A US exporter classifies a shipment as EAR99 (the residual category under the Export Administration Regulations covering items not specifically listed on the Commerce Control List) and proceeds without a licence. Six months later, OFAC flags the end-user. The goods have already moved. The classification was defensible. The sanctions screening was not. Two parallel regimes – export controls and economic sanctions – had to be satisfied, and only one was.
Determining that an item is EAR99 is a starting point, not a clearance. As of April 2026, every EAR99 determination sits alongside a separate OFAC sanctions screen: the item may be unrestricted under the Export Administration Regulations administered by the Bureau of Industry and Security, yet the transaction may be prohibited entirely because the end-user, end-use, or destination is subject to an OFAC programme. Both analyses must be completed before any shipment proceeds.
This guide walks through each step of an EAR99 determination, explains where the OFAC analysis sits in that sequence, and identifies the risk flags that most frequently cause otherwise compliant exporters to face enforcement exposure.
Step 1: Understand what EAR99 means – and what it does not
EAR99 is the default classification for any commercial item subject to the EAR that does not appear on the Commerce Control List with its own Export Control Classification Number (ECCN – the alphanumeric code that identifies the control basis and applicable licence requirements for a listed item). EAR99 items require no BIS licence to most destinations under normal conditions. That is the entire scope of the classification.
What EAR99 does not do is release a transaction from OFAC sanctions obligations, from end-use controls such as the anti-boycott rules, from anti-diversion requirements, or from the restrictions that apply when an item is destined for certain enumerated end-uses or end-users regardless of their classification status. In our experience, the single most persistent error among exporters newly entering cross-border trade is treating "EAR99" as the end of the compliance inquiry rather than the first checkpoint passed.
The practical implication is structural. The export-controls analysis and the sanctions analysis are run by different agencies – BIS and OFAC respectively – under different statutory authorities, apply different tests, and can produce different outcomes on the same transaction. A business that completes only one of the two has not completed its compliance obligation. Have you documented both analyses separately and kept records in a form that can be produced on request?
Step 2: Classify the item correctly against the Commerce Control List
Before an exporter can rely on EAR99, it must work through a structured classification exercise against the Commerce Control List to confirm that no ECCN applies. The process is sequential, not impressionistic.
Start with the item's technical parameters: function, performance levels, constituent materials, software components, and any embedded technology. Cross-reference those parameters against each applicable category of the CCL. Categories run from munitions-adjacent through nuclear and chemical to general industrial and consumer items. The exporter bears the burden of the classification decision. BIS offers a commodity classification service, but submitting a request is not mandatory; many experienced exporters perform the analysis in-house using the CCL and the Supplement guidance, then retain the analysis for the record.
If a CCL entry plausibly covers the item, even in part, treat the item as potentially ECCN-controlled and examine the entry's licence requirements before concluding otherwise. A hasty EAR99 determination that should have yielded an ECCN is a strict-liability exposure under the EAR. We regularly advise exporters who have inherited legacy classification trees that were never updated as product specifications changed; the classification must follow the item as it exists on the date of export, not as it existed when the tree was first built.
Once the review confirms no CCL entry captures the item, note the negative finding in the export file. Write it down. "EAR99 – no CCL entry applies – confirmed [date] – reviewed by [analyst]" is the minimum record. The absence of documentation is itself a vulnerability if BIS or OFAC subsequently asks how the determination was made.
Step 3: Identify the applicable OFAC programme before any other screen
The OFAC analysis is triggered by three independent factors: the identity of the parties, the destination, and the nature of the transaction. Any one of them can create a sanctions prohibition even where the goods are EAR99 and no BIS licence would otherwise be required.
Party screening comes first. The exporter must check the buyer, the end-user, intermediate brokers, freight forwarders, financial counterparties, and – critically – the beneficial ownership chain of each of them against OFAC's SDN List (Specially Designated Nationals and Blocked Persons) and any other applicable OFAC list. Under OFAC's 50 percent rule (the rule treating any entity owned 50 percent or more in the aggregate by one or more blocked persons as itself blocked, even if not separately listed), a counterparty that appears clean on the surface may be blocked at the ownership level. Screening the listed name alone is insufficient.
Destination screening runs in parallel. Certain country-level programmes prohibit substantially all transactions with the relevant territory regardless of the item being shipped. An EAR99 widget destined for an embargoed territory is a prohibited transaction. The OFAC programme structure for each country-level regime specifies what is prohibited; some permit narrow categories of authorised transactions under a general or specific licence. But the default is prohibition, and the exporter must establish the authorisation, not assume it.
End-use screening closes the loop. OFAC's secondary-sanctions programmes can apply even where neither the counterparty nor the destination triggers a primary prohibition, if the transaction materially supports a sanctioned activity. EAR99 classification is irrelevant to that question.
Step 4: Assess secondary-sanctions risk and cross-border dimensions
Secondary-sanctions risk is the dimension that catches non-US exporters most by surprise – and US exporters operating through non-US subsidiaries most acutely. OFAC's secondary-sanctions authorities reach transactions conducted entirely outside the United States when a US nexus exists: dollar clearing, US-person involvement, or goods of US origin, including EAR99 items.
The practical consequence for a European or Asian exporter selling an EAR99 item to a third-market buyer is real. If the goods are of US origin or contain US-origin technology above the applicable de minimis threshold (the BIS threshold above which the re-export or transfer of foreign-made items incorporates sufficient US content to trigger EAR jurisdiction), the US rules apply regardless of where the exporter is incorporated. OFAC's reach runs alongside and independently of BIS jurisdiction. Both must be assessed.
Consider also the position under other regimes. UK OFSI, EU sanctions Council regulations, and the Swiss SECO regime each maintain their own lists and their own prohibitions. A transaction that clears OFAC may be caught by an EU asset-freeze regulation or a UK financial-sanctions notice. In our practice, cross-border transactions involving goods sourced, financed, or shipped through multiple jurisdictions routinely require a parallel screen under at least three regimes. The strictest prohibition governs; there is no "most favoured" exemption that lifts a prohibition because another regime permits the same transaction.
For exporters whose goods transit through the UAE, Singapore, or Japan – jurisdictions that maintain their own sanctions frameworks aligned partly with UN Security Council obligations and partly with autonomous measures – an additional regime layer applies. The UN Consolidated List is the baseline for all member states. Each of those jurisdictions supplements it. An EAR99 item moving through Dubai on its way to a third market must clear UAE rules as well as OFAC.
Step 5: Apply the correct OFAC licence or authorisation where required
If the OFAC analysis in steps 3 and 4 identifies a prohibition, the next question is whether a general licence (a standing authorisation covering a defined category of transactions without a separate application) or a specific licence (a case-by-case authorisation granted by OFAC for a transaction not covered by a general licence) is available.
General licences vary by programme. They are published in the programme's regulations and in OFAC's online resource for each regime. Where a general licence covers the proposed transaction, the exporter must confirm that every condition is met – including, in many cases, conditions on the end-use, the recipient, or the type of goods – and document that confirmation in the export file. Using a general licence without documenting the eligibility analysis is a common source of enforcement exposure. The licence exists; the question is whether this transaction falls within its scope.
Where no general licence applies, a specific licence application is required before the transaction proceeds. OFAC's processing timelines are not specified by regulation as a fixed period; processing can take weeks to months depending on the programme and the complexity of the request. We have acted for exporters who proceeded with a transaction on the assumption that an application was pending, only to face the consequence that the transaction had occurred during the prohibited period without authorisation. The application does not create authorisation; only the grant does.
One structural point: the BIS licence and the OFAC licence are entirely separate instruments, issued by different agencies, under different authority, covering different legal questions. An OFAC specific licence does not authorise an export that requires a BIS licence, and vice versa. Both must be in place before a dual-controlled shipment moves. For EAR99 items, the BIS side requires no licence to most destinations; but if the destination or end-user is subject to an OFAC programme, the OFAC licence obligation remains fully operative.
Step 6: Record, retain, and review
Both BIS and OFAC require exporters to maintain records of transactions subject to their jurisdiction. The standard record-keeping period under the EAR is five years from the date of the transaction; OFAC's record-keeping requirements align closely with this period, as currently in force – verify the current position before relying on this. Records must be maintained in a retrievable form. "We did a check" is not a record. The classification analysis, the CCL review, the party and destination screens, the list of sources checked, the date and identity of the analyst, and the ultimate determination must all be documented.
Review the classification periodically. EAR99 status is not permanent. BIS revises the CCL; items that were EAR99 when a product line launched may be captured by a new or amended ECCN entry as technology controls are tightened. OFAC adds new designations to the SDN List and publishes new or amended general licences on a rolling basis. An exporter that reviewed a classification and a counterparty screen two years ago and has not revisited either since carries an unquantified risk on every transaction it has shipped in the interim.
Build a review trigger into the compliance programme: any change to the product specification, any new destination, any change in ownership of a regular counterparty, and any public announcement of new sanctions designations or new CCL entries should automatically generate a re-screen. Compliance programmes that are static are not compliant – they are simply undiscovered liabilities.
Common risk flags and when to involve counsel
Several patterns generate disproportionate enforcement risk and should be treated as triggers for legal review before a shipment proceeds.
The first is a beneficial-ownership question on the buyer. If the counterparty's ultimate beneficial owner cannot be confirmed through available public sources and the buyer is unwilling or unable to provide documentation, the 50 percent rule analysis cannot be completed. That is not a green light; it is an unresolved risk. Proceeding without resolution is a strict-liability exposure under OFAC's enforcement framework.
The second is a destination with a known transhipment risk. Certain routing patterns – goods shipped to a free-trade zone or a jurisdiction adjacent to a sanctioned territory – are treated by OFAC as indicative of potential diversion. EAR99 classification does not remove the diversion risk. BIS's end-use controls apply regardless of ECCN status; OFAC's diversion-risk standards apply to the transaction as a whole.
The third is a rush. In our experience, the transactions that later attract enforcement attention are disproportionately those where commercial pressure caused the compliance process to be abbreviated. A same-day classification review and a name-only screen against a single list is not the standard of care that regulators expect. If a counterparty or a timeline is creating pressure to compress the compliance process, that pressure is itself a red flag.
The fourth is a change in end-use after shipment. OFAC and BIS both maintain post-shipment jurisdiction over goods exported in violation of applicable rules, even where the original export appeared lawful. If an exporter learns that goods reached a different end-user or are being used for a different purpose than declared, a voluntary self-disclosure analysis may be warranted. Early review in that situation can preserve options that are foreclosed once an enforcement inquiry has already opened.
A common myth is that EAR99 status provides a safe harbour against OFAC enforcement. It does not. OFAC's legal authority operates entirely independently of BIS's classification regime. An EAR99 determination is relevant only to the BIS licence question. It has no bearing on whether a transaction is prohibited by an OFAC programme, whether a party is blocked or designated, or whether a licence or authorisation from OFAC is required. That distinction – clearly understood by experienced practitioners and frequently missed by compliance teams without dedicated export-controls counsel – is the single most important structural point in this area.
Related practices
- Deemed export and technology controls under BIS and the EAR – classification, deemed-export licences, and technology-transfer controls for cross-border transactions.
- EAR99 determination: advanced scenarios – re-exports, de minimis analysis, and foreign-direct product rule exposure for non-US exporters.
- OFAC sanctions screening: a compliance programme guide – designing and testing a screening system that satisfies the five-element standard across multiple regimes.