A manufacturer of precision instruments receives an order from a distributor it has worked with for three years. The goods are dual-use. The distributor is based in a jurisdiction where the end-user community is mixed, and three of its downstream buyers have recently appeared on the Entity List (BIS's list of parties subject to enhanced licence requirements or denial of export privileges). The manufacturer's compliance team catches the connection – but only because one analyst happened to recognise a name. That is not a programme. That is luck.
A sanctions compliance programme under the Export Administration Regulations ("EAR"), administered by the Bureau of Industry and Security ("BIS"), is a documented, risk-calibrated set of controls covering classification, screening, licence determination, record-keeping, and training. BIS has stated publicly that the existence of a well-designed programme is a significant mitigating factor in enforcement. As of mid-2026, BIS enforcement activity across dual-use and export-control matters remains at an elevated level, and the agency expects exporters, re-exporters, and transferors to demonstrate systemic controls – not ad hoc review.
This guide walks through the essential steps to build, test, and sustain a BIS/EAR-compliant programme, flags the cross-regime considerations that multinationals regularly underweight, and identifies the points at which specialist counsel adds the most value.
Step 1: Understand what BIS / EAR controls – and who it reaches
The EAR governs the export, re-export, and in-country transfer of items that are subject to US jurisdiction, and the reach of those rules is broader than most first-time programme designers expect. "Items" in the EAR sense means goods, software, and technology, including source code. The jurisdictional hook is not physical location of the goods: it is the nature of the item and the extent to which it incorporates US-controlled content, US-origin technology, or was produced with US equipment or software above defined thresholds.
An Export Control Classification Number ("ECCN") on the Commerce Control List ("CCL") signals that an item has one or more identified reasons for control – national security, nuclear non-proliferation, regional stability, anti-terrorism, and others. Items not on the CCL are designated EAR99, which carries no licence requirement for most destinations. But EAR99 is not a free pass: if the end-user is on a restricted-party list, or if there are red flags around end-use, even EAR99 items can require a licence.
The extraterritorial dimension is where the programme must go beyond the domestic team. The de minimis rule and the foreign direct product rule ("FDPR") can subject non-US entities to EAR jurisdiction when their products incorporate or are produced using US-controlled inputs or technology above defined thresholds. A European subsidiary that re-exports goods produced with US-origin technology can be acting as a "re-exporter" subject to EAR – and its compliance programme must reflect that. In our practice, this is one of the most frequently underestimated exposure points for non-US multinationals.
No BIS/EAR compliance programme is complete unless it maps the full jurisdictional perimeter: which entities in the group are exporters, re-exporters, or transferors under EAR; which products carry an ECCN; and which shipments or technology transfers are caught by the FDPR or de minimis rules regardless of where they originate.
Step 2: Classify your items before you screen your counterparties
Classification is the logical first gate in any EAR compliance programme, because you cannot determine licence requirements, applicable exceptions, or list-screening obligations until you know what your items are. Classification determines which CCL entry, if any, applies and which control reasons are engaged.
Correct classification requires a technical assessment of the item against the CCL parameters, and it requires documentation. A spreadsheet of ECCNs assigned by sales staff is not a classification system. A well-constructed programme has a written classification methodology, version control on product classifications, a review trigger when products are modified, and sign-off from someone with authority and the requisite technical knowledge.
Misclassification in either direction carries risk. Over-classifying leads to unnecessary licence applications, delays, and cost. Under-classifying – treating a controlled item as EAR99 – is the more serious error. BIS will look at the classification record in any enforcement review, and an absence of documentation makes it hard to argue that a violation was the product of reasonable judgement rather than indifference. Have you documented not just the conclusion but the analytical path that reached it?
In a recent matter, a technology business had correctly classified its core hardware but had never classified the accompanying software tools and had not assessed whether technology transfers to its overseas service teams constituted deemed exports requiring a licence determination. We conducted a full classification review, updated the product register, and identified two categories requiring new licence determinations. The business then resolved those determinations before any shipment occurred.
Programme note: classification is not a one-time exercise. A product line changes; controls lists are updated; jurisdictional facts shift. Build a classification-review trigger into every product-development and product-modification gate.
Step 3: Design your screening architecture
Screening under BIS/EAR means checking parties – buyers, end-users, freight forwarders, financial intermediaries, and others involved in the transaction – against the restricted-party lists that BIS administers or that interact with EAR obligations. The primary BIS lists are the Entity List, the Denied Persons List, and the Unverified List. The Entity List imposes a licensing requirement (or a presumption of denial) for transactions with named parties; the Denied Persons List prohibits all dealings; the Unverified List indicates that BIS has been unable to verify the party's bona fides.
OFAC's lists – principally the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) – operate separately but in parallel. A robust screening architecture covers both regimes. The two agencies administer different statutory bases, different lists, and different licensing routes, but from the exporter's perspective the practical obligation is to screen against all applicable restricted-party databases before each transaction.
Cross-regime screening has a specific architecture requirement. BIS screening for the Entity List may need to be matched against an EU and UK designated-party search for the same counterparty, since the EU and UK regimes have their own lists, and a party not on BIS's lists may be designated under EU Council regulations or OFSI's consolidated list. Conversely, a party on the BIS Entity List may not be designated for sanctions purposes in any other regime. The two systems should be integrated but must not be conflated.
The position above covers the standard architecture. Your specific facts – the jurisdictions you ship to, the sectors your buyers operate in, the complexity of your distribution chain – change the screening design. For an assessment of your programme's screening gaps, contact Calder & Vance at info@caldervance.com.
Screening system configuration matters as much as list selection. Fuzzy-match thresholds, transliteration rules, and alias handling determine whether a hit is returned or a listed party slips through. In our experience, firms using generic screening tools set to default parameters generate large volumes of false positives and miss aliases and variant spellings. Calibration is not a technical luxury; it is a compliance obligation.
Step 4: Map your licence determination and exception logic
Once an item is classified and parties have been screened, the next step is to determine whether a transaction requires a licence, qualifies for a licence exception, or may proceed under a No Licence Required determination. The EAR provides a structured but complex hierarchy of licence exceptions, each with defined eligibility criteria tied to the item's ECCN, the destination country, the end-user, and the end-use.
Programme design here involves two documents. First, a licence-determination matrix: for each product category and each destination or end-user profile, what is the applicable exception (if any) and what eligibility conditions must be met? Second, a licence-management register: for all cases where a licence has been obtained from BIS, what are the conditions attached, what shipments have been made against it, and when does it expire?
The exception analysis requires specialist input for anything beyond the straightforward. Some exceptions – License Exception TMP for temporary exports, License Exception ENC for encryption items – carry specific conditions, reporting obligations, and annual self-classification requirements. Treating exceptions as a form-free shortcut is one of the most common programme failures we encounter.
Where a licence is required and no exception applies, the programme must have a defined application process: who prepares the application, who signs, what supporting documentation is required, and what the escalation path is when BIS raises questions. BIS licence processing times vary; a programme that has no mechanism for managing the lead time will create commercial pressure to ship before the licence arrives.
Step 5: Build the transaction red-flag review process
Classification, screening, and licence determination together cover the systematic review. The red-flag layer is the human judgement element, and it is expressly expected by BIS. The agency's guidance identifies specific red flags – patterns in a transaction that should prompt additional enquiry before a shipment proceeds, regardless of whether a listed party appeared in screening.
Common red flags include: a buyer who is reluctant to identify the end-user; a request to omit the exporter's name from documentation; an end-use or end-user that is inconsistent with the goods being purchased; payment routed through a third country with no obvious commercial explanation; or an intermediary whose address is a freight-forwarding hub without a plausible distribution function. No list of red flags is exhaustive. The programme must give staff the tools to identify and escalate, not just a static checklist.
Red-flag review interacts directly with the know-your-customer obligation. A financial institution running sanctions screening under OFAC requirements will apply a similar logic, but the BIS red-flag analysis is transaction-level and item-specific in a way that a generic customer-onboarding screen is not. For exporters that also engage banks and freight forwarders in the transaction chain, the programme should address how red flags are communicated and what authority the compliance function has to hold a shipment.
If a transaction has already been flagged internally, or if a filing has been refused, an early compliance review can preserve options that narrow with delay. Contact Calder & Vance at info@caldervance.com to discuss a confidential review.
Step 6: Record-keeping, training, and programme governance
The EAR specifies a mandatory record-keeping period for export transactions, and programme design must embed this as a baseline requirement. Record-keeping under BIS covers export documents, licence applications and approvals, classification records, screening outputs, and correspondence with the agency. Gaps in records substantially weaken any enforcement defence and can themselves constitute a violation.
Training is the mechanism by which the programme lives beyond the compliance team. BIS expects that staff in sales, logistics, finance, and product development – not only compliance professionals – are aware of the obligations that attach to their roles. A training programme that reaches only the compliance team is not proportionate to the EAR's scope. Training should be role-specific: the classification obligation for a product manager differs from the red-flag obligation for a sales representative, and both differ from the licence-management obligation for a logistics coordinator.
Programme governance means accountability. Who owns the programme? Who reviews it annually? What is the escalation path for a potential violation? What is the process for a voluntary self-disclosure ("VSD") – BIS's mechanism for a company to report an apparent violation in exchange for enforcement credit – if a shipment is discovered to have been made without the required licence? A programme without a VSD decision tree is incomplete; the question of whether to disclose, and on what timeline, is a legal judgement that must be made quickly and with advice.
Governance also requires a periodic testing cycle. A written programme is a hypothesis about how the business operates. Testing – transaction sampling, classification audits, screening-logic reviews – determines whether the hypothesis is correct. Our practice includes structured compliance-testing work; see our related service on compliance audit and testing for a practical grounding in what that process involves.
How does BIS / EAR interact with other regimes?
The EAR does not operate in isolation, and a BIS compliance programme that ignores adjacent regimes will produce blind spots. Three interactions are particularly important for cross-border businesses.
First, OFAC and BIS share restricted-party management functions in the US government, but they operate under different statutes, different lists, and different licensing routes. A transaction may be clear under the EAR (no ECCN, EAR99, no Entity List match) and still prohibited under OFAC because the counterparty is an SDN. The programme must run both analyses; neither substitutes for the other.
Second, the EU's dual-use regime and the UK's export-control regime under the Export Control Order impose parallel controls on many of the same categories of goods and technology. A company exporting from the EU or the UK must assess the EU list and the UK Strategic Export Licensing criteria in addition to any EAR requirements that apply by reason of US-origin content or the FDPR. In some cases the applicable foreign-direct-product rules extend EAR requirements even to exports from the EU or UK entity. The interaction is not simple, and the programme design must address both regimes for any exporter with dual-origin product lines.
Third, secondary sanctions risk sits outside the EAR but within the broader compliance environment. OFAC's secondary-sanctions programmes can restrict the ability of non-US entities to deal in certain markets even where those entities are not themselves subject to primary OFAC jurisdiction. A BIS compliance programme for a non-US subsidiary of a US parent, or for a non-US company with significant US-dollar transaction flows, should address the secondary-sanctions dimension even if BIS/EAR is the primary export-control concern. For a cross-border overview of how these programmes interact, our guide to cross-border compliance programme design sets out the analysis in full.
How a business weighs these interactions depends heavily on its product mix, its geographic footprint, and its ownership structure. The answer for a US exporter shipping hardware to allied-nation distributors looks different from the answer for a European manufacturer using US-controlled semiconductor technology in products sold globally. Both need a programme; they do not need the same programme.
Common mistakes and when to involve compliance counsel
In our practice advising exporters and multinationals on BIS/EAR matters, certain programme failures recur. The most common is treating classification as a commercial task rather than a technical-legal one – resulting in a product register full of ECCNs assigned on the basis of marketing descriptions rather than CCL parameters. The second most common is screening that covers OFAC but not BIS lists, or vice versa. The third is a training programme that exists on paper but has not been delivered to sales or logistics staff in any form that affects their daily decisions.
A fourth, and underappreciated, failure is the absence of a formal mechanism for dealing with the deemed export issue. A deemed export is a release of technology to a foreign national in the United States – it is treated as an export to that person's country of nationality. For technology businesses with international engineering teams, this is not a theoretical concern; it is an active compliance obligation.
The myth worth addressing directly: some businesses assume that because they have not yet received a BIS inquiry or notice, their current programme is adequate. BIS enforcement works on a detection and investigation cycle that lags compliance failures by months or years. The absence of a notice is not evidence of compliance. In our experience, the businesses that discover violations first – through their own programme testing – are consistently in a better position to manage the outcome than those who discover violations when BIS does.
Specialist compliance counsel adds value at six points: initial programme design, classification review of a new product line, due diligence screening on a target or counterparty, response to a BIS inquiry or Suggested Charging Letter, decision-making on VSD, and periodic programme testing. For ongoing matters, early involvement shapes the record. For new programmes, early involvement prevents the record from becoming a problem.
Related practices
- Compliance audit and testing – structured testing of live export-control and sanctions programmes
- BIS / EAR compliance programme design: advanced issues – deep-dive on FDPR, deemed exports, and enforcement defence
- Cross-border compliance programme design – how BIS/EAR, OFAC, EU, and UK obligations interact for multinationals