Anti-circumvention measures and third countries under EU: step by step

A trading company exports components through a third-country distributor. The goods reach their final destination without touching an EU member state. The exporter assumes the EU controls no longer apply. That assumption is wrong – and in 2026, the EU deployed its anti-circumvention instrument for the first time to reach exactly this pattern.

EU anti-circumvention measures allow the Council to extend restrictions to operators in third countries where those operators are found to be facilitating the defeat of EU sanctions or export controls. The legal basis sits in Council regulations, directly applicable in all member states. As of January 2026, this instrument has moved from standby to active use, making third-country routing a live enforcement risk rather than a theoretical one.

This guide works through the key questions a compliance counsel or General Counsel needs to answer: what the measures cover, how the EU test is applied, where it diverges from the US and UK approaches, what a step-by-step compliance review looks like, and when to involve external sanctions counsel.

What are EU anti-circumvention measures, and why do they matter for third-country routes?

EU anti-circumvention measures are provisions within Council regulations that target conduct – by any operator, including those outside the EU – that defeats or is designed to defeat the effect of EU sanctions or export controls. They are not a separate regime. They extend the reach of existing restrictions to third-country conduct.

The core prohibition is on circumvention (any act or omission that avoids an obligation imposed by a Council regulation, whether deliberately or through wilful disregard). This includes routing a controlled item through a non-EU country, using a non-EU affiliate to contract around a blocked-person prohibition, and structuring a transaction so that no single leg appears prohibited while the overall effect defeats a restriction.

Why does this matter now? The EU has historically relied on member states to police their own exporters. In 2026, it applied a dedicated anti-circumvention instrument to an active sanctions programme for the first time, issuing measures directed at specific operators and trade patterns in third countries. That step confirms that the instrument is operational and that third-country routing is now a priority target. A business that routes goods through a transit hub without a proper legal analysis is no longer in a grey area – it is in the sights of an active enforcement tool.

In our experience, the businesses most exposed at this stage are those that redesigned supply chains quickly, at pace with sanctions developments, without pausing to assess whether the new route itself creates anti-circumvention risk.

Which goods and sectors fall within scope?

The scope of EU anti-circumvention controls tracks the scope of the underlying Council regulation. If an item – whether goods, technology, or software – is listed in an annex to a Council regulation as subject to an export restriction, that restriction and the anti-circumvention provisions that reinforce it travel with the item wherever it goes from an EU operator.

EU dual-use export controls, governed by the recast Dual-Use Regulation, operate in parallel. Items on the EU dual-use control list carry their own restrictions, independently of any sanctions-linked measure. A dual-use item subject to both regimes must satisfy both. Where two regimes apply, the stricter prohibition governs the conduct of a person subject to both.

Sectors with persistent high risk include: advanced electronics and computing components, precision machinery, optical instruments, chemical precursors, and certain software with cryptographic or surveillance functions. The specific listings change with each Council amendment, so a control-list check must be run against the version in force at the time of the transaction – not the version current when a previous shipment was cleared.

A common gap we identify in client programmes is a static product catalogue mapping: the team classified the item once, two years ago, and has not reviewed the listing since. That is precisely the gap that an anti-circumvention audit is designed to close.

How does the EU test for anti-circumvention work step by step?

The EU anti-circumvention test is applied in a sequence. Work through each step before committing to a transaction involving a third-country route.

Step 1 – Identify the applicable Council regulation and the restriction. Determine which regulation governs the goods or the counterparty. Check whether the item appears in the relevant annex as export-restricted. If a counterparty is listed on the EU Consolidated List, asset-freeze and making-available prohibitions also apply. Both layers must be checked.

Step 2 – Map the full transaction chain. Do not assess only the leg you control. Map the chain from the EU exporter or seller through every intermediary to the end user. A sharp change in trade flows to a neighbouring or transit jurisdiction is treated as a diversion red flag. Where a new distributor has appeared in a jurisdiction that was not previously part of the supply chain, that change requires an explanation.

Step 3 – Apply the diversion-risk indicators. EU authorities and member-state competent authorities use established diversion indicators: mismatch between declared end use and the technical characteristics of the goods; buyer with no commercial history in the relevant product sector; shipping route with unnecessary transits; unusually high price tolerance; and requests to obscure origin or end-user documentation. If two or more of these apply, enhanced due diligence is required before proceeding.

Step 4 – Assess the third-country operator's status. Ask whether any party in the chain – shipper, freight forwarder, distributor, end-user – is listed on an EU or member-state control list, or has been identified in EU anti-circumvention measures. An operator does not need to be EU-based to be restricted. As of 2026, operators in third countries have been named directly under the anti-circumvention instrument. Screening must reach them.

Step 5 – Determine whether a licence or authorisation is required. If the item is export-restricted and the destination or end-user falls within scope, a licence from the relevant member-state competent authority is required before the transaction proceeds. Check whether any general authorisation covers the transaction. If not, a specific authorisation is needed. EU dual-use general export authorisations are destination- and item-specific: never assume one covers a novel route.

Step 6 – Document the analysis and retain records. Document each step of the assessment. Under EU rules, records must be retained for a defined period – verify the current requirement in the applicable regulation, as retention obligations vary. The documentation must be sufficient to demonstrate to a competent authority, on inspection, that the anti-circumvention analysis was done contemporaneously and in good faith.

How does EU anti-circumvention differ from the US and UK approaches?

The EU, US, and UK each have anti-circumvention provisions, but the architecture, reach, and enforcement posture differ materially. A business operating across all three regimes cannot rely on satisfying one as a proxy for the others.

Under the US approach, the EAR prohibits re-exports of controlled items from third countries, and the Foreign Direct Product rules can bring foreign-made items within US jurisdiction where they incorporate controlled US technology. BIS maintains an Entity List and a Denied Persons List; dealing with listed parties requires a licence or is prohibited outright. Critically, a US prohibition on facilitation by US persons applies: routing a transaction through a non-US affiliate to avoid a direct prohibition is itself a violation. The reach of US controls is extraterritorial in a way that is broader and more extensively litigated than the EU equivalent.

Under the UK approach, OFSI administers financial sanctions and OFSI's enforcement guidance addresses third-country involvement. The UK ownership-and-control test can catch a non-listed entity that is controlled by a designated person, which is analogous to but not identical to the EU control test. ECJU administers UK export licensing; the UK has its own strategic export control list, which largely mirrors the EU dual-use list post-Brexit but is separately maintained and has diverged in places.

The EU approach differs in two respects. First, the anti-circumvention instrument as deployed in 2026 is a sanctions tool as well as an export-control tool – it can restrict third-country operators from any further dealings with the EU market. Second, the EU relies on member-state competent authorities for licensing and enforcement, which creates some divergence in practice across jurisdictions even within the same Council regulation. An exporter based in one member state is subject to that state's enforcement posture, which is not always identical to that of a neighbouring state implementing the same regulation.

In our cross-border practice, we regularly advise clients who assume that US EAR compliance is sufficient for EU purposes, or vice versa. It is not. The two regimes have different control lists, different licence-exception structures, and different third-country reach rules. A shipment that is EAR99 is not automatically outside the EU dual-use list. Each must be run independently.

What are the principal risk flags for third-country transactions?

Third-country transactions carry a distinct risk profile because the compliance visibility of the EU exporter typically ends at the point of export. These are the flags that should trigger an enhanced review or a pause.

Diversion indicators. A sharp change in trade flows to a neighbouring or transit jurisdiction is, as a matter of EU enforcement practice, a diversion red flag. This applies whether the change follows a sanctions programme or is otherwise unexplained. Transit through a third country does not change an item's controlled status; origin and end-use analysis follows the item, not the route.

Unusual contractual terms. A buyer that resists completing an end-user certificate, requests that documentation omit the item's technical specification, or proposes a route that adds transit legs without commercial explanation is presenting diversion risk. These are not neutral preferences. They require an explanation in the due-diligence file.

Indirect listing risk. EU asset-freeze prohibitions extend to making funds or economic resources available, directly or indirectly, to or for the benefit of listed persons. A distributor with no listing may nonetheless be an economic resource of a listed person, or may be conducting on behalf of one. The analysis cannot stop at first-tier screening.

Licensing gaps on the new route. A transaction that was previously covered by a general export authorisation may not be covered by the same authorisation if the route changes. A new transit jurisdiction, a new freight forwarder, or a new end user can take the transaction outside the scope of an existing authorisation. Recheck on every material change.

Inconsistency with stated end use. The technical characteristics of the goods and the stated end use must align. A high-specification computing component sold to a buyer whose stated activity is commodity distribution does not align. That inconsistency must be resolved before export, not after a competent authority raises it.

What does a compliance checklist for anti-circumvention and third countries look like?

The following sequence represents a working anti-circumvention compliance checklist for export-control and sanctions counsel advising on an EU-governed transaction with a third-country leg.

• Confirm the classification of the item under the EU dual-use list and any relevant Council regulation annex.
• Screen all parties in the transaction chain – including freight forwarders, transit agents, and end users – against the EU Consolidated List and any anti-circumvention measures in force.
• Map the full shipping route. Flag any transit jurisdiction with elevated diversion risk.
• Review the end-user certificate for consistency with the goods' technical characteristics.
• Identify the applicable member-state competent authority and confirm whether a general export authorisation covers the transaction or whether a specific authorisation is required.
• Check parallel obligations under the EAR (US) and UK export control order, where relevant.
• Document the assessment contemporaneously and retain records in accordance with the applicable obligation.
• Set a trigger for re-review: any change in route, party, or product specification reopens the analysis.

Does your current export-compliance programme include a re-review trigger on route changes? In our experience, it is the absence of exactly this trigger that produces the most avoidable violations.

For businesses handling advanced computing controls under the EAR, the parallel US obligations require a separate classification and routing analysis; the two regimes must be run side by side.

Cloud and remote-access delivery models create their own diversion questions. See our guide to cloud and remote-access controls on a cross-border basis and our OFAC-specific guide on remote-access controls for the treatment of technology transfers in digital form.

When should a business involve external compliance counsel?

External counsel should be brought in early, not after a problem has materialised. The situations that most commonly benefit from early involvement are these.

A supply-chain redesign that routes controlled goods through a new third country is the clearest trigger. The compliance team can clear the first leg. It often lacks the cross-regime visibility to assess what happens in transit and at delivery. That is the gap that produces anti-circumvention exposure.

A competent authority request for information – even one framed as routine – warrants immediate legal review. The information a business provides in response to such a request shapes the enforcement assessment. An uncoordinated or incomplete response can convert a minor matter into a formal investigation.

A transaction that involves a party in a jurisdiction subject to EU measures, or a party flagged by internal screening, requires a legal opinion before the transaction proceeds. A screening hit is not, by itself, a definitive answer. Clearing it or confirming the block requires a legal analysis, not a compliance-team judgment call.

Voluntary self-disclosure is a recognised mitigating factor in enforcement assessments across several regimes. If your review identifies a potential violation – a shipment that may have bypassed a restriction, or a party that should not have been cleared – the question of whether and how to disclose requires legal advice. The window for early disclosure is typically short, and disclosure made after a competent authority has already identified the matter carries less weight than one made proactively.

We act for multinationals, financial institutions, and exporters on sanctions and export-control matters across the major regimes. Where a business is working through an EU anti-circumvention question alongside a parallel US or UK concern, our practice handles both without the coordination cost of involving multiple separate advisers.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.