How to meet licence conditions on controlled computing under OFAC

A technology exporter has secured a specific OFAC licence for a shipment of advanced computing equipment to a restricted destination. The paperwork is signed, the freight is booked – and then the compliance team reads the licence conditions. Delivery verification. End-use certificates. Reporting windows. A stalled transaction follows. Understanding how to meet those conditions before they breach them is what decides whether the shipment moves or the licence is revoked.

Licence conditions for controlled computing exports under OFAC are legally binding obligations attached to a specific licence authorisation. They govern how, where, and to whom controlled computing items may be transferred, and they require active post-shipment monitoring. Failure to meet any condition is treated as a violation of the licence itself – with the same civil-penalty exposure as an unlicensed transaction. As of January 2026, OFAC's enforcement posture treats licence-condition breaches as serious, non-egregious violations in the first instance, but repeated or concealed failures attract egregious treatment.

This guide walks through the decision sequence a compliance team should run: from reading the licence correctly, through pre-shipment checks, delivery verification, end-use monitoring, and record-keeping, to the cross-regime considerations that apply when UK or EU controls also bite.

If you have a specific licence: what does it actually authorise?

A specific licence (a case-by-case authorisation to conduct an otherwise prohibited transaction) does not authorise everything the underlying transaction involves – it authorises only the precise activity described in its terms. Reading it literally, every time, is step one.

Begin by mapping the licence terms against your transaction facts. Identify the licensed parties – both the US person and the foreign counterparty. Confirm the exact commodity description, including any classification reference on the Commerce Control List. Note the stated end-use and end-user. Then list every condition in order of sequence: what must happen before shipment, at shipment, at delivery, and at intervals afterwards.

Conditions on computing licences commonly include a requirement that the end-user sign an end-use certificate before the item leaves the exporter's control. That certificate must exactly match the licence description. In our experience, exporters sometimes use a generic end-use certificate that predates the specific licence application; the result is a mismatch that OFAC may treat as a condition failure regardless of the exporter's intent.

Ask yourself: does the licence cover re-exports by the licensed foreign party? Many do not. A downstream transfer by the original recipient – even to a subsidiary in the same group – may be outside scope unless explicitly addressed. If you cannot find clear authorisation for a step in the transaction, stop and seek guidance before proceeding.

What must happen before the shipment leaves?

Pre-shipment compliance under a controlled computing licence is the highest-leverage stage: problems identified here are correctable; problems identified after delivery are not.

The pre-shipment sequence typically runs in this order. First, confirm that the licence has not expired or been suspended. OFAC can suspend or revoke a licence; check the current status against the licence number, and do not assume a licence issued months ago is still valid. Second, verify that the named end-user has not been added to a blocking list since the licence was issued. The SDN List (OFAC's list of Specially Designated Nationals and blocked persons) is updated without notice; a counterparty that was clean at licence issuance may have been added since. Run a fresh screen.

Third, obtain any required pre-shipment documentation – end-use certificates, import certificates, or delivery verification undertakings – and retain copies. The record-keeping obligation under OFAC runs for five years. Fourth, brief the freight forwarder on the licence conditions. Forwarders are not sanctions counsel; they handle many shipments and may not read the specific licence in detail. If a condition requires the forwarder to take a particular action (such as obtaining a signed receipt at delivery), that instruction must be given in writing before departure.

One risk flag we see regularly: the licence was obtained by the legal team and filed, but the operations team that actually manages the shipment has never read it. The gap between the licence holder and the logistics chain is where conditions are breached.

If delivery is required to be verified: how does that obligation work?

Delivery verification is a condition that OFAC attaches to licences for high-risk commodities or destinations when it needs proof that the item reached the authorised end-user and not an intermediate or unauthorised party.

The mechanics are straightforward, but the deadlines are tight. Typically, the licence will require the exporter to obtain a signed delivery confirmation from the end-user within a defined period after shipment, and to submit that confirmation to OFAC. Blocked-property and rejected-transaction reports are due to OFAC within 10 business days of the triggering event; delivery-verification deadlines under licence conditions may be shorter or longer depending on the specific licence text, but the spirit of OFAC's reporting expectations is that any required submission is made promptly.

Where delivery cannot be confirmed – the goods are in transit, the recipient is unresponsive, or a freight intermediary has taken custody without onward delivery to the named end-user – the right step is to notify OFAC promptly, before the deadline expires, rather than wait and hope delivery materialises. Early contact preserves the voluntary character of the disclosure. Late contact, after OFAC has reason to believe the condition was missed, does not.

In our cross-border practice, we have seen situations where a consignment arrived at a port in a third country and was re-routed by the freight agent before the end-user took physical possession. Whether that re-routing breaches the delivery condition depends entirely on the licence text; there is no generic answer. The analysis must happen before the routing decision, not after.

What are the ongoing end-use monitoring obligations?

Some computing licences carry post-delivery end-use monitoring conditions that extend well beyond the shipment itself. These are most common where the computing item is dual-use or has significant military-application potential, and where the licensing programme involves heightened scrutiny of the destination country or sector.

End-use monitoring can require periodic reports from the end-user on the location and use of the item, site visits by or on behalf of the licensor, or an obligation to notify OFAC if the end-user proposes to transfer, re-export, or modify the item. BIS administers a parallel end-use check programme under the EAR; where both OFAC and BIS controls apply to the same item, both sets of conditions must be met simultaneously. The stricter obligation governs the conduct of any person subject to both.

The practical difficulty is that end-use monitoring depends on the co-operation of a foreign counterparty. Building that co-operation into the commercial contract – as a condition of payment, a termination trigger, or a warranty obligation – before the licence is granted is far more effective than trying to impose it after delivery. We regularly advise exporters to include specific end-use and re-export clauses in their sale agreements at the licensing stage, so that the contractual mechanism and the licence condition are aligned from the outset.

Is your commercial contract drafted to support the end-use monitoring obligations in your licence? If not, there is a structural gap that no compliance programme can bridge without contractual reform.

How does the OFAC licence-conditions analysis differ from the UK and EU positions?

The cross-border dimension is not optional: a controlled computing export that requires an OFAC authorisation will often also require a UK or EU export licence, and the conditions attached by each regime are independent of each other.

Under OFAC, the licence-conditions analysis is transaction-specific and tied to the SDN list and the relevant sanctions programme. The general licence (a standing authorisation that permits a defined category of transactions without a separate application) may cover some computing-adjacent activity, but computing hardware for restricted destinations is almost always outside the scope of any general licence; the myth that a general licence covers everything – and so no specific application is needed – is one of the most common and costly misunderstandings we encounter.

In the UK, export licences for controlled computing goods are administered by the ECJU. The ECJU issues Standard Individual Export Licences (SIELs) and Open Individual Export Licences (OIELs), and each carries its own conditions on end-use, delivery verification, and reporting to the ECJU rather than to OFSI. OFSI administers financial sanctions under SAMLA and the relevant thematic regulations; where the transaction involves payment to a party in a restricted jurisdiction, an OFSI financial-sanctions licence may also be required alongside the ECJU export licence. The two licences are issued independently and their conditions do not cross-refer.

The EU position adds a third layer for exporters operating through EU entities. EU dual-use export controls are governed by the recast Dual-Use Regulation. That regulation uses a different control list and classification logic from the EAR, and the licensing authority is the competent authority of the member state from which the item is exported. Conditions imposed by an EU member-state authority on a computing export licence do not discharge OFAC conditions, and vice versa. Where all three regimes apply, each set of conditions must be tracked and met on its own terms.

For businesses subject to both the EAR and OFAC controls – the more common US scenario – the ECCN classification of the item determines which EAR licence exceptions, if any, are available. A licence exception under the EAR does not substitute for an OFAC licence where OFAC authorisation is separately required. The regimes operate in parallel, not in sequence.

What are the highest-risk mistakes, and when should you involve counsel?

Licence-condition failures in the controlled computing sector cluster around five patterns, each of which creates significant civil-penalty exposure under OFAC's Enforcement Guidelines.

The first is treating the licence as a one-time approval rather than an ongoing obligation. Once a specific licence is issued, the compliance work intensifies; it does not end. The second is delegation without briefing. Licence conditions bind the licence holder; sub-contractors, freight agents, and distributor networks are not automatically aware of them. Third is record-keeping failure. The five-year record-keeping obligation is concrete; it covers not just the shipping documents but all correspondence, end-use certificates, delivery confirmations, and monitoring reports. A company that cannot produce those records on an OFAC inquiry is at a material disadvantage even if the underlying transaction was clean.

The fourth pattern is misidentifying the general-licence position. Where an exporter believes a general licence applies and does not obtain a specific licence, any associated licence conditions from the general licence must still be met. Many exporters focus on whether the general licence covers the transaction and overlook the conditions it carries. Fifth – and the most serious – is discovering a condition failure after the fact and not reporting it. Voluntary self-disclosure (VSD) to OFAC is a recognised mitigating factor under OFAC's Enforcement Guidelines; it does not eliminate liability, but it changes the penalty calculus materially.

Counsel should be involved at three points: when the licence application is being drafted (to negotiate the scope and wording of conditions before they are imposed), when a condition cannot be met for operational reasons (to assess whether amendment or prior authorisation from OFAC is available), and as soon as there is a potential condition failure (to advise on VSD, preserve records, and structure the disclosure). Involving counsel at the first point is far less costly than at the third.

The OFAC statute of limitations for civil violations is a material consideration for any condition failure. As currently in force – verify before reliance – it was extended to ten years for civil and criminal violations of IEEPA and TWEA in 2024. That means a condition breach from earlier in a programme's life may still carry exposure today.

Licence conditions for controlled computing exports under OFAC – a step-by-step compliance checklist

The following sequence consolidates the decision tree for a compliance team managing a specific OFAC licence on a controlled computing export. Each step is a decision point; failure at any step should pause the process and trigger a legal review before proceeding.

1. Read the licence in full. Map every condition against your transaction facts before any pre-shipment activity begins.
2. Confirm licence validity. Check that the licence has not expired, been suspended, or been revoked. Do this at the time of shipment, not at the time of booking.
3. Re-screen all parties. Run a fresh SDN and relevant blocking-list screen on the end-user, all intermediaries, and the freight forwarder. A clean screen at application does not guarantee a clean screen at shipment.
4. Obtain pre-shipment documentation. Collect all required end-use certificates, import certificates, and delivery-verification undertakings before the item leaves your control. Confirm that each document matches the licence description exactly.
5. Brief the logistics chain. Provide the freight forwarder and any intermediary with written instructions that reflect the licence conditions applicable to their role. Retain those instructions on file.
6. Align the commercial contract. Confirm that the sale or service agreement imposes on the end-user the same end-use, re-export, and monitoring obligations that the licence requires the exporter to enforce.
7. Execute and document. At each post-shipment milestone – delivery confirmation, periodic monitoring report, end-use check – complete the required action and retain the documentation.
8. Report on time. Any required submission to OFAC must be made within the window stated in the licence. If a condition cannot be met within that window, contact OFAC before the deadline – not after.
9. Flag potential failures immediately. If a condition may not have been met, preserve all records, instruct counsel, and assess the VSD position before taking any other step.
10. Maintain records for five years. The five-year record-keeping obligation is not discretionary. Maintain a complete licence file from issuance through all post-delivery monitoring periods.

For exporters managing multiple licences across OFAC, the ECJU, and EU competent authorities simultaneously, a licence-condition tracking matrix – mapping each licence, each condition, and each deadline in a single document – is the single most practical tool for avoiding a breach. We have assisted clients in designing and stress-testing that matrix as part of a broader export-controls programme.

For a detailed assessment of your OFAC licence conditions or to discuss a specific computing export authorisation, see our OFAC computing licence conditions service. Exporters operating under both OFAC and UK controls will find the complementary analysis in our guide to computing licence conditions under OFSI. For transactions involving the UAE as a transit or destination jurisdiction, our UAE computing licence conditions guide addresses the applicable country regime and the reclassification changes that took effect in 2026.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.