A European technology company exports a controlled encryption device to a US-domiciled subsidiary. The shipment has passed the EU dual-use pre-clearance. The US parent assumes the hard work is done. Three months later, BIS opens an inquiry: the device required an independent licence under the EAR, and OFAC has flagged the end-user's downstream customer as a potential specially designated national. Two separate control regimes, two separate violations, one avoidable exposure. This is the pattern we see repeatedly in cross-border technology trade.
EU dual-use classification and US export-control classification are parallel but legally independent exercises. A product cleared under EU Regulation 2021/821 (the EU dual-use rules) has not been cleared under the EAR (Export Administration Regulations, administered by the Bureau of Industry and Security) or under OFAC's sanctions programmes. Where both regimes apply – which is common for any dual-use item that touches US-origin technology, US persons, or USD-denominated transactions – a business must satisfy both frameworks independently. As of April 2026, the gap between what EU classification covers and what US controls additionally require is the single most consistent point of failure we observe in cross-border compliance programmes.
This analysis maps the divergence criterion by criterion, identifies the risk flags that compliance teams miss, and sets out the practical steps a cross-border business should take before it ships, re-exports, or re-transfers a dual-use item touching both regimes.
What does EU dual-use classification actually determine – and what it does not?
EU dual-use classification under the applicable Council Regulation determines whether a good, software, or technology appears on the EU Common List of controlled items, what licence requirement applies within the EU's export authorisation regime, and which EU general or global export authorisation, if any, covers the transaction. Classification places the item within a category and entry-number structure that governs EU-territory exports, brokering, and transit controls. It does not, on its own, address US jurisdiction.
This is a point that experienced export managers understand but that finance, procurement, and legal teams outside the trade-compliance function regularly miss. The EU classification exercise answers one question: what does EU law require for this item leaving EU territory? It does not answer whether US jurisdiction attaches to the same item, whether the EAR's Export Control Classification Number (ECCN – the US Commerce Control List entry that determines EAR licence requirements) produces a different result, or whether an OFAC-administered sanctions programme independently prohibits the transaction.
In our cross-border practice, the most common failure mode is not a false negative on the EU list. It is the assumption that a successful EU classification exercise has discharged the compliance obligation globally. It has not.
How does the BIS / EAR classification system differ from the EU dual-use regime?
The EAR and the EU dual-use regime share a structural heritage – both derive from the Wassenaar Arrangement and other multilateral control regimes – but they are implemented through distinct national rules with distinct scopes, list structures, and jurisdictional triggers. The differences matter operationally.
The EU regime is territory-based for its primary trigger: it applies to items physically located in EU member-state territory that are being exported, brokered, or transited through the EU. The EAR extends further. It applies to US-origin items wherever they are in the world, to items incorporating more than a defined proportion of US-origin controlled content (the de minimis rule), and to foreign-produced direct products of certain US-origin technology or software under the Foreign Direct Product Rule (FDPR). This extraterritorial reach means that a product with no physical connection to the United States may still require a BIS licence if it was produced using US-controlled technology or software.
The list structures diverge as well. The EU Common List uses a specific numbering system with general software notes, technology notes, and catch-all provisions that are interpreted by individual member-state export control authorities. The EAR's Commerce Control List (CCL) uses ECCN numbers with reasons for control that drive the licence requirement independently of any list-based entry: a product that does not appear on the CCL is classified as EAR99, a residual category that still requires OFAC clearance on the end-user and transaction. Classification exercises in the two regimes produce results that are sometimes parallel and sometimes divergent. An item that falls within EU control at one level may map to a higher-control ECCN, a lower-control ECCN, or EAR99 under the US system.
What triggers the most risk? Re-exports and re-transfers. A European manufacturer ships to a Singapore distributor under an EU General Export Authorisation. That same item, if it contains US-origin controlled content or is a foreign direct product subject to the FDPR, requires a BIS licence or applicable licence exception before re-export from Singapore to a third country. The EU authorisation is legally irrelevant to that requirement. We regularly advise trading businesses that discover this gap only after the re-export has already occurred.
For a detailed analysis of how deemed-export obligations attach under the EAR – including for technology transferred to foreign nationals within the United States – see our briefing on deemed export and technology classification under BIS/EAR.
Where does OFAC sit in relation to EU dual-use classification?
OFAC administers US sanctions programmes that are entirely separate from the BIS/EAR export-control licensing regime. EU dual-use classification has no bearing on OFAC jurisdiction. This is the second systematic gap: businesses that complete both an EU classification and a BIS ECCN determination sometimes assume the OFAC check is subsumed. It is not.
OFAC's jurisdiction attaches through a different set of triggers. The primary triggers are: the involvement of a US person (any US citizen, permanent resident, US-incorporated entity, or person physically in the United States) in the transaction; the routing of a transaction through the US financial system (including any USD-denominated payment); the presence of US-origin goods in the shipment; or the identity of the counterparty or end-user as a Specially Designated National (SDN – a person or entity on OFAC's SDN List, meaning all US-person dealings are prohibited and any US-connected property must be blocked).
These triggers can attach to a transaction even where the goods in question are not on the EU Common List and do not have a controlled ECCN. An EAR99 item – one that carries no BIS licence requirement under the CCL – can still be prohibited under an OFAC sanctions programme if the end-user or destination is subject to comprehensive or targeted US sanctions. EU dual-use classification provides no guidance on this at all. A business exporting a wholly EU-origin, EU-classified item that routes through a USD correspondent bank, involves a US parent entity in the approval chain, or reaches an end-user who is an SDN is fully within OFAC's jurisdiction regardless of what the EU classification exercise produced.
The practical consequence is that a cross-border export compliance programme must run three checks in sequence, not one: EU classification and authorisation; EAR classification and licence requirement; and OFAC end-user, end-use, and sanctions-programme screening. These are not alternatives. They are cumulative. Where they conflict, the stricter prohibition governs.
What are the divergence points that businesses most consistently miss?
Four divergence points generate most of the cross-border exposure in our practice. Each one is a place where a business that has correctly completed its EU dual-use classification believes it is protected and is not.
First: the FDPR and re-export chains. The Foreign Direct Product Rule means that US-controlled semiconductor technology used to design a foreign-produced chip subjects that chip to EAR jurisdiction. The chip may not appear on the EU Common List at all. The EU-classification exercise will not surface this. A trading house that re-exports such a chip from an EU member state to a non-EU country without BIS authorisation has an EAR violation regardless of its EU compliance position.
Second: end-user controls and the Entity List. The EU end-user certificate requirement and the US Entity List (BIS's list of parties subject to a licence requirement for all or substantially all exports, re-exports, and transfers) operate on different bases. A counterparty that does not trigger the EU end-user certificate requirement may nonetheless appear on the Entity List, requiring a BIS licence for any EAR-subject item. Entity List status is reviewed and updated frequently; a clean EU end-user check at the time of classification does not freeze the US position.
Third: catch-all controls. Both regimes have catch-all provisions – controls that apply to items not listed on the respective control lists if the exporter knows or has reason to believe the items are intended for a prohibited end-use or end-user. The scope and practical trigger-point of the catch-all differs between the EU and US regimes. A US catch-all exposure can arise on an EU-uncontrolled item where a red flag exists about the end-user's weapons or proliferation programme. EU-only classification analysis will not surface the US catch-all question.
Fourth: OFAC secondary-sanctions risk. Secondary-sanctions risk arises where a non-US business's conduct – even without any US jurisdictional nexus on the goods themselves – risks triggering OFAC's authority to deny that business access to the US financial system or US-person dealings. Secondary sanctions are programme-specific and carry their own threshold analysis. EU dual-use classification is blind to this risk entirely. A transaction perfectly compliant under EU export rules can still place a European business in secondary-sanctions risk territory if its counterparty operates in a targeted sector of a designated country and the transaction reaches a defined threshold.
How do the licensing routes diverge, and what does that mean for timing?
When a licence is required, the EU and US regimes run separate, independent licensing procedures. There is no mutual recognition, no automatic carry-over, and no joint-licence mechanism. A business that needs authorisation under both regimes must pursue both applications concurrently or sequentially, manage two timelines, and satisfy two sets of documentary requirements.
EU licences are issued by individual member-state competent authorities. Processing timelines vary materially by member state and by item category; the relevant national authority determines the procedure. Appeals against refusals go to the national administrative or judicial route in the relevant member state, and ultimately to the EU General Court or the Court of Justice where EU-level instruments are challenged.
US BIS licensing timelines are set by internal agency procedures. Applications that require referral to other agencies – including the Department of Defense, the Department of State, or OFAC itself for sanctions-screening purposes – extend the timeline. OFAC specific-licence applications involve a separate procedure: the applicant must demonstrate that the transaction qualifies for a specific licence, provide the full transaction structure, identify all parties, and often go through several rounds of agency queries. The two procedures do not run together; a BIS licence application does not constitute an OFAC licence application, and vice versa.
For businesses managing simultaneous EU and US licence applications, a common risk is that one licence is granted and the other is refused, leaving a window in which partial compliance creates contractual, reputational, and legal problems. We advise clients to identify this risk at the outset of any transaction involving dual-regime licensing requirements and to structure the transaction documentation – the purchase order, the shipment terms, the payment conditions – to preserve flexibility if one application is delayed or refused.
The position above covers the standard case. Your facts – the item's technology content, the counterparty's ownership structure, the re-export destination, and the jurisdictions that touch the payment chain – change the analysis in ways that a general classification review will not catch. For an assessment of your specific exposure, contact Calder & Vance at info@caldervance.com.
Risk flags that should trigger immediate specialist review
Not every dual-use export transaction requires external counsel. But certain patterns should trigger an immediate specialist review, because the gap between EU dual-use classification and full US compliance is widest precisely where these factors appear.
- US-origin technology in the product's design chain. If the item was designed using US software or technology that is controlled under the EAR, the FDPR analysis is mandatory. EU classification will not surface it.
- Counterparties in jurisdictions subject to comprehensive US sanctions. Where a transaction touches a country under a comprehensive US sanctions programme, OFAC jurisdiction very likely attaches regardless of the EU classification outcome. The EU may not impose equivalent restrictions on that territory.
- End-users in high-risk sectors. Military-end-use and military-end-user rules under the EAR impose licence requirements for EAR-subject items destined for military end-users in defined countries, irrespective of ECCN classification. EU controls on equivalent end-uses may differ in scope.
- Transactions routed through correspondent banking chains involving US banks. OFAC's jurisdiction through the US financial system is broad. A EUR-denominated transaction can still pass through USD-clearing infrastructure. If there is any USD leg, the OFAC screen is mandatory.
- Re-export or re-transfer from a non-EU, non-US jurisdiction. Once an EU-authorised export reaches a third country, the EU authorisation expires its relevance. The EAR licence requirement for any subsequent re-export of EAR-subject items applies in that third country regardless of the original EU authorisation.
- Ownership changes in the counterparty. Post-transaction ownership changes can bring a previously clear counterparty within the scope of an OFAC designation, an Entity List entry, or a military-end-user rule. A static classification review taken at the time of initial due diligence does not protect against this.
In a recent matter, a technology manufacturer in an EU member state had completed a thorough EU dual-use classification review and obtained the applicable EU general export authorisation for a series of shipments to a distributor in a third country. The manufacturer's US parent had not, however, conducted an FDPR analysis. Certain items in the shipment were foreign direct products of US-origin controlled technology. We were instructed when BIS identified the pattern in the course of a broader review. We scoped the apparent violation, advised on voluntary self-disclosure, and prepared the penalty defence. The matter underscored a point we have observed consistently: the EU compliance file creates a false sense of comprehensive clearance in organisations where US and EU controls are managed in separate teams without a shared hand-off protocol.
What a compliant cross-border classification programme looks like
A cross-border classification programme that covers both EU and US requirements is not twice the work of a single-regime programme. It is a structured methodology that runs the two classification exercises in parallel, identifies the interaction points, and builds in the decision gates where the stricter regime governs.
The methodology we apply with clients in our export-controls practice involves five elements. First: product classification in both regimes simultaneously, not sequentially. An item's EU Common List position and its EAR ECCN are determined in the same review, with the US FDPR analysis run as a mandatory additional step wherever US-origin technology appears in the design chain. Second: counterparty screening against both regimes' lists – the EU consolidated list, OFAC's SDN List, the BIS Entity List and Denied Persons List, and the relevant programme-specific OFAC lists – at the time of contract and on a live-monitor basis thereafter. Third: end-use and end-user controls designed to address both the EU end-user certificate requirements and the US military-end-use and military-end-user rules, with a consistent red-flag escalation process. Fourth: a licence-requirement decision tree that identifies, for any given transaction, which regime requires a licence, whether any licence exception applies under each regime (and the exceptions are regime-specific), and the timeline and documentation requirements for each applicable application. Fifth: a re-export and re-transfer protocol for third-country distributors, covering the EAR licence requirements for any further movement of EAR-subject items and the contractual provisions that allocate compliance responsibility downstream.
Does your current classification programme run these steps for both the EU and US regimes? If the answer involves uncertainty, the gap is where enforcement risk lives.
For businesses managing these obligations at the intersection of the EU and Canadian dual-use regimes as well, see our comparative analysis at EU dual-use classification: OFAC vs Canada. For the direct EU-to-EU regime comparison, see EU dual-use classification: OFAC vs EU analysis.
The common myth: "our EU export compliance covers US requirements"
The most persistent misconception we encounter in cross-border export practice is that a business operating from EU territory, exporting EU-origin goods under a valid EU authorisation, has no independent US compliance exposure. The reasoning runs: the goods are European, the licence is European, the customer is not American. Why would US law apply?
It applies through four channels, each independent of the goods' origin. First, through the FDPR and the de minimis rule, which extend EAR jurisdiction to foreign-produced items containing or produced with US-controlled technology. Second, through the US financial system, which creates OFAC jurisdiction over any transaction routed through USD-clearing infrastructure or involving a US bank as correspondent. Third, through US-person involvement, which captures any US citizen, US resident, or US entity that participates in the transaction in any role – approver, funder, insurer, freight forwarder. Fourth, through secondary sanctions, which can create OFAC risk for non-US businesses dealing with designated sectors or persons regardless of any US-person or US-dollar nexus.
None of these channels is addressed by EU dual-use classification. A business that has invested in a meticulous EU classification programme and has no equivalent US review has, in OFAC and BIS terms, done very little. The EU programme is necessary but not sufficient. The two regimes must be managed as a combined obligation, not as alternatives.
In our experience, this misconception is most prevalent in mid-size manufacturers that have a dedicated EU export compliance officer but have not yet built US regulatory review into the standard transaction approval workflow. The fix is structural: it requires a hand-off protocol, not just a one-time awareness exercise.
Related practices
- Deemed export and technology classification – BIS/EAR – assessing release of controlled technology to foreign nationals in the US
- EU dual-use classification: OFAC vs Canada – comparative analysis of US and Canadian dual-use control regimes