BIS / EAR: control beyond the bright-line ownership test

An exporter clears its counterparty through name-screening. The entity does not appear on the Entity List (BIS's list of parties subject to additional licence requirements) or the Denied Persons List (parties with whom transactions are prohibited or restricted). The shipment proceeds. Six months later, a compliance review surfaces a relationship that the name screen never touched: a controlling shareholder whose influence over the buyer's operational decisions brought the transaction within a prohibited category. That gap – between a clean name screen and genuine control analysis – is where real export-control exposure lives.

Under the Export Administration Regulations ("EAR"), administered by the Bureau of Industry and Security ("BIS"), the bright-line ownership test identifies many restricted parties, but it does not exhaust the analysis. Control – exercised through governance rights, contractual mechanisms, operational dependency, or practical influence – can bring a party within the scope of export-control restrictions even where the 50 percent or more ownership threshold is not met. As of January 2026, BIS guidance and practice confirm that the EAR looks to the substance of a relationship, not merely to its formal equity structure.

This guide sets out, step by step, what a compliance-ready business needs to establish before it treats a counterparty as clear: the pre-conditions to check, the control indicators that the EAR regime looks for, the cross-regime comparison that flags where the analysis diverges, and the point at which a matter requires export-control counsel.

What you need before you start: a pre-screening readiness check

Before applying the control-beyond-ownership analysis, a business must confirm that it has a baseline of accurate, current information about the counterparty's ownership structure and key relationships. Without this foundation, any further analysis is unreliable. The EAR regime, under BIS and IEEPA, proceeds from the reality of a business relationship, not its public presentation.

The pre-screening stage requires at minimum: a verified copy of the counterparty's corporate registration and organisational chart; identification of all persons holding governance rights (board seats, veto rights, reserved matters, approval thresholds) regardless of equity stake; a record of any existing contractual arrangements that give an outside party operational authority; and a review of any publicly available filings that might disclose beneficial-ownership information or affiliate relationships.

In our experience, the most common failure at this stage is treating the corporate organogram as complete. Holding structures that route through nominees, foundations, or trust arrangements regularly obscure the party whose influence over the counterparty is operationally decisive. Preparing documentation at this stage is not optional: BIS expects records to be kept for five years, and a missing audit trail worsens an enforcement outcome materially.

Does your compliance team have access to the full ownership and governance picture, or only to the registered-entity level? If the answer is the latter, the readiness check is not yet complete.

Step 1 – Apply the classification and destination analysis first

Control analysis under BIS / EAR is always downstream of a correct item-classification assessment. Determine first whether the goods, technology, or software being exported are classified by an ECCN (Export Control Classification Number under the US Commerce Control List) or are designated EAR99 (subject to the EAR but without a specific CCN). The control-beyond-ownership question only has material consequences if the item carries a licence requirement or an end-use restriction for the destination in question.

BIS administers the Commerce Control List across ten categories and five product groups. A party-control analysis applied to a transaction involving EAR99 goods going to a low-risk destination may reach a different conclusion on its practical significance than the same analysis applied to an advanced-computing item subject to Foreign Direct Product rules or military end-use restrictions.

This sequencing matters. A business that jumps to counterparty-control analysis without completing item classification risks spending resource on a question that does not, in that transaction's context, alter the licence requirement. Classify first; then assess the control relationship of the relevant parties.

Step 2 – Map governance rights and de facto authority, not just equity

The EAR recognises that effective control over a party's decisions can be exercised through mechanisms other than shareholding. This is the heart of the control-beyond-ownership analysis: identifying who has the practical ability to direct the counterparty's acquisition, use, or re-export of controlled items.

The indicators that BIS practice and guidance treat as relevant include: board appointment and removal rights that give a party decisive say over the counterparty's commercial strategy; veto rights over technology-acquisition or supply-chain decisions embedded in shareholder agreements or financing documents; contractual arrangements under which the counterparty is operationally dependent on a restricted party for licences, software, or technical support; and exclusive distributor relationships where the restricted party controls the end-use or onward destination of the goods.

A significant minority holding – below the 50 percent or more ownership threshold – combined with governance rights of the kind described above is treated by BIS as a red flag requiring further assessment, not a safe harbour. The formal equity percentage is the starting point; it is not the ending point. In our practice, we regularly encounter counterparties where a twenty-five percent holder with board-appointment rights and a technology-licensing agreement exercises more decisive control than a fifty-one percent passive investor.

Practical question: can the counterparty acquire, retransfer, or modify the use of the controlled item without the consent of any other party? If not, identify who that other party is and apply the restricted-party analysis to them directly.

Step 3 – Apply the military end-use and end-user controls

For many exporters, the most pressing aspect of control-beyond-ownership analysis arises not from corporate governance but from end-use. BIS administers military end-use and end-user restrictions ("MEU controls") for specified destinations, and these operate independently of whether the immediate counterparty clears the party-list check.

MEU controls bite where the exporter has knowledge – or a reason to know – that the controlled item will be used for military end-use or by a military end-user in a covered destination. A counterparty that is formally civilian but has contractual or operational ties to a covered military programme can bring the transaction within MEU scope, even if the counterparty's name does not appear on any restricted-party list.

The key operational implication is this: end-use and end-user certification, collected at the transaction level rather than at the counterparty-onboarding level, is an essential control. A party that has been onboarded and cleared at a point in time may subsequently enter a programme that triggers MEU restrictions. In our experience, the on-boarding certificate does not substitute for transaction-level end-use diligence on higher-risk items and destinations.

The deemed export rule is an extension of the same logic: controlled technology released to a foreign national within the United States – including through remote access – is treated as an export to that person's country of nationality. This rule can apply inside a company's own workforce and is frequently overlooked in technology-licensing and research contexts.

Step 4 – Assess the Foreign Direct Product rules for non-US entities

A common misconception among non-US businesses is that the EAR reaches only US-origin goods. It does not. The Foreign Direct Product ("FDP") rules extend BIS jurisdiction extraterritorially to foreign-produced items that are the direct product of controlled US technology or software, or that are produced by a plant or major component thereof. As of January 2026, the FDP rules represent one of the most consequential extraterritorial assertions of US export-control jurisdiction.

For control-beyond-ownership purposes, FDP analysis adds a further layer. A non-US manufacturer that uses a licensed US technology in its production process may find that its products are subject to the EAR, and that transactions involving restricted parties – even where the non-US manufacturer has no US-linked equity relationship with those parties – can require a BIS licence. The control question then expands: not only who controls the counterparty, but whether the item itself is within BIS's extraterritorial reach.

Where the EAR applies extraterritorially, cross-regime interaction becomes immediately material. A transaction involving the same goods may also engage EU dual-use controls under the applicable EU Regulation, UK export-licensing requirements under the ECJU, or the controls of a third country. Where two regimes both apply, the stricter prohibition governs the conduct of a party subject to both. Export-control counsel should be involved before any non-US manufacturer assumes that FDP analysis does not affect its transaction.

Step 5 – Review the compliance checklist before execution

Before executing a transaction involving any counterparty where the ownership-threshold test did not resolve the analysis, a business should work through a structured pre-execution checklist. This is not a bureaucratic formality; it is the documented record that, in an enforcement context, distinguishes a good-faith compliance failure from wilful or reckless conduct.

The checklist should confirm: item classification and licence-requirement analysis completed and recorded; restricted-party screening conducted against current versions of the SDN List, Entity List, Denied Persons List, and relevant third-country lists; end-use and end-user certification obtained for higher-risk items and destinations; governance and control analysis completed and documented for any counterparty flagged by a minority holding or governance-right indicator; FDP analysis completed for any non-US-origin item; and internal sign-off obtained at an appropriate level of authority.

A voluntary self-disclosure ("VSD") to BIS is a recognised mitigating factor in enforcement proceedings. A well-maintained compliance record – including this checklist – supports the case for voluntary disclosure and for a reduced penalty outcome if a violation is later identified. Records must be maintained for five years. A checklist that does not exist at the time of the transaction cannot be reconstructed to serve this purpose.

One practical point on the myth that name screening alone is enough: the Entity List and Denied Persons List identify parties by name and address, but they do not capture every relationship that the EAR prohibits. Transactions with unlisted parties who are controlled by, act as a conduit for, or are operationally dependent on a listed entity can engage EAR liability even when the immediate counterparty's name returns clean. Name-screening is a necessary starting point, not a complete control.

How does this analysis compare across the UK, EU, and Canadian regimes?

Cross-regime comparison is essential for any business subject to more than one jurisdiction's export-control rules, and the control-beyond-ownership analysis differs in meaningful ways between BIS / EAR, the UK ECJU regime, EU dual-use controls, and the Canadian approach.

Under UK export-licensing rules administered by the ECJU, the analysis of whether a party is "controlled by" a restricted person involves both an ownership criterion and a control test. The UK financial-sanctions regime administered by OFSI uses a similar ownership-and-control approach: a non-listed entity can be caught through a listed person exercising control over it, and UK case law distinguishes actual, existing influence from a hypothetical ability to exert control. The practical implication is that a UK exporter applying only the US ownership-threshold test to a counterparty may miss parties that the UK control test would catch.

Under EU dual-use controls, governed by the applicable EU Regulation, the analysis of end-user and end-use restrictions follows a parallel but not identical path. The EU has separate catch-all controls for items not listed on the dual-use list where the exporter has grounds to believe the goods will be used in a prohibited programme. For EU-established exporters, this means that a counterparty that clears the BIS party-list check may still require a licence application under the EU regime.

Canada's regime, administered under SEMA and JVCFOA with GAC oversight, similarly does not limit its counterparty-control analysis to a mechanical ownership threshold. In our cross-border practice, we advise exporters operating across these regimes to map each regime's control test explicitly, rather than assuming that a conclusion under one regime carries over to another. It does not.

For a detailed treatment of the EU control-beyond-ownership analysis, see our guide on control beyond the bright-line test under EU rules. For advice on how BIS / EAR affiliate-level restrictions interact with this analysis, see our affiliate-level restrictions service page. The Canadian dimension is covered in our control-beyond-ownership guide for the Canadian regime.

Risk flags and when to involve export-control counsel

Certain fact patterns should prompt immediate escalation to qualified export-control counsel rather than resolution through a standard compliance workflow. Identifying these situations early preserves options; waiting until a transaction has executed or a shipment has moved narrows them materially.

Escalate to counsel where: the counterparty has a minority shareholder or governance-rights holder who appears on any restricted-party list; the end-use or end-user certification raises any doubt about the ultimate destination or application of the goods; the item is subject to FDP rules and the full supply-chain analysis has not been completed; the counterparty has changed ownership, management, or key contractual relationships since it was last onboarded; or the transaction involves a jurisdiction where MEU controls or country-specific export-control rules apply.

A single mis-classified shipment or a transaction executed without the benefit of a completed control analysis can expose an exporter to significant civil penalties, denial of export privileges, and – in cases involving wilful conduct – criminal liability under the applicable US statutes. The EAR's strict-liability posture on civil violations means that the absence of knowledge is not a defence to the underlying violation, though it is relevant to penalty mitigation.

We act for multinationals, financial institutions, and exporters on sanctions and export-control matters across the major regimes. A compliance programme that has not been tested against the full control-beyond-ownership standard – not just the name screen – carries a residual risk that is best assessed before a transaction rather than in an enforcement context.

For a confidential assessment of your export-control compliance programme or a specific transaction, contact Calder & Vance at info@caldervance.com.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.