Digital-asset counterparty diligence under BIS / EAR: a practical guide

A technology exporter closes a distribution agreement with a digital-asset platform overseas. The buyer screens clean on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) and on the EU consolidated list. Weeks later, due diligence uncovers that the platform routes transactions through an entity that appears on the BIS Entity List (the list of parties to whom exports, re-exports, and transfers require a licence or are prohibited under the Export Administration Regulations). The contract is already signed. The goods are already shipping. That discovery, made too late, is the diligence failure that haunts cross-border digital-asset transactions in 2026.

Digital-asset counterparty diligence under BIS / EAR is a structured process for determining, before a transaction closes, whether a counterparty or its connected persons appear on US export-control lists, whether the technology or items being transferred carry licence requirements for that counterparty's jurisdiction or end use, and whether the deal's structure triggers any deemed-export (the release of controlled technology to a foreign national, treated as an export to their home country) or re-export exposure. The governing authority is the Bureau of Industry and Security within the US Department of Commerce, acting under the Export Administration Regulations. A clean OFAC screen does not satisfy BIS / EAR obligations; the two regimes operate on different lists, different legal bases, and different trigger points.

This guide walks through the diligence process question by question – from identifying what the EAR actually covers in a digital-asset context, through the counterparty checks and end-use controls, to the point at which a compliance counsel or sanctions lawyer should be brought in.

What does BIS / EAR actually cover in a digital-asset transaction?

The EAR covers the export, re-export, and in-country transfer of items – including software, technology, and hardware – that are subject to US jurisdiction, regardless of whether any sanctions programme is engaged. In a digital-asset context this catches a broader range of activity than most compliance teams expect.

Blockchain infrastructure, cryptographic software, and certain hardware used in mining or custody operations can each carry an Export Control Classification Number (ECCN – the classification on the Commerce Control List that determines licence requirements and available exceptions). Items not specifically classified sit in the EAR99 category, but EAR99 does not mean uncontrolled; those items remain subject to end-user and end-use restrictions, and to the Entity List and Denied Persons List prohibitions, as currently in force.

Digital platforms often transfer technology in forms that compliance teams do not immediately recognise as exports: a software licence granted to a foreign user, remote access to a controlled platform, or a transfer of source code. Each of these can constitute a deemed export. In our experience, digital-asset businesses most commonly mis-characterise their technology as purely financial and therefore outside the EAR's scope. That characterisation is frequently wrong.

The critical first question in any BIS / EAR diligence exercise is therefore: what, precisely, is being transferred? Only once that is answered can the correct classification and the correct counterparty check be run.

Which BIS lists must be checked, and how do they differ from OFAC?

BIS maintains two primary restricted-party lists: the Entity List and the Denied Persons List. Neither is the same as the OFAC SDN List, and a counterparty can appear on one but not the others. Running only an OFAC screen – the most common error we see in cross-border transactions – leaves the Entity List and Denied Persons List entirely unchecked.

The Entity List identifies foreign parties for whom a licence is required for any export, re-export, or transfer subject to the EAR, because those parties pose an unacceptable risk of diversion to prohibited end uses or end users. The licence review policy for Entity List parties is typically a presumption of denial, as currently in force. The Denied Persons List identifies US and foreign persons denied export privileges; any transaction with a denied person is prohibited without exception.

BIS also maintains the Unverified List and the Military End-User list, which do not trigger automatic licence requirements but do require heightened scrutiny and can bar the use of certain licence exceptions under MEU (military end-use and end-user) restrictions.

The cross-border dimension matters here. A counterparty in a jurisdiction that another regime – for example, OFSI in the UK or the EU Council – has also listed must be checked against each applicable list independently. Where two regimes both apply, the stricter prohibition governs. Screening against a single list, even a comprehensive one, is not a substitute for regime-specific checks. For comparison of diligence obligations across the broader cross-border environment, see our digital-asset counterparty diligence: cross-border guide.

How should a business classify its digital-asset technology under the Commerce Control List?

Classification is the step that determines which licence requirements, exceptions, and end-use controls apply to the specific technology being transferred. Every item subject to the EAR has a classification, either a specific ECCN on the Commerce Control List or EAR99 by default.

For digital-asset technology, the most relevant CCL categories cover information security, telecommunications equipment, and certain advanced computing hardware. Cryptographic functionality is a commonly misunderstood trigger: software or hardware that implements encryption above specified parameters may require a licence for certain destinations and end users, even if its primary commercial purpose is a payment platform or a custody solution.

Classification is not a one-time exercise. It must be revisited when the technology changes, when the counterparty changes, and when the destination or end use changes. A reclassification of an item – or a change in a country's country-group classification under the EAR – alters the analysis prospectively, as currently in force. In 2026, for example, changes to country-group classifications for certain destinations affected the licence requirements and exception eligibility applicable to technology transfers in those markets.

In our practice, we advise clients to document their classification reasoning, not just their conclusion. A well-documented classification record is the foundation of an enforcement defence if the analysis is later questioned.

What does end-use and end-user diligence require in the digital-asset sector?

End-use and end-user diligence under the EAR requires a business to establish, before transfer, that neither the counterparty nor the intended use of the technology falls within a prohibited category. BIS administers MEU restrictions that prohibit certain exports, re-exports, and transfers to military end users or for military end uses in specified destinations, without a licence.

In the digital-asset sector this is not a theoretical concern. Mining hardware, custody infrastructure, and blockchain analytics tools have potential military, intelligence, and surveillance applications. A compliance team cannot assume that a platform presenting itself as a commercial payments business has no connections to state or military entities. Diligence must reach the actual use of the technology, not just the stated purpose of the buyer.

Practically, end-use diligence in a digital-asset context should cover: the counterparty's ownership structure and any state or governmental interest; the specific functions the technology will perform on the buyer's platform; whether the platform operates in, or routes transactions through, jurisdictions subject to enhanced EAR controls; and whether the buyer has a history of dealing with restricted parties. This is not a box-checking exercise. It requires documentary evidence – representations, contractual undertakings, and where the risk profile warrants it, a site visit or third-party audit.

For digital-asset businesses with exposure to maritime payment flows or AIS-related infrastructure, cross-border transactions & diligence obligations can also intersect with trade-sanctions monitoring; see our AIS anomaly indicators service for the EU-facing dimension of that risk.

What are the risk flags that should escalate a diligence review?

Certain patterns in a digital-asset counterparty's profile consistently signal elevated BIS / EAR exposure and should trigger an escalated review rather than a routine screen.

The first flag is ambiguity in the counterparty's ownership chain. Where beneficial ownership cannot be confirmed, or where intermediate holding structures obscure the nationality or identity of ultimate owners, the deemed-export risk increases materially. A foreign national with an ownership interest in the counterparty may themselves be a foreign person to whom a controlled technology transfer is effectively made. Ownership and control analysis is not limited to OFAC's 50 percent threshold; under the EAR, a significant minority holding in a counterparty that is itself connected to a listed entity is a red flag that requires active management rather than passive monitoring, as currently in force.

The second flag is a destination or transit route through a country subject to enhanced export controls. Transit through a third country does not change an item's controlled status; origin and end-use analysis follows the item, not the route. A sharp change in trade flows to a neighbouring or transit jurisdiction is treated by BIS as a diversion indicator. Digital-asset transactions are particularly susceptible to this pattern because the technology transfer itself is often invisible in the traditional trade data.

Third: representations in the transaction documents that attempt to shift sanctions and export-control risk entirely to the buyer. The seller's reps and warranties do not remove the buyer's sanctions risk – but, critically, they do not remove the seller's BIS / EAR obligations either. A contractual indemnity from the counterparty is not a licence exception and does not substitute for the exporter's own diligence. This is the myth we see most frequently in cross-border digital-asset transactions: that the seller's representations transfer the legal exposure. They do not.

Fourth: a counterparty that is itself a virtual-asset service provider (VASP) operating without clear regulatory registration in any jurisdiction. Unregulated or lightly regulated VASPs present a diversion risk because the technology's ultimate users may be unknown even to the direct counterparty.

How does BIS / EAR diligence differ from OFAC diligence in the digital-asset space?

The two US regimes operate on different lists, different jurisdictional triggers, and different legal consequences – and a business that conflates them will have gaps in both. Understanding the divergence is the starting point for a BIS / EAR diligence that does not merely replicate the OFAC screen.

OFAC sanctions are asset-based and transaction-blocking: the consequence of dealing with a designated person is that the transaction is blocked, or prohibited outright. The obligation runs to whoever is a US person, and through secondary-sanctions risk, to non-US persons in certain circumstances. The SDN List is OFAC's primary tool, though general licences can authorise otherwise prohibited activity.

BIS / EAR controls are item-based and transfer-based: the question is whether the technology, software, or hardware being transferred requires a licence for the specific end user, end use, and destination. The Entity List and Denied Persons List are the access controls; classification is the gateway. Civil liability is strict in both regimes, but criminal export-control enforcement through the Department of Justice carries additional exposure. The voluntary self-disclosure (VSD) mechanism – a disclosure to BIS before a violation is discovered – is a recognised mitigating factor, in the same way that VSD operates as mitigation under OFAC's Enforcement Guidelines.

A further divergence that matters in the digital-asset sector: OFAC's blocking obligations can extend to property in which a designated person has any interest. BIS controls attach to the transfer of controlled items, not to property interests. The two analyses must be run in parallel, not in sequence. See our companion guide for the OFAC dimension: digital-asset counterparty diligence: OFAC guide.

The UK and EU regimes add further layers. OFSI's financial-sanctions controls and the EU asset-freeze regime each have their own list checks and ownership-and-control tests. Where a digital-asset transaction has a UK or EU nexus, those checks run independently. The stricter prohibition of any applicable regime governs the conduct of a person subject to it.

When should a business involve export-control counsel?

Early involvement of compliance counsel or a sanctions lawyer with export-control experience is cheaper and more effective than post-closing remediation. The question is not whether to involve counsel, but at which point in the transaction cycle to do so.

Pre-signature is the optimal point. Classification questions, Entity List status, and deemed-export exposure can all be addressed before contractual commitments are made. If a licence is required, the application process takes time – specific licence timelines vary by regulator and by matter – and the transaction cannot close lawfully without it. Discovering the requirement after signature compresses the timeline and, in the worst case, requires unwinding executed steps.

A pre-transaction BIS / EAR review should cover: item classification and applicable licence requirements or exceptions; a full restricted-party screen against the Entity List, Denied Persons List, and relevant sub-tier lists; an end-use and end-user assessment for the specific technology and the specific buyer; and a deemed-export analysis for any technology releases to foreign nationals involved in the transaction.

Counsel should also be instructed immediately when a potential violation is identified. If a shipment has already occurred, or technology has already been transferred, to a party that is later found to be listed or to be in a prohibited destination, the question of VSD becomes urgent. A VSD filed before the agency discovers the violation is a significant mitigating factor under BIS's enforcement guidance. Delay narrows options.

We regularly advise digital-asset businesses, exporters, and cross-border transaction teams on precisely this sequence – from pre-deal classification through to enforcement response. In a recent matter, a digital-infrastructure business engaged us to assess the BIS / EAR position on a proposed technology licence to a platform with indirect links to an Entity List party. We mapped the ownership chain, assessed the deemed-export exposure, and identified the appropriate licence exception, allowing the transaction to close within the statutory constraints. No outcome is guaranteed, but early assessment materially improves the options available.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.