A UK-based engineering firm hires a foreign national and, days into the project, asks whether sharing a controlled technical specification with that person requires a licence. The question lands in the export-control team's inbox on a Friday afternoon. By Monday, a delivery is already scheduled. This is not an edge case. In our experience, deemed-export risk sits at exactly this junction between HR onboarding, export-control classification, and financial-sanctions screening – and it is the junction most businesses handle least systematically.
As of April 2026, the UK does not operate a formal deemed-export rule (a statutory provision treating the disclosure of controlled technology to a foreign national as an export to their country of nationality) in the way the US Export Administration Regulations do. However, the interaction between the UK export-control regime administered by the Export Control Joint Unit (ECJU) and the financial-sanctions regime administered by OFSI (the Office of Financial Sanctions Implementation) creates obligations that function similarly in practice. A business that transfers controlled technology – whether physically, electronically, or orally – to a person who is designated under a UK sanctions regime, or to an entity owned or controlled by a designated person, may trigger both sets of rules simultaneously.
This guide walks through the relevant steps: identifying the applicable tests, conducting the analysis, managing the intersection with OFSI financial-sanctions obligations, and knowing when to involve counsel. A cross-regime comparison with the US and EU positions is included at each stage.
Step 1: Understand what "technology transfer" means in the UK context – and where OFSI sits in it
Technology transfer, for UK export-control purposes, means the transmission of controlled technical information – drawings, specifications, manuals, software source code, or oral technical assistance – whether by post, email, remote access, or conversation. The ECJU administers the rules under the Export Control Order and the relevant dual-use instruments. Those rules require a licence where the technology is listed and the destination or recipient falls within a controlled category. That obligation exists independently of sanctions.
OFSI's role is distinct. OFSI administers financial sanctions under the Sanctions and Anti-Money Laundering Act ("SAMLA") and the thematic regulations made under it. Its core prohibition is on making funds or economic resources available to a designated person, or for the benefit of a designated person. Technology – including intellectual property, software, and technical know-how – can constitute an economic resource (an asset that may be used to obtain funds, goods, or services) under the financial-sanctions framework. Transferring controlled technology to a designated person, or to an entity they own or control, may therefore trigger the economic-resources prohibition even if an ECJU licence is in place or no export-control licence requirement applies at all.
The practical result is a two-track analysis. The ECJU track asks: is this technology controlled, and does the recipient or destination require a licence? The OFSI track asks: is the recipient designated, or owned or controlled by a designated person, and does the transfer constitute making an economic resource available? Both tracks must be run. One does not resolve the other.
Step 2: Screen the recipient against the UK Consolidated List and ownership-and-control chains
Before any technology is transferred, screen every natural person and legal entity involved in the transaction against the UK Consolidated List – the official register of persons designated under UK sanctions regimes. Screening against the UN Consolidated List and the OFAC SDN List (the list of Specially Designated Nationals and blocked persons maintained by the US Treasury's OFAC) is also advisable for cross-border transactions, as secondary-sanctions risk and correspondent-banking implications may arise even for transactions that are purely UK-facing.
A clean result at the level of the direct recipient is not sufficient. Under the UK ownership and control test (the test under SAMLA and the thematic regulations for whether a non-designated entity is caught because a designated person owns or controls it), a business must look through the ownership chain. The designated person need not appear on the corporate register as a shareholder. Control – including control through contractual or other arrangements that give a designated person decisive influence – can engage the prohibition. In our experience, the ownership-and-control chain is where technology-transfer transactions most frequently stall during enhanced due diligence.
How deep must you go? There is no statutory fixed depth. The standard is what a reasonable and appropriately skilled compliance professional would do given the risk profile of the recipient, the sector, and the jurisdiction. For higher-risk transactions – technology with military or dual-use potential, recipients in sectors where designated persons are known to operate, or jurisdictions subject to thematic UK sanctions – a full beneficial-ownership mapping is appropriate.
Step 3: Classify the technology and determine the ECJU licence position
Classification under the UK dual-use regime runs in parallel with the OFSI screening. Determine whether the technology falls within the UK dual-use list or another controlled category. If it does, identify the applicable ECCN (Export Control Classification Number, the alphanumeric code that places an item or technology on the applicable controlled list) or its UK equivalent entry. Then determine whether a licence is required for the intended recipient and jurisdiction.
Where a licence is required and the recipient is a foreign national located in the UK – the factual pattern closest to the US deemed-export concept – the position is that the transfer is nonetheless a controlled event. The ECJU assesses applications on the basis of the end use and the end user, not merely the physical location of the transfer. An internal transfer within a UK workplace can require a licence if the recipient is a national of a country subject to a strategic arms embargo and the technology is controlled for that country.
This is the point at which the ECJU and OFSI tracks converge most sharply. A person who is both a national of a sanctioned-regime-associated country and a designated person engages both sets of rules. Neither a granted ECJU licence nor a clean export-control analysis displaces the OFSI economic-resources prohibition. Both must be satisfied before the transfer proceeds.
For the cross-regime comparison: the US position under the EAR operates a formal deemed-export rule under which release of controlled technology to a foreign national in the United States is treated as an export to the country of that national's most recent citizenship or permanent residency. The EU dual-use regime does not contain an equivalent provision at the EU-regulation level, though member-state implementations vary. The UK position is therefore intermediate – it does not have the mechanistic US rule, but the ECJU's end-user focus and OFSI's economic-resources prohibition together produce a similar practical obligation for higher-risk transfers.
Step 4: Assess whether the transfer makes an economic resource "available"
The OFSI prohibition on making economic resources available to or for the benefit of a designated person is broad. It does not require a transfer of ownership. Giving a designated person access to technology – including granting software access, sharing a controlled specification by email, or conducting a technical briefing – may constitute making an economic resource available if that person could convert the technology into funds, goods, or services of value.
What is the correct analysis? Courts and OFSI guidance indicate that the test focuses on whether the designated person derives a meaningful benefit from the access. A transfer that increases the operational capability or market value of a designated entity's business is a transfer for the benefit of the designated person, even if the immediate recipient is a non-designated employee or affiliate. In our cross-border practice, we regularly advise clients to apply this test at each stage of a technology-sharing programme, not only at the point of initial transfer.
The specific licence route (a case-by-case authorisation from OFSI to conduct an otherwise prohibited transaction) is available where the transfer would otherwise be prohibited. OFSI publishes guidance on the information required in a licence application, including the nature of the activity, the parties, and the rationale for the authorisation. Licence decisions are made on the specific facts. No guarantee of a licence can be given, and timing depends on the complexity of the application and OFSI's assessment. Verify the current processing timescales with OFSI before planning a transaction around a licence.
The bridge from the ECJU analysis to the OFSI analysis is the concept of benefit. An ECJU licence confirms that the transfer is permitted for strategic-export-control purposes. It says nothing about whether the recipient is a designated person or whether OFSI's authorisation is also required. Treating an ECJU licence as a clean bill of health for OFSI purposes is the most common structural error we encounter in dual-track technology-transfer reviews.
Step 5: Identify the risk flags that require counsel involvement
Not every technology-transfer scenario requires external legal advice. But several patterns consistently require it. What are they?
- A positive screening hit or a close-name match on the UK Consolidated List, the UN Consolidated List, or the OFAC SDN List against any party to the transfer.
- Ownership or control uncertainty – a recipient whose beneficial-ownership chain cannot be traced with confidence to a clean result, particularly in sectors or jurisdictions associated with designated persons under a relevant UK thematic regime.
- A technology item with both commercial and military application (dual-use), where the end use declared by the recipient cannot be verified independently.
- A request to transfer technology to a foreign national whose country of nationality is subject to a UK arms embargo or thematic sanctions regime, even if that individual is based in the UK.
- An existing ECJU licence that does not expressly cover the specific technology or the specific recipient now in view.
- A transaction where a US-connected entity is involved, triggering potential extraterritorial BIS jurisdiction under the EAR and the risk of parallel OFAC exposure alongside the UK obligations.
In a recent matter, a precision-engineering firm sought to share calibration software with a foreign-national contractor on a UK site. Screening returned a close-name match to a designated person. We reviewed the ownership chain, confirmed the contractor was not the designated individual, and documented the analysis in a contemporaneous compliance record. The transfer proceeded with appropriate safeguards. The matter illustrates that a positive-match workflow – not a binary screen-and-release process – is what the rules require.
Step 6: Document the analysis, apply controls, and maintain the record
Documentation is not a bureaucratic afterthought. It is the primary evidence of good faith in any subsequent OFSI enforcement review. An OFSI enforcement assessment looks at whether the firm had appropriate controls, whether it identified and acted on the relevant risk, and whether it can demonstrate what it did and why.
The record should capture: the date and nature of the technology, the recipient and the screening result, the ownership-and-control analysis, the ECJU classification outcome and licence status, the OFSI economic-resources assessment, and the individual who approved the transfer. Where a specific licence was obtained, retain the licence document and any correspondence with OFSI. Where a licence was not required, retain the analysis that supports that conclusion.
OFSI's enforcement guidance emphasises the importance of voluntary self-disclosure (a VSD – a firm's proactive report to OFSI of a suspected sanctions breach before the regulator becomes aware through other means). A well-documented pre-transfer analysis that reveals, in retrospect, a missed risk is a different enforcement posture from a firm that had no analysis at all. We have acted for businesses in OFSI enforcement reviews where contemporaneous documentation made a material difference to the assessment of culpability.
For record-keeping: the applicable period under UK financial-sanctions rules and the Export Control Order requires retention for a defined period after the transaction. Verify the specific retention period applicable to your transaction type against current OFSI and ECJU guidance before relying on any general statement. The requirement applies to both physical and electronic records, including email chains, screening screenshots, and approval logs.
Step 7: Apply the cross-border overlay – US, EU, and beyond
A technology-transfer transaction with any US-origin content – software, source code, technical data – carries BIS jurisdiction under the EAR regardless of where the transfer occurs. The EAR's reach is extraterritorial: a UK firm re-exporting US-origin technology to a third party must comply with BIS licence requirements and restrictions, including the US deemed-export rule where a foreign national is the recipient. This is a separate obligation from the UK ECJU analysis and the OFSI SAMLA analysis.
Where the transferor is an EU-regulated entity or where the transaction touches an EU member state, the EU dual-use regulation and the relevant Council regulations on financial sanctions apply in parallel. The EU does not have a formal deemed-export rule at EU level, but the economic-resources prohibition in Council regulations mirrors the OFSI prohibition in substance. A cross-border technology-transfer that is lawful under OFSI may still require an OFAC general licence or a BIS licence, or may be caught by an EU sectoral restriction.
The rule across all regimes is consistent: the stricter prohibition governs. Where OFSI permits a transfer but the EAR does not, the EAR prevails for any US-connected element. Where an ECJU licence is in place but OFSI requires a specific licence, both must be obtained before the transfer. Compliance counsel advising on this intersection must map each regime's reach to the specific facts before giving a clearance opinion.
For Singapore, Japan, and UAE-headquartered businesses with UK operations or UK-origin technology: each jurisdiction operates its own strategic-goods control and financial-sanctions regime. The UK ECJU controls continue to apply to UK-origin technology regardless of where the transferring entity is incorporated. OFSI's jurisdiction applies to any transfer by a person in the UK or by a UK-connected person, wherever located. Local counsel in the relevant jurisdiction should be engaged for the national-law analysis.
Related practices
- Deemed exports and technology transfer – BIS/EAR service – US deemed-export classification, licence assessment, and EAR end-use controls
- Deemed export and technology transfer – Singapore guide – how Singapore's strategic-goods regime treats technology releases to foreign nationals
Common objections: what compliance teams get wrong
One persistent misconception is that the OFSI financial-sanctions regime applies only to cash payments and wire transfers. It does not. The economic-resources prohibition extends to any asset that can be converted into value – and controlled technology, IP licences, and software access all qualify. A business that screens payments carefully but does not screen technology transfers at all has a gap in its programme that OFSI enforcement has, in practice, begun to address.
A second misconception is that a UK entity dealing only with UK-resident individuals has no deemed-export exposure. The nationality of the recipient matters to the ECJU analysis for certain controlled items, and the designated-person status of the recipient matters to OFSI regardless of residence. Neither test is purely geographic.
A third misconception – and in our experience the most costly – is that a clean ECJU licence is a complete authorisation. It is an authorisation under the Export Control Order. It is not an OFSI licence. It does not displace the financial-sanctions economic-resources prohibition. The two regimes are parallel, not hierarchical.