A Canadian technology distributor ships software to a reseller in a third market. The software incorporates US-origin components. The reseller's end-customer turns out to be subject to OFAC prohibitions. Two regulators now have a potential interest: OFAC, because of the US-origin content, and Global Affairs Canada, because the exporter is a Canadian-registered entity. Which rules govern? Which penalties apply? And does the answer change if the Canadian company had no US nexus beyond the components themselves?
Under OFAC, extraterritorial reach (the extension of US sanctions obligations to non-US persons and non-US transactions) flows primarily from the presence of US-origin goods, technology, or financial intermediation in a transaction – not from the nationality of the exporter. Canada's sanctions regime, administered by Global Affairs Canada under SEMA (the Special Economic Measures Act) and the Export and Import Permits Act, binds Canadian persons and Canadian-registered entities but does not assert the same category of extraterritorial jurisdiction over purely foreign actors. The divergence is consequential: a Canadian exporter with any US-origin content in its product stack faces a dual-compliance obligation that Canada's domestic rules alone do not resolve.
This analysis maps the points of divergence across four dimensions – jurisdictional reach, the re-export control test, ownership and control attribution, and enforcement posture – and sets out the practical steps a cross-border business should take before it ships.
What legal authority drives each regime?
OFAC administers US economic sanctions under authority delegated from IEEPA (the International Emergency Economic Powers Act) and, for older programmes, TWEA (the Trading with the Enemy Act). These statutes vest the executive branch with broad authority to regulate transactions by any person – US or non-US – where the transaction involves a US nexus. The US nexus can be US-origin goods, US-origin technology, a US financial institution, US dollar clearing, or US persons involved at any point in the chain.
Canada's sanctions authority rests on different constitutional ground. SEMA empowers the Governor in Council to impose sanctions in response to a grave breach of international peace and security or a serious violation of international law. The Export and Import Permits Act (EIPA) provides the parallel export-licensing mechanism for controlled goods and technology, including items controlled under Canada's Export Control List. Both instruments bind Canadian persons and entities operating in Canada. Neither creates the same category of jurisdiction over wholly foreign-to-foreign transactions that have no Canadian touchpoint.
That structural difference matters immediately for any business with operations in both countries. OFAC's reach is drawn by the content of the shipment and the route of the transaction. Canada's reach is drawn by the identity and location of the actor. In our cross-border practice, we regularly encounter businesses that treat the two regimes as symmetrical. They are not.
How does each regime define a prohibited re-export?
Under the US rules, a re-export occurs when US-controlled items – whether physical goods, software, or technology – are shipped from one foreign country to another, or when US-origin technology is transferred between foreign nationals. OFAC's sanctions-based prohibition on a re-export arises when the ultimate destination, the end-user, or the end-use is subject to a US sanctions programme. The EAR (Export Administration Regulations), administered by BIS, applies a parallel but distinct re-export control that turns on the Export Control Classification Number of the item and the destination. OFAC and BIS controls are legally separate; both may apply simultaneously to the same shipment.
Canada's EIPA controls re-exports of items on the Export Control List. A re-export licence is required when a Canadian-origin item, or a foreign item that has been imported into Canada and is being re-exported, falls within a controlled category and is destined for a country or end-user triggering the licence requirement. Canada's list-based controls are broadly aligned with the Wassenaar Arrangement and other multilateral export-control regimes. However, Canada does not assert jurisdiction over the onward movement of Canadian-origin content once it has been lawfully exported to a third country – at least not in the same automatic, self-executing way that the EAR's foreign-direct product rule operates for US-origin technology.
The practical implication is sharp. A product with both US-origin and Canadian-origin components leaving a Canadian warehouse for a third market may require a BIS licence, an OFAC authorisation, and an EIPA permit – or none, or some combination – depending on the classification of the item, the destination, and the end-use. Have you reviewed all three instruments before approving the shipment?
Where does extraterritorial reach diverge most sharply?
OFAC's extraterritorial reach operates through two principal mechanisms: the US nexus test and secondary-sanctions exposure. The US nexus test means that any foreign-to-foreign transaction that routes through a US correspondent bank, involves US-origin goods or technology, or is facilitated by a US person (including a US employee of a foreign company) is caught by OFAC's primary prohibitions. Secondary-sanctions risk goes further: it exposes non-US persons who engage in significant transactions with designated parties to the risk of their own designation or of exclusion from the US financial system, even with no direct US nexus in the specific transaction.
Canada does not operate a secondary-sanctions regime of comparable scope. A Canadian company that transacts with an OFAC-designated party faces no automatic Canadian legal prohibition solely on that basis – unless the designated party is also listed under a Canadian sanctions instrument. In practice, many major designees appear on both the OFAC SDN List (OFAC's list of Specially Designated Nationals and blocked persons) and the Canadian equivalent; but the lists are not identical, and the timing of additions differs. A party may be designated by OFAC months before Canada acts, leaving a window in which a Canadian exporter technically complies with Canadian law while being exposed to US secondary-sanctions risk if any US-origin content or US financial intermediation is involved.
In our experience, the most dangerous period for Canadian exporters is precisely that gap: the interval between an OFAC listing and the corresponding Canadian listing. Businesses that run only Canadian-list screening miss the exposure entirely.
The position above covers the standard case. Your facts – the content of your product, the route of the transaction, the location of your financial intermediaries – change the analysis materially.
For an initial assessment of your exposure under OFAC and Canadian export-control rules, contact Calder & Vance at info@caldervance.com.
How does the foreign-direct product rule affect Canadian exporters?
The foreign-direct product rule (FDP rule) under the EAR extends US jurisdiction to foreign-produced items when the item is the direct product of certain US-origin technology or software, or when it is produced by a plant or major component of a plant that is itself the direct product of such technology. The FDP rule has been expanded in recent years to cover specific Entity List contexts. A Canadian manufacturer using US-origin semiconductor fabrication technology may find that its output is subject to EAR controls even if every physical component sourced for the finished product is of non-US origin.
Canada has no equivalent rule. Canadian export-control law does not assert jurisdiction over the downstream products of Canadian-origin technology once that technology has been lawfully transferred abroad. The asymmetry is significant. A Canadian company building a product that incorporates US-origin production equipment or software tools needs to assess FDP rule exposure under the EAR – and that assessment belongs to US export-control counsel, not solely to Canadian compliance staff.
This is one of the most frequently overlooked compliance gaps we encounter in practice. A Canadian manufacturer will correctly obtain EIPA clearance for its exports and will correctly screen end-users against Canadian lists. It will then assume the transaction is clean. It is not, if US-origin production technology is in the supply chain and the FDP rule applies. The question is not rhetorical: how many tiers back have you traced the origin of your production inputs?
For a technical classification and FDP-rule analysis under the EAR, see our service page on deemed export and technology controls under BIS and the EAR.
What is the ownership and control attribution test under each regime?
OFAC applies the 50 percent rule: any entity owned 50 percent or more in the aggregate, directly or indirectly, by one or more SDN-listed persons is itself treated as blocked, even if it does not appear on the SDN List by name. The test is arithmetic and automatic. OFAC has confirmed that the rule aggregates the holdings of multiple listed persons to reach the threshold. No separate designation is required. The blocked status attaches to the entity by operation of the rule.
Canada's sanctions instruments adopt an ownership and control test that looks to whether a designated person owns or controls the entity in question. "Control" is a broader concept than arithmetic ownership: it can encompass de facto direction, contractual control, or governance rights that fall below the 50 percent ownership threshold. In practical terms, a Canadian sanctions analysis may require a qualitative assessment of control that the US arithmetic test does not.
The divergence creates compliance complexity for transactions involving complex corporate structures. An entity that falls just below the OFAC 50 percent threshold – say, a company that is 45 percent owned by a listed person – may nonetheless be caught under a Canadian control analysis if the listed person exercises de facto direction. Conversely, an entity above 50 percent aggregate ownership by listed persons is blocked under OFAC regardless of whether a Canadian analysis would reach the same conclusion. A dual-regime ownership mapping exercise is therefore not optional for high-risk transactions; it is the minimum standard of care.
How do enforcement postures compare?
OFAC's civil enforcement programme is one of the most active of any sanctions authority globally. OFAC publishes enforcement actions with detailed statement-of-facts releases, and it routinely pursues non-US persons and entities where a US nexus is established. Civil penalties can be substantial; OFAC calculates penalties on a per-transaction basis, and the aggregate exposure across a pattern of violations can be significant. OFAC's enforcement guidance treats a VSD (voluntary self-disclosure to a regulator) as a mitigating factor that can materially reduce the base penalty.
Canada's sanctions enforcement under SEMA and the EIPA has historically been less frequent and less publicly visible than OFAC's enforcement record. That does not mean enforcement is absent. Contraventions of EIPA export-licensing requirements carry criminal penalties, and prosecutions have been brought for unlicensed exports of controlled goods. The trajectory of Canadian enforcement activity has been towards greater scrutiny and more public reporting, consistent with broader international trends.
For a business with dual exposure, the asymmetry in enforcement culture creates a perverse dynamic. A company may assess its Canadian risk as manageable while underweighting the OFAC exposure that attaches to the same transaction through the US-origin content in the shipment. We regularly advise clients who have conducted a thorough Canadian compliance review and have not separately modelled the OFAC risk profile. The two analyses need to run in parallel, not sequentially.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time.
To discuss an enforcement exposure or a voluntary self-disclosure strategy, contact Calder & Vance at info@caldervance.com.
A common misconception: Canadian compliance clears the US risk
The most persistent myth in this area is that a clean Canadian compliance review – proper EIPA permitting, correct Canadian-list screening, no prohibited Canadian-person nexus – means the transaction is clear of US regulatory risk. It does not.
OFAC jurisdiction attaches to the US-origin content, to the US financial intermediary, or to the US person involved in the deal. None of those triggers requires Canadian regulatory involvement. A Canadian exporter with full EIPA compliance may still be in violation of OFAC's rules if it ships to an SDN-listed end-user through a route involving a US correspondent bank, or if the items contain US-origin technology classified under the EAR.
The corrective is not complex in principle, though it is demanding in practice: build a compliance review that addresses all applicable regimes simultaneously, not in sequence. Screen against US lists as well as Canadian lists. Assess the origin of goods and technology inputs, not only the goods themselves. Confirm whether any financial intermediary in the payment chain is a US institution. And document the analysis so that, in the event of a regulatory inquiry, the decision-making process is clearly reconstructable. That documentation standard applies equally under OFAC's guidelines and under Canada's export-control regime.
Practical steps for cross-border businesses
The following decision sequence is not exhaustive, but it addresses the points of highest risk for Canadian businesses with US-origin content in their supply chains.
- Map the origin of all inputs. Identify every component, software package, and item of technology in the product that originates in the United States. Confirm whether any is subject to EAR controls and whether the FDP rule could extend those controls to the finished product.
- Screen all parties against both lists. Run the end-customer, the consignee, the freight forwarder, and all intermediaries against the OFAC SDN List and the Canadian Consolidated Autonomous Sanctions List. Do not rely on a single-list screen for a dual-regime transaction.
- Assess the payment route. Confirm whether any financial institution in the payment chain is a US-chartered institution or processes the transaction through a US correspondent. If so, OFAC's rules apply regardless of where the goods originate.
- Classify the goods under both regimes. Confirm the Export Control Classification Number under the EAR and the equivalent Group 1 classification under Canada's Export Control List. Both classifications are required before a licence determination can be made.
- Determine licence requirements and exceptions. Where a licence may be required under OFAC, the EAR, or the EIPA, identify the applicable exception or authorisation pathway before proceeding. Proceeding without this step is the source of the majority of enforcement exposure we see in practice.
- Document the compliance decision. Record the screening results, the classification rationale, the licence determination, and the basis for any exception relied upon. Maintain that record for a period consistent with the applicable record-keeping requirement of each regime.
For the EU dimension of re-export and extraterritoriality, see our analysis of OFAC vs the EU: re-export and extraterritorial reach compared. For the UK dimension, see our analysis of OFAC vs OFSI: re-export and extraterritorial reach compared.
Related practices
- Deemed export and technology controls – BIS and EAR – classification, deemed-export analysis, and licence applications under the EAR
- OFAC vs EU: re-export and extraterritoriality – regime comparison across US and EU export-control obligations
- OFAC vs OFSI: re-export and extraterritoriality – US and UK divergence on re-export controls and secondary-sanctions reach