A shipment leaves the United States. The exporter later discovers the end-user appears on the Bureau of Industry and Security's Entity List. Or a technology transfer occurred without the required licence under the Export Administration Regulations. The compliance team now faces a question that will shape every subsequent decision: does this constitute an apparent violation, and what must the company do next?
An apparent violation (a transaction or conduct that on its face appears to breach the Export Administration Regulations, or EAR, administered by the Bureau of Industry and Security, or BIS) triggers a structured internal assessment before any decision about voluntary disclosure can be made. As of March 2026, BIS assesses apparent violations against a published set of general factors – including wilfulness, harm to the export-control programme, and the company's prior compliance history – that determine both whether a penalty is appropriate and, if so, its severity. A prompt, thorough, and well-documented internal assessment is the single most important step a business can take after identifying a potential EAR breach.
This guide walks through the assessment process step by step, compares the BIS approach with the OFAC framework and with EU and UK export-control regimes, and identifies the risk flags that most commonly lead businesses to escalate to counsel.
Step 1: Understand what BIS considers an apparent violation
An apparent violation under the EAR is any act or omission that, on its face, appears to breach a prohibition or licence condition – whether or not a criminal or civil finding has been made. BIS makes clear that the apparent-violation label is a starting point, not a conclusion.
The EAR governs the export, re-export, and in-country transfer of dual-use and commercial goods, software, and technology. An item's Export Control Classification Number – its ECCN (the alphanumeric code on the Commerce Control List that indicates why the item is controlled and to which destinations it requires a licence) – determines the applicable licence requirements. An apparent violation arises when an ECCN-controlled item moves without the required licence, when a shipment reaches an end-user on a restricted party list such as the Entity List or the Denied Persons List, or when a condition attached to an existing licence is not respected.
Apparent violations can also arise from re-export. A European subsidiary that transfers US-origin technology to a third-country customer without checking whether BIS jurisdiction still attaches commits a potential EAR violation, regardless of where the subsidiary is incorporated. This extraterritorial reach is one of the defining features of BIS enforcement and sets the EAR apart from most other export-control regimes. We regularly advise non-US companies that encounter this point for the first time after a transaction has already completed.
The governing instrument is IEEPA together with the Export Control Reform Act, which together form the statutory basis for the EAR. BIS – formally the Bureau of Industry and Security within the US Department of Commerce – administers and enforces those regulations. DOJ handles criminal referrals when wilful conduct is involved.
Step 2: Preserve and secure the evidence
Before any substantive review begins, issue a legal hold. All records connected to the transaction – export documentation, classification records, licence files, correspondence with the end-user, shipping instructions, and internal approvals – must be preserved from deletion, alteration, or overwriting.
This step is time-critical. In our experience, the most damaging early mistakes in apparent-violation matters are not the underlying export control breach itself but the subsequent loss of records that would have supported a mitigating narrative. BIS treats record-keeping as a substantive obligation, not an administrative nicety. The EAR requires exporters to retain export-related records for five years from the date of export or from the date of any other triggering action – a mandatory retention period that reflects the window within which BIS can initiate an enforcement action.
The hold must extend beyond the compliance team. Sales staff who communicated with the customer, logistics staff who arranged the shipment, and any third-party freight forwarder who acted as the exporter of record may each hold relevant material. Coordinate the hold quickly, and document that you did so.
Step 3: Conduct the internal fact-gathering review
The internal review is the analytical core of the apparent-violation assessment. Its purpose is to establish, as precisely as possible, what happened – not to reach a premature legal conclusion about whether a violation occurred.
The review should address at minimum:
- What item was exported, re-exported, or transferred? What is its ECCN classification, and on what basis was that classification made?
- What licence exception, if any, was applied? Was the exception correctly available at the time of the transaction?
- Who was the end-user or transferee? Had the company screened that party against BIS restricted-party lists before the transaction? When was the screening conducted?
- Was there any red-flag information that should have prompted further diligence?
- Was a licence required? If a licence existed, were all its conditions observed?
- What was the value and volume of the transaction?
- How did the apparent violation come to light – through internal review, a third-party notification, or a BIS inquiry?
Document every step of this fact-gathering process. If the matter later becomes the subject of a BIS investigation, or if the company decides to submit a voluntary self-disclosure (VSD – a formal notification to BIS describing the apparent violation and the company's remediation steps, which BIS treats as a significant mitigating factor), the internal review record becomes the foundation of that submission.
Do not conduct this review in a way that conflates facts with conclusions. A witness interview that asks "did we violate the EAR?" rather than "what did you know and when?" will produce an unreliable record and may generate a document that complicates later privilege claims.
Step 4: Map the transaction against BIS general factors
Once the facts are established, apply BIS's published general factors for evaluating apparent violations. These factors determine whether a penalty is warranted and, if so, its magnitude.
BIS considers factors including:
- Wilfulness and knowledge: Was the violation intentional? Did the exporter know or have reason to know the applicable rule?
- Harm to the export-control programme: Did the item or technology reach a destination or end-user that the EAR is specifically designed to prevent from accessing it?
- Individual characteristics: Is the company a first-time apparent violator? Does it have a prior enforcement history with BIS or with OFAC?
- Compliance programme: Did the company have a functioning export compliance programme at the time? Was the violation the result of a systemic failure or an isolated error?
- Remediation: Has the company taken corrective action to prevent recurrence?
- Cooperation: Has the company been forthcoming in the agency's review?
This factor mapping is not a penalty calculation – BIS retains discretion and the factors interact with one another. It is, however, an essential analytical step because it tells the compliance team and its counsel where the case is likely to sit on the spectrum from a no-action letter at one end to a substantial civil penalty or a criminal referral at the other. In a recent matter, a technology manufacturer whose compliance team had documented a genuine classification uncertainty before the transaction used that record to demonstrate that the apparent violation arose from an honest disagreement about ECCN classification rather than wilful non-compliance. That documentation materially affected how BIS viewed the matter.
Step 5: Decide on voluntary self-disclosure
The decision whether to submit a VSD is one of the most consequential choices in export-control enforcement. BIS treats a timely, accurate, and complete VSD as a major mitigating factor. The EAR's penalty provisions reflect a meaningful difference in outcome between companies that voluntarily disclose and those that do not.
The VSD analysis has two stages. First, decide whether to disclose at all – a question that turns on the severity of the apparent violation, the likelihood that BIS will discover it independently, and the company's overall enforcement history. Second, if the company decides to disclose, decide how quickly and in what form. BIS expects a voluntary disclosure to be thorough and accurate; an incomplete or misleading VSD is worse than no VSD at all and will eliminate the mitigating benefit.
Timing matters. A disclosure made promptly after the apparent violation is discovered is treated more favourably than one filed after BIS has already opened an investigation. If BIS has already contacted the company, the calculus changes significantly and immediate legal advice is required.
The position under other regimes adds complexity. A business that has simultaneously sold items subject to UK export controls without an ECJU licence, or has transferred dual-use goods without the required authorisation under EU dual-use rules, may need to consider parallel disclosures. The UK regime administered by the Export Control Joint Unit operates separately from BIS. The EU regime – built on the EU dual-use regulation – has its own national enforcement structures across member states. Neither automatically benefits from a BIS VSD, and the reverse is equally true. If you are managing a multi-jurisdiction apparent violation, co-ordinating disclosure strategy across the relevant regimes requires careful sequencing.
The position for OFAC matters is analogous but not identical. OFAC's guidelines similarly treat voluntary self-disclosure as a mitigating factor. However, OFAC and BIS are separate agencies with separate enforcement frameworks and separate penalty structures. A single transaction can generate simultaneous exposure to both – for example, an unauthorised export to a party on both the Entity List and the SDN List – and each agency will assess the matter on its own terms. We regularly advise clients managing parallel BIS and OFAC exposure, and in our experience, co-ordinating the disclosure and remedy strategy from the outset avoids the risk of making statements to one agency that complicate the position with the other.
How does the BIS / EAR approach compare with other regimes?
The BIS apparent-violation framework shares its general logic with the enforcement regimes of OFAC, OFSI, and the EU sanctions bodies, but differs in important respects that affect how a cross-border business should structure its response.
Under OFAC, the starting point for an apparent violation is similar: facts are gathered, factors are evaluated, and VSD is considered. The OFAC framework distinguishes between egregious and non-egregious cases, with the former attracting a significantly higher penalty base. BIS uses a comparable graduated structure but applies it across a different item universe – controlled exports rather than financial transactions with blocked parties.
Under OFSI – the UK Office of Financial Sanctions Implementation – the enforcement regime is directed at financial sanctions breaches rather than export control breaches. UK export control violations fall instead under ECJU and the criminal law applicable to breaches of the Export Control Order. The UK regime does not currently operate a VSD mechanism with the same formalised mitigation structure that BIS and OFAC provide, though co-operation with authorities and self-reporting are recognised as mitigating conduct.
Under the EU dual-use regulation, enforcement is decentralised to member-state authorities. There is no single EU VSD process equivalent to the BIS procedure. A German exporter that discovers an apparent violation will be dealing with its national competent authority; a French exporter, with a different authority. Standards for voluntary disclosure, and the mitigating weight assigned to it, vary accordingly. The EU regime does, however, apply a uniform licensing structure for items on the EU control list, and the classification starting point is broadly harmonised across member states.
Singapore, Japan, and the UAE each maintain national export-control regimes that impose independent licensing requirements. An apparent violation in one jurisdiction does not automatically mean a violation has occurred under another, but an exporter handling the same item type across multiple jurisdictions should check each applicable country regime independently before concluding that a BIS VSD resolves the full picture.
The critical practical point is that the strictest applicable prohibition governs the transaction in that jurisdiction. A BIS licence, for example, does not authorise an export that violates an EU restriction on the same item to the same destination. Where regimes diverge, the most restrictive controls the outcome.
Related practices
- Apparent-violation assessment under EU sanctions – structuring the internal review and disclosure decision under EU law
- Apparent-violation assessment under Canadian export controls – how Global Affairs Canada's enforcement regime compares with BIS
- Cross-border apparent-violation assessment – managing parallel exposure across multiple export-control and sanctions regimes
Risk flags that require immediate counsel involvement
Not every apparent violation requires immediate external legal advice. A minor, isolated classification error with no restricted-party involvement and a well-documented compliance trail may be manageable with internal resource, at least at the initial fact-gathering stage. The following situations are different.
Involve sanctions and export-control counsel immediately when:
- The end-user or end-use appears on the Entity List, the Denied Persons List, the Unverified List, or OFAC's SDN List.
- The items involved relate to weapons of mass destruction-related goods, advanced semiconductors, or other categories that attract heightened scrutiny under the EAR.
- There is any indication that the shipment was deliberately structured to avoid an export-control check – even if the structuring was carried out by a freight forwarder or intermediary without the exporter's direct knowledge.
- BIS has already been in contact: a subpoena, an inquiry letter, or an unannounced audit visit changes the legal position fundamentally.
- The transaction has also generated potential OFAC, OFSI, or EU sanctions exposure.
- The apparent violation involves a re-export by a non-US entity and raises extraterritorial jurisdiction questions.
- Senior management or individual employees may face personal liability.
- Criminal liability is a realistic possibility – this is relevant where there is evidence of wilful conduct, and DOJ criminal export-control prosecutions have resulted in significant personal consequences.
The position above covers the standard case. Your facts – the counterparty, the goods, the route, the specific EAR controls in play – change the analysis in ways that can significantly affect both the liability exposure and the remedy strategy.
For an assessment of your apparent-violation exposure under the EAR, or to discuss how BIS's enforcement approach applies to your specific facts, contact Calder & Vance at info@caldervance.com.
A common myth about BIS apparent-violation assessment
A persistent misconception in cross-border compliance is that apparent-violation assessment under the EAR is primarily a documentation exercise – that assembling the right paperwork after the fact will resolve the matter without further consequence. This is incorrect, and the misconception can lead companies to delay substantive legal review until options have narrowed significantly.
BIS assesses the substance of the apparent violation, not only the quality of the documentation. A well-organised binder of export records is valuable, but it does not substitute for an accurate classification, a pre-transaction restricted-party screen, and an honest assessment of red flags that appeared before the shipment. If the substance of the underlying transaction was problematic, curated documentation will not change that assessment. What mitigates is genuine remediation: correcting the classification, strengthening the screening process, and demonstrating to BIS that the systemic failure has been addressed.
In our cross-border practice, the companies that achieve the best outcomes in apparent-violation matters are those that approach BIS with a clear, accurate account of what happened and a credible remediation plan – not those that attempt to reframe events through selective record presentation.
If a transaction has already been flagged, or if an internal review has produced findings that you are uncertain how to characterise to BIS, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential assessment.