A technology company sources components through a three-tier supply chain: a Taiwanese assembler, a South Korean distributor, and a Singaporean trading house. The compliance team screens the direct counterparties. All pass. Then a shipment is held at a US port. The underlying issue is not a listed person at tier one – it is a blocked entity at tier three, combined with export-control classifications that nobody had mapped.
Supply-chain sanctions mapping under OFAC and the US Export Administration Regulations – administered by BIS – operates through two legally distinct but practically overlapping regimes. OFAC targets persons and property; the EAR targets items and their movement. Both can catch the same transaction, and missing either one creates enforcement exposure that a sanctions lawyer cannot easily repair after the fact. As of January 2026, enforcement actions under both regimes continue at elevated levels, and cross-border supply-chain diligence that covers only tier-one counterparties consistently leaves material risk unaddressed.
This analysis sets out how the two regimes interact at the supply-chain level, where they diverge, and what a cross-border business needs to do before the cargo moves.
Two authorities, one transaction: how OFAC and BIS divide the field
OFAC and BIS regulate the same international transaction through different legal instruments and different triggers. Understanding where each authority starts and stops is the first step in supply-chain sanctions mapping.
OFAC administers economic sanctions programmes under the International Emergency Economic Powers Act and the Trading with the Enemy Act. Its prohibitions are person-centred: transactions are blocked when a sanctioned person – someone on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons), on a sectoral list, or caught by the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) – is a party, a beneficiary, or an owner of property involved in the transaction. The nationality of the goods is not the primary test. The identity of the party is.
BIS administers the Export Administration Regulations under the Export Control Reform Act. Its controls are item-centred: goods, software, and technology are classified on the Commerce Control List by their technical characteristics, and a licence may be required to export, re-export, or in-country transfer an item regardless of whether any sanctioned person is involved. An ECCN (Export Control Classification Number under the US Commerce Control List) tells you what the item is and where it can go. EAR99 – the default classification for items not specifically listed – does not mean unrestricted; the general prohibitions and foreign-policy controls still apply.
In our experience, the practical danger zone is the intersection: a transaction that is not blocked under OFAC but still restricted under the EAR, or one where OFAC clearance is assumed to cover the BIS analysis. It does not.
The ownership-and-control question in supply-chain screening
OFAC's 50 percent rule means that an entity owned 50 percent or more in the aggregate by blocked persons is itself treated as blocked, even if it does not appear on any published list. That rule runs through every tier of the supply chain.
Supply-chain mapping fails most often at two points. First, it stops at the immediate counterparty rather than working up the ownership chain. A distributor may be clean on the SDN List; its majority shareholder may not be. Second, aggregation is miscounted. Where two blocked persons each hold a minority stake, their combined ownership may cross the 50 percent threshold. In our cross-border practice, we see this pattern regularly in group structures spanning multiple jurisdictions, particularly where intermediate holdcos sit in lightly regulated offshore locations.
BIS operates a parallel but different list-based control. The Entity List (BIS's list of foreign persons subject to specific licence requirements) imposes licence requirements on exports to listed parties that do not depend on a 50 percent ownership calculation. A company on the Entity List is controlled by name, not by an aggregation formula. But a company that is not on the Entity List may still be a restricted end-user if it is engaging in activities that trigger the End-User Review Committee's attention or if it is involved in a military end-use.
The divergence matters. Under OFAC you must trace ownership. Under BIS you must assess the end-use and end-user. A supply-chain mapping exercise that addresses only one of these questions answers only half the problem. Does your current screening tool flag Entity List entries alongside SDN and OFSI matches? Many do not.
Where do the regimes diverge on supply-chain sanctions mapping?
The sharpest divergence between OFAC and BIS in supply-chain mapping lies in their extraterritorial reach and their treatment of non-US persons in third-country supply chains.
OFAC's secondary sanctions (measures that target non-US persons for conduct outside US jurisdiction that involves a sanctioned country or person) extend the US sanctions perimeter well beyond US persons. A non-US supplier that facilitates a transaction with a blocked person can face secondary sanctions designation, cutting it off from the US financial system. That threat reshapes the calculus for every link in the supply chain, not just the US participants.
BIS's extraterritorial reach operates through the de minimis rule and the foreign-direct product rule. Where a foreign-made item contains US-origin content above a defined threshold, or where it is produced using US-origin technology or software above defined parameters, BIS licence requirements follow the item regardless of where it is manufactured or shipped from. For supply chains built around US-origin semiconductor technology, this reach is substantial. A Taiwanese foundry producing chips on US-designed equipment, incorporating US-origin chip-design software, may be producing items that require a BIS licence for certain destinations even though the physical goods never touch US soil.
The UK and EU regimes add a further layer. OFSI applies its own ownership and control test (the UK and EU test for whether a non-listed entity is caught through a listed person), which – unlike OFAC's mechanical 50 percent rule – incorporates a control element. An entity that a listed person controls but does not own above 50 percent may still be caught under OFSI or EU analysis. For a supply chain that involves UK or EU entities or financial institutions, this divergence between the US test and the UK/EU test requires a separate pass. Relying on an OFAC clearance to satisfy an OFSI or EU audit will not hold.
Switzerland, Singapore, Japan, and Australia each operate their own frameworks with varying scope, ownership tests, and list-maintenance approaches. In a supply chain that touches financial institutions or logistics nodes in those jurisdictions, the applicable country regime adds obligations that neither OFAC nor BIS addresses.
What BIS classification means for supply-chain diligence
Correct item classification is not a one-time exercise. A product's ECCN can change as a result of technical modifications, reclassification decisions by BIS, or changes in the regulatory status of the destination country. Supply chains built on a classification done at product launch may be operating on outdated analysis years later.
Classification determines the licence exception – or the licence requirement – that applies to each shipment. An item with an ECCN in the 3A or 4A series, for example, carries country-group-specific controls that differ substantially from an EAR99 item. A business exporting dual-use components through a chain of intermediaries needs to know the classification of every item at every node of the chain, because a re-export from an intermediary in a third country is itself an export from that country under the EAR's re-export rules.
In a recent matter, a European manufacturer supplying advanced measurement equipment through a regional distributor discovered that the distributor had been re-exporting the items to a destination not covered by the original licence. The manufacturer had classified the items correctly. The error lay in the absence of end-use controls downstream: no written assurance from the distributor regarding re-export, no contractual notification requirement, and no periodic audit of the distributor's customer base. The exposure ran not to the manufacturer's immediate customer but to the destination of the sub-sale. We assessed the position, advised on a voluntary self-disclosure approach, and assisted in redesigning the distributor agreement to include the necessary end-use controls. The matter was addressed before enforcement action was initiated.
Risk flags: what supply-chain mapping consistently misses
Experienced compliance counsel identify a consistent cluster of gaps in supply-chain sanctions mapping across sectors and geographies. Addressing them before a transaction closes is materially less costly than addressing them under enforcement pressure.
The first gap is tier-one-only screening. A business that screens its direct suppliers but not its suppliers' suppliers is exposed to the full depth of the chain without knowing it. OFAC enforcement does not stop at the invoice counterparty. The question is whether a sanctioned person or blocked property is involved anywhere in the transaction, including at the raw material or component level.
The second gap is outdated classification. As noted above, ECCNs change. A classification that was accurate at product launch may no longer reflect the current regulatory treatment of the item, particularly in fast-moving technology sectors.
The third gap is financial-flow mapping. A supply chain that clears goods-movement screening may still route payments through a financial intermediary that maintains a correspondent relationship with a blocked entity. OFAC's prohibitions cover any transaction in which a US financial institution is involved, including clearing US-dollar payments. A non-US business whose supply-chain payments clear through a US correspondent bank is inside OFAC's perimeter regardless of where the goods move.
The fourth gap is licence condition compliance. Where a licence has been obtained – from OFAC or from BIS – the conditions attached to it impose ongoing obligations. Exporters that obtain a BIS licence and then fail to comply with the end-use reporting or return conditions have not escaped enforcement risk; they have created a new category of it.
The fifth gap is contractual enforcement. Supply-chain diligence conducted at onboarding is not supply-chain compliance over the life of the relationship. Without audit rights, notification obligations, and termination rights in the supply agreement, a business cannot act on red flags it later identifies.
Which regime is stricter on supply-chain sanctions mapping?
Framing the question as "which regime is stricter" understates the problem. A supply chain can be fully compliant under one regime while non-compliant under another, and both sets of consequences are real.
OFAC's prohibitions are absolute where they apply. There is no de minimis threshold below which a blocked-person connection is ignored. Where a blocked person is involved, the transaction is prohibited unless an authorisation – a specific licence (a case-by-case authorisation to conduct an otherwise prohibited transaction) or a general licence (a standing authorisation that permits a defined category of transactions without a separate application) – applies. Civil penalties under OFAC can be calculated on a per-transaction basis and can reach amounts that bear no proportional relationship to the value of the prohibited activity. Criminal exposure exists for wilful violations.
BIS penalties operate similarly: per-item, per-export, potentially per-day. The Entity List and Denied Persons List create absolute prohibitions – no licence exception applies to a denied party – while the general prohibition on supporting weapons of mass destruction programmes applies regardless of item classification or list status.
Where the two regimes converge on the same transaction, the stricter prohibition governs. A business that obtains a BIS licence for a controlled item cannot rely on that licence if the consignee is also a blocked OFAC person: the OFAC prohibition operates independently and is not waived by BIS authorisation. Equally, an OFAC authorisation does not address EAR classification requirements. Each regime must be satisfied on its own terms.
For the cross-border business, this means the correct question is not which regime to prioritise. It is how to ensure both are satisfied before the goods move.
How Calder & Vance approaches supply-chain sanctions mapping
We regularly advise exporters, manufacturers, and trading intermediaries on supply-chain diligence that spans OFAC, BIS, and the UK, EU, and multi-jurisdictional regimes. Our approach integrates the two US regimes from the outset rather than treating them as sequential checks.
The position above covers the standard case. Your facts – the counterparty, the goods, the route, the jurisdictions involved, and the financial institutions processing payments – change the analysis materially.
Our work on supply-chain mapping typically covers four areas. First, we assess the ownership and control structure of key counterparties at multiple tiers, applying the relevant test for each regime in scope. Second, we review item classifications and confirm that the applicable licence exceptions or licences are current and correctly applied. Third, we map the payment flows to identify US-dollar clearing points and the correspondent-banking exposure that creates. Fourth, we review the contractual structure – representation and warranty language, audit rights, notification obligations, and termination triggers – to ensure the business has the legal tools to act on a red flag when it surfaces.
We also work with clients on voluntary self-disclosure where a supply-chain review uncovers an apparent violation. A VSD (voluntary self-disclosure to a regulator) to OFAC or BIS, prepared and submitted correctly, is treated as a significant mitigating factor in the penalty calculation. The window for effective disclosure is finite. Early advice preserves options.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. For a confidential review of your supply-chain exposure under OFAC or BIS, contact Calder & Vance at info@caldervance.com.
For related questions on financial-institution exposure to supply-chain sanctions risk, see our service page on correspondent banking and de-risking under OFAC. For a comparison of OFAC and EU supply-chain mapping, see our OFAC vs EU supply-chain analysis. For the UK-Australia comparison, see our OFSI vs Australia supply-chain analysis.
Related practices
- Correspondent banking and de-risking under OFAC – financial-institution exposure mapping and OFAC compliance programme review
- OFAC vs EU supply-chain mapping analysis – regime-by-regime comparison for cross-border procurement and distribution
- OFSI vs Australia supply-chain mapping analysis – UK and Australian regime obligations for international supply chains