A technology exporter based in Europe finalises a distribution agreement with a partner in Southeast Asia. The goods have military-adjacent applications. The compliance officer asks: does this shipment need a US export licence? The question turns, first and last, on the item's Export Control Classification Number (ECCN – the alphanumeric code on the US Commerce Control List that determines which controls and licence requirements apply to a given item). Get the classification wrong and the shipment may leave without a required licence – or, equally costly, sit in a warehouse while the team chases an authorisation that was never needed.
ECCN classification is the foundational step in US export-control compliance under the Export Administration Regulations (EAR), administered by the Bureau of Industry and Security (BIS). A correct classification tells a business whether a licence is required to ship an item to a given destination, end-user, or end-use – and, critically, whether OFAC's sanctions programmes independently block or restrict the same transaction. As of April 2026, the EAR and OFAC's sanctions programmes operate in parallel; satisfying one does not satisfy the other.
This guide walks through the classification process step by step, explains where OFAC intersects with export-control obligations, flags the most common errors, and sets out when a business should involve specialist counsel.
Step 1: Understand the two-regime architecture – BIS and OFAC
ECCN classification is a BIS function, not an OFAC function – yet OFAC and BIS work in tandem on almost every cross-border transaction involving controlled items. BIS administers the EAR and the Commerce Control List (CCL), which assigns an ECCN to dual-use goods, software, and technology. OFAC administers economic sanctions programmes under IEEPA and other statutory authority, blocking transactions with designated persons or targeted countries and territories.
The two regimes address different questions. BIS asks: is this item controlled for export, re-export, or in-country transfer, and if so, what licence is required? OFAC asks: is the counterparty, destination, or transaction prohibited under any active sanctions programme? A business must clear both hurdles. An item that carries a favourable ECCN and qualifies for a licence exception can still be blocked entirely by OFAC if the consignee is on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) or if the destination is subject to a comprehensive sanctions programme.
In our experience, the commonest structural error is treating ECCN classification as the end of the compliance analysis. It is not. It is the beginning. Once you know the classification, the OFAC screening check runs in parallel – and the stricter prohibition governs. Where BIS permits the shipment under an exception but OFAC prohibits it, the shipment is prohibited.
Step 2: Locate the item on the Commerce Control List – or confirm it is EAR99
Every physical good, piece of software, or item of technology subject to the EAR falls into one of two categories: it either carries a specific ECCN on the CCL, or it is designated EAR99 (the residual category for items subject to the EAR but not specifically enumerated on the CCL). EAR99 items generally do not require a licence for most destinations – but they are not outside export-control scrutiny entirely.
The CCL is organised into ten product categories (0 through 9) and five product groups within each category (designated A through E). A classification therefore looks like "3A001" – category 3 (electronics), product group A (systems, equipment, and components), control number 001. The classification determines which Reasons for Control apply – national security, nuclear non-proliferation, chemical and biological weapons, missile technology, regional stability, and others – and which destinations trigger a licence requirement for each reason.
To locate the correct ECCN, the classifier must work through the CCL entry by entry, matching the item's technical parameters against the control text. This is not a word-search exercise. The CCL entries contain technical thresholds – performance levels, frequencies, tolerances – and an item may fall under multiple candidate entries. The correct ECCN is the most specific entry whose control text encompasses the item's technical characteristics.
Where no CCL entry applies, the item is EAR99. That determination should be documented. Do not assume EAR99 by default: the absence of a positive match must be the conclusion of a genuine search, not the starting assumption.
Step 3: Apply the technical parameters and obtain a written determination
The classification analysis should produce a written determination that records the item's technical specifications, the CCL entries considered, the reasons for accepting or rejecting each candidate entry, and the final ECCN (or EAR99 finding). This document is the audit trail. It is what a business presents to BIS during an inspection, to a freight forwarder requiring classification evidence, or to counsel if an apparent violation arises later.
Where internal technical expertise is limited, or where the item sits on the boundary between two entries, the prudent course is to request a Commodity Classification determination from BIS. BIS will issue a binding written classification. This process takes time – verify current processing times with BIS directly, as timelines vary – but the result is authoritative and provides a strong compliance defence.
What specific technical data do you need before you can complete the analysis? At a minimum: the item's function, its technical specifications against the parameters in the candidate CCL entries, its intended end-use, the software or technology embedded in or accompanying it, and any controlled components or materials incorporated into a finished product. Missing any of these creates a gap in the determination that an enforcement authority will probe.
A practical discipline that we regularly recommend to clients is a two-reviewer sign-off on any classification that could plausibly sit at a controlled ECCN. One reviewer performs the analysis; a second reviews the technical evidence and the CCL entries independently. Disagreements surface errors. Agreement adds a layer of documented diligence.
The position above covers the standard classification case. Your facts – the item's precise technical characteristics, its embedded software, its intended end-use, and the identity and location of the end-user – change the analysis materially.
For a confidential review of a classification question or a potential breach, contact Calder & Vance at info@caldervance.com.
Step 4: Run the OFAC check – counterparty, destination, and end-use
Once the ECCN is confirmed, the OFAC analysis runs alongside the BIS licence-requirement check. The OFAC check has three limbs: the counterparty screen, the destination screen, and the end-use or end-user screen.
The counterparty screen checks the buyer, the consignee, the freight forwarder, the financial institutions involved, and any other party to the transaction against OFAC's published lists – primarily the SDN List. The 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) means that list-screening alone is insufficient. An entity not named on the SDN List may still be treated as blocked if a listed person owns it at or above that threshold.
The destination screen checks whether the country of ultimate destination is subject to a comprehensive or targeted OFAC sanctions programme. The programmes differ in scope and in the prohibitions they impose. Some programmes block virtually all transactions with a country or territory. Others target specific sectors, individuals, or activities. The EAR Country Chart tells you which destinations require a BIS licence; OFAC's programme-specific regulations tell you what is independently prohibited. They do not always align.
The end-use and end-user screen asks whether the proposed use of the item – or the identity of the ultimate end-user – triggers any OFAC prohibition independently of the item's classification. Certain end-uses and end-users may be prohibited under thematic sanctions programmes even where the destination country is not comprehensively sanctioned. This check requires more than a name search: it requires an understanding of what the buyer intends to do with the goods.
In our cross-border practice, we advise clients to treat the OFAC check not as a single gate at the point of shipment but as a continuing obligation. Ownership structures change. Designations are issued and updated. An end-user cleared at the start of a multi-year supply agreement may be designated before the final delivery.
Step 5: Determine whether a licence or licence exception applies
Where a BIS licence is required, the analysis turns to whether a licence exception (a standing authorisation in the EAR that permits certain exports without a separate BIS licence application, subject to conditions) is available, or whether a licence application must be filed.
The EAR contains a range of licence exceptions. Each has specific eligibility conditions – destination, end-use, end-user, value limits, and prior conduct requirements. A business must confirm that every condition is met before relying on an exception. Partial compliance does not satisfy the exception. If any condition fails, the exception is unavailable and a licence application is required.
Where OFAC's programmes are also engaged, a separate OFAC authorisation may be required alongside the BIS licence or in place of it. OFAC issues specific licences (case-by-case authorisations for an otherwise prohibited transaction) and general licences (standing authorisations for defined categories of transactions). General licences are published in the programme-specific regulations and apply automatically if all stated conditions are met; a separate application is not required. Specific licences require an application to OFAC, supported by a detailed description of the transaction, the parties, the proposed end-use, and the basis for relief.
The two licensing regimes – BIS and OFAC – are separate. A BIS licence does not authorise an OFAC-prohibited transaction, and an OFAC general licence does not remove a BIS licence requirement. Both authorities must be satisfied independently. If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time.
For an assessment of your exposure under the EAR and OFAC's programmes, contact Calder & Vance at info@caldervance.com.
Step 6: Document, monitor, and review
A completed ECCN classification is not a permanent determination. Items are redesigned, re-engineered, or incorporated into new products. The CCL is amended. BIS issues new controls on items that were previously EAR99. OFAC issues new designations and new programme-specific rules. A classification that was correct at first determination may be incorrect a year later.
Record-keeping obligations under the EAR are meaningful. Businesses must maintain export records for a prescribed period – verify the current requirement, but plan for a multi-year retention obligation. Records must be sufficient to demonstrate compliance: the classification determination, the licence or licence-exception basis, the end-user documentation, the screening evidence, and the transaction records.
A periodic review cycle – at minimum annually, and whenever a product line changes materially – is good practice and a strong compliance defence. In our experience advising exporters across multiple sectors, the firms that face the most difficult enforcement conversations are those whose classification files have not been updated to reflect product changes that shifted an item from EAR99 to a controlled ECCN. The gap between the old determination and the current product is precisely where an apparent violation arises.
A monitoring programme should also track BIS's Entity List and Denied Persons List alongside OFAC's SDN List. BIS publishes these lists independently of OFAC. An entity on the Entity List may be subject to licence requirements that do not apply to other parties in the same country, even where OFAC has not designated the entity. Both lists require separate, regular checking.
Cross-border dimension: how other regimes interact with US controls
The EAR has explicit extraterritorial reach. The de minimis rule subjects foreign-made items to the EAR where US-origin controlled content exceeds a defined percentage of the item's total value – verify the applicable thresholds, as they differ by destination. The foreign direct product rule (FDPR) can subject foreign-made products to the EAR where they are produced using US-origin technology or software subject to the EAR. Both rules can catch a non-US manufacturer that uses US components or technology in its production process.
For a business operating between the US and the European Union, this creates a dual-layer obligation. EU dual-use controls apply to the same goods under EU Regulation 2021/821 and its successor instruments. The EU CCL does not map identically onto the US CCL: an item controlled under the EAR at a specific ECCN may carry a different classification number under EU rules, and the licence requirements differ. Where the EU Blocking Regulation is engaged, there can be tension between compliance with US re-export controls and EU obligations to resist their extraterritorial application.
The United Kingdom applies its own export-control regime through the Export Control Order and ECJU licensing. Post-Brexit, the UK CCL has diverged from the EU regime in some areas. A UK-based subsidiary of a US group must therefore satisfy ECJU requirements independently of both EAR and EU obligations. In our cross-border practice, we regularly advise businesses on this three-way analysis – US, EU, and UK – where goods or technology move through multiple jurisdictions before reaching the end-user.
Singapore, Japan, and Australia each maintain export-control regimes that interact with the EAR through catch-all controls, re-export notifications, and mutual-recognition arrangements. The practical implication for a multinational with distribution operations in those jurisdictions is that a supply chain routed through any of them must be checked against the applicable country regime as well as the EAR. A shipment that clears BIS requirements at the point of US export may require a local licence or notification at the re-export point.
What does this mean for a business that sources from the US, processes goods in the EU or UK, and distributes in Asia? It means that the classification analysis is not a single country exercise. Each leg of the supply chain has its own control trigger. The analysis must follow the goods.
Risk flags and when to involve counsel
Several patterns in the classification process indicate elevated risk and warrant early specialist involvement. None of the following is an exhaustive list, and the weight of each flag depends on the specific facts – but each one, in our experience, has preceded an enforcement enquiry.
- Dual-use ambiguity. Items with both civil and military or proliferation-sensitive applications frequently sit near the boundary between a controlled ECCN and EAR99. Where the item's performance parameters are close to the control thresholds, or where the end-use is not fully confirmed, the EAR99 determination is fragile.
- Technology and software transfers. Exporting an item is one thing; transferring the technology or source code to produce it is another. Technology transfers – including by email, cloud upload, or training – are subject to the EAR independently of any physical shipment. The deemed export rule can further apply to the release of controlled technology to a foreign national within the United States itself.
- Re-exports and in-country transfers. The EAR applies to re-exports of US-origin items from third countries. A distributor in Germany re-exporting to a customer in a targeted country is making an EAR-controlled re-export, not just a local sale. The obligation travels with the goods.
- Aggregation under the 50 percent rule. Where a potential counterparty has multiple shareholders and any combination of blocked-person holdings could reach 50 percent or more in the aggregate, the OFAC analysis must map the full ownership structure – not just run a name-screen against publicly visible owners.
- Changes in product specification. A redesign that adds a new capability, increases a performance parameter, or incorporates new software may shift the item's ECCN. The original classification should be re-run whenever the product changes materially.
- Unusual transaction features. Cash-in-advance payment terms, unusual routing, requests to omit technical specifications from commercial documents, or end-users whose business activities do not obviously correspond to the goods ordered are all red-flag indicators under BIS's Know Your Customer guidance.
The myth that ECCN classification is a one-time administrative task – classify once, ship indefinitely – is the single most common structural misconception we encounter. Classification is a living determination. It must be revisited each time the product, the end-user, or the regulatory environment changes. The compliance obligation does not end at the first determination.
How Calder & Vance assists on ECCN classification matters
Our export-controls practice handles classification questions from initial ECCN determination through to BIS Commodity Classification requests, licence-exception eligibility reviews, and OFAC-parallel screening for the same transaction. We classify items across the full CCL – electronics, telecommunications, sensors and lasers, aerospace, materials, chemicals, and dual-use software – and we have acted for manufacturers, distributors, technology companies, and research institutions.
In a recent matter, a materials-science business faced a BIS enquiry following the shipment of a product it had classified as EAR99. We reviewed the product's technical specifications against the CCL, identified the controlling ECCN entry that the original classification had overlooked, scoped the apparent violation, and advised on voluntary self-disclosure to BIS. We also mapped the OFAC exposure for the same shipments and prepared the disclosure package. The matter proceeded through the enforcement process. No specific outcome is guaranteed in similar matters, but early and complete disclosure is consistently the best basis for managing the process.
Our approach: classify the item using the CCL and the item's verified technical specifications, confirm licence requirements and available exceptions, run the OFAC screen in parallel, and design the end-use and end-user controls that prevent the same risk arising on future shipments.
Related practices
- Deemed export and technology controls under the EAR – BIS analysis of technology releases to foreign nationals in the US and abroad
- ECCN classification guide – part 4 – advanced classification for software, encryption, and emerging technology
- ECCN classification and UK export controls – how UK ECJU obligations interact with BIS classification