believe are controlled only by GAC are in fact subject to three separate regulatory authorities: GAC, BIS, and – if a sanctioned party or jurisdiction is involved – OFAC.
Fifth: overlooking the interplay with financial institutions. A correspondent bank processing the payment for a cross-border export will run its own OFAC and GAC screening against the transaction. If the bank's analysis produces a different result from the exporter's – because the bank has a broader ownership tracing model, or because the list has been updated between the exporter's screening date and the payment date – the payment may be blocked. At that point, the exporter's compliance record becomes immediately relevant. Contemporaneous documentation of the original analysis is the first thing an enforcement reviewer will request.
Common objections – and why they do not hold
The most persistent objection we hear from businesses in this space is: "We are a Canadian company exporting Canadian goods, so OFAC does not apply to us." This is the most dangerous myth in cross-border export-control compliance. It is wrong for at least three reasons.
OFAC's secondary-sanctions architecture can reach non-US businesses that facilitate transactions with certain designated persons or jurisdictions, even where no US person or US-origin goods are directly involved. The secondary-sanctions exposure is programme-specific and must be verified for each counterparty and transaction – but the starting position is not that Canadian businesses are outside OFAC's reach.
Where a Canadian export contains US-origin technology above the relevant de minimis threshold, BIS's EAR applies to the re-export of that technology regardless of where it is re-exported from. OFAC's programmes apply to any transaction that involves a US-origin item and a sanctioned party. The Canadian entity is the exporter, but the US regulatory framework travels with the US-origin content.
Finally, Canadian financial institutions processing payments, and US correspondent banks clearing dollar transactions, will apply OFAC screening to the payment chain regardless of whether the exporter believes OFAC governs the underlying transaction. A finding at the payment stage does not respect the exporter's legal analysis. The practical consequence is enforcement risk even if the exporter's legal position were ultimately defensible.
A second objection – "we cleared the buyer in our screening tool, so we are compliant" – also requires correction. Screening-tool clearance confirms that the named entity does not appear on a list at the time of the search. It does not confirm: that the ownership chain has been traced to ultimate beneficial owners; that the stated end-use has been verified; that a re-export restriction is in place; that the screening was repeated at the time of shipment; or that the list has not been updated in the interval. Screening is a necessary condition for compliance, not a sufficient one.
What a compliant end-use and end-user programme must include
A cross-border business operating under both OFAC and Canadian export-control obligations should build its end-use and end-user programme around a defined sequence of steps, applied at each transaction stage.
Before contract signature, the business should: screen the buyer and all known ownership-chain entities against both OFAC lists and the GAC Consolidated Canadian Autonomous Sanctions List; determine whether the goods are controlled under the EAR, the Canadian Export Control List, or both; and identify whether an OFAC licence, a BIS licence, or a GAC permit is required. Where the goods contain US-origin components, the US-origin content analysis should be completed at this stage, not after the contract is signed.
At the contract stage, the business should: incorporate end-use restrictions and re-export prohibitions in the sale agreement; obtain an EUC where required by GAC permit conditions; and verify that the payment mechanism does not route through a financial institution or jurisdiction that would generate additional screening concerns.
At the point of shipment, the business should: re-run screening against both list sets, because list updates between contract date and shipment date are common and consequential; confirm that any applicable permit or licence remains in force; and record the screening results, the permit or licence reference, the EUC, and the shipping documentation in a durable format.
After shipment, the business should: maintain all records for the longer of the two regimes' required periods (and in practice, for no less than five years from the transaction date); monitor for re-export indicators, such as intelligence from freight forwarders or public sources that the consignee is transshipping goods; and review the programme against any regulatory changes that affect the listed items or the counterparty jurisdictions involved.
For businesses with recurring exports to the same distributor network, a periodic audit of the distributor's own compliance controls – screening capability, re-export procedures, EUC management – is a proportionate additional step. A compliance programme that is strong at the first point of sale but relies on distributors who have no downstream controls is, in practice, only as strong as its weakest link in the chain.
When to involve counsel – and what to bring to the first conversation
The right moment to involve external sanctions and export-control counsel is before the transaction structure is finalised, not after the payment is blocked or the enforcement inquiry arrives. In our experience, the businesses that manage multi-regime end-use and end-user risk most effectively are those that build regulatory analysis into the transaction-approval process, rather than treating it as a post-signing check.
The trigger points that most reliably indicate that external counsel should be engaged include: a counterparty with beneficial owners in a jurisdiction of elevated sanctions concern; a product that contains US-origin components and is being exported by a Canadian entity to a third market; a distributor that will re-export the goods, particularly to markets with active OFAC programmes; an OFAC licence application or a GAC permit application that involves an end-user whose compliance history is unclear; and any situation in which the business's own screening has returned an uncertain result – a partial name match, an ownership chain that cannot be fully traced, or a gap in the public registry information for the counterparty.
The first conversation is more productive when the business brings: the counterparty's name and registered address; known ownership information, including any public registry extracts; a description of the goods, including whether they contain US-origin components; the proposed route of the shipment; and the terms of the proposed payment, including the currency and the financial institutions involved. This information allows counsel to scope the analysis quickly and identify which of the two regimes – OFAC, BIS, GAC – or all three, requires a licence or permit before the transaction proceeds.
If a transaction has already been flagged by a bank or a screening tool, the situation calls for immediate review. Options narrow as time passes. Early engagement preserves the ability to present a complete compliance record, to make an accurate disclosure where one is appropriate, and to take the steps that demonstrate good faith to the relevant authority. A VSD (voluntary self-disclosure to a regulator), where the facts and the applicable guidelines support it, can be a material factor in the outcome of an enforcement process – but it must be prepared carefully, and the timing matters.
For a detailed comparison of how the UK's OFSI applies its own end-use and end-user controls alongside OFAC, see our analysis of end-use and end-user controls: OFAC vs OFSI. For the equivalent comparison between OFSI and the Australian regime, see our analysis of end-use and end-user controls: OFSI vs Australia.
Related practices
- Deemed Export and Technology Controls – BIS/EAR – classifying technology transfers to foreign nationals and managing EAR licence requirements
- End-Use and End-User Controls: OFAC vs OFSI – comparative analysis of the US and UK positions for cross-border exporters