A technology exporter in Germany receives a purchase order from a distributor in Singapore. The goods are dual-use. The in-house compliance officer asks a straightforward question: what is the Export Control Classification Number (ECCN – the alphanumeric code on the US Commerce Control List that determines which export-licence requirements, if any, apply to an item under the Export Administration Regulations) for this product? The answer shapes whether a licence is required, which end-use controls must be imposed, and whether OFAC's own sanctions overlay triggers additional prohibitions entirely independent of the BIS licensing question. Getting the classification wrong does not merely delay the shipment. It can expose the exporter, the distributor, and every intermediary to significant civil and criminal liability under US law – even if not one of them is a US person.
As of April 2026, ECCN classification is a BIS/EAR function, not an OFAC function – yet OFAC sanctions operate in parallel and can prohibit a transaction that BIS has licensed. Correct classification requires working through the Commerce Control List, determining whether the item is subject to the EAR, identifying the applicable reasons for control, and then overlaying any OFAC embargo or designation that independently bars the transaction regardless of classification. Misunderstanding which authority governs which question is itself the most consequential error practitioners encounter.
This guide walks through each step of the ECCN classification procedure, identifies where businesses most often go wrong, explains how OFAC's role differs from BIS, and sets out when independent counsel should be engaged.
Step 1: Understand which authority governs – and why OFAC is not the classifier
ECCN classification sits with the US Department of Commerce, Bureau of Industry and Security, under the Export Administration Regulations (EAR) – the principal US instrument governing dual-use export controls – not with OFAC. OFAC administers economic and trade sanctions under authorities including IEEPA and TWEA, maintaining the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) and a set of country-programme regulations. These two regimes are legally distinct, administered by different agencies, and triggered by different facts.
Why does the confusion arise? Because both regimes can prohibit the same transaction. A shipment to a particular destination may require a BIS export licence because of the item's ECCN. It may simultaneously be prohibited by OFAC because the consignee appears on the SDN List, or because the destination is subject to a comprehensive OFAC embargo. In that case, obtaining a BIS licence does not cure the OFAC bar. The correct sequence is therefore to classify first (BIS/EAR), then to run the full OFAC screening as a separate, sequential step.
In our cross-border practice, the single most common structural error is treating "cleared by export control" and "cleared by OFAC" as the same question. They are not. A BIS licence authorises the export under the EAR. It does not authorise a transaction that is independently prohibited by OFAC. Practitioners who conflate the two expose their clients to enforcement risk from either agency – or both simultaneously.
Step 2: Determine whether the item is subject to the EAR at all
Before assigning an ECCN, the threshold question is whether the item is subject to the EAR. Not all US-origin items are. Items on the US Munitions List (administered by DDTC under ITAR) are outside the EAR. Items that are entirely foreign-origin and have no US content, US technology, or US software may not be "subject to the EAR" at all, though the de minimis rule and the foreign direct-product rule (FDP rule) can reattach EAR jurisdiction to foreign-made items in circumstances that are not always intuitive.
The FDP rule is particularly significant for technology and semiconductor exporters. Under the EAR, a foreign-made item can become subject to US export-control jurisdiction if it is the direct product of certain US-origin technology or software, or if it is produced by a plant or major component of a plant that is itself such a product. The scope of this rule has been expanded in recent years. Any business that designs, manufactures, or sources from a supply chain with US technology inputs should test the FDP question before concluding the item is outside the EAR entirely.
If the item is subject to the EAR and is not on the Commerce Control List, it is classified as EAR99 (a catch-all designation for items subject to the EAR but not specifically listed on the CCL). EAR99 items are not licence-free in all circumstances. They still require a licence if the end-use, end-user, or destination triggers a separate control – and they remain subject to OFAC's parallel prohibitions regardless of classification.
Step 3: Work through the Commerce Control List classification procedure
The Commerce Control List (CCL) organises items into ten categories (from basic materials through electronics, telecommunications, sensors, lasers, navigation, marine, aerospace, propulsion, and miscellaneous) and five product groups within each category. The correct approach is systematic: identify the category and group that fits the item's primary characteristics, read the entry carefully, and test against the control parameters.
Several practical steps belong in every classification exercise.
- Read the entire entry, not only the headline description. Technical parameters, notes, and exclusions within an ECCN entry can place an item outside a listing that, at first glance, appears to cover it.
- Check the "Related Controls" notation. Some entries cross-reference USML categories, ITAR controls, or Nuclear Regulatory Commission jurisdiction. A cross-reference may mean the item is not subject to the EAR at all.
- Identify all applicable reasons for control. A single ECCN can carry multiple reasons – national security, anti-terrorism, nuclear non-proliferation, regional stability, crime control, missile technology. Each reason generates a different set of licence requirements for different destinations.
- Consult the Commerce Country Chart. Once you have the ECCN and the reasons for control, the Country Chart determines whether a licence is required for the specific destination. The analysis is destination-specific and reason-specific.
- Check for licence exceptions. Even where a licence requirement exists, an applicable licence exception under the EAR may authorise the export without a formal application. Eligibility is item-, transaction-, and destination-specific.
Self-classification is legally permissible and common for straightforward commercial items. For items at or near the technical parameters of a listing – so-called "borderline" items – the risk of misclassification increases significantly. Commodity Classification requests (formal classification requests submitted to BIS) are available where certainty is required. We regularly advise exporters on when self-classification is defensible and when a formal request is the more prudent course.
Step 4: Run the OFAC overlay – the parallel screen that BIS cannot address
OFAC's screening obligation runs parallel to, and independently of, the BIS classification exercise. Once the ECCN is determined and the BIS licence position is resolved, the exporter must confirm that neither the transaction nor any party to it is prohibited under OFAC's regime.
The core OFAC questions at this stage are:
- Is any party to the transaction – exporter, buyer, end-user, financial intermediary, freight forwarder – on the SDN List or any other OFAC list?
- Does the destination fall within a comprehensive OFAC embargo? Some country programmes bar virtually all transactions with the target country, irrespective of the item's ECCN or whether a BIS licence is available.
- Does the transaction involve a non-listed entity that is nonetheless blocked under the 50 percent rule (OFAC's rule treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked, whether or not listed)?
- Does the transaction involve a sectoral sanction (a targeted prohibition covering specific sectors, transaction types, or financial instruments, rather than a blanket country embargo) under any of OFAC's active directive programmes?
A BIS export licence does not override an OFAC prohibition. Equally, an OFAC specific licence (a case-by-case authorisation to conduct an otherwise prohibited transaction) does not satisfy the BIS licensing requirement if one independently applies. The two agencies operate separate licensing regimes, and a transaction that requires both authorisations must obtain both. This point appears elementary, but in our practice it is regularly missed in time-pressured deal processes.
Step 5: How does the cross-border picture change – UK, EU, and Singapore perspectives
ECCN classification is a US construct. But businesses operating across jurisdictions cannot stop at the US analysis. The UK, EU, and a growing number of third countries maintain their own dual-use export-control regimes, and the same physical item will carry a different classification – and different licence obligations – under each.
Under the EU dual-use rules, items are classified against the EU's own control list, which broadly mirrors the Wassenaar Arrangement and other multilateral export-control regimes but is not identical to the CCL. The EU Blocking Regulation also creates tension for EU-resident exporters: compliance with certain extraterritorial US measures can, in defined circumstances, conflict with obligations under EU law. In our experience, EU-based exporters of US-origin or US-technology-content goods must manage both sets of obligations simultaneously and take advice on how to handle genuine conflicts.
The UK retained its own dual-use list and control architecture after Brexit. ECJU (the Export Control Joint Unit) administers UK export licensing, and the UK Strategic Export Control Lists differ from the EU list in certain respects. Exporters shipping from the UK to a third country need to classify under the UK regime independently, even where the same goods were previously classified under EU rules.
Singapore's Strategic Goods Control regime, administered by Singapore Customs, covers a defined list of strategic goods and technology. A re-export or transshipment through Singapore of US-origin goods subject to the EAR must comply with both the US regime (including any applicable BIS licence conditions and OFAC restrictions) and Singapore's own controls. The interplay between BIS end-use conditions and Singapore's permit requirements is a recurring issue for supply chains that use Singapore as a distribution hub. We advise trading companies and freight forwarders on precisely this intersection.
Step 6: Common pitfalls and risk flags in the classification process
Classification errors cluster around a predictable set of failure modes. Knowing them is the starting point for reducing exposure.
Relying on a supplier's ECCN without independent verification. A supplier's classification may be outdated, may reflect different technical specifications, or may simply be wrong. Importers and distributors who rely uncritically on a supplier-supplied ECCN inherit the classification risk. The EAR places classification responsibility on the exporter, not on the upstream supplier.
Failing to re-classify after product changes. Engineering changes to hardware, firmware, or software can alter the technical parameters that determine classification. A product that was correctly classified as EAR99 three years ago may today fall within an ECCN if its performance has been enhanced. Classification records should be reviewed when products are updated, not only at initial launch.
Ignoring software and technology controls. Physical goods attract the most attention in classification exercises, but the EAR controls exported software and technology – including intangible technology transfers by email, cloud access, and training. A deemed export (the release of controlled technology to a foreign national within the United States, which is treated as an export to that person's country of nationality) can require a BIS licence even where no physical item leaves the US. Businesses that share technical data with foreign nationals without a deemed-export analysis face significant exposure.
Applying the wrong version of the CCL. The CCL is updated periodically. Firms that maintain static internal classification databases without a live update mechanism will eventually apply superseded parameters. Classification exercises should reference the current version of the CCL as published by BIS.
Treating licence exceptions as automatic entitlements. Licence exceptions have eligibility conditions that must be met for each specific transaction. They are not blanket permissions. A firm that applies a licence exception without confirming eligibility – for the specific item, the specific destination, the specific end-user, and the specific end-use – has not lawfully avoided the licence requirement; it has created an unrecorded apparent violation.
Does your internal classification process include a periodic re-classification trigger tied to product development milestones? In our experience, the absence of that trigger is the most frequent source of stale-classification exposure.
Step 7: When to involve counsel and what a classification review covers
Self-classification is appropriate for straightforward commercial items with clear, undisputed CCL entries. It is not appropriate – or at least not sufficient without expert input – in a number of situations that we encounter regularly.
Counsel should be involved when: the item sits at or near a technical parameter threshold in a CCL entry; the supply chain includes US-origin technology or software that may trigger the FDP rule; the product has been recently upgraded and prior classification may no longer hold; the intended destination or end-user sits in a jurisdiction with an active OFAC programme; the transaction involves a party whose ownership structure is complex and the 50 percent rule analysis is non-trivial; or BIS has previously raised questions about the exporter's classification practices.
In a recent matter, a mid-sized electronics manufacturer in the UK had been exporting a line of components classified internally as EAR99 for several years. A product refresh pushed the performance specification across a CCL technical threshold. We conducted a full re-classification review, identified the applicable ECCN and reasons for control, confirmed the licence requirements for the distributor's intended destinations, and structured an end-use-certification programme for the ongoing relationship. The matter also required a review of the UK Strategic Goods Control List and a comparison of the two classification outcomes, which differed for one destination. No enforcement action arose; the risk was identified and remediated before any transaction was completed.
What does a classification review actually produce? At minimum: a written classification opinion recording the methodology, the technical parameters reviewed, the applicable CCL entries, the reasons for control, the BIS licence and licence-exception position for each intended destination, and the OFAC overlay analysis for each intended party and destination. That record is also the evidence base for any voluntary self-disclosure (VSD – voluntary self-disclosure to a regulator) if a prior classification error is discovered.
For exporters who have identified a past classification error and need to assess whether and how to disclose, our enforcement team can scope the apparent violation, advise on the VSD process under both BIS and OFAC, and prepare the submission. Early involvement preserves options that narrow significantly once enforcement attention has begun.
Related practices
- Deemed Export and Technology Controls – BIS/EAR deemed-export licensing, technology classification, and end-use controls for foreign-national access
- ECCN Classification: Advanced Issues – deeper analysis of borderline items, FDP rule application, and multi-jurisdiction classification conflicts
- ECCN Classification in M&A Due Diligence – classification risk in target assessments, legacy-violation exposure, and post-closing remediation