How to manage advanced-computing export controls under OFAC

A semiconductor manufacturer finalises a sale of high-performance graphics processing units to a distributor in a third market. The compliance team screens the buyer against the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) and finds no match. The transaction proceeds. Six months later, the same chips appear in a facility subject to a US technology-restriction order. The question that arrives in legal's inbox is not whether the buyer was listed – it is whether the item required a licence before it ever left the warehouse. That question sits at the intersection of OFAC sanctions and the Export Administration Regulations (the EAR, administered by the Bureau of Industry and Security). Getting the analysis wrong on either side creates exposure that a clean screening result cannot remedy.

Managing advanced-computing and AI chip controls under OFAC requires a two-track analysis: first, a sanctions screen under OFAC for any prohibited party or territory nexus; second, a classification and licence determination under the EAR for the item itself. As of January 2026, both tracks are simultaneously active for advanced computing hardware, and a gap in either can generate significant civil exposure. The 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) operates independently of BIS controls, so a transaction can clear one track and fail the other.

This guide walks through the decision sequence a compliance team should run before any advanced-computing transfer, maps where the two regimes diverge, and identifies the points where early counsel involvement changes the outcome.

If the buyer is already screened – does the analysis stop there?

It does not. A clean SDN-list result means only that the immediate counterparty is not a designated person. The OFAC inquiry continues through the 50 percent rule: if one or more blocked persons own the buyer in the aggregate at that threshold or above, the buyer is itself treated as blocked, regardless of whether it appears on any published list. Aggregation is where transactions fail silently. Two separate listed shareholders each holding minority positions can combine to trigger the rule.

In our experience, the screening step that companies most often skip is the ownership chain above the direct buyer. Standard screening platforms match the legal entity name. They do not automatically map the beneficial-ownership structure to current SDN designations. For advanced-computing hardware – which attracts heightened regulatory attention – that gap is not acceptable. The practical question at this stage is: have you reviewed the shareholder register, not just the company name?

Beyond the SDN screen, OFAC's comprehensive and territorial programmes impose separate prohibitions that are not list-based. A transaction that would be lawful if reviewed only against the SDN List may nonetheless be prohibited if the end-destination falls within a programme's territorial scope. For advanced computing, the territory question is rarely straightforward: items can be re-exported or re-directed after an initial transfer, and facilitation by a US person of a downstream prohibited transaction is itself prohibited under OFAC's rules.

The OFAC track, in summary, requires: (1) a name and entity screen including aggregated ownership; (2) a territorial check against all relevant programmes; and (3) a facilitation analysis for any US person involved in the broader transaction chain. Only after all three are clear does the OFAC inquiry close – and the EAR inquiry is then running in parallel.

If OFAC clears – does the EAR permit the transfer?

Not automatically. The EAR governs whether the item itself requires a licence for export, re-export, or in-country transfer to a particular destination or end-user, and classification under the Commerce Control List (CCL) drives that analysis. Advanced computing chips and related hardware are classified by reference to an ECCN (Export Control Classification Number), which determines the applicable controls, the available licence exceptions, and whether a licence is required for the destination.

The correct starting point is classification, not assumption. A common error is to assume that commercially available hardware is uncontrolled. It is not. Hardware that was EAR99 – the designation for items subject to the EAR but not classified on the CCL – at one product generation may move onto the CCL at the next as performance thresholds advance. Classification must be confirmed for each product at the time of export. The content brief for this guide explicitly identifies the myth that commercial items cannot be controlled; that myth has produced enforcement exposure for exporters who relied on a prior-generation analysis for an updated chip.

Once classification is confirmed, the destination's country-group classification determines licence requirements and exception eligibility. A country's reclassification changes the analysis prospectively – so a licence exception that applied to a destination last year may not apply today, and vice versa. As of the date of this guide, the applicable country-group status of several advanced-computing destinations is subject to active regulatory review, and any compliance programme should build in a regular re-check of destination classifications. One significant change, noted in current regulatory guidance, relates to the UAE's classification status – that specific change remains subject to pending verification and should be confirmed against the current regulatory text before reliance.

Licence exceptions under the EAR are narrow, item- and destination-specific, and conditional on end-use. Eligibility for an exception does not remove the obligation to verify end-use and end-user. BIS maintains the Entity List and the Denied Persons List; a buyer who clears the OFAC SDN screen may still appear on one of these BIS lists, and a separate BIS-specific screen is required.

When the destination or end-user presents a red flag – what is the decision branch?

When screening or diligence reveals a red flag – a party associated with a restricted end-use, a destination subject to heightened controls, or an ownership structure that cannot be fully mapped – the analysis branches into three options: decline the transaction, seek additional assurances, or apply for a licence.

Declining is the clearest risk-management step, but it should be a considered decision rather than a reflex. In our practice, we regularly advise clients who have declined a transaction without a full analysis and later learned that a licence exception or a specific licence would have permitted it. The cost of that missed opportunity – in particular where a competitor operating under a licence wins the business instead – is a real commercial consequence that a binary screen-and-block approach does not price.

Seeking additional assurances means obtaining end-use certificates or equivalent documentation from the buyer and, where the destination warrants it, from the ultimate end-user. The value of that documentation depends on its specificity and credibility. A generic "not for military use" undertaking carries less weight in a BIS enforcement context than a detailed statement identifying the facility, the intended application, and the applicable export control classification. We have acted for exporters in building out end-use assurance programmes that are proportionate to the risk profile of the product and the destination.

Applying for a licence – either a specific licence from BIS or, where the OFAC track requires it, a specific licence from OFAC – is the route for transactions that cannot proceed under an exception. A specific licence is a case-by-case authorisation to conduct an otherwise prohibited transaction. Licence processing times vary by regulator and the complexity of the matter; in our experience, advanced-computing applications attract detailed technical and end-use scrutiny, and a well-prepared application substantially reduces the risk of a request for additional information that extends the review period.

How do the UK and EU export-control regimes interact with the OFAC and EAR analysis?

For a business operating between the United States, the United Kingdom, and the European Union, advanced-computing transfers sit under three independent export-control regimes simultaneously. A transaction that clears both OFAC and BIS may still require a licence under UK or EU rules – and where two regimes apply, the stricter prohibition governs the conduct of a person subject to both.

UK export controls are administered by the Export Control Joint Unit (ECJU). Licence types include SIELs (Standard Individual Export Licences) and OIELs (Open Individual Export Licences), as currently in force, and the applicable controls for advanced computing hardware track the UK's own version of the dual-use list. The UK regime has operated independently of EU controls since the end of the Brexit transition period, and the UK dual-use list, while substantially aligned with international control lists, is maintained separately. Any transfer from a UK-based entity, including a re-export of US-origin goods, requires a separate ECJU analysis.

EU dual-use export controls are governed by Regulation (EU) 2021/821, the recast Dual-Use Regulation, which came into force in 2021. The EU regime applies to exports from EU member states and to re-exports of controlled goods that pass through EU territory. The EU General Court has jurisdiction over designation and control challenges; the regulatory mechanics differ from both the US and UK approaches, particularly on the treatment of intangible technology transfers and cloud-based technical-assistance routes. A US-origin hardware transfer that involves an EU intermediary – a distributor, a logistics provider, or a financing institution – may bring EU rules into scope even where the exporter is not itself EU-based.

The cross-regime question that our practice addresses most frequently is not "which regime applies?" but "which obligation is the binding constraint?" Where a US-licence exception permits a transfer that the EU regime restricts, or where the UK requires a licence that BIS does not, the answer is not to net the obligations against each other. The stricter requirement applies, and compliance with the more permissive regime does not provide a defence under the stricter one. Working through the interaction requires a jurisdiction-by-jurisdiction analysis, not a consolidated one.

What risk flags should accelerate escalation to counsel?

Certain patterns in an advanced-computing transaction are sufficiently high-risk that they should trigger immediate escalation to sanctions and export-control counsel rather than a standard compliance-team review. Early escalation, in our experience, preserves options. A self-discovered issue handled before a transaction is consummated is in a fundamentally different position from one disclosed after completion.

The principal red flags, in order of urgency, are as follows.

• Ownership opacity. A buyer that declines to provide a full shareholder register, or whose ultimate beneficial ownership routes through jurisdictions with limited corporate-transparency requirements, presents an aggregation risk that cannot be resolved without the underlying information. The transaction should pause until ownership is mapped.
• Destination mismatch. A declared end-destination that is inconsistent with the buyer's business profile, or a routing that passes through a transit jurisdiction with a history of diversion, is a diversion red flag. A sharp change in trade flows to a neighbouring jurisdiction is treated by regulators as exactly this pattern. The item's controlled status follows it, not the stated route.
• End-use inconsistency. A stated end-use that is implausible for the buyer's apparent capacity – for example, a small trading company acquiring data-centre-grade hardware in quantities inconsistent with its disclosed operations – warrants a red-flag analysis before the transaction proceeds.
• Post-transfer re-export. Any indication that the buyer intends to re-export the goods – whether disclosed or inferred from the commercial context – requires the analysis to be extended to the secondary destination and the downstream end-user. The EAR's extraterritorial reach through Foreign Direct Product rules can bring that re-export within US jurisdiction even after the initial export is complete.
• Military end-use risk. BIS administers military end-use and end-user restrictions for specified destinations. Where the buyer or its affiliates have any apparent connection to military programmes in a restricted destination, the analysis must address these restrictions separately from the standard CCL classification review.
• Voluntary self-disclosure considerations. If a potential violation is identified after a transaction has completed – whether through an internal review, a compliance audit, or a third-party report – the question of whether to make a VSD (voluntary self-disclosure to a regulator) arises immediately. VSD is a recognised mitigating factor in OFAC's Enforcement Guidelines, and the decision to disclose, the timing of that disclosure, and the form of the accompanying narrative are matters where counsel involvement is essential. The window for an effective VSD is not indefinite.

Is your compliance programme designed to surface these flags before the transaction completes, or only after a problem has already crystallised? The architecture of the control – where in the transaction lifecycle the screening and diligence steps run – determines whether escalation happens early enough to be useful.

What does an advanced-computing export-control compliance checklist look like in practice?

A structured compliance checklist for advanced-computing transfers under OFAC and the EAR addresses three phases: pre-transaction, at execution, and post-transfer monitoring. Each phase has mandatory steps and decision points.

Pre-transaction phase

• Confirm the ECCN classification for the specific product at the current generation. Do not carry forward a prior-generation classification without re-verification.
• Screen the buyer and all known intermediaries against the SDN List. Map ownership to the 50 percent threshold for each counterparty, using the shareholder register, not only commercial screening databases.
• Screen against the BIS Entity List and Denied Persons List as a separate step. A clear OFAC result does not clear the BIS lists.
• Confirm the destination country-group classification as of the transaction date. Confirm whether any applicable licence exception covers the item, the destination, and the stated end-use – all three conditions must be met.
• Assess the transaction under the UK (ECJU) and EU dual-use controls where any party, routing, or financing element touches those jurisdictions.
• Obtain end-use documentation from the buyer and, where warranted by the destination's risk profile, from the ultimate end-user.

At-execution phase

• Confirm that any licence or licence-exception condition is reflected in the export documentation.
• Verify that the shipping routing matches the declared destination. A last-minute routing change to a transit jurisdiction is a diversion indicator that requires the pre-transaction analysis to be re-run before shipment.
• Retain all classification, screening, and diligence records. Sanctions records must be kept for five years, as currently in force, and the same discipline applied to EAR records is consistent with best practice for a unified compliance record.

Post-transfer monitoring phase

• Monitor for open-source indicators of diversion, including trade-press reporting, regulatory enforcement actions concerning similar hardware, and changes in the buyer's apparent business profile.
• Re-screen the buyer and the ownership structure on a periodic basis; designation status changes after the transaction date can affect ongoing service or support obligations.
• Review any catch-all enquiry received from BIS regarding the specific goods and destination. A catch-all enquiry, if ignored, does not provide a defence; it is a regulatory indicator that requires immediate legal review.

We regularly advise exporters on the design and testing of compliance programmes that span all three phases. A programme that addresses only the pre-transaction screen – which is the most common gap we encounter – leaves the post-transfer and facilitation exposure unaddressed.

Related practices

• BIS / EAR advanced-computing controls service – classification, licence applications, and end-use compliance under the EAR
• Advanced computing controls: UAE guide – country-group changes, the separate approval framework, and what changed for UAE-destination transfers
• Anti-circumvention and third-country transfers: EU guide – the EU instrument applied for the first time in 2026, diversion analysis, and transit obligations

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.