OFAC vs BIS / EAR: Ship-to-ship transfer risk controls compared

A commodity trader with a cargo moving between two offshore points receives a routine charter confirmation. Buried in the voyage instructions is a notation: "STS at outer anchorage." The compliance team pauses. Is the ship-to-ship transfer itself a sanctions event? Does OFAC's analysis differ from the EAR? And does it matter which crew member presses the pump switch? These questions decide whether the deal closes, whether a licence is needed, and whether a voluntary self-disclosure becomes necessary.

Ship-to-ship transfer risk controls under OFAC and under the BIS Export Administration Regulations operate on fundamentally different legal theories, even when applied to identical physical movements of cargo at sea. OFAC's controls are transaction-based and party-based: they prohibit dealings with blocked persons and blocked property, and they apply to any US person or any transaction with a US nexus regardless of where the transfer occurs. BIS controls are item-based and destination-based: they follow the classification of the cargo on the Commerce Control List and the end-use and end-user characteristics of the transaction. A single STS transfer can trigger both regimes simultaneously, or only one, or neither – and the analysis under each regime runs on a different track.

This analysis sets out, regime by regime, what each authority requires, where the two diverge on the key criteria a practitioner must test, and what those divergences mean for the cross-border business that relies on maritime movements as a core element of its supply chain.

What is the legal basis for each regime's authority over a ship-to-ship transfer?

OFAC derives its authority principally from IEEPA and, in older programmes, from the Trading with the Enemy Act. That authority reaches any US person anywhere in the world, any person within the United States, and any transaction that uses the US financial system or involves US-origin goods, technology, or services. The prohibition is transactional: if a blocked person is a party, or if blocked property is involved, the transaction is prohibited unless licensed. The physical location of the STS – whether in international waters, in the exclusive economic zone of a third state, or in a coastal state's territorial sea – is legally irrelevant to OFAC's reach once a US nexus exists.

BIS administers the EAR under authority derived from the Export Control Reform Act. Its controls attach to items on the Commerce Control List, classified by an ECCN (Export Control Classification Number), and to items subject to the EAR but not separately classified, which are designated EAR99. The EAR applies extraterritorially through Foreign Direct Product rules (FDP rules), which can bring foreign-made items within US jurisdiction where they are the direct product of controlled US technology or software. A maritime cargo transfer is within BIS jurisdiction if the cargo is an EAR-controlled item or if the re-export involves a foreign-produced item meeting FDP-rule thresholds. The physical movement at sea is the occasion for the export or re-export, not by itself a separate regulated act.

The doctrinal difference matters immediately in practice. OFAC asks: who are the parties and is there blocked property? BIS asks: what is the item, where is it going, and who will receive it? Both questions must be answered before any STS transaction that involves US-nexus cargo or parties can be cleared.

How does each regime treat the party-screening obligation?

Under OFAC, party screening is the central control. The SDN List (OFAC's list of Specially Designated Nationals and blocked persons) must be checked against every party with a role in the transaction: the vessel owner, the operator, the charterer, the cargo seller, the cargo buyer, the freight forwarder, and – critically – any entity in the ownership chain of those parties. The 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) means that a counterparty that does not appear by name on the SDN List may still be a blocked person. Aggregation applies: two listed persons each holding significant minority stakes can together cross the threshold.

OFAC's facilitation prohibition adds a further layer. A US person that arranges, directs, finances, or enables an STS that would be prohibited if done directly is itself in violation, even if the US person does not own the cargo or the vessel. In our experience, this is the provision that catches brokers, agents, and P&I correspondents who believe they are merely facilitating paperwork rather than conducting a transaction.

BIS party screening runs in parallel but through a different list architecture. The Entity List and the Denied Persons List contain parties with whom dealings require a licence or are prohibited outright. An item moving to or through a listed entity triggers a separate licence analysis under the EAR regardless of OFAC status. It is entirely possible for a counterparty to appear on an OFAC list but not on any BIS list, or vice versa, or on both. The two list ecosystems are maintained independently and do not cross-populate automatically. A compliance programme that screens only the SDN List has not completed a BIS party analysis; and a programme that screens only Entity List and Denied Persons has not completed an OFAC analysis.

The practical divergence here is significant. OFAC screening must reach the ownership chain. BIS screening, while it also looks through corporate structures in certain circumstances, focuses primarily on the end-user and the end-use of the specific item. A vessel operator that is a minority-owned subsidiary of a blocked person may be caught by OFAC but not flagged by a standard BIS party check. Is your screening programme running both analyses, and are you retaining records for the five years that OFAC requires?

Where do the regimes diverge on cargo classification and the item-level analysis?

OFAC does not itself classify cargo. Its prohibitions apply to the transaction and the parties. If blocked property is being transferred – regardless of what the cargo physically is – the transaction is prohibited. A cargo of agricultural commodities, a cargo of crude oil, and a cargo of electronics components are all equally subject to OFAC prohibitions if they constitute blocked property or are being moved for the benefit of a blocked person. OFAC does maintain specific commodity-level guidance within individual programme contexts, and general licences can authorise particular categories of goods in defined circumstances, but the fundamental analysis is party- and property-based, not classification-based.

BIS operates an entirely different logic. Every item in the transaction requires a classification determination. An EAR99 item – one subject to the EAR but not listed on the Commerce Control List – generally moves with fewer licence requirements, but it is not automatically exempt: military end-use and end-user controls can apply, and an STS transfer to a restricted destination or a flagged end-user may still require a licence even for EAR99 cargo. Items with a positive ECCN carry country-specific and use-specific licence requirements. BIS also administers license exceptions, which are standing authorisations that permit a defined category of exports or re-exports without a separate licence application, but each exception has item-, destination-, and end-use-specific eligibility criteria that must be confirmed before reliance.

The divergence is sharpest for dual-use cargo. An industrial compressor that is also classifiable as having marine applications, a chemical product with multiple end-uses, a navigation component – each of these may sit high on the ECCN schedule and carry BIS licence requirements that would not appear from an OFAC party screen alone. We regularly advise exporters who have cleared a cargo on OFAC grounds but overlooked the EAR classification entirely. The two analyses must be run concurrently, not in sequence.

How does each regime treat the location and mechanics of the STS event?

Maritime sanctions compliance, as a technical matter, commonly turns on verifying insurance cover, monitoring AIS transmission gaps, and scrutinising the STS transfer itself. OFAC's analysis of the physical event is focused on three questions: (1) Is a blocked person a party? (2) Is blocked property being moved? (3) Is a US person providing a service or is the US financial system being used? The location of the transfer does not provide a safe harbour. An STS conducted in international waters, structured to avoid a US port call, remains within OFAC's jurisdiction if a US-person broker arranged it, a US-dollar payment cleared through a US correspondent bank, or the cargo originated from a US-controlled person.

BIS jurisdiction over the physical STS event is triggered by the re-export or transfer of EAR-controlled items. A re-export occurs when a controlled item is exported from one foreign country to another. An STS transfer in international waters between two vessels both registered outside the United States constitutes a re-export for BIS purposes if the cargo is EAR-controlled and the ultimate destination changes. The location – international waters, third-country anchorage, high-seas bunkering zone – does not remove the item from EAR jurisdiction once the classification threshold is met.

AIS manipulation is a specific risk signal that both regimes treat seriously, though through different mechanisms. A vessel that disables or spoofs its automatic identification system during an STS creates a rebuttable presumption of an attempt to obscure the transfer. Under OFAC, this bears directly on the "reason to know" analysis in the facilitation prohibition and on whether a voluntary self-disclosure would be treated as mitigated or aggravated. Under BIS, an AIS gap in the voyage record is a diversion red flag that can indicate the cargo was transferred to a restricted end-user – and a sharp change in stated destination after loading is among the recognised indicators of diversion risk. Our practice addresses both dimensions through a unified voyage-record review rather than treating the AIS anomaly as solely a sanctions question.

Related practices:

• AIS anomaly indicators – EU service – screening vessel AIS gaps and anomaly indicators under EU sanctions obligations
• Transit rerouting red flags: EU vs SECO analysis – comparing EU and Swiss diversion red-flag treatment in transit movements

What is the extraterritorial reach of each regime – and how do they interact with other regimes?

OFAC's extraterritorial reach is wide. The SDN List and the underlying programme prohibitions apply to US persons worldwide, to transactions in US dollars passing through the US financial system, and to any goods or technology with a US origin nexus. Secondary-sanctions risk – the possibility that a non-US person conducting an activity that falls within the scope of certain US programme legislation could be designated or subjected to correspondent-banking restrictions – extends OFAC's practical reach beyond the jurisdictional base of US-person activity. A non-US shipowner that repeatedly conducts STS transfers of restricted cargo may find itself exposed to secondary-sanctions measures that affect its ability to access the US financial system, even if no US person or US property is directly involved.

The EAR's extraterritorial reach operates through FDP rules, as noted above, and through the re-export controls that follow EAR-controlled items wherever they travel. Where a foreign-produced vessel component – a navigation system, a propulsion control unit, a cargo monitoring device – is the direct product of controlled US technology or software, it may remain within EAR jurisdiction regardless of how many subsequent ownership changes the vessel has undergone. This is a significant and frequently overlooked dimension of BIS exposure for non-US shipowners and operators.

The cross-regime dimension does not stop at OFAC and BIS. The UK's OFSI administers a financial-sanctions regime under SAMLA that runs parallel to OFAC but applies independently to UK persons and UK-nexus transactions. The UK's ownership and control test (the UK and EU test for whether a non-listed entity is caught through a listed person) differs from OFAC's 50 percent rule: it looks at actual control rather than a fixed ownership threshold, which means a minority shareholder with effective management control over a shipowner can cause the shipowner to fall within UK designations even where OFAC's mechanical test would not be met. Where a vessel is insured in the London market, the OFSI dimension is as live as the OFAC dimension. A designation of an insurer, as a technical matter, can cascade into a loss of cover for vessels it insures – itself a compliance trigger for charterers and ports entirely independently of any cargo-level prohibition.

EU Council Regulations impose asset-freeze prohibitions that extend to making funds or economic resources available, directly or indirectly, to or for the benefit of listed persons. An STS in which an EU-operator vessel serves as the receiving ship creates EU nexus regardless of whether the cargo is EAR-controlled or the parties are on the SDN List. Where two regimes both apply, the stricter prohibition governs the conduct of a person subject to both. This means the analysis in a multi-jurisdiction STS is never the most permissive reading across the applicable regimes – it is the most restrictive that controls.

How do the two regimes compare on enforcement posture and risk consequence?

OFAC's civil-penalty authority rests on a strict-liability basis: no knowledge or intent is required for the violation to exist. A transaction that involves blocked property or a blocked person is a violation whether or not the parties knew the counterparty's status. Knowledge and intent bear on the penalty calculation under OFAC's Enforcement Guidelines, which establish the egregious/non-egregious and voluntary self-disclosure framework. A VSD (voluntary self-disclosure to a regulator) is a recognised mitigating factor under those Guidelines, and in our practice we assess VSD eligibility as a priority question whenever a potential violation is identified. The statute of limitations for civil and criminal violations under IEEPA was extended in 2024 (as currently in force, verify the current position before relying on this), giving OFAC a substantially longer window to pursue historical STS transactions that later come to light.

BIS enforcement for export-control violations follows a different track. Criminal liability can arise where an item is knowingly exported in violation of the EAR. Administrative penalties are imposed by BIS and the DOJ for criminal matters. The voluntary self-disclosure mechanism exists under the EAR as well, and like OFAC's VSD framework it is a mitigating factor in BIS's penalty calculus. The interaction matters: a single STS transaction that violates both OFAC prohibitions and EAR re-export restrictions creates simultaneous exposure on both enforcement tracks, and a VSD to OFAC does not constitute a VSD to BIS. Each disclosure must be made separately, to the appropriate authority, and the scope of each is defined by that regime's rules.

In a recent matter, a commodity trading business identified that an STS transfer it had arranged had involved a vessel whose beneficial owner appeared on a watch-list that our review identified as a pre-cursor to formal designation. We assessed the OFAC and BIS exposure simultaneously, advised on VSD eligibility under both regimes, and structured the internal investigation to preserve the mitigating record for both authorities. The outcome of any disclosure is never guaranteed, but early structured action consistently produces a stronger position than delayed or partial disclosure.

A common myth in the market is that a seller's representations and warranties in a contract of sale remove the buyer's sanctions risk. They do not. A contractual rep that a counterparty is not a designated person has no legal effect on OFAC's analysis of whether the underlying transaction violated a programme prohibition. If the rep is wrong, the buyer has a breach-of-contract claim against the seller – and a separate, live sanctions exposure to OFAC or BIS. Representations allocate financial risk between contracting parties; they cannot license an otherwise prohibited transaction and they cannot retroactively cure a violation. The due-diligence obligation runs independently of the contractual allocation.

What does a side-by-side criterion comparison show for STS risk controls?

Reviewing the two regimes against the criteria that matter most for STS transactions makes the divergences operational rather than theoretical.

Jurisdictional trigger: OFAC is triggered by a US-person party, US-origin property, or a US-dollar financial nexus. BIS is triggered by an EAR-controlled item, an FDP-rule-caught item, or a re-export to a new destination. A non-US party with no US-dollar clearing and no US-origin cargo may have no OFAC exposure – and full BIS exposure if its cargo is EAR-controlled.

Party analysis: OFAC requires tracing the ownership chain to the 50 percent rule threshold and aggregating blocked-person holdings. BIS focuses on the end-user and end-use and applies a list-based check against the Entity List and Denied Persons. Neither analysis substitutes for the other.

Cargo analysis: OFAC does not classify cargo; any blocked property is equally prohibited. BIS classifies every item by ECCN or EAR99 designation; dual-use items with positive ECCNs require a licence determination for the destination and end-user.

Location of STS: Neither regime provides a location-based safe harbour. Both follow the party or the item into international waters, third-country anchorages, and foreign ports.

AIS and diversion indicators: Both regimes treat AIS anomalies as a red flag. Under OFAC, an AIS gap bears on the facilitation and wilfulness analysis. Under BIS, it is a diversion indicator that can affect licence-exception eligibility and the voluntary self-disclosure calculation.

Enforcement mechanism: OFAC imposes civil penalties on a strict-liability basis, with IEEPA as the statutory authority. BIS can pursue both administrative and criminal penalties under the Export Control Reform Act and related statutes, with DOJ involvement for criminal matters.

VSD framework: Both regimes have a VSD mechanism that is a mitigating factor. Both require a separate disclosure; a disclosure to one authority does not satisfy the other. Timing is material in both frameworks.

Cross-regime interaction: Where OFSI, EU Council regulations, or other applicable regimes also apply, the stricter prohibition governs. A clean OFAC and BIS analysis does not produce clearance if an EU or UK prohibition is also engaged.

Does your maritime compliance programme test all of these criteria for each STS transaction, or does it route to OFAC screening first and treat a clean screen as the end of the analysis? In our experience, the latter approach misses the EAR dimension in a significant proportion of dual-use cargo movements.

When should a business involve sanctions and export-control counsel on STS risk?

Counsel involvement is not a last resort for the moment a notice arrives. The more consequential decisions – whether to complete a voyage, whether to make a VSD, whether to seek a specific licence before the transfer occurs – each carry time-sensitive elements that narrow the available options if addressed late.

Situations in which we recommend involving counsel before the transfer include: any STS where the vessel owner, operator, or charterer cannot be verified to the ownership chain level required by the 50 percent rule; any cargo with a positive ECCN where the re-export destination has changed from the original export authorisation; any voyage instruction that routes through a jurisdiction associated with elevated diversion risk; and any transaction where an AIS gap in the voyage history is unexplained.

Situations in which we recommend involving counsel immediately after the transfer include: discovery that a party to a completed STS appears on any OFAC list or the BIS Entity List; discovery that the cargo was re-exported to a destination not covered by the original EAR authorisation; receipt of a subpoena, information request, or voluntary self-disclosure invitation from any competent authority; and any internal report or audit finding that identifies an STS transfer not covered by the entity's compliance documentation.

The VSD decision is particularly time-sensitive. Under both OFAC and BIS, the value of a disclosure diminishes if the regulator becomes aware of the violation before the disclosure is received. Once an investigation is opened, a proactive disclosure becomes a reactive one and the mitigating credit is substantially reduced. Early assessment – before any regulator contact – is the point at which counsel can make the most material difference to the outcome.

For a confidential review of your STS compliance programme or a specific transfer that has raised a concern, contact Calder & Vance at info@caldervance.com.

To discuss extraterritorial reach under both OFAC and the EAR in the context of a specific voyage or cargo classification, you may also find it useful to review our analysis of vessel insurance verification under OFAC compared with the Canadian regime.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.