How to respond to anti-circumvention measures under EU

A European trading company routes a controlled dual-use item through a third country. The goods leave the EU, pass through an intermediary jurisdiction, and reach an end-user that would have triggered a licence requirement if the export had been direct. The transaction appears clean on paper. Under the EU's anti-circumvention instrument, it may not be. As of January 2026, that instrument has been applied for the first time, and the compliance stakes for operators with third-country supply chains have shifted materially.

EU anti-circumvention measures (provisions in EU sanctions regulations that extend obligations to operators in third countries where EU measures are being circumvented) can reach conduct well beyond the EU's borders. The governing authority is the Council of the EU, acting through directly applicable Council Regulations. When goods, technology, or financial flows are re-routed through a third country to defeat a prohibition, the anti-circumvention rules treat the transaction as if the evasion had not occurred. The practical consequence is that EU-nexus operators – and, increasingly, third-country intermediaries – must understand precisely how these rules work before any cross-border transaction is structured.

This guide walks one representative cross-border engagement front to back: from the initial compliance flag, through the legal analysis, to the controls a business should put in place and the point at which specialist counsel becomes necessary.

Stage one: identifying the compliance flag

The first task is recognising that an anti-circumvention question has arisen at all. EU anti-circumvention measures and third countries are not a single, static provision. They sit across a range of Council Regulations and, in certain programmes, in dedicated anti-circumvention articles that operate alongside the underlying prohibitions.

A compliance flag typically arises in one of three ways. First, a screening tool returns a result that does not directly match a listed person, but the goods or funds are destined for a jurisdiction that has shown a sharp change in trade flows. Second, an existing supplier or distributor reports that a known buyer is now routing orders through a new entity in a neighbouring country. Third, an internal audit identifies a pattern of indirect transactions that aggregate to volumes inconsistent with the stated end-use market.

Each of these signals a possible circumvention attempt. They do not, by themselves, establish one. The compliance officer's first step is to distinguish a genuine diversion risk from a legitimate third-country transaction. That distinction turns on documented evidence, not inference. In our experience, the teams that manage this well have a standard initial triage checklist that asks three questions: Does this jurisdiction appear as a diversion red flag in our internal risk data? Is there a plausible commercial rationale for the routing that is independent of any restriction on the ultimate destination? Is the end-user independently verifiable?

If any answer is uncertain, the transaction should be paused and assessed before any shipment, payment, or technology transfer is made.

Stage two: working through the legal analysis

Once a flag has been identified, the next step is the legal analysis: does EU anti-circumvention law, as currently in force, reach the transaction in question? This is where the anti-circumvention measures and third countries compliance work becomes technically demanding.

EU anti-circumvention provisions operate on two axes. The first is the geographic reach of the underlying prohibition. EU measures are directly applicable to EU persons (natural and legal), to EU-incorporated entities acting anywhere, and to conduct taking place within EU territory. A transaction that starts and ends entirely outside the EU still falls within scope if an EU person is involved at any stage – as exporter of record, as beneficial owner of the goods, as financier, or as the party providing technical assistance.

The second axis is the circumvention concept itself. The relevant question is whether the structure of the transaction has the purpose or effect of defeating a prohibition that would have applied to a direct route. Courts and regulators have not reduced this to a single mechanical test. Instead, they look at objective indicators: a sharp change in trade flows to the third country; a new entity with no apparent commercial history; a mismatch between the volume of goods and the absorptive capacity of the stated end-use market; and an absence of credible end-user documentation.

Where the EU's anti-circumvention instrument has been applied directly to third-country operators, the legal basis is the Council's authority to address operators whose conduct undermines the practical effect of EU measures, even where those operators are not themselves EU persons. This is a significant jurisdictional extension. As a matter of practice, the question of how and whether an EU court would enforce such a measure against a purely third-country operator without EU assets or presence is unresolved. What is settled is the consequence for any EU-nexus operator that continues the transaction: the EU prohibition applies to it fully, and facilitation by an EU person of a transaction that would be prohibited if conducted directly is itself prohibited.

The cross-regime dimension matters here. Under the US Export Administration Regulations (the EAR), transit through a third country does not change an item's controlled status. Origin and end-use analysis follows the item, not the route. Under UK export licensing rules administered by the ECJU, similar principles apply: re-export through an intermediate jurisdiction does not extinguish a licence requirement that would have attached to a direct export. In our practice, a transaction that triggers a circumvention question under the EU regime will almost always require a parallel check under US and UK law, because the risk is structural rather than jurisdiction-specific. Have you run the analysis across all three regimes, or only under EU law?

Stage three: assessing third-country routing risk in practice

The practical risk assessment turns on three variables: the item, the route, and the end-user.

On the item: EU dual-use export controls are governed by the recast EU Dual-Use Regulation, as currently in force. That regulation establishes a control list and a licensing regime. Whether an item requires a licence for export to a given destination is the starting point. A controlled item exported without a licence to the correct end-user, then diverted through an intermediate jurisdiction to a prohibited end-user, is a circumvention. The item's classification does not change along the route.

On the route: a transit jurisdiction that appears frequently in diversion red-flag analysis is a material risk indicator. Regulators treat a sharp and unexplained change in trade flows to a neighbouring or transit jurisdiction as evidence of potential diversion. This does not make the transaction illegal, but it requires enhanced due diligence and documented justification. Compliance counsel should ensure the file contains a credible, contemporaneous commercial explanation for the routing.

On the end-user: end-use controls are a central component of EU and US export-control regimes. The EU Dual-Use Regulation requires exporters to assess end-use as well as end-user. A declared end-use that is inconsistent with the end-user's known operations is a red flag that should stop the transaction pending further investigation. Under BIS and the EAR, military end-use and end-user restrictions for specified destinations add a further layer of scrutiny that EU exporters with US-origin content in their goods must also apply.

The interaction of EU anti-circumvention measures with the US Foreign Direct Product rules deserves particular attention. Where EU-made goods incorporate controlled US technology or software above applicable thresholds, the EAR can apply extraterritorially. A transaction that appears to fall only under EU law may simultaneously engage US jurisdiction. In our cross-border practice, mapping the origin of every controlled input in a dual-use item is a standard step before any export to a jurisdiction with elevated risk.

Stage four: the compliance checklist before the transaction proceeds

This is the operational core of any anti-circumvention measures and third countries compliance programme: a structured pre-transaction checklist that a compliance officer can apply consistently.

Before a controlled or potentially controlled item is exported, or technology transferred, through or to a third-country party, the following steps should each be completed and documented:

• Item classification confirmed. Has the item been classified against the EU Dual-Use Regulation control list? Has the same item been assessed under the US Commerce Control List if it contains any US-origin content? Classification must be documented and reviewed when the item's specifications change.
• End-user verified independently. The stated end-user's identity, address, and business activities should be verified against independent sources, not solely the counterparty's representations. Where the routing passes through an intermediary, the intermediary's principals and UBOs should be screened.
• Routing commercially justified. A contemporaneous note should explain the commercial rationale for using a third-country route rather than a direct export. The note should be drafted at the time of the transaction, not reconstructed later.
• Diversion indicators assessed. Has the compliance team reviewed whether the transit jurisdiction appears on any internal or publicly available diversion red-flag list? Has there been a sharp change in trade volumes through this route in recent periods?
• Licence requirements confirmed. Has a licence been obtained, or an exception confirmed, for the export to the stated end-user and end-use? Does the routing change the licence analysis? In general, it does not alter the legal requirement, but it may affect the practical ability to verify end-use conditions.
• Contractual protections in place. Does the contract with the third-country buyer or intermediary include end-use and re-export clauses? Are those clauses enforceable in the third country's legal system?
• Record-keeping confirmed. OFAC regulations require sanctions records to be kept for five years. Best practice applies the same standard to export-control records under EU and UK law. The file should contain all of the above at the time the transaction is approved.

A checklist alone is not a compliance programme. It is the visible output of one. The controls behind it – classification procedures, screening systems, training, escalation paths, and senior sign-off for elevated-risk transactions – must exist and function before the checklist is useful.

Stage five: the common myth and the real risk

A widespread misconception in cross-border trade is that commercial availability defeats export-control classification. The reasoning runs: if a product can be purchased without restriction in any hardware shop or online marketplace, it cannot be export-controlled, and routing it through a third country raises no legal issue.

This is incorrect. Dual-use controls attach to an item's technical parameters and to its potential military or proliferation applications, not to its commercial availability. An item that is freely available on the commercial market may still carry an Export Control Classification Number (ECCN – a classification number on the US Commerce Control List) or appear on the EU Dual-Use Regulation's Annex. Commercial availability may affect the weight a regulator gives certain factors in a licensing decision. It does not remove the export-control obligation.

A related error is assuming that because a previous export of the same item to the same destination was cleared without incident, all future exports are automatically permissible. Controls change. Country-group classifications can shift. The designation of an end-user can occur between orders. Each transaction requires its own assessment at the time it is conducted.

In our experience advising exporters on EU and parallel US controls, the firms most exposed to enforcement are not those that knowingly attempt circumvention. They are the firms whose compliance infrastructure has not kept pace with the technical evolution of their product lines, and which have continued to ship items under a classification that was correct two years ago but is no longer current. Periodic classification reviews are not optional housekeeping. They are a core compliance requirement.

Stage six: when to involve sanctions and export-control counsel

The decision to involve counsel is itself a compliance step. It should be made as early in the process as possible, not after a regulator has raised a query.

Specific triggers for early engagement include:

• A transaction that involves a third-country intermediary in a jurisdiction flagged for diversion risk, where the end-user cannot be independently verified to a standard the compliance team is confident in.
• A transaction where the item's classification is uncertain, or where the item contains US-origin components that may engage the EAR's extraterritorial reach in addition to EU controls.
• A request from a regulator – whether the European Commission, a national competent authority, the ECJU, or BIS – for information about a past or current transaction.
• A compliance audit that identifies a gap between the controls in place and the documented standard the business has committed to.
• A change in the sanctions or export-control regime – such as the first application of the EU's anti-circumvention instrument to third-country operators – that requires a review of existing contractual and operational arrangements.

The position above covers the standard case. Your facts – the specific item, the third country in the route, the end-user, and the regime in play – change the analysis materially. Early advice is not a cost. It is the difference between a transaction that proceeds lawfully and one that creates enforcement exposure that a later review cannot close.

For a confidential review of a cross-border transaction or export-control compliance programme, contact Calder & Vance at info@caldervance.com.

Useful resources from this practice

• Advanced computing controls under BIS and the EAR – service coverage for technology exporters under US export control.
• Cloud and remote-access controls in cross-border transactions – guide on deemed-export and technology-release issues in digital delivery.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.