A European equipment manufacturer ships a controlled item to a distributor. Weeks later, an internal review flags a possible licensing gap under the Export Administration Regulations (EAR – the US Commerce Department's primary export-control regime, administered by the Bureau of Industry and Security). The shipment is already in the destination country. The same transaction may also have triggered EU dual-use obligations. Two regulators. Two enforcement postures. One legal team trying to decide whether to disclose, and to whom.
As of March 2026, enforcement risk after a breach under the BIS / EAR and under the EU dual-use regime differs in material respects: the legal basis, the penalty architecture, the role of voluntary self-disclosure, and the extraterritorial reach each follow distinct paths. Understanding those differences is the first practical step for any cross-border business that discovers an apparent violation.
This analysis maps those differences, identifies the points at which the regimes interact, and sets out the decision sequence a compliance team should follow when a breach surfaces on both sides of the Atlantic.
How do the BIS / EAR and EU dual-use regimes ground their enforcement authority?
BIS derives its enforcement authority from the Export Control Reform Act and the EAR, which operate under the broad grant of the International Emergency Economic Powers Act (IEEPA). BIS exercises authority through its Office of Export Enforcement (OEE) and the Office of Antiboycott Compliance. Criminal matters are referred to the Department of Justice. The EU dual-use regime rests on a Council Regulation that imposes directly applicable obligations across all member states; enforcement is decentralised, meaning each member state's competent authority – customs, trade, or a dedicated licensing body – investigates and penalises breaches within its own territory.
That structural difference matters immediately after a breach. A BIS apparent violation presents a single federal counterpart. An EU apparent violation may engage the authorities of every member state through whose territory or jurisdiction the transaction passed. A German exporter who shipped through a Dutch freight forwarder to a buyer whose end-user certificate raised questions could face inquiries from more than one national authority simultaneously. We regularly advise clients on exactly this multi-authority scenario, and the burden of managing parallel proceedings is consistently underestimated.
The UN Security Council maintains its own Consolidated List, which sits above both regimes and captures the most significant proliferation-related designations. Neither BIS nor EU licensing cures a UN-listed end-user situation, and any cross-border analysis must check the Consolidated List first.
What is the BIS enforcement procedure after a breach?
BIS enforcement after an apparent violation typically begins with OEE investigation – either triggered by an internal disclosure, a tip, a customs referral, or a licensing anomaly identified during routine review. The process moves through three main stages: investigation, charging (by way of a charging letter), and settlement or hearing before an administrative law judge.
The most consequential early decision is whether to make a voluntary self-disclosure (VSD – a proactive report to OEE describing the apparent violation before BIS initiates its own inquiry). BIS guidance describes VSD as a mitigating factor. In our experience advising exporters across multiple sectors, a well-prepared VSD – factually complete, submitted promptly, and accompanied by a remediation plan – consistently produces more favourable treatment than a case in which OEE learns of the violation independently. The guidance does not guarantee an outcome, and no practitioner should promise one.
Under the EAR, civil penalties can be assessed per violation. The monetary base for civil penalties is subject to adjustment under applicable statutory inflation provisions; the current figures should be verified against the latest Federal Register notice before reliance. Criminal penalties for wilful violations are a separate track, with potential terms of imprisonment and higher fines. The distinction between wilful and non-wilful is therefore central to any early risk assessment.
A further BIS-specific risk is the Denied Persons List and Entity List – administrative tools that prohibit dealings with listed parties without a specific licence. Post-breach, BIS may impose a Temporary Denial Order (TDO – an emergency measure suspending a company's export privileges) where ongoing harm is alleged. A TDO is a severe interim step that can halt a business. The mere risk of a TDO application should accelerate the VSD decision.
How does EU enforcement after a dual-use breach compare in procedure and penalty?
EU enforcement procedure lacks the federal-counterpart simplicity of BIS. Each member state implements the Council Regulation through national law, and the penalty regimes – both civil and criminal – vary considerably across the EU. Some member states cap administrative fines at multiples of the transaction value; others prescribe fixed monetary bands. Criminal exposure ranges from modest fines to significant custodial terms depending on the national implementing legislation.
Does that variation create a lighter-touch outcome for a business that breaches the regime? Not reliably. Member states with historically active enforcement – including Germany, the Netherlands, France, and Sweden – apply serious penalties, and their customs and export-control authorities work closely with each other and with the European Commission. A business that assumes it can resolve matters quietly in a more lenient jurisdiction may find that the primary exporting member state's authority takes the lead regardless of where the goods transited.
The EU regime does not have a formal VSD mechanism equivalent to the BIS process. Cooperation and early engagement with the competent national authority can mitigate penalty, but the procedural basis and the credit given for cooperation depend on national procedural rules rather than a harmonised EU standard. This is one of the most practically significant divergences between the two regimes. In our cross-border practice, clients frequently assume that a BIS VSD filing will cover their EU exposure or vice versa. It does not. Each regime requires its own disclosure and remediation strategy.
The EU also operates a catch-all control – an obligation that can require authorisation for exports not listed on the dual-use annex if the exporter has grounds to believe the items could contribute to certain end-uses or end-users of concern. Breach of a catch-all obligation is enforceable under the same national penalty regimes. This creates a risk that sits outside the item-classification logic and is therefore harder to manage purely through compliance checklists.
Where do BIS extraterritorial reach and EU jurisdiction create overlap for a cross-border business?
BIS's extraterritorial reach through the de minimis rule and the foreign direct product rule (FDPR – a rule that extends EAR jurisdiction to foreign-made items incorporating US-origin content above a threshold, or produced using certain US technology) is one of the most operationally significant features of the EAR for non-US businesses. A European company that exports a product containing US-origin components above the applicable de minimis threshold, or that is the direct product of certain US-controlled technology, is exporting a US-regulated item whether or not it recognises that fact.
That jurisdictional overlap means a European exporter can face simultaneous enforcement exposure: OEE pursuing an EAR violation, and a national EU authority pursuing a breach of the relevant Council Regulation. The two investigations are legally independent. A settlement with BIS does not close the EU inquiry, and vice versa. Coordinating legal strategy across both jurisdictions is therefore essential, not optional.
Japan, Singapore, and the UAE each operate export-control regimes that may also be engaged depending on the destination, the item, and the route. Japan's Foreign Exchange and Foreign Trade Act, Singapore's Strategic Goods Act, and the UAE's dual-use controls all impose obligations that can produce enforcement risk where a shipment transits or where the exporter or distributor is established in those jurisdictions. A complete post-breach risk map must consider all jurisdictions the transaction touched.
The position above covers the standard multi-jurisdiction case. Your specific facts – the item's classification, the end-user, the destination, the transaction route, and the nationalities of the parties – change the analysis materially.
For a cross-regime assessment of your specific exposure, contact Calder & Vance at info@caldervance.com.
What are the key risk flags that elevate enforcement exposure after a breach?
Certain features of a transaction consistently elevate enforcement risk after an apparent violation surfaces. They are worth mapping explicitly because they shape both the urgency of counsel involvement and the likely trajectory of any enforcement inquiry.
The first is end-user concern. Where the ultimate recipient was on the Entity List, the EU Consolidated List, or the UN Consolidated List at the time of the transaction, enforcement exposure rises sharply. A licensing gap is significantly more serious when the unlicensed export reached a restricted party than when it reached a commercially ordinary customer. BIS and EU authorities treat this as an aggravating factor.
The second is item sensitivity. Exports of items controlled for national security, weapons proliferation, or missile technology attract greater regulatory attention than lower-tier controlled items. Under the EAR, items with certain Export Control Classification Numbers (ECCNs – the alphanumeric codes on the Commerce Control List that determine an item's control status and applicable licence requirements) carry a higher penalty exposure profile when exported without a required licence.
The third is knowledge or reason to know. Both the EAR and EU law distinguish between negligent, reckless, and knowing violations. Evidence that the business had red flags – an unusual destination, a suspicious intermediary, an end-use certificate inconsistent with the buyer's business – and failed to act on them moves the matter toward the more serious end of the enforcement spectrum. That shift has implications for whether criminal referral is a live risk.
The fourth is systemic failure. A single isolated error carries different weight from a pattern of similar violations across multiple transactions. Where internal review surfaces multiple instances, the case for immediate counsel engagement and a structured VSD is strong. Attempting to resolve multiple violations piecemeal, or self-certifying compliance without independent review, regularly compounds the original problem.
Finally, remediation speed matters. Both BIS and EU national authorities look at what the business did after it discovered the apparent violation. A company that self-identified, contained the issue, brought in counsel, and began preparing a disclosure within a short window after discovery will be in a materially better position than one that delayed, conducted an incomplete internal review, or initially declined to treat the matter as a potential violation.
How does voluntary self-disclosure work under BIS / EAR, and what is the EU equivalent?
Under the EAR, a VSD is a formal written submission to OEE that describes the apparent violation, the parties, the items, the destinations, and the circumstances, together with a preliminary assessment of the applicable controls and a proposed remediation plan. BIS guidance sets out what a complete VSD contains; the quality of the submission affects the credit given. A VSD that is vague, incomplete, or submitted after BIS has independently begun an inquiry receives reduced mitigation credit. The business must self-report; a disclosure prompted by an OEE inquiry already in progress is not a VSD.
Timing matters critically. The guidance does not specify a rigid deadline for VSD submission, but the practical window narrows quickly once OEE or another federal agency becomes aware of the apparent violation through any independent route. Acting within days, not weeks, of an internal discovery is the norm in well-run post-breach programmes.
The EU does not have a single harmonised VSD instrument. Member states vary in how they treat voluntary disclosure: some have formal procedures under their national implementing legislation; others treat cooperation as a general mitigating factor within the penalty calculation. The common thread across the EU member states with the most active enforcement is that early, voluntary, and detailed cooperation is treated as mitigating. The absence of a harmonised process means the mechanics must be assessed jurisdiction by jurisdiction. In a matter where the breach touched multiple member states, the sequencing of disclosures across authorities requires careful strategic judgement.
If a transaction has already been flagged by a regulator, or if an internal review has surfaced an apparent violation, an early review of the VSD options can preserve options that narrow quickly with time.
To discuss a disclosure strategy or to scope the apparent violation across both regimes, contact Calder & Vance at info@caldervance.com.
What is the post-breach compliance remediation the regulators expect?
Both BIS and EU national authorities expect post-breach remediation that goes beyond the immediate disclosure. A business that surfaces an apparent violation and simply stops there – without improving the programme that produced the error – signals to the regulator that further violations are likely. That inference harms the enforcement outcome.
BIS guidance identifies several elements of an effective compliance programme: senior management commitment, export-control risk assessment, written policies and procedures, training, screening against the relevant lists, a process for reviewing and addressing red flags, and auditing of the programme's effectiveness. Where a VSD is submitted, a concrete remediation plan addressing these elements should accompany it.
EU national authorities apply their own expectations, which generally track the same logic even where they are less formally codified. The German BAFA, the Dutch Ministry of Foreign Affairs, and the French DGDDI each have published guidance that emphasises the importance of internal controls, staff training, and management oversight. Demonstrating that you have redesigned the programme in response to the violation – not merely retrained the compliance officer who missed the check – is consistently the stronger remediation story.
What does a well-designed post-breach programme look like in practice? It maps the specific failure – classification error, screening gap, inadequate end-user review, management oversight failure – and puts a discrete control against each failure mode. It allocates responsibility. It sets a review date. It is documented and can be produced to a regulator on request. In our practice, we regularly work with compliance teams to test that programme against the standard both BIS and EU authorities expect, and to document it in a form that supports a VSD filing or a penalty-mitigation submission.
What is the common misconception about resolving post-breach exposure, and when should counsel be involved?
The most persistent misconception we encounter is that a single internal review – conducted by the compliance team that ran the original transaction – provides sufficient basis for a VSD or for a conclusion that no disclosure is required. It does not. An internal review conducted without legal privilege, without independent oversight, and without a structured methodology is likely to miss systemic issues, to understate the scope of affected transactions, and to produce a document that becomes discoverable and damaging in subsequent proceedings.
A second misconception is that disclosure to BIS resolves the EU exposure. As noted above, the two regimes are legally independent. Separate disclosure strategies, calibrated to the specific member states involved and the national procedural rules that apply, are required. A business that submits a strong VSD to BIS and then assumes the EU matter is also managed has not resolved its cross-border position.
Counsel should be involved at the earliest point at which an apparent violation is identified – ideally before any substantive internal review is conducted, so that privilege can attach to the investigation from the outset. The question is not whether the business can handle the review internally; in many cases, internal teams are capable and well-informed. The question is whether an unprotected internal investigation is the right vehicle for a matter that could result in civil or criminal enforcement in multiple jurisdictions.
Our practice on post-breach matters covers the full sequence: scoping the apparent violation under both BIS / EAR and EU dual-use rules, advising on VSD strategy and timing, preparing the disclosure submission and accompanying remediation plan, managing regulator queries across jurisdictions, and designing the programme improvements that form the remediation package. For exporters and trading houses facing a post-breach situation, engaging specialist export-control counsel early consistently produces a better-managed process and a more defensible outcome.
Related practices
- Apparent violation assessment (EU) – scoping EU dual-use enforcement exposure and disclosure options after a breach
- Post-breach enforcement risk: OFAC vs BIS / EAR analysis – comparing OFAC and BIS enforcement postures for US-nexus violations
- Post-breach enforcement risk: OFAC vs EU analysis – enforcement divergence between OFAC financial sanctions and EU measures