A US-headquartered group exports advanced electronics through its European trading subsidiary. Customs authorities flag a consignment. Within days, the business faces parallel scrutiny: the US Bureau of Industry and Security reviewing potential violations of the Export Administration Regulations, and EU competent authorities examining whether the transaction fell within the scope of the relevant Council dual-use regulation. Both investigations are live simultaneously. The question is not just whether a violation occurred – it is whether the penalty that follows can be materially reduced, and by what mechanism.
Mitigation factors in enforcement under the BIS / EAR and the EU dual-use regime differ in structure, weight, and procedure. BIS applies a published, multi-criterion framework that rewards voluntary self-disclosure, strong compliance programmes, and cooperation. The EU operates through national competent authorities applying divergent national penalty laws, with no single harmonised mitigation schedule – though common principles have emerged across jurisdictions. In almost every cross-border matter, the gap between the two systems determines where the strategic emphasis should fall.
This analysis maps the key divergences criterion by criterion, identifies the risk points that practitioners encounter most frequently, and sets out the practical implications for a business managing exposure on both sides of the Atlantic.
How does BIS structure its mitigation analysis under the EAR?
BIS applies a formal, criterion-driven framework when assessing penalty levels for apparent violations of the Export Administration Regulations. The framework is set out in BIS's own enforcement guidelines and distinguishes between factors that aggravate a penalty and factors that mitigate it. Neither list is exhaustive, and BIS retains discretion to weight factors according to the specific facts of each matter.
The core mitigating factors recognised by BIS include: the existence of an effective export-compliance programme at the time of the violation; the willingness of the entity to make a voluntary self-disclosure (VSD – a proactive report of an apparent violation to BIS before the agency identifies the conduct independently); meaningful cooperation with the investigation; the absence of prior violations; and evidence that the violation was not wilful or intentional. A VSD is perhaps the single most significant procedural lever available under the EAR. In our experience, a well-prepared VSD – submitted with a thorough internal investigation, a clear account of what happened, and a concrete remediation plan – can reduce the base penalty substantially. The reduction is not guaranteed by the act of disclosure alone; the quality and completeness of the submission matters.
BIS also weighs aggravating factors: concealment, obstruction, the sensitivity of the goods or technology involved, the destination, the end-user, and any prior violation history. Where aggravating factors predominate, a VSD does not neutralise the result – it shifts the starting point downward but does not eliminate the agency's discretion to impose a significant penalty.
One practical reality is worth stating clearly. BIS and the Department of Justice frequently coordinate on export-control matters that may carry criminal as well as administrative dimensions. A decision made in the administrative track – including the timing and content of a VSD – can affect the criminal posture. Counsel familiar with both tracks is essential before a disclosure strategy is fixed.
What is the EU approach to mitigation and how is it organised?
The EU dual-use regime imposes obligations through a directly applicable Council regulation, but enforcement is left to each member state's competent authority, applying that state's national penalty law. This structural feature is the defining characteristic of EU enforcement from a mitigation perspective: there is no single EU-wide mitigation schedule, no uniform penalty range, and no harmonised procedure for voluntary disclosure.
What does exist is a set of principles common to most national systems. German, French, Dutch, and Belgian authorities – among the most active in export-control enforcement – each recognise, to varying degrees, the relevance of cooperation, self-reporting, remediation, the presence of a compliance programme, and the intention behind the conduct. The weight given to each varies. Some national systems treat voluntary disclosure as a formal, named procedure with defined procedural consequences. Others treat it as one factor among many, weighed informally by the authority.
In practice, a business that self-reports to a German competent authority on the same day as it files a VSD with BIS may find that the two submissions are evaluated against very different standards. The German authority will apply domestic administrative and criminal procedure. BIS applies its own guidelines. The timeline, the procedural requirements, and the weight given to the disclosure differ. We regularly advise clients managing simultaneous US and EU investigations that the disclosure strategy must be planned for both systems at the outset, not retrofitted.
The EU General Court and the Court of Justice have addressed procedural rights in sanctions-related contexts – primarily in listing and delisting disputes – but these decisions do not directly govern export-control penalty proceedings at the national level. The national courts of each member state hear enforcement challenges under domestic administrative or criminal law. This fragmentation is operationally significant for any business with European trading operations.
Where do the two regimes diverge most sharply on voluntary self-disclosure?
Voluntary self-disclosure is the most consequential single mitigation tool available under the EAR, and its treatment under the EU regime is the most significant structural divergence a practitioner encounters. BIS has a published VSD procedure. The EU does not.
Under the EAR, a VSD submitted in the correct form to BIS – and, where applicable, to the State Department's Directorate of Defense Trade Controls for munitions-related matters – starts a defined process. BIS acknowledges receipt, may open an investigation, and takes the timing and quality of the disclosure directly into account when determining the penalty base. The key word is "timing": a disclosure that precedes agency awareness of the conduct is treated more favourably than one submitted after the agency has already identified a potential violation. Have you confirmed, before any submission, whether BIS has already opened an inquiry?
In the EU, the position depends entirely on the member state where the violation occurred or where the exporter is established. Some member states have introduced formal notification or cooperation procedures that function similarly to a VSD. Others have no equivalent mechanism, and a proactive report to the competent authority may be assessed simply as a factual matter – cooperation noted, but no fixed procedural benefit attached. The business considering simultaneous disclosure in both regimes must map the specific national procedures applicable to each EU jurisdiction in scope before it acts. A uniform disclosure approach – identical in timing and form across all jurisdictions – is rarely optimal.
There is a further complication. In certain EU member states, self-reporting an export-control violation to the competent authority may also trigger obligations or risks under domestic anti-money-laundering or criminal law. A disclosure that is plainly advantageous in the US administrative track may carry different implications in a national criminal context. This intersection is frequently underestimated by compliance teams managing primarily from the US end of the transaction.
How do compliance programme quality and remediation weigh differently?
BIS places explicit weight on the quality of an entity's export-compliance programme both at the time of the violation and in the period following discovery. A documented, implemented programme that nonetheless failed to prevent a specific violation can still count as a mitigating factor, provided the programme was genuine and the failure was not systemic. The key is that the programme must have been active and tailored to the entity's actual risk – not a paper exercise maintained in a compliance manual that no one consults.
Post-violation remediation matters too. BIS expects an entity to investigate the root cause, correct the deficiency, retrain staff, and in many cases implement enhanced controls. A detailed remediation plan submitted as part of a VSD, or during a BIS investigation, signals to the agency that the entity has treated the matter seriously. In a recent matter, a manufacturing business subject to BIS inquiry demonstrated through contemporaneous records that it had overhauled its classification and end-user screening procedures within weeks of identifying the apparent violation. That documented response formed a central element of the penalty-reduction argument.
EU national authorities vary considerably on this point. German practice tends to weight compliance programme quality and post-violation remediation meaningfully. The presence of a structured Internal Compliance Programme – the terminology used in the EU's own guidance on dual-use controls – can reduce the penalty in certain member states, though the procedural mechanism differs. Other national systems are less systematic: remediation is noted but does not translate into a defined reduction. The absence of a harmonised standard means that the mitigation value of a compliance investment differs depending on where the enforcement action is brought.
One practical implication: businesses that operate in multiple EU member states and export under the EAR should maintain compliance programmes designed to satisfy both the BIS compliance standard and the ICP benchmark used in EU guidance. The two standards overlap substantially. Building to the more demanding of the two requirements is both efficient and strategically sound.
What role does intent play, and how differently do the regimes treat it?
Intent is treated differently in structure, though convergently in outcome, across the two regimes. Under the EAR, wilfulness is an aggravating factor. A violation that the entity knew of, or should reasonably have known was occurring, attracts a significantly heavier penalty than one arising from inadvertent misclassification or an honest screening failure. The distinction between a wilful violation and a reckless one matters, as does the distinction between recklessness and a genuinely inadvertent act.
BIS does not require proof of intent to establish a violation. The EAR operates on a strict-liability basis for the administrative track: the export either complied with the applicable licence requirement or it did not. But intent enters the analysis at the penalty-determination stage, and it enters powerfully. A business that can demonstrate it acted on an honest, well-documented classification determination – even if that determination was ultimately wrong – is in a materially better position than one that cannot produce contemporaneous records.
EU national systems are more varied. Criminal enforcement provisions in several member states require proof of intent – knowledge that the goods were controlled, or at minimum recklessness as to that question. Administrative enforcement is typically less demanding on the intent element, but the distinction between wilful and negligent conduct still bears on the penalty level in most systems. The practical consequence is that the same set of facts – a controlled shipment without the required authorisation – can be characterised as an administrative matter in one EU member state and a criminal matter in another, depending on the available evidence of intent and the prosecutorial posture of the local authority.
For cross-border businesses, this divergence creates a real strategic decision point. Gathering and preserving evidence of the genuine state of knowledge at the time of the shipment – classification records, screening outputs, legal opinions, training records – is important in both systems, but the precise form that evidence needs to take differs. That documentation strategy should be part of any export-compliance programme before a problem arises, not assembled retrospectively.
When does cooperation with investigators produce different outcomes?
Cooperation with the investigating authority is a recognised mitigating factor in both regimes, but its practical expression differs. Under the EAR, cooperation with BIS during an investigation – providing requested records promptly, making witnesses available, not impeding access to relevant information – is formally noted in the penalty analysis. Non-cooperation or obstruction is a named aggravating factor and can substantially increase the outcome.
The calculus here is not simply about responsiveness. Cooperation that goes beyond the minimum – providing BIS with a thorough account of what happened, including facts that are unfavourable to the entity – is treated more favourably than cooperation that meets requests precisely and no more. In our cross-border practice, this creates a recurring tension: the level of openness that maximises mitigation credit in the US administrative track may create risk in a parallel EU or domestic criminal proceeding, where the same disclosures could be used by a different authority for a different purpose.
The EU position again varies by member state. Some national competent authorities operate investigative processes that look broadly similar to BIS practice: document requests, interviews, the expectation of cooperation. Others have more compressed, penalty-first enforcement styles, where the cooperation window is narrow. The difference matters because the moment of meaningful cooperation – the point at which the entity's engagement actually affects the outcome – occurs earlier in some systems than in others. Missing that window by treating all EU authorities as if they operate on the BIS timeline is a mistake we see repeatedly.
The position above covers the standard enforcement scenario. Your facts – the goods classified, the destination, the authority leading the inquiry, the timing of internal discovery – all change the analysis materially. If an investigation has already been opened, the window to influence the outcome narrows quickly.
For an assessment of your exposure and a review of the available mitigation arguments in your specific jurisdictions, contact Calder & Vance at info@caldervance.com.
What are the common risk flags in a cross-border mitigation strategy?
Several recurring patterns account for most of the avoidable failures in cross-border mitigation strategy. Understanding them before a matter becomes active is far more valuable than identifying them after the fact.
Disclosure timing mismatches. A business that files a VSD with BIS before it has assessed whether the same conduct requires notification in one or more EU member states risks creating a public record of the violation in the US before it has developed a position in Europe. Conversely, a business that delays US disclosure to manage the EU sequence may lose the VSD benefit at BIS. Mapping the disclosure calendar across all relevant jurisdictions is the first task.
Inconsistent factual accounts. A VSD to BIS, a notification to a German authority, and a report to a Dutch competent authority are three separate submissions, potentially read by multiple agencies with overlapping interests. Inconsistencies – even inadvertent ones arising from different levels of factual development at the time of each submission – can be treated as aggravating in one or more systems. A single, disciplined factual narrative, updated consistently as the investigation develops, is essential.
Compliance programme gaps discovered during investigation. A BIS investigation frequently involves a review of the entity's export-compliance programme. If that review reveals that the programme was deficient – not just that it failed to catch a specific violation – the mitigation credit for having a programme disappears, and an aggravating factor may emerge. An honest pre-disclosure assessment of programme quality, and a clear plan to address genuine gaps, should precede any submission.
Underestimating the criminal dimension in the EU. Several EU member states have active criminal prosecutors with jurisdiction over export-control violations. A matter that presents as purely administrative at the outset can develop a criminal dimension as facts emerge. The standard of privilege, the rights of the investigated entity, and the rules of evidence in criminal proceedings differ materially from those in administrative enforcement. Engaging counsel who understands both tracks early is not overcaution – it is basic risk management.
Over-relying on a single EU point of contact. Businesses often assume that engagement with the competent authority of the member state where the exporter is established is sufficient. Where goods transited or were delivered in other member states, or where EU-origin goods are involved in a re-export pattern, multiple national authorities may have jurisdiction. A mitigation strategy designed for one authority may not travel.
If a transaction has already been flagged, or a filing has been refused, an early and structured review can preserve mitigation arguments that narrow with delay. Contact Calder & Vance at info@caldervance.com for a confidential review.
Addressing the myth: "A strong compliance programme guarantees a reduced penalty"
A common misconception among compliance officers is that the existence of a documented export-compliance programme provides automatic mitigation credit in any enforcement action. It does not, in either regime.
Under the EAR, BIS distinguishes between a programme that is genuine – embedded in operations, maintained with real resources, and updated as the entity's risk profile changes – and one that is formal but hollow. A compliance manual that existed on the date of a violation but was not implemented in the relevant operational function provides limited mitigation credit. BIS may in fact treat a gap between written policy and operational practice as evidence that the entity knew, or should have known, of the risk and chose not to act on it.
In EU national systems, the analysis is similar. An Internal Compliance Programme submitted to a competent authority as evidence of a good-faith compliance posture will be assessed on its operational substance, not its length. Where the programme did not include the specific goods, destinations, or end-users involved in the violation, the mitigation value is reduced. Where the programme had not been updated to reflect changes in the applicable control lists, the argument that it was active and effective at the time of the violation is harder to sustain.
The practical message is straightforward. A compliance programme supports a mitigation argument most effectively when it was specific to the relevant risk, actively implemented by the relevant personnel, updated as controls evolved, and tested periodically against actual transactions. If the programme meets that standard and a violation nonetheless occurred, the entity can credibly argue that the failure was a genuine exception. If it does not meet that standard, the programme may be a neutral factor or, in a worst case, a liability.
We regularly advise businesses at the programme-design stage that building to a genuine standard – not a paper one – is the single most durable investment in enforcement mitigation available before a problem arises.
Related practices
- Apparent Violation Assessment – EU – assessing and managing EU enforcement exposure across member state jurisdictions
- OFAC vs BIS / EAR: Mitigation Factors Compared – how mitigation criteria differ between the two principal US enforcement authorities
- OFAC vs EU: Mitigation Factors in Enforcement – comparing US financial-sanctions and EU enforcement mitigation approaches