A multinational exporter finalises a deal for technical equipment to a buyer in a third market. The item has potential civil and military applications. The US parent asks whether BIS authorisation is required. The EU subsidiary asks whether an EU export licence is needed. The UK entity asks whether OFSI has any bearing on the shipment. Three entities, one item, three distinct regimes – and the classification result may differ under each.
EU dual-use classification is the process of determining whether goods, software, or technology appear on a control list – primarily the EU's dual-use regulation – and therefore require a licence before export. OFAC governs US economic sanctions, not export classification directly; that falls to BIS under the EAR. OFSI administers UK financial sanctions. All three regimes interact with dual-use classification, and divergences between them create real compliance gaps for cross-border businesses. As of April 2026, those gaps are widening as each jurisdiction updates its controls independently.
This analysis maps the classification tests, the governing authorities, and the practical divergence points across the EU, US, and UK regimes. It then identifies the risk flags that should prompt early legal review.
Who administers dual-use classification across the three regimes?
The EU, the US, and the UK each maintain distinct control lists, administered by different authorities, operating under different legal instruments. Understanding the institutional structure is a prerequisite for accurate classification across any cross-border supply chain.
In the EU, the dual-use regulation – the principal Council regulation governing dual-use goods and technology – sits with the European Commission and national competent authorities. Exporters must identify the applicable control-list entry and apply for a licence from their national authority. The regulation applies to exports from EU territory, and the control list is structured around internationally agreed control regimes, including the Wassenaar Arrangement, the Nuclear Suppliers Group, the Australia Group, and the Missile Technology Control Regime.
In the United States, BIS administers the EAR (Export Administration Regulations), the primary instrument governing US dual-use exports. Classification turns on the ECCN (Export Control Classification Number under the US Commerce Control List). OFAC operates separately: it imposes sanctions-based prohibitions on transactions with certain countries, individuals, and entities. A shipment can be outside BIS control but still blocked by OFAC, and vice versa. The two US agencies are legally and institutionally distinct.
In the UK, the ECJU (Export Control Joint Unit) administers export licences under the Export Control Order and successor instruments. OFSI administers UK financial sanctions under the Sanctions and Anti-Money Laundering Act (SAMLA) and the relevant thematic regulations. OFSI does not classify goods. It can, however, prohibit financial transactions that fund or facilitate a restricted transfer – including payment for a dual-use shipment to a designated person. The distinction between ECJU controls and OFSI prohibitions is frequently misunderstood, and that misunderstanding creates liability.
Practitioners advising on OFAC matters note that the US extraterritorial reach extends the analysis further still. A non-US entity involved in a transaction with a US nexus – US-origin goods, US-origin technology, US dollar clearing – may be caught by EAR or OFAC rules regardless of where it is incorporated. We regularly advise EU and UK businesses that believed US rules had no application to their export, only to discover that a US-origin component or a dollar-denominated payment changed the picture entirely.
How does EU dual-use classification work in practice?
EU dual-use classification is a two-stage process: first, determine whether the item falls within a control-list entry; second, determine what licence, if any, is required for the intended destination, end-user, and end-use.
The control-list entry is identified by reference to the technical parameters of the item – its specifications, software functions, or technology characteristics – against the entries in the EU dual-use regulation's Annex I. Entries are structured into ten categories, from advanced materials (Category 1) to aerospace (Category 9), each with product group sub-headings covering equipment, test equipment, materials, software, and technology. Classification requires a technical assessment, not merely a product description.
If the item is listed, the exporter must next determine the applicable licence type. The EU offers several instruments: a Union General Export Authorisation (UGEA) covers defined lower-risk destinations and items and does not require a formal application. A national general authorisation operates similarly at the Member State level. An individual licence is required for higher-risk items, sensitive end-users, or destinations not covered by a general authorisation. A global licence is available for regular exporters of specific items to pre-approved recipients.
Critically, the EU regime includes a catch-all provision. An exporter who knows, or has been informed, that an item – even an unlisted item – is or may be intended for a weapons-of-mass-destruction programme, a military end-use in an arms-embargoed destination, or certain other restricted end-uses, must seek a licence regardless of list status. This is not a theoretical risk. In our cross-border practice, we have seen the catch-all triggered in supply chains where the exporter had correctly determined that the item itself was not listed.
After classification and licence determination, the exporter must maintain documentation – the technical assessment, the licence, the end-user undertaking, and the shipping records – for a period specified by the applicable national rules. Consistent and complete records are the first line of defence in any enforcement enquiry.
Where does US ECCN classification diverge from the EU classification test?
The US ECCN system and the EU dual-use classification share a common ancestry in the multilateral control regimes, but diverge materially in structure, scope, and the consequences of an incorrect classification.
Under the EAR, every item subject to US jurisdiction has a classification, whether or not it is controlled. An item that does not fall within a specific ECCN is classified as EAR99 – meaning it is subject to the EAR but not controlled for most destinations. EAR99 items may still require a licence for sanctioned destinations or sanctioned end-users, or when a red flag exists. The EU system has no direct equivalent: an unlisted EU item simply requires no licence, unless the catch-all applies. The practical difference is that a US exporter of an EAR99 item must still run the destination, end-user, and end-use checks; an EU exporter of an unlisted item has fewer mandatory procedural steps (but must still assess the catch-all).
The licence exception regime also differs. BIS maintains a detailed set of licence exceptions – STA, ENC, TMP, and others – which can authorise otherwise-controlled exports without a case-by-case application. The EU's general authorisations serve an analogous function but are structured differently. An item eligible for a BIS licence exception may not be eligible for a comparable EU general authorisation for the same destination. Exporters operating both a US and an EU entity out of a shared product catalogue must map these instruments separately and cannot assume symmetry.
A further divergence concerns technology and software. The EAR applies to US-origin technology wherever it travels – the de minimis rule and the foreign direct product rule can extend US jurisdiction to foreign-made goods incorporating US-origin technology or produced using US equipment. The EU regulation, by contrast, is primarily territorial: it applies to exports from EU territory, and the concept of extraterritorial reach over foreign-made items is considerably narrower. This divergence is most acute in semiconductor, telecommunications, and defence-related supply chains.
Does your product catalogue have a single ECCN mapped per item, without a parallel EU classification? That is one of the most common gaps we identify in export-compliance programmes across multinational manufacturers.
How does OFSI interact with dual-use classification – and where do businesses go wrong?
OFSI does not publish a classification list and does not determine whether an item is controlled for export purposes. Its jurisdiction is financial sanctions: prohibiting transactions that involve a designated person or that breach a sanctions regime administered by the UK. The overlap with dual-use classification arises in two ways, and both are frequently misunderstood.
First, a payment for the transfer of a dual-use item – or for associated services such as brokering, technical assistance, or financing – may be prohibited if any party in the chain is a designated person. OFSI's prohibitions attach to the financial transaction, not the physical movement of goods. A business that obtains an ECJU export licence but fails to screen the buyer and intermediaries against the UK Consolidated List may still commit a financial-sanctions violation when it receives payment or transfers funds.
Second, UK thematic sanctions regulations can restrict the supply, delivery, transfer, or making available of certain goods and technology to specified destinations or persons – not just the financial side of the transaction. These restrictions can run alongside, or independently of, the ECJU licensing regime. A business that has a valid export licence may still need to consider whether the supply itself is prohibited under the relevant thematic sanctions regulation. The two regimes – export controls and financial or thematic sanctions – must be analysed in parallel, not sequentially.
In a recent matter, a technology distribution business had correctly licensed its exports under both the EAR and EU rules. The financial-sanctions screen had been applied only to the direct buyer. Intermediate distributors in the channel had not been checked. OFSI's remit would have extended to any financial transaction involving a designated intermediary. The business restructured its screening protocol to cover the full distribution chain before any transfer of title or funds.
The position above covers the standard case. Your facts – the counterparty, the goods, the route, the regime in play – change the analysis. For an assessment of your exposure under OFAC, OFSI, and the EU dual-use regime, contact Calder & Vance at info@caldervance.com.
What is the cross-border risk when OFAC, the EAR, and the EU regime apply simultaneously?
When a single supply chain touches the United States, the EU, and the UK, all three regimes can apply simultaneously. The prohibition that governs is the strictest applicable prohibition at each point in the chain.
A common scenario: an EU exporter ships dual-use technology to a non-sanctioned destination. The technology incorporates US-origin components above the applicable de minimis threshold. BIS jurisdiction attaches to the re-export via the foreign direct product rule or the de minimis rule, regardless of the EU authorisation already obtained. OFAC may additionally prohibit any transaction if the end-user is on the SDN List. OFSI may prohibit the financial leg if a UK-nexus person is involved.
Secondary-sanctions risk is a related but distinct concern. OFAC can impose sanctions on non-US persons who engage in conduct that OFAC considers to fall within the scope of a secondary-sanctions programme. A European company that knowingly facilitates a transaction that OFAC would prohibit for a US person may face OFAC designation or the cutting-off of US correspondent banking access – even if no US goods, technology, or persons were directly involved. This extraterritorial reach has been a source of tension between the US and its treaty partners, and it materially raises the stakes for non-US businesses assessing their dual-use compliance obligations.
Our practice regularly advises non-US businesses on secondary-sanctions risk and on the interaction between BIS extraterritorial controls and EU or UK classification results. The analysis requires working through each regime's jurisdictional rules sequentially, then identifying the most restrictive obligation at each step.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com to discuss the position.
What risk flags should prompt legal review before shipment?
Several risk indicators, if present in a proposed shipment, should trigger a legal review before the transaction proceeds rather than after it has been flagged by a regulator.
First, any item with a military or intelligence application, even a partial one, where the buyer or the end-destination has not been independently verified. The catch-all provisions of both the EU and UK regimes, and the EAR's end-use check requirements, all impose enhanced obligations when the intended use is uncertain.
Second, a change of destination mid-shipment or a request to re-route through an intermediary jurisdiction. Transshipment through low-scrutiny hubs is a documented method for evading export controls, and a change in routing should be treated as a significant red flag warranting a full re-assessment of the applicable licence requirements and end-user declarations.
Third, an end-user whose ownership structure includes entities or individuals from a jurisdiction subject to a comprehensive or targeted sanctions programme. The 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) applies independently of any export-classification exercise. An entity that passes the classification screen may still be a blocked person for OFAC purposes.
Fourth, a buyer that is reluctant to provide end-user certificates, that requests removal of markings or serial numbers, or that proposes payment through an unrelated third party. These are documented red flags under US, EU, and UK export-control guidance, and they create personal liability for the individuals who approve the shipment.
Fifth, technology transfers – including source code access, technical assistance, or training – that are not accompanied by a parallel classification exercise. Technology and software are controlled separately from physical goods in all three regimes. A business that correctly licences the hardware component of a sale may inadvertently transfer controlled technology without a licence during the installation and training phase.
The consequences of an undetected compliance failure vary by regime. Under the EAR, civil penalties can be significant for each violation, and criminal penalties apply in cases of wilful breach. EU Member State penalties differ across jurisdictions but can include fines and suspension of export privileges. UK penalties under SAMLA can include substantial monetary penalties and criminal prosecution. Across all regimes, voluntary self-disclosure – a VSD (voluntary self-disclosure to a regulator) – is a well-established mechanism for mitigating penalty exposure, but it must be made on the basis of a clear-eyed assessment of the apparent violation and the supporting facts.
A myth that cross-border businesses should discard
A persistent misconception in cross-border export compliance is that obtaining an EU dual-use export licence satisfies the full compliance obligation for a shipment from an EU entity. It does not.
An EU export licence addresses the EU regulatory requirement for the specific item, destination, and end-user presented in the application. It does not authorise a transaction that would be independently prohibited under OFAC or under OFSI's financial-sanctions regime. It does not override BIS jurisdiction over US-origin technology incorporated in the product. It does not discharge the end-use diligence obligation that exists under EU, UK, and US rules alike. And it is issued on the basis of the facts declared at the time of application; a change in the end-user, the destination, or the declared end-use after licence issuance can invalidate the authorisation.
We have acted for businesses that proceeded on the assumption that a valid EU licence was a comprehensive clearance. The gap between that assumption and the actual position under OFAC or the EAR is where enforcement exposure accumulates.
Related practices
- Deemed export and technology controls under BIS/EAR – US jurisdiction over technology transfers and how to assess licence requirements.
- EU dual-use classification: OFSI vs EU analysis – a detailed comparison of how OFSI and the EU Council regime interact on dual-use questions.
- Export licence determination: EU vs SECO – mapping EU and Swiss export-control requirements for cross-border exporters.
Frequently asked questions on EU dual-use classification across the OFAC, OFSI, and EU regimes
- Where do the regimes diverge on EU dual-use classification?
The principal divergences are: the scope of extraterritorial jurisdiction (broadest under the EAR via the foreign direct product rule; narrowest under the EU regime); the treatment of unlisted items (EAR99 items still require end-user checks; EU unlisted items require no licence unless the catch-all applies); and the relationship between financial-sanctions prohibitions and export-licensing authorisations (OFSI and OFAC operate independently of export-licence decisions and can prohibit transactions that the licensing authority has authorised). Each divergence requires a separate analytical step.
- Which regime is stricter on EU dual-use classification?
There is no single answer: strictness varies by item, destination, and end-user. The EAR has the broadest extraterritorial reach and applies to US-origin technology anywhere in the world. EU controls are generally territorial but include a broad catch-all for unlisted items. UK controls under the Export Control Order are broadly comparable to the EU but updated independently post-Brexit. The applicable regime principle is that the most restrictive obligation at each point in the chain governs – and for many cross-border shipments, that means satisfying all three simultaneously.
- What should a cross-border business do about EU dual-use classification?
A cross-border business should first classify its product under all applicable control lists – the EU Annex I, the US Commerce Control List (by ECCN), and the relevant UK control list. It should then determine what licences or authorisations are required for each destination and end-user combination, screen all parties against applicable sanctions lists (including the SDN List, the UK Consolidated List, and the EU Consolidated List), obtain and retain end-user undertakings, and establish a documented programme for reviewing these steps when facts change. Where the analysis involves US-origin technology or a US financial nexus, BIS and OFAC jurisdiction must be assessed in parallel.
About the author
J. M. Aldridge advises multinationals and financial institutions on US sanctions and export controls, with a focus on OFAC licensing, secondary-sanctions risk, and BIS classification. Calder & Vance – International Sanctions & Export Control Counsel.
About Calder & Vance
Calder & Vance is an independent international sanctions and export-control boutique. We advise multinationals, financial institutions, exporters, and individuals on the major regimes – OFAC and BIS in the United States, OFSI and ECJU in the United Kingdom, the EU Council regulations and the EU General Court, the United Nations Consolidated List, and the regimes of Switzerland, Canada, Australia, the UAE, Singapore, and Japan. Our work is limited to lawful compliance, licensing, delisting, enforcement defence, and due diligence. To discuss a matter, contact info@caldervance.com.
Disclaimer: This material is general information, not legal advice, and is not a substitute for advice on your specific facts. Sanctions and export-control rules change frequently and differ by regime; verify the current position before relying on anything stated here. Calder & Vance does not advise on circumventing or evading sanctions. For advice on your situation, contact info@caldervance.com.