A mid-sized technology exporter receives a purchase order from a distributor in a friendly jurisdiction. The goods look ordinary. But one line item carries performance parameters that sit uncomfortably close to a control threshold on the Commerce Control List. Has the exporter classified the item correctly? Does that classification interact with any OFAC sanctions programme? These are not abstract questions. A wrong classification, or a gap between the export-control and sanctions analyses, can expose the business to significant civil and criminal risk under US law.
As of April 2026, ECCN classification (the process of assigning an Export Control Classification Number from the US Commerce Control List to a specific item) is administered by the Bureau of Industry and Security under the Export Administration Regulations. OFAC operates separately, controlling transactions with designated persons and sanctioned programmes, not the classification itself. A complete US compliance analysis must address both: an item's ECCN determines what licence is needed to export; OFAC determines whether the transaction can proceed at all. Failing to run both analyses in parallel is the most frequent structural gap we see in cross-border export programmes.
This guide walks through ECCN classification step by step, explains where the BIS and OFAC analyses intersect, identifies the points at which classification errors carry the greatest penalty risk, and sets out when to involve specialist export-control and sanctions counsel.
Step 1: Understand what ECCN classification is – and what it is not
ECCN classification is the process of locating an item – goods, software, or technology – on the Commerce Control List and assigning it the appropriate five-character alphanumeric code that governs its export-licence requirements. It is a BIS-administered function under the Export Administration Regulations. OFAC's role is distinct: OFAC administers economic sanctions programmes that prohibit or restrict transactions with designated parties and certain jurisdictions, regardless of what the item is.
Why does this matter for an OFAC-focused compliance programme? Because the two analyses are complementary, not substitutes. An item classified as EAR99 – the lowest-control designation, meaning it falls outside the CCL's specific entries – is still subject to OFAC's prohibitions if the end-user or end-use triggers a sanctions concern. Conversely, a properly licensed export under a BIS licence does not automatically satisfy OFAC requirements. In our experience, businesses that treat export-control classification and sanctions screening as a single checkpoint routinely miss one or the other.
The starting question, then, is not "do I need an OFAC licence?" It is: "What is this item? Who is the end-user? Where is it going? And what do BIS and OFAC each say about that combination?" Classification is the foundation of the first question. Sanctions screening answers the second and third.
Step 2: Gather the technical parameters of the item
Accurate ECCN classification begins with assembling the item's full technical specification, because control thresholds on the Commerce Control List are defined by precise technical parameters – processing speeds, wavelengths, tensile strengths, encryption key lengths, and similar measurable characteristics. A classification based on a product's commercial name or marketing description, rather than its actual performance parameters, is legally unreliable.
The documentation you need at this stage typically includes engineering specifications, data sheets, software architecture documents (for technology), bills of materials, and any available manufacturer's classification opinion. If the item is manufactured by a third party, that manufacturer may already hold a classification; request it in writing and keep it on file. Caution: a third-party classification opinion does not transfer legal responsibility. The exporter remains responsible for the accuracy of its own determination.
One practical risk flag: parameter creep. A product that was correctly classified two years ago may have been updated – firmware, processing capability, new export configurations – in a way that moves it across a control threshold. We regularly advise clients to build classification reviews into product-update cycles, not just into new-product launches. A classification that is accurate at launch can become inaccurate within months.
Step 3: Work through the Commerce Control List in sequence
The Commerce Control List is organised into ten categories (numbered 0 through 9) and five product groups (A through E within each category), covering everything from nuclear materials to telecommunications equipment to software. The classification exercise is a sequential matching exercise: identify the relevant category by the nature of the item, then work through the entries within that category to find the specific ECCN, comparing the item's parameters against each entry's technical thresholds.
The sequence has three possible outcomes. First, the item matches a specific ECCN entry – it is controlled, and that entry defines the reasons for control and, consequently, the licence requirements for each destination. Second, the item is within a category but does not match any specific entry's technical thresholds – it is classified EAR99, meaning it requires no BIS licence for most destinations, though end-use and end-user checks still apply. Third, the item is not subject to the EAR at all – for example, because it falls under State Department jurisdiction as a defence article under the US Munitions List.
That third outcome is important. Items on the US Munitions List are controlled by the International Traffic in Arms Regulations, not the EAR. Misidentifying an ITAR-controlled item as an EAR item – and assigning it an ECCN when it should have no ECCN – is a classification error with serious legal consequences. Jurisdiction determination is, therefore, the preliminary step before any CCL search. Have you confirmed that BIS, and not the State Department, is the correct controlling agency for your item?
Step 4: Identify the reasons for control and the applicable licence requirements
Once you have assigned an ECCN, the next step is to read the entry's reasons for control. Each ECCN carries one or more reason-for-control designators – national security, regional stability, anti-terrorism, nuclear non-proliferation, and others. These designators drive the licence requirements for specific destinations and end-uses. An item controlled for national security reasons faces different licence requirements than one controlled solely for regional-stability reasons, and the applicable general prohibitions and licence exceptions vary accordingly.
Licence exceptions are standing authorisations in the EAR that permit certain exports without a case-by-case licence application. Whether an exception applies depends on the ECCN, the reasons for control, the destination, and the end-user. Eligibility is not assumed from the ECCN alone. A common error at this stage is assuming that a low-control ECCN automatically qualifies for the most permissive licence exceptions. It does not always.
At this point the OFAC layer becomes directly relevant. Even where a BIS licence exception applies and no BIS licence is required, a separate OFAC analysis is mandatory if the destination, the buyer, or any party in the transaction touches an OFAC-administered programme. The BIS and OFAC analyses must both be completed and both must be affirmative before the transaction proceeds. This is not a redundancy – it is a structural feature of US export-control law that many non-US businesses encounter for the first time when a transaction is already in progress.
The position above covers the standard case. Your facts – the item's parameters, the destination, the ownership chain of the buyer, and the applicable OFAC programme – change the analysis materially. To discuss how BIS and OFAC interact in your transaction, contact Calder & Vance at info@caldervance.com.
Step 5: Run the parallel OFAC analysis – where the two regimes intersect
The OFAC analysis runs parallel to, not after, the BIS classification. The central question is whether any party to the transaction – the buyer, the end-user, any intermediate party, any owner of those entities – appears on OFAC's SDN List (the Specially Designated Nationals and Blocked Persons List, which identifies individuals and entities whose property is blocked under US law) or is otherwise covered by an OFAC-administered programme.
OFAC's 50 percent rule extends that analysis to entities. Any entity owned 50 percent or more, directly or indirectly, by one or more SDN-listed persons is itself treated as blocked – even if the entity itself does not appear on the SDN List. The aggregation point is critical: two listed persons each holding a minority interest may together reach the 50 percent threshold. Screening a buyer's name against the SDN List without mapping its ownership structure misses this exposure entirely.
OFAC's reach is extraterritorial. Non-US parties to a transaction involving US-origin goods, US-dollar clearing, or a US person in the chain may be subject to OFAC jurisdiction. Secondary-sanctions risk – the risk that a non-US person is denied access to the US financial system or designated for engaging in activity that OFAC targets – adds a further layer. We regularly advise non-US clients who first encounter OFAC's reach at the point of a correspondent-bank rejection. That is a late and costly discovery.
The UK and EU regimes add a further dimension. Under OFSI and under the EU Council regulations, ownership-and-control tests can capture entities that do not reach OFAC's mechanical 50 percent threshold, because both the UK and EU apply a control element in addition to a percentage test. A cross-border transaction may satisfy the OFAC threshold test but still be restricted under OFSI or EU rules if a designated person exercises effective control without majority ownership. Any business with EU or UK operations – or EU/UK bank accounts – must address all three regimes.
Step 6: Document the classification and the sanctions analysis
Documentation is not a formality. It is the principal evidence available to a business if a classification is later challenged by BIS, or if OFAC initiates an inquiry into a transaction. The record should capture the technical parameters reviewed, the CCL entries considered and the reason for selecting or rejecting each, the final ECCN assigned, the reasons for control identified, the licence exception or licence relied upon, the OFAC screening conducted (including the date and the list versions queried), the ownership-and-control analysis for the buyer, and the conclusion.
Records must be maintained for the period required under the EAR – five years from the date of the transaction or the date of the licence application, whichever is later. OFSI and EU records obligations carry comparable retention requirements, as currently in force and subject to verification before reliance. A classification file that cannot be reconstructed at the time of an inquiry is, for practical purposes, no file at all.
If a transaction has already been flagged, or a filing has been refused, early review can preserve options that narrow with time. A voluntary self-disclosure (VSD) – submission to BIS or OFAC acknowledging an apparent violation before the agency identifies it independently – is a mitigating factor under both agencies' penalty frameworks. Timing matters. Contact Calder & Vance at info@caldervance.com before submitting a VSD.
Step 7: Recognise the risk flags that require specialist input
Several fact patterns call for specialist classification and sanctions counsel before any decision is made. Each represents a point at which the standard classification process intersects with a heightened legal risk.
- Items near a control threshold. When a product's technical parameters sit close to – but are argued to be below – a CCL threshold, the classification is contested. A reasonable-basis determination requires a documented technical analysis, not an assertion. BIS can and does disagree with exporters' threshold judgments.
- Encryption and software items. Encryption technology and software carry their own classification rules and reporting requirements that differ from the general CCL structure. An exporter unfamiliar with those rules frequently misclassifies items in this category.
- Technology and deemed exports. Releasing controlled technology to a foreign national inside the United States constitutes a deemed export and requires the same licence analysis as a physical export to that person's country of nationality. Businesses with international research and development teams often overlook this entirely.
- Layered ownership structures. Where the buyer or end-user is owned through multiple intermediate entities, or where ownership is held through funds, trusts, or nominee arrangements, the OFAC 50 percent rule analysis must trace each layer. Screening tools that query only the immediate counterparty are insufficient.
- Dual-use goods with military end-users. Certain destinations and military or government end-users trigger additional controls regardless of the ECCN. End-use certification and due diligence on the end-use itself are required.
- Post-shipment audits and red flags. If a buyer requests unusual delivery terms, obscures the end-use, or shows other transactional red flags identified in BIS guidance, the classification and screening process must pause. A completed classification does not overcome a transactional red flag.
Related practices
- Deemed Export and Technology Controls – structuring compliance for technology releases to foreign nationals inside the US.
- ECCN Classification Guide – Part 3 – working through specific CCL categories and the technology-control entries in detail.
- ECCN Classification Guide – Part 4 – addressing licence applications, licence exceptions, and BIS advisory opinions.