A dual-use goods exporter operating across the Atlantic ships a consignment to a distributor in a third market. Weeks later, BIS opens an inquiry. Simultaneously, the EU member-state authority where the exporter's European subsidiary is licensed flags the same transaction. Two enforcement files. Two penalty regimes. Entirely different procedural rules. What the exporter does in Washington can affect its position in Brussels – and what it fails to do in either can compound the damage in both.
Penalty defence and settlement under BIS / EAR and the EU export-control regime follow different legal architectures: BIS operates a structured administrative penalty process under IEEPA and the Export Control Reform Act, with a formal settlement path through an Order Relating to Export Privileges and a voluntary self-disclosure credit; EU enforcement is fragmented across member states, each applying its own procedural law under the EU dual-use rules, with no single settlement authority and widely varying penalty caps. Where an apparent violation touches both regimes, the divergence between them is not merely technical – it shapes every tactical decision from the first internal review through to final resolution.
This analysis maps the two systems side by side: the authorities, the procedure, the settlement mechanics, the mitigating factors each regime recognises, and the cross-border risk flags that counsel needs to address before the first formal response is filed.
Who administers the process, and what is the legal basis?
BIS – the Bureau of Industry and Security within the US Department of Commerce – administers the Export Administration Regulations under authority delegated by IEEPA and the Export Control Reform Act. It investigates apparent violations through its Office of Export Enforcement and pursues civil penalties through the administrative penalty process. The Department of Justice may bring parallel criminal proceedings where the facts support it, and coordination between the two is active in serious cases.
The EU dual-use regime operates through EU Regulation 2021/821 as the governing instrument. That regulation sets out the obligations – licensing, end-use controls, catch-all requirements – but delegates enforcement entirely to member states. Each member state designates its own competent authority. In Germany it is BAFA; in France, the SBDU within the Directorate-General for Enterprise; in the Netherlands, the Central Import and Export Service. There is no EU-level enforcement body, no EU-level settlement authority, and no common procedural code. A multinational with operations in several member states faces, in principle, as many separate enforcement processes as it has relevant subsidiaries.
That structural difference is the starting point for any cross-border penalty defence. BIS produces a single decision on the US conduct. The EU may produce multiple decisions on conduct that is legally the same transaction, assessed under different national procedural rules, with different timelines and different penalty caps.
How does BIS conduct an apparent-violation review?
BIS initiates an apparent-violation inquiry on the basis of a referral, a tip, or its own screening of export data. The Office of Export Enforcement may request a meeting, issue a subpoena for records, or proceed directly to a charging letter. The company has an opportunity to respond, to request a hearing before an administrative law judge, and to negotiate a settlement before or after formal charges are filed.
Settlement is common in export-control enforcement. BIS works through a consent order process: the parties agree on a civil penalty, a compliance commitment, and – in higher-risk cases – a monitorship or third-party audit requirement. Where a voluntary self-disclosure (VSD – a self-initiated report to BIS of an apparent violation before the agency opens its own inquiry) has been filed, BIS treats it as a significant mitigating factor. The agency's penalty guidelines describe VSD as warranting a substantial reduction from the otherwise applicable base penalty. In our experience advising exporters through this process, a well-prepared VSD that accurately scopes the violation and demonstrates prompt remedial action consistently produces a more favourable settlement position than the equivalent conduct handled reactively.
The timeline from the opening of an OEE inquiry to a final settlement agreement is variable. Straightforward cases with a VSD and clear cooperation can resolve within several months. Contested matters with parallel criminal referral can extend considerably longer. BIS does not publish a fixed statutory deadline for resolution of civil enforcement proceedings.
What is the EU enforcement procedure for a dual-use violation?
EU enforcement begins at member-state level. The competent authority in the relevant member state – the one in which the licence was issued or in which the exporter is established – investigates the apparent violation under its national administrative or criminal procedure law. Some member states treat export-control violations as purely administrative offences; others can criminalise them. The characterisation affects everything from document-production obligations to the right to silence.
There is no EU-wide settlement procedure equivalent to the BIS consent-order process. Some member states permit negotiated outcomes; others apply a fixed penalty scale that leaves little room for factual mitigation. The mitigating factors recognised vary: some competent authorities formally credit a voluntary disclosure equivalent to the BIS VSD; others treat it as a procedural point with limited weight. A business that assumes the BIS penalty-mitigation logic will transfer automatically to a European enforcement file is likely to be disappointed.
Enforcement timelines in EU member states are governed by national limitation periods and administrative procedure law. Where the exporter operates through subsidiaries in multiple member states, it may face overlapping inquiries with different deadlines, different document-production requirements, and different concepts of privilege. Coordinating those proceedings without inadvertently waiving privilege in one jurisdiction while asserting it in another is a practical task that requires early, specialist attention.
What does this mean for a compliance team that has just discovered an apparent violation and is deciding where to start? The answer depends on where the goods were licensed, where the exporter is established, and where BIS has signalled its interest. All three may point in different directions.
How do the penalty factors and mitigation credits compare?
BIS applies a penalty-factor analysis that is broadly analogous to, though structurally distinct from, OFAC's framework. Aggravating factors recognised by BIS include: wilful or knowing conduct; harm to national security objectives; concealment or obstruction; the existence of a compliance programme that was ignored; and prior violations. Mitigating factors include: VSD; cooperation; the absence of prior violations; remedial action; and the existence of a well-designed compliance programme at the time of the violation.
The compliance-programme credit is worth particular attention. BIS – like OFAC – distinguishes between a programme that exists on paper and one that functions in practice. An exporter with a written export-compliance policy but no training records, no classification review procedures, and no documented screening of end-users will find that its "compliance programme" carries little mitigating weight. In our cross-border practice, we regularly advise clients to treat the pre-violation state of their compliance programme as an evidence-gathering priority from the moment an apparent violation is identified.
On the EU side, the mitigating factors recognised vary by member state. Common considerations include: whether the violation was disclosed proactively; the gravity and duration of the violation; the exporter's compliance history; and remedial steps taken. However, the weight assigned to each factor, and the procedural mechanism for presenting them, differs materially across jurisdictions. Where a single shipment touches BAFA in Germany and the French SBDU simultaneously, the exporter cannot assume that the same factual narrative will carry equivalent mitigating weight in both forums.
The divergence extends to penalty caps. BIS civil penalties are calculated per violation and per day of a continuing violation. EU member-state caps are set by national law; they range from modest fixed amounts in some jurisdictions to unlimited or revenue-based penalties in others. The most commercially significant risk in a cross-border matter may sit in one regime or the other depending on the facts – which is why a joint assessment of both penalty exposures should be the first analytical step, not an afterthought.
Does cooperation with BIS affect the EU position, and vice versa?
This is the cross-border question that generates the most tactical complexity, and it has no uniform answer. Cooperation with BIS – including the production of documents, the making of witness statements, and the filing of a VSD – does not automatically assist or harm the EU position. But the two processes interact in ways that are not always obvious.
A VSD filed with BIS will describe the apparent violation, the goods involved, the end-user, and the remedial steps taken. That narrative becomes a fixed point in the factual record. If the EU competent authority later requests information, the exporter's description of the conduct needs to be consistent with the VSD without creating inadvertent admissions under a different legal standard. An EU competent authority applying criminal-procedure principles may treat a detailed BIS VSD as the equivalent of a confession; one applying administrative-procedure principles may treat it as cooperation evidence supporting a reduced penalty. Neither outcome is certain in advance.
The reverse dynamic is equally significant. A response to an EU competent authority that includes a factual account of the violation can be requested by BIS through mutual legal assistance or informal law-enforcement channels. Exporters that treat their EU and US enforcement files as separate matters, managed by separate teams with no coordination, routinely create inconsistencies that harm both positions. We regularly advise that a single coordinated factual narrative – developed by counsel with visibility across both processes – is an essential early step in any multi-jurisdictional export-control matter.
The position of the exporter's non-US personnel is a specific risk. BIS has broad authority over conduct with a US nexus, including the activities of non-US subsidiaries that re-export US-origin goods or technology. A European export manager involved in a transaction that BIS classifies as a violation of the EAR may find themselves subject to a denial of export privileges – an outcome that affects their personal ability to engage in US trade, regardless of where they are based.
What are the principal risk flags in a joint BIS / EU enforcement matter?
Several risk patterns recur in cross-border export-control enforcement. The first is a failure to scope the apparent violation accurately before the VSD or the first voluntary submission is filed. An exporter that files a VSD describing a single shipment, then discovers further apparent violations during internal review, faces a significantly more difficult position than one that took the time – before filing – to conduct a thorough lookback. BIS guidance is clear that a VSD should be accurate and complete; supplemental disclosures after the initial filing attract scrutiny.
The second risk is the assumption that a VSD filed with BIS covers the EU position. It does not. The EU competent authority has no formal notification mechanism linked to BIS, and a proactive disclosure must be made separately and under the procedural rules of the relevant member state. The timing of that separate disclosure – and its contents – is a tactical decision that should be made by counsel with cross-border visibility, not by the exporter's compliance team acting independently.
A third risk arises from record-keeping gaps. BIS requires exporters to maintain records of export transactions for a defined period. EU dual-use rules impose their own record-keeping obligations under the applicable member-state regime. Where the internal records are incomplete – either because the retention period has passed or because the documentation was never created – the exporter's ability to demonstrate that a transaction was licensed, classified correctly, or subject to a valid end-use undertaking is materially weakened. Gaps in records are not, by themselves, an aggravating factor; but they limit the mitigating narrative available to counsel.
A fourth risk is the assumption that a negotiated BIS settlement closes the matter. Civil settlement with BIS resolves the administrative proceeding. It does not resolve any parallel criminal investigation, any ongoing EU enforcement file, or any financial-sanctions exposure that may arise from the same transaction under OFAC – which operates an entirely separate enforcement regime with its own penalty calculus. In a transaction involving dual-use goods, financial payments, and a third-market end-user, all three US authorities – BIS, OFAC, and DOJ – may be active simultaneously.
A fifth risk, and one we see regularly, is the underestimation of the export-compliance-programme evidence burden. Both BIS and the more sophisticated EU competent authorities will assess the state of the programme at the time of the violation. An exporter that cannot produce training records, classification documentation, screening logs, and escalation procedures for the period in question will find that the mitigating value of its compliance programme is severely discounted. Building that evidentiary record during the internal review – rather than reconstructing it from memory during the enforcement proceedings – is a material difference in outcome.
If your business has received an inquiry from BIS, OEE, or a European competent authority, the position above covers the standard analytical frame. Your specific facts – the goods, the end-user, the licence status, the member states involved, and the timeline of internal discovery – will change the analysis substantially.
For a confidential assessment of your cross-border enforcement exposure, contact Calder & Vance at info@caldervance.com.
A common myth: "If we cooperate with one authority, the other will follow"
A persistent assumption in cross-border enforcement is that cooperation with the lead authority – typically BIS, where the goods have a US origin – will translate automatically into a cooperative credit with the EU competent authority. This is not how either regime works in practice.
BIS assesses cooperation by reference to the exporter's conduct before it: prompt response to requests, accurate voluntary disclosure, no obstruction, no concealment. The EU competent authority makes its own assessment under its own procedural rules. That assessment may not reference the BIS file at all. In member states where enforcement is primarily administrative, the competent authority may have limited visibility of the BIS proceeding; in member states where enforcement is handled by a prosecutor, the interest in the BIS settlement terms may be significant but the legal effect of them under national law may be nil.
Exporters sometimes assume that a BIS settlement agreement – which typically includes a compliance commitment and sometimes a monitorship – satisfies the EU authority's concern about future conduct. In our experience, EU competent authorities apply their own assessment of the exporter's remedial programme, independent of any BIS order. A monitorship or compliance commitment imposed by BIS does not substitute for the evidence of corrective action that the EU authority expects to see.
The myth runs in the other direction too. Exporters that have negotiated a favourable outcome with a European competent authority sometimes approach BIS on the assumption that the European result is persuasive. BIS makes its own determination on the facts as they relate to the EAR and the US national-security interest. The outcome in Europe, while not irrelevant as a factual matter, carries no formal weight in the BIS proceeding.
If a transaction has already been flagged by either authority – or if an internal review has identified an apparent violation – early specialist review can preserve options that narrow with time. The sequencing of disclosures, the scope of the initial VSD, and the coordination of factual narratives across jurisdictions are decisions that are far easier to make correctly before the first formal submission than to correct afterwards.
Contact Calder & Vance at info@caldervance.com for a review of a flagged transaction or an active enforcement file.
When should a cross-border business involve counsel?
The answer, consistently, is earlier than feels necessary. The internal review that identifies an apparent violation is not a neutral, consequence-free process. Decisions made during that review – who is interviewed, what documents are preserved, what communications are sent – can affect privilege, can create the record that BIS or the EU competent authority later reviews, and can limit or expand the options available at the penalty-defence and settlement stage.
Counsel should be involved at the moment an apparent violation is identified and before any voluntary disclosure is filed with either authority. The scope of the disclosure, its timing relative to any ongoing agency inquiry, and its contents are all tactical decisions. A VSD filed before the scope of the violation is properly understood, or filed with an inaccurate description of the goods or the end-use, does more harm than a disclosure made after a proper internal review.
A parallel consideration is the position of individual employees. In export-control enforcement, both BIS and EU criminal prosecutors may pursue individuals – not just entities – for violations. The interests of the entity and of its employees may diverge at any point in the enforcement process. Counsel advising the entity should identify that divergence early and ensure that individuals who may face personal exposure obtain independent representation before they participate in any internal review or make any statement to an authority.
The decision matrix for a cross-border business that has identified an apparent violation runs broadly as follows:
Situation A – the violation appears limited to a single jurisdiction and the internal review is complete: assess VSD eligibility under the relevant regime; prepare a disclosure that is accurate and complete; engage with the competent authority on timeline and scope; document the remedial programme. The BIS process may resolve in months; EU timelines vary by member state.
Situation B – the violation touches both BIS and one or more EU competent authorities: establish a single coordinated factual narrative before any disclosure is filed; assess the privilege position in each jurisdiction; determine the optimal sequencing of disclosures; ensure the internal review is conducted under privilege where possible; identify any individual-exposure issues early. Timeline will be longer; settlement sequencing matters.
Situation C – BIS or DOJ has already opened an inquiry: the VSD window may have closed for full credit purposes; the priority shifts to cooperation, accurate and prompt production of requested records, and preparation of the factual and legal defence. Parallel EU exposure should be assessed immediately.
In a recent matter, a manufacturing business with operations in two European member states identified an apparent violation of the EAR arising from a re-export of US-origin components by one of its subsidiaries. The violation had a potential EU dual-use dimension. We scoped the apparent violation across all affected entities, prepared a coordinated VSD to BIS that was accurate and complete, made separate proactive disclosures to both relevant EU competent authorities under their respective procedural rules, and managed the production of records to each authority under a coordinated privilege framework. The matter was resolved without parallel criminal proceedings.
Related practices
- EU apparent violation assessment – expert review of export-control exposure under EU dual-use rules
- OFAC vs BIS / EAR penalty defence: a comparative analysis – how the two US regimes diverge on settlement and mitigation
- OFAC and BIS / EAR penalty defence in practice – procedural guidance for cross-border enforcement matters