A Canadian trading company ships temperature-control hardware to a distributor in a third market. Six months later, Global Affairs Canada contacts the exporter asking for shipping records. The in-house team discovers that no export permit was obtained and that the hardware appears on Canada's Export Control List. Criminal exposure is now live. What exactly is that exposure, how is it assessed, and when does it escalate from a regulatory matter to a prosecution risk?
Criminal exposure in export-control cases under Canada arises principally under the Export and Import Permits Act ("EIPA") and, where sanctioned parties are involved, under the Special Economic Measures Act ("SEMA"). Both instruments carry criminal penalties, including custodial sentences, for knowing or wilful contraventions. The governing authority is Global Affairs Canada ("GAC"), with the Royal Canadian Mounted Police and Public Prosecution Service of Canada involved in serious criminal matters. The exposure analysis turns on five factors: whether a permit was required, whether one was held, what the exporter knew, how the goods were classified, and whether a sanctioned party touched the transaction.
This guide walks through those five factors step by step, maps the points where Canada's approach diverges from the US, UK, and EU regimes, and identifies the risk flags that should prompt immediate engagement of counsel.
Step 1 – Establish Whether a Permit Was Required
The first step is to confirm whether the exported goods, technology, or software appeared on Canada's Export Control List at the time of the shipment. Canada maintains the Export Control List under EIPA. Items are grouped by category, and a permit is required for controlled items exported to most destinations. The question of "required at the time" matters: retrospective amendments do not convert a lawful historic export into a violation.
In our cross-border practice, this classification step is often the one that has been done poorly or not at all. Exporters who rely on an initial commodity description without verifying against the current list version, or who assume that a previously assessed product line remains unchanged, create exactly the factual gap that an investigation will probe. The GAC enforcement team will ask for the classification record. If one does not exist, that absence itself becomes evidence of inadequate controls.
The cross-regime comparison is instructive here. Under the US Export Administration Regulations administered by BIS, every item has an ECCN (Export Control Classification Number under the US Commerce Control List) or is classified as EAR99. Canada's Export Control List uses a parallel but not identical structure, meaning that an item classified under the US regime does not automatically carry the same status in Canada. Businesses with dual US-Canada supply chains frequently discover that a product licensed under the EAR required a Canadian permit that was never sought. Both exposure tracks must be assessed together.
Step 2 – Determine Whether a Valid Permit Was Held
If the goods required a permit, the second step is to verify whether a valid, applicable export permit was in place at the time of the export. A permit that has expired, that named a different consignee, or that covered a different end use does not cure the violation. The permit must match the actual transaction.
Permit conditions matter as much as permit existence. A permit may authorise export to a specific end user for a specific declared end use. If the goods were re-exported by the foreign consignee to a third party, the original exporter may face a fresh exposure if they knew or ought to have known of that re-export and failed to include appropriate conditions or report the re-direction to GAC.
In a recent matter, a manufacturing business held a valid permit for controlled components destined for an industrial customer in one jurisdiction. The customer diverted a portion of the shipment to a related entity in a different market. We assessed the knowledge question and the permit conditions together. The outcome turned on whether the original exporter had taken reasonable steps at the time of export to establish the end-use commitment and whether the contract documents evidenced those steps. That assessment shaped the voluntary disclosure decision.
Under SEMA, the permit question is separate from the sanctions-compliance question. A transaction can be permitted under EIPA and still violate SEMA if a designated person is involved. Step 2 must therefore also include a check against Canada's sanctions lists for all parties to the transaction, not just the named consignee.
Step 3 – Assess the Knowledge Element
Criminal liability under EIPA requires proof that the person knowingly exported without a required permit, or knowingly provided false or misleading information to obtain a permit. "Knowingly" is a specific mental-element requirement, and it sits at the centre of any criminal exposure assessment.
What does "knowingly" cover in practice? Canadian courts have interpreted the knowledge element to include wilful blindness. A compliance officer who does not ask the question because they prefer not to know the answer is not insulated from criminal exposure. Deliberately compartmentalising information to avoid a positive finding is, in our experience, the pattern that most often converts a civil exposure into a criminal one. The evidence trail – emails, internal notes, compliance checklists, and escalation records – is what GAC and prosecutors will examine.
The knowledge element distinguishes the criminal track from the administrative track. GAC has discretion to treat contraventions administratively, with penalties short of prosecution. That discretion is exercised partly by reference to culpability: a genuine classification error, promptly self-reported, in a business with otherwise-credible controls, is treated differently from a pattern of deliberate non-compliance. Establishing the knowledge picture early is therefore both a legal assessment and a strategy question.
How does this compare to the UK and EU approaches? Under OFSI's enforcement model and the UK Export Control Order, recklessness and negligence can found civil liability, but criminal prosecution in the UK similarly requires a higher mental-element threshold. The EU regime varies by member state implementing legislation, but serious criminal prosecution ordinarily requires intent or at least gross recklessness. Canada is broadly aligned: a pure administrative error, without knowledge or wilful blindness, should not found a criminal conviction, though it may still attract a civil penalty or permit suspension.
Step 4 – Map the Sanctions Overlay
Separate from the EIPA permit question, a transaction may violate one of Canada's autonomous sanctions regulations made under SEMA or the United Nations Act. These regulations prohibit dealing in property of designated persons, making goods or services available to designated persons, and a range of related activities. The criminal penalties under SEMA and the United Nations Act are distinct from those under EIPA, and both can apply to the same transaction.
Canada's autonomous sanctions regime is administered by GAC's Sanctions Policy and Operations division. Canada designates individuals and entities under SEMA by Order in Council, and those designations do not automatically mirror the OFAC SDN List, the OFSI Consolidated List, or the EU asset-freeze list. A party that is designated in Canada may not be designated in the US or EU, and vice versa. This divergence is a persistent source of exposure for businesses that screen against only one list.
The cross-border implication is significant. A US-parented Canadian subsidiary may be subject to both OFAC regulations (including secondary-sanctions risk) and to SEMA. The OFAC regulations may be broader in scope – OFAC's extraterritorial reach covers US-person involvement anywhere in the transaction – but SEMA covers conduct by Canadian persons and entities regardless of US connections. Where both regimes apply, the stricter prohibition governs each element of the transaction. That stacking of obligations is something we regularly advise cross-border businesses to map before the transaction, not after a GAC inquiry letter arrives.
Does the UN Consolidated List affect the analysis? Yes. Where a UN Security Council resolution imposes asset freezes or arms embargoes, Canada implements those measures through regulations under the United Nations Act. Those regulations carry their own criminal penalty track. For any transaction touching a jurisdiction or sector subject to UN measures, the UN layer must be assessed alongside SEMA and EIPA.
Step 5 – Evaluate the Voluntary Disclosure Decision
Once the exposure picture is mapped across Steps 1 to 4, the business faces a decision: whether to make a voluntary disclosure to GAC. This is the point at which counsel becomes essential, not optional.
GAC has published guidance on self-reporting. A voluntary disclosure made promptly, completely, and before an enforcement inquiry is opened will generally be treated as a mitigating factor in any administrative or criminal response. It does not provide immunity, but it substantially affects the enforcement calculus. GAC's discretion runs from a formal warning through to a referral to the RCMP for criminal investigation. A well-prepared voluntary disclosure, supported by a root-cause analysis and a corrective-action plan, can keep a serious matter in the administrative track.
What makes a disclosure "complete"? In our experience, the submissions that fare best are those that identify the specific transactions, set out the classification and permit assessment, address the knowledge question honestly, and propose concrete remediation measures. A disclosure that minimises or obscures the facts is worse than no disclosure at all: it creates a subsequent credibility problem if the full picture later emerges through an investigation. We regularly advise clients to treat the disclosure document as if it will eventually be read by a prosecutor, not just an administrative reviewer.
The decision to disclose is also affected by whether a parallel OFAC, OFSI, or EU investigation is likely. Where the same transaction has US or UK dimensions, a Canadian voluntary disclosure may be admissible in those parallel proceedings. The sequencing and content of disclosures across regimes must be coordinated. Acting in one jurisdiction without considering the effect on another is a common and avoidable error.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. For a confidential review of a potential breach under the Canadian regime, contact Calder & Vance at info@caldervance.com.
Risk Flags That Require Immediate Escalation
Not every export-control issue requires urgent external counsel. But certain indicators should trigger immediate escalation to qualified counsel, regardless of how the internal compliance team assesses the underlying facts.
The highest-risk indicators are:
- Receipt of a written inquiry, production demand, or audit notice from GAC, the RCMP, or the Canada Border Services Agency.
- Discovery that a transaction involved a party that was designated under SEMA or the United Nations Act at the time of the shipment.
- Evidence that internal communications discussed the permit requirement and no permit was obtained – this pattern supports a wilful blindness or knowledge finding.
- Discovery of a prohibited end use: a civil or military end user barred under the applicable permit conditions, or an end use associated with weapons of mass destruction.
- A transaction that also involved US-origin content, a US-person intermediary, or an EAR-controlled item – because the BIS exposure runs in parallel and BIS has its own enforcement track, including the Entity List and denial orders.
- Any prior permit suspension, warning letter, or adverse classification finding from GAC – a repeat pattern is treated markedly more seriously.
The position above covers the standard assessment. Your specific facts – the classification, the knowledge record, the parties involved, and the regimes triggered – change the analysis materially. For an assessment of your exposure under the Canadian regime, contact Calder & Vance at info@caldervance.com.
Where Canada Sits in the Cross-Border Enforcement Picture
Canada is sometimes underestimated as an enforcement regime. That is a mistake. GAC has increased its enforcement activity in recent years, and the combination of EIPA and SEMA gives it a broad reach. The criminal penalties under both instruments are meaningful: custodial sentences are available for the most serious knowing contraventions, and corporate penalties can be significant.
Compared with OFAC, GAC's enforcement posture is less aggressive in volume terms, but the legal exposure for a Canadian person or entity acting in violation of SEMA is structurally comparable to the exposure a US person faces under OFAC's administered regulations. The key difference is OFAC's extraterritorial reach: OFAC's secondary-sanctions architecture can apply to non-US, non-Canadian businesses that touch a US-dollar transaction or use US financial infrastructure. That reach does not apply under SEMA, which is territorially focused. However, a Canadian parent with a US subsidiary faces both regimes simultaneously, and the OFAC track will frequently dominate the priority assessment because of the scale of OFAC's civil-monetary-penalty authority.
Against the UK regime, Canada's structure is notably similar: both SEMA and the Sanctions and Anti-Money Laundering Act ("SAMLA") operate through Orders or Regulations that implement autonomous or UN-derived designations. Both OFSI and GAC have civil enforcement tools and a referral track for criminal matters. The procedural steps in a voluntary disclosure to OFSI and to GAC are broadly comparable, though the timelines and the content requirements differ. We regularly advise clients facing parallel Canadian and UK exposure on how to coordinate those disclosures effectively.
One area where Canada differs structurally from the EU is the absence of a pan-national administrative court equivalent to the EU General Court. A designation challenge in Canada proceeds through the Federal Court by way of judicial review. That is a higher threshold to clear than an annulment action before the EU General Court, and the available evidence is more constrained. Businesses assessing a delisting route under multiple regimes need to factor this into their strategic planning from the outset.
Related practices
- Apparent violation assessment (EU) – mapping EU sanctions enforcement exposure and voluntary disclosure options
- Criminal export-control exposure: cross-border guide – parallel-regime assessment across US, UK, EU, and Canada
- Criminal export-control exposure under the EU – Council regulation analysis and member-state enforcement tracks