A UK-headquartered trading house has secured a buyer for controlled dual-use components. Its legal team runs parallel checks: one under the Export Control Order through ECJU, and a second pass for EU re-export considerations because the components were originally procured from a continental supplier. The results diverge. The UK licence route looks available; the EU position is less clear. Which determination governs – and can both be wrong simultaneously?
Export-licence determinations under OFSI and ECJU in the United Kingdom follow a distinct statutory and procedural path from those required under the EU dual-use regime and EU financial-sanctions instruments. The two systems share common heritage but have diverged materially since the UK's withdrawal from the EU. As of April 2026, the divergences touch the legal basis, the ownership-and-control test applied to end-users, the grounds for refusal, and the extraterritorial reach of each regime – any of which can decide whether a deal proceeds.
This analysis maps each point of divergence in turn, identifies the risk flags that most often surprise cross-border businesses, and sets out when specialist counsel adds decisive value.
What is the legal and institutional basis for each regime?
The UK export-licensing regime rests on the Sanctions and Anti-Money Laundering Act ("SAMLA") for financial-sanctions dimensions and on the Export Control Order for goods and technology controls, administered by ECJU under the Department for Business and Trade; OFSI, as the Office of Financial Sanctions Implementation within HM Treasury, sits alongside ECJU and issues licences specifically for transactions involving designated persons or asset-freeze obligations under the relevant UK thematic regulations.
The EU regime operates through directly applicable Council Regulations, enforced by member-state competent authorities, with the EU dual-use rules governing export of controlled goods and technology. Licensing decisions are made at member-state level, but the underlying legal obligation – the prohibition and the criteria for authorisation – derives from the Council Regulation and cannot be varied by any single member state. The EU General Court and the Court of Justice provide the judicial oversight layer that the UK system replaces with judicial review before the High Court.
In practice, this bifurcation creates a structural asymmetry. A business holding a valid UK ECJU licence for an export has no assurance of the equivalent EU position. The two systems are administered by different competent authorities, apply different classification criteria, and carry different legal consequences for non-compliance. That gap is not theoretical: in our experience, businesses that assumed post-Brexit alignment and relied on a UK determination for an EU leg of the same transaction have encountered enforcement exposure that preventive analysis would have avoided.
How do the classification and trigger tests differ?
Under the UK Export Control Order, an item requires a licence if it appears on the UK Strategic Export Control Lists with a relevant control entry, or if it is subject to a catch-all control triggered by known or suspected end-use for weapons of mass destruction or military programmes. The UK lists have been maintained and updated independently since 2021, meaning the UK control entries and the EU's equivalent – the EU dual-use list under the relevant Council Regulation – are no longer automatically identical.
The EU trigger test under its dual-use rules operates similarly but has evolved through separate amendment cycles. Divergences are currently modest for most categories, but the direction of travel is independent: where the EU has added or removed a control entry, the UK may not have followed, and vice versa. For exporters of items in emerging-technology categories – advanced semiconductors, certain software with surveillance applications, specific biological equipment – the possibility of a classification that is controlled under one list but not the other is live.
The financial-sanctions dimension of export-licence determinations adds a further layer. An export that involves a designated person at any point – as the buyer, the end-user, an intermediary, or a beneficial owner above the relevant ownership threshold – requires an OFSI licence in the UK, regardless of whether the goods themselves are on the control list. Under the EU regime, the equivalent prohibition stems from the relevant Council Regulation, applied by the member-state competent authority. The ownership-and-control test used to identify whether a non-listed entity is caught differs between the two regimes, as discussed below.
Where do the ownership-and-control tests diverge?
The ownership-and-control test is the point where OFSI and EU practice diverge most consequentially for export-licence determinations. Under UK financial sanctions, OFSI applies an ownership and control test – asking both whether a designated person owns the relevant entity (the ownership limb) and whether a designated person controls it, even below the formal ownership threshold (the control limb). This dual-limb approach means that an entity with a minority-but-influential designated shareholder can be caught even if the ownership threshold is not met.
The EU equivalent, under the applicable Council Regulations, applies a broadly comparable ownership-and-control test but the administrative guidance issued by member-state competent authorities on how to apply the control limb has not been uniform. Some member states apply a stricter reading; others a more permissive one. The EU General Court has addressed the outer boundaries of the test in a series of annulment proceedings, but the day-to-day application remains with the national competent authority. For a cross-border transaction running through multiple EU member states, the exporter may face materially different answers from different authorities to the same ownership question.
OFAC in the United States applies the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) – a mechanical, ownership-only test. The UK and EU tests are accordingly stricter in one dimension (control) while the OFAC test produces a clearer binary for ownership-only analysis. For a transaction that has a US nexus – US-origin goods, a US person in the chain, or dollar-denominated settlement – the US test applies in parallel, and the strictest prohibition governing any element of the transaction will govern that element. That is the cardinal rule in any multi-regime analysis.
The practical consequence: an export-licence determination conducted only under one regime can produce a legally clean answer that is wrong for another regime covering the same transaction. We regularly advise businesses on cases where a UK ECJU/OFSI analysis concluded that the end-user was not caught, but the EU member-state authority reached the opposite conclusion because it applied a different reading of the control limb to the same ownership structure.
The position above covers the standard structural case. Your facts – the goods, the route, the ownership structure of the buyer, and the jurisdictions touching the transaction – change the analysis materially.
For a confidential review of a specific transaction structure, contact Calder & Vance at info@caldervance.com.
What are the grounds for refusal and how do they compare?
ECJU assesses licence applications against the Consolidated Criteria, which consider human rights, international humanitarian law, regional stability, the diversion risk, and the UK's international obligations. OFSI applies its own licensing criteria under the relevant thematic regulations, testing whether the proposed activity falls within a general or specific-licence authorisation and whether granting it would be consistent with the purposes of the sanctions programme. These are distinct legal tests, applied by different competent authorities, with different administrative review routes.
The EU grounds for refusal under the dual-use rules reference the Common Position on arms exports and the EU's foreign and security policy objectives. These grounds are translated into member-state decisions but the underlying normative framework is set at EU level. For items controlled under both the UK and EU lists, the same export may be refused in one jurisdiction and granted in another, creating a situation where a business must manage the consequences of a split determination.
Two risk flags are worth highlighting. First, a refusal in one regime does not automatically trigger a refusal in another – but in our experience, regulators in other jurisdictions often treat a prior refusal as a relevant factor in their own assessment, and non-disclosure of a prior refusal can constitute an independent compliance failure. Second, the EU Blocking Regulation operates in a specific counter-sanctions context: where a business is caught between incompatible obligations from the EU and a third-country sanctions programme, the Blocking Regulation may prohibit compliance with the third-country measure. The UK has its own blocking mechanism, but the scope and the operative thresholds differ. Neither mechanism eliminates the legal tension; they change where the compliance risk sits.
How does extraterritoriality affect export-licence determinations?
The extraterritorial reach of each regime is the dimension most likely to surprise a non-US business. UK financial sanctions under OFSI apply to UK persons (wherever they are located), to entities incorporated in the United Kingdom, and to conduct within the UK. They do not, in the general case, reach a purely foreign transaction between non-UK parties with no UK connection. The EU financial-sanctions instruments similarly apply to EU persons and entities and to conduct within the EU – but the precise scope of the territorial nexus has been elaborated differently across member states, and the aggregated EU network effect is significant because many financial intermediaries with EU-licensed operations are caught by the EU regime even for transactions executed outside the EU.
US secondary-sanctions risk introduces a different dimension entirely. US export controls under the EAR apply to US-origin items and to items incorporating US-origin technology above a defined threshold, regardless of where the re-export occurs or who is exporting. For a UK exporter of goods that incorporate US-origin components, an ECJU licence may be necessary but not sufficient: a BIS determination, and potentially an OFAC licence, may also be required. Where any element of the transaction involves a US nexus, OFAC's reach can extend to non-US parties through secondary-sanctions exposure.
For transactions that touch multiple jurisdictions – a UK exporter, an EU intermediary, a non-EU end-user, and US-origin content in the goods – the export-licence determination is not a single question with a single answer. It is a matrix: one determination per regime, per transaction leg, per type of obligation in play. Missing any cell in that matrix is an enforcement risk. Have you mapped every jurisdiction whose rules could bite on your transaction before you apply for a licence?
What are the procedural timelines and record-keeping obligations?
ECJU's processing times for standard individual export licences vary by workload and complexity; the publicly stated target is a defined number of working days for straightforward applications, with complex cases taking materially longer. OFSI processes specific-licence applications and has published timelines, though the processing period can extend where the application raises novel or complex questions about the relevant thematic sanctions programme. Neither authority publishes a guaranteed turnaround, and neither timeline is matched by a statutory right to a decision within the stated period.
Record-keeping obligations differ as well. Under the UK export-control rules, licence holders must retain supporting documentation for a prescribed period. OFSI's enforcement guidance addresses record-keeping for financial-sanctions licences. Under the EU dual-use rules, exporters are required to retain export documentation for a period specified in the applicable Council Regulation. The retention periods are broadly comparable, but the specific documents required and the form in which they must be kept differ between the regimes.
For a business managing licences across both regimes simultaneously, the administrative burden of maintaining parallel records – with different document sets, different retention periods, and different competent authorities to whom they may be produced – is substantial. Building a unified licence-management system that satisfies both sets of requirements from the outset is materially less costly than retrofitting compliance after an audit or enforcement inquiry.
What are the principal risk flags in practice?
In our cross-border practice, five risk flags recur in export-licence determinations that span both regimes.
First, divergent classification results. An item classified as EAR99 under the US list (no control entry, no licence required) can carry a control entry under the UK list, the EU list, or both. Classification done only under one list, or transposed mechanically from a pre-Brexit determination, will be wrong in some cases. Reclassify under each applicable list as a distinct exercise.
Second, ownership-structure opacity. Both regimes require the exporter to assess the ownership and control of the end-user. Structures involving multiple layers of holding companies, trust arrangements, or nominee shareholders are not unusual in cross-border trade. An incomplete ownership analysis – stopping at the first legal-entity layer – routinely misses a designated-person connection that a full beneficial-ownership map would reveal. The control limb of the UK and EU tests amplifies this risk beyond what a pure ownership check would catch.
Third, the deemed-export issue. Technology transferred to a foreign national on UK or EU territory can require an export licence under both regimes. The deemed-export rules are not identical, and the activities that trigger them – academic collaboration, commercial knowledge transfer, software uploads – require separate analysis for each regime. For a deeper examination of how this plays out under the US EAR, see our analysis of deemed-export compliance for technology transfers under BIS/EAR.
Fourth, catch-all-control gaps. Both the UK and EU systems include catch-all provisions that can require a licence even for non-listed items where the exporter knows or has reasonable grounds to suspect a prohibited end-use. The evidential standard and the process for escalating a catch-all concern differ between the regimes. A compliance team trained only on one system may not recognise the trigger indicators under the other.
Fifth, the interplay with financial sanctions. A goods export that clears the control-list test can still require an OFSI or EU financial-sanctions licence if the payment, the intermediary, or the ultimate beneficial owner of the end-user involves a designated person. Financial-sanctions and export-controls licensing are legally separate processes administered by separate authorities. Securing one licence does not discharge the other. We have acted for businesses that held a valid ECJU licence but had not obtained an OFSI authorisation for the financial leg – the exposure arose not from the goods, but from the transaction structure.
If a transaction has already been flagged, or a filing has been refused, an early legal review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential initial assessment.
A common misconception: one regime's approval clears the path for all
A persistent misconception among cross-border businesses – even among experienced compliance teams – is that a licence granted by one competent authority effectively resolves the position under the other. It does not. An ECJU open individual export licence does not constitute a finding by an EU member-state authority that the export is permitted under the EU dual-use rules. An OFSI general licence does not discharge EU financial-sanctions obligations. The regimes are legally distinct, and each authority makes its own determination on its own legal basis.
The misconception is understandable: before the UK's departure from the EU, UK and EU determinations were, for practical purposes, the same determination. That symmetry ended. The two regimes have since been amended, interpreted, and applied independently. Assuming alignment – without checking – is a compliance gap that enforcement authorities on both sides have noted.
The corrective is straightforward in principle: treat each regime as a separate legal question requiring a separate analysis. In practice, that requires either a team with genuine cross-regime expertise or external counsel who can run both analyses in parallel without telescoping one into the other. For a comparison of how licence exceptions operate between the EU and SECO (Switzerland), see our analysis of EU vs SECO licence-exception eligibility. For the equivalent BIS/EAR versus EU comparison, see our analysis of licence-exception eligibility under the BIS EAR and EU regime.
Related practices
- Deemed export and technology controls (BIS/EAR) – licensing, classification, and end-use controls for technology transfers under US export-control rules.
- Licence-exception eligibility: BIS EAR vs EU – a comparative analysis of exception criteria and the divergences that matter for cross-border exporters.