A technology exporter in Germany prepares to ship software to a distributor in Southeast Asia. Its legal team asks one question before the contract is signed: does this item carry an Export Control Classification Number (ECCN – a code on the US Commerce Control List that determines which countries, end-users, and end-uses require a licence under the Export Administration Regulations)? The answer governs not only whether a Bureau of Industry and Security licence is needed, but whether an OFAC sanctions programme independently blocks the deal. Getting the classification wrong does not merely risk a civil penalty; it can mean a prohibited transaction has already completed.
As of April 2026, ECCN classification under US export-control rules is formally a BIS and EAR exercise, not an OFAC function – but the two regimes intersect directly. An item's ECCN determines licence requirements under BIS; OFAC's sanctions programmes then overlay additional or absolute prohibitions based on who the counterparty is and which programme applies. A business that classifies correctly for BIS purposes but ignores OFAC's independent controls has completed only half the analysis.
This guide works through the classification process step by step, identifies where OFAC's programmes alter the conclusion, flags the most common errors, and explains when to bring in export-control and sanctions counsel.
Step 1 – Understand who governs what, and why both regimes apply
ECCN classification sits with BIS and the EAR, which implement US export-control law under the Export Control Reform Act and IEEPA. BIS maintains the Commerce Control List, and every item – physical goods, software, technology – is either assigned a specific ECCN or falls into the residual EAR99 category. OFAC administers separate sanctions programmes under IEEPA and other statutory authority, prohibiting transactions with designated persons, listed entities, and entire country programmes.
The two systems are not alternatives. They operate in parallel. An exporter must satisfy BIS licence requirements for a given ECCN and must simultaneously confirm that no OFAC programme prohibits the transaction with the specific counterparty. In our cross-border practice, the most persistent misconception is that a clean ECCN classification – even one that shows no licence required – serves as clearance for the whole transaction. It does not. OFAC's analysis runs independently and can prohibit a transaction that BIS would permit without a licence.
A practical illustration: an item classified as EAR99 (no ECCN, the lowest-controlled tier) still requires an OFAC-specific licence or general authorisation if the buyer is a Specially Designated National (SDN – a person or entity on OFAC's blocked list) or is located in a country subject to a comprehensive OFAC programme. The EAR99 classification is irrelevant to that question.
Understanding this structural separation is the foundation of every classification exercise. Neither regime is optional, and neither regime's clearance substitutes for the other's.
Step 2 – Classify the item on the Commerce Control List
BIS classification follows a defined sequence: identify the item's technical parameters, locate the matching category and group on the Commerce Control List, confirm the ECCN, and determine the reasons for control that apply to it. The list is organised into ten categories (from nuclear materials through aerospace) and five product groups (equipment, materials, software, technology, and a catch-all). Each combination of category and group produces a specific ECCN structured as a number, a letter, and three further digits.
Where no specific entry captures the item, the correct classification is EAR99. That classification is not a safe harbour; it is the starting point for the OFAC layer of analysis. We regularly advise exporters who treat EAR99 as a green light. It is not. It means BIS has no specific licence requirement for the item in isolation; it says nothing about the counterparty, the end-use, or the OFAC overlay.
The classification exercise must capture the item as exported – including any software bundled with hardware and any technology transferred alongside a physical good. A deemed export (the release of controlled technology to a foreign national inside the United States, treated as an export to that person's country of nationality) generates its own classification and licence-requirement questions entirely separately from any physical shipment. For the deemed-export analysis, see our dedicated guidance on deemed exports and technology controls under BIS and the EAR.
Step 3 – Map the ECCN against OFAC's programmes
Once the ECCN is established, the exporter must determine whether any OFAC programme creates an independent prohibition or licence requirement for the proposed transaction. This step has two sub-tasks: counterparty screening and programme-specific analysis.
Counterparty screening means checking every party in the transaction chain – buyer, end-user, freight forwarder, financial intermediary, and any intermediate consignee – against OFAC's SDN List and the other lists OFAC maintains. A hit on any list triggers a blocking obligation or a prohibition, regardless of the ECCN. The 50 percent rule (OFAC's rule that any entity owned 50 percent or more in the aggregate by one or more blocked persons is itself treated as blocked, even if not separately listed) requires mapping the ownership chain behind each counterparty, not merely running the legal name through a screening database.
Programme-specific analysis means identifying whether the destination country, sector, or transaction type falls within a comprehensive or targeted OFAC programme. Comprehensive programmes typically prohibit virtually all transactions with a country, its government, and persons located there, without regard to the item's ECCN. Targeted programmes restrict transactions in specific sectors – defence, energy, financial services – or with specific persons, and require a more granular analysis tied to the item and its end-use.
The interaction between the ECCN and the applicable OFAC programme determines the final legal position. An item with a high ECCN in a controlled category might require both a BIS licence and an OFAC specific licence. An EAR99 item shipped to an SDN requires an OFAC licence even though BIS requires none. A licensed item can still be shipped under a BIS licence while simultaneously requiring an OFAC authorisation that has not been obtained. Each layer is independent.
Step 4 – Determine whether a licence or authorisation is required
After the ECCN and OFAC programme analysis are complete, the exporter's question is whether a licence, a licence exception, or a general authorisation covers the transaction – or whether a specific licence application to BIS or OFAC (or both) is required.
Under the EAR, licence exceptions are defined conditions under which a normally controlled item may be exported without a licence. Each exception has eligibility criteria tied to the ECCN, the destination, the end-user, and the end-use. An exporter that does not satisfy every element of an exception cannot rely on it. In our experience, exceptions are frequently cited without a complete check of all eligibility conditions – that is an enforcement exposure.
Under OFAC, general licences (standing authorisations permitting a defined category of transactions without a case-by-case application) cover a significant range of humanitarian, journalistic, personal, and certain commercial activities. Where no general licence applies, a specific licence (a case-by-case authorisation for an otherwise prohibited transaction) must be sought from OFAC directly. OFAC considers specific licence applications on a policy basis that varies by programme; there is no entitlement to approval, and timelines vary.
A critical cross-border point: the absence of a US licence requirement does not mean the transaction is uncontrolled. The EU dual-use regime, the UK's Export Control Order, and the applicable country regime for jurisdictions such as Japan and Singapore each maintain independent controls. An item that clears BIS and OFAC may still require a licence from ECJU in the United Kingdom or from the relevant EU competent authority. Where an EU or UK exporter is involved, both regimes bite simultaneously. The stricter prohibition governs.
Step 5 – Document the classification and maintain the record
A classification determination is only as reliable as the documentation behind it. BIS and OFAC both expect exporters to be able to demonstrate the basis for the classification and the licence eligibility conclusion at the time of export, not retrospectively. A spreadsheet entry is not sufficient. The record should capture the technical parameters reviewed, the ECCN selected and why, the reasons for control identified, the OFAC programme analysis, the licence or exception relied upon, and the screening results for each party in the transaction.
Record-keeping obligations under the EAR require that export documentation be retained for a defined period after the date of export, currently stated as five years in the applicable rules. OFAC similarly requires that records supporting a licensed or authorised transaction be maintained and be available for examination. Where a voluntary self-disclosure (VSD – a proactive disclosure to BIS or OFAC of a potential violation) becomes necessary, the quality of the contemporaneous record directly affects the outcome of the disclosure process.
We have acted for exporters whose classification files were assembled after the fact when an enforcement inquiry arrived. The absence of contemporaneous records creates a presumption of inadequate controls, and that presumption is difficult to displace in a penalty proceeding. The record is not a formality; it is the evidence base for any subsequent enforcement defence.
What is the difference between how OFAC and other regimes handle item classification?
OFAC does not maintain its own item-classification list in the same sense that BIS maintains the Commerce Control List or the EU maintains its dual-use list. OFAC's prohibitions are counterparty-based and programme-based: the question is who the buyer is and which programme applies, not (primarily) what the item is. BIS, by contrast, builds the control around the item first – the ECCN triggers the licence requirement, and the country and end-use refine it.
The EU dual-use regulation and the UK Export Control Order each maintain their own control lists, structured similarly to the Commerce Control List and aligned in significant respects with the Wassenaar Arrangement, the Nuclear Suppliers Group, and other multilateral control regimes. An item may carry different classification outcomes under the EU list, the UK list, and the US Commerce Control List even for the same physical good. That divergence is not theoretical; we regularly advise on transactions where a European exporter's classification under the EU regime does not map directly to the BIS classification for the same item, and both analyses must be completed.
Japan, Singapore, and Australia each maintain national lists that similarly derive from, but do not replicate, the US Commerce Control List. An exporter routing goods through a third country faces the classification rules of each jurisdiction through which the goods pass – and the applicable country regime can impose a higher standard than the US EAR. The stricter rule governs the transaction, not the more permissive one.
A further difference: OFAC's extraterritorial reach means that non-US persons transacting in US-origin goods, US-dollar payments, or items that contain a defined percentage of US-controlled content can fall within the EAR's jurisdiction and simultaneously within OFAC's primary or secondary-sanctions reach. The EU and UK regimes do not impose the same extraterritorial jurisdictional sweep, though secondary-sanctions risk – the risk that a non-US entity loses access to US markets by dealing with OFAC-designated persons – is a practical constraint on many non-US businesses regardless of whether US law formally applies to them.
Common risk flags and when to involve counsel
The most common errors we see in ECCN classification work fall into five patterns. First, classifying the item at the point of original manufacture without revisiting the classification when the item is modified, when technology is added, or when the export destination changes. Classification is a transaction-specific exercise, not a once-only product decision.
Second, treating a US re-export as if it were not subject to the EAR. Where a non-US entity re-exports a US-origin item, the EAR may apply to that re-export if the item retains sufficient US content or if it is the direct product of controlled US technology. The jurisdiction of the EAR does not end when the item leaves the United States.
Third, running screening only against the named buyer and ignoring the ownership chain. The 50 percent rule means a buyer that is clean on its face may be blocked through its shareholders. Screening must map the beneficial ownership structure, not merely the legal name of the contracting party.
Fourth, relying on a licence exception without confirming every eligibility criterion. Exceptions are conditions, not defaults. The exporter must satisfy all of them.
Fifth – and this is the myth we encounter most frequently – believing that OFAC compliance is someone else's problem because the goods are controlled under the EAR. The two regimes are independent. An EAR-compliant shipment can simultaneously be an OFAC violation.
Counsel should be involved when: the classification is genuinely uncertain and the item sits at a technical boundary; the counterparty or ownership chain raises screening concerns that a database result alone does not resolve; the destination country is subject to a comprehensive or significantly targeted OFAC programme; a re-export or deemed-export scenario applies; or a potential violation has been identified and the question of voluntary disclosure arises.
The position above covers the standard case. Your facts – the item, the counterparty structure, the route, the programme in play, and the applicable non-US controls – change the analysis. For a review of your specific transaction or classification programme, contact Calder & Vance at info@caldervance.com.
Related practices
- Deemed Export and Technology Controls under BIS and the EAR – jurisdictional analysis for technology transfers to foreign nationals inside the US
- ECCN Classification under OFSI – Practitioner Guide – how UK export-control classification interacts with OFSI financial sanctions
- ECCN Classification under OFSI: Second Series – supplementary guidance on UK dual-use controls and OFSI licensing