A technology company closes a software licensing deal. Its legal team screens the buyer and finds no SDN matches. The product ships. Three months later, the compliance officer realises the software included a strong-encryption module and asks a simple question: did we need an export licence first? The answer depends on two separate bodies of rules that most businesses treat as one.
Encryption export controls in the United States sit primarily under the Export Administration Regulations (the EAR, administered by the Bureau of Industry and Security, or BIS), but OFAC sanctions (the Office of Foreign Assets Control) run in parallel and can prohibit a transaction that BIS would otherwise permit. As of April 2026, both regimes must be satisfied before any encryption product is transferred to a foreign person or destination. A licence or exception under the EAR does not override an OFAC prohibition, and vice versa.
This guide walks through the compliance sequence step by step: classification, the EAR exception and licence analysis, the OFAC sanctions screen, the interaction between the two regimes, the principal risk flags, and when to engage specialist counsel. It also compares the US position with the parallel UK and EU controls, because most encryption exporters operate across more than one jurisdiction.
Step 1 – Classify the encryption item under the Commerce Control List
The first step is determining whether your encryption product, component, or technology falls within the scope of the Commerce Control List (CCL) and, if so, which Export Control Classification Number (ECCN) applies. An ECCN is the alphanumeric code on the CCL that identifies the item and the reasons for control. Encryption items generally sit within a specific category of the CCL that covers information-security products; the classification turns on the algorithm, key length, and the function of the item.
A product that is not on the CCL – an EAR99 item – is not subject to BIS licence requirements for most destinations, but it is still subject to OFAC sanctions. This distinction matters. Many technology businesses assume that a low-sensitivity item escapes all controls. It does not: the OFAC prohibition layer applies regardless of CCL classification.
In our experience, the classification step is where errors accumulate. Businesses often rely on a supplier's classification without independently verifying it, or they apply a single ECCN to a product suite that contains encryption modules of differing specifications. A mis-classification feeds incorrect conclusions at every downstream step. The prudent approach is to document the classification rationale, including the algorithm type, key length, and any mass-market features that might affect the analysis under the applicable EAR provisions.
Step 2 – Determine whether a BIS licence exception applies
Once the ECCN is confirmed, the analysis turns to whether the proposed transfer is covered by one of the BIS licence exceptions for encryption items. The EAR provides several exceptions specifically designed for encryption products, covering categories such as mass-market software, technology released for public review, and items transferred to subsidiaries or employees of the exporter. Each exception has its own eligibility criteria, end-use conditions, and – in some cases – reporting obligations.
The key questions are: Who is the recipient? What is the end use? Is the destination a country subject to US arms embargo or a country-level sanctions programme? The answers determine which exceptions remain available.
Some exceptions require a one-time review submission to BIS before first use. Others apply without prior authorisation but still require the exporter to retain records. Regardless of which exception is claimed, the exporter must keep documentation for five years from the date of the export, re-export, or transfer. That record-keeping obligation is not optional; it is the evidentiary foundation for any enforcement defence.
Where no exception covers the transaction, a BIS licence application is required. The timeline for a licence decision varies; in our cross-border practice, businesses often underestimate the lead time and commit to delivery deadlines before the licence is in hand. That sequencing error creates pressure to ship without authorisation.
Step 3 – Run the OFAC sanctions screen
OFAC's prohibitions operate independently of BIS. Even where the EAR permits the export – under a licence exception or a specific licence – a transaction that involves a blocked person, a sanctioned entity, or a comprehensively sanctioned jurisdiction remains prohibited under OFAC unless OFAC itself has authorised it.
The screening obligation has three components. First, screen the end-user and all intermediaries against the SDN List (OFAC's list of Specially Designated Nationals and Blocked Persons) and the other OFAC consolidated lists. Second, check whether the destination country is subject to a comprehensive sanctions programme. Third, apply the 50 percent rule (OFAC's rule treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked, even if not separately named on the SDN List). Ownership that is layered through holding structures does not change the analysis: OFAC's guidance is explicit that indirect ownership aggregates.
The SDN List is updated without advance notice. A counterparty who passed screening last quarter may now be listed. We regularly advise clients to build automated, triggered re-screening into their order management systems rather than relying on point-in-time checks at contract stage only.
The position above covers the standard case. Your facts – the counterparty's ownership chain, the jurisdiction, the encryption specification, and the route of transfer – change the analysis in ways that a generic screening tool cannot fully resolve.
For an initial assessment of your exposure under the EAR and OFAC, contact Calder & Vance at info@caldervance.com.
Step 4 – Apply the stricter prohibition where regimes diverge
Where more than one regime applies to a transaction, the strictest applicable prohibition governs. This principle sits at the heart of multi-regime compliance and is frequently misunderstood. A BIS licence does not authorise a transaction that OFAC prohibits. An OFAC general licence does not authorise an export that BIS requires a specific licence for. The regimes stack; they do not substitute for one another.
The cross-border dimension adds further layers. A UK exporter transferring encryption technology to a US parent, or a US company re-exporting to a third-country affiliate, may find that the UK Export Control Order (administered by ECJU, the Export Control Joint Unit) and OFSI financial-sanctions rules also apply. The EU dual-use regulation captures exports from EU member states; the EU has its own encryption classification criteria, which do not map precisely onto the US CCL. The result is that a product cleared under one regime may require separate authorisation under another.
In practice, the divergence most often bites in three places. First, the licensing exception categories differ: an item covered by a US mass-market exception may still require individual authorisation under the applicable EU or UK rules. Second, the end-user verification requirements differ in depth and documentation standard. Third, the post-shipment reporting obligations are not harmonised. A business that designs its compliance programme around US requirements only will have gaps when it ships from a European entity or through a European intermediary.
Have you mapped which regime governs each leg of your supply chain, or only the originating shipment?
Step 5 – Identify and manage the principal risk flags
Certain patterns in encryption export transactions generate elevated risk and warrant heightened due diligence before shipment. Recognising them early determines whether a compliance issue is resolved before a transaction closes or after a regulator has opened an inquiry.
The risk flags most commonly encountered in our practice include the following:
- End-user uncertainty: where the stated end-user is a trading company, a distributor, or an intermediary without a clear disclosed end-use, the exporter lacks the information to complete the destination and end-use analysis. A licence exception or licence itself will not protect against a subsequently discovered prohibited end-use if the exporter failed to make reasonable enquiries.
- Jurisdiction mismatches: where the shipping address, the billing address, and the ultimate destination differ, the relevant jurisdiction for sanctions analysis is the ultimate destination and the nationality of the end-user, not the billing country. Relying on the billing address alone is a common error that creates gaps in the OFAC analysis.
- Ownership opacity: where the counterparty's ultimate beneficial ownership is unclear or where a corporate structure uses multiple holding layers across jurisdictions, the 50 percent rule analysis cannot be completed without ownership data. Proceeding without that data is not a defensible position.
- Re-export risk: encryption technology that is exported legitimately to a first recipient can be re-exported to a third-country destination that would not have been licensable directly. The EAR imposes re-export controls; US-origin encryption items carry those controls to every subsequent destination, not just the first. This is the extraterritorial reach of the EAR, and it affects foreign companies that receive US-origin encryption products.
- Technology transfers without physical shipment: a deemed export (the release of controlled technology to a foreign national in the United States) is treated as an export to the person's country of nationality for EAR purposes. Encryption technology shared in a code review, a training session, or an employment context with a foreign national may constitute a controlled transfer requiring authorisation.
If a transaction has already been flagged, or a filing has been refused, an early legal review can preserve options that narrow as time passes. Contact Calder & Vance at info@caldervance.com for a confidential review.
Step 6 – Address a potential violation: the VSD decision
When a business discovers a possible violation – a shipment made without the required BIS authorisation, a transaction that may have involved a sanctioned party, or a deemed export that was not identified in time – the immediate question is whether to make a voluntary self-disclosure (VSD) to the relevant authority. A VSD is a proactive report to the regulator disclosing the potential violation before the regulator identifies it independently.
OFAC treats a VSD as a significant mitigating factor in penalty calculations. The mitigating weight of a VSD is greater when it is timely, complete, and accompanied by a credible remediation plan. BIS has a parallel VSD programme; the two agencies handle their respective VSD processes separately, meaning a business may need to file disclosures with both if the violation implicates both the EAR and OFAC sanctions rules. Filing with one does not substitute for filing with the other.
The decision whether to file a VSD is a legal judgment, not an administrative step. The scope of the disclosure, the framing of the facts, and the sequence of the remediation all affect the outcome. We have acted for businesses at this stage and the approach taken in the first days after discovery has material consequences for how the matter resolves. Early specialist advice is not a precaution; it is a factor in the result.
The myth we encounter regularly is that a small or inadvertent violation does not warrant formal disclosure. In fact, OFAC's civil penalty scheme applies to both wilful and non-wilful violations. The mitigating factors available – including VSD, compliance programme quality, and the nature of the transaction – are assessed differently depending on the characterisation of the conduct. An undisclosed violation that is later discovered independently carries a worse penalty profile than one that the company surfaced and reported itself.
How does the UK and EU position compare?
UK encryption export controls are administered by ECJU under the Export Control Order, which implements the UK's dual-use regulation. Following the UK's departure from the EU single market, the UK maintains its own dual-use controls list, which tracks the former EU list closely but has diverged on some classification criteria since then. OFSI administers UK financial sanctions in parallel; like OFAC, OFSI prohibitions apply independently of any ECJU licensing position.
The EU dual-use regulation applies to exports from EU member states. EU encryption classification criteria are broadly aligned with the former UK and with international Wassenaar Arrangement standards, but the specific control parameters, the exceptions available, and the national licensing authorities differ across member states. There is no single EU-wide encryption export licence; businesses apply to the competent authority in the member state from which they are exporting.
One practical difference is the treatment of general trade authorisations under the EU regime for certain low-risk encryption exports to a defined set of destinations. These standing authorisations allow exporters to proceed without an individual licence application, subject to registration and reporting requirements. The scope of these authorisations does not map precisely onto the US mass-market exception, and exporters should not assume that a product covered by one is automatically covered by the other.
Where does this leave a business exporting encryption products from the US, the UK, and an EU member state simultaneously? It means three separate classification analyses, three sets of licensing-exception criteria, and three parallel sanctions screens – OFAC, OFSI, and the EU Council-regulation prohibitions. Each screen uses its own list and its own ownership-and-control test. The intersection of all three is not routinely addressed by standard compliance tools, and it is precisely where specialist cross-regime counsel adds value.
Related practices
- Deemed export and technology controls under the EAR – BIS classification, deemed-export analysis, and end-use programme design for US-origin technology
- Encryption export controls under OFAC: advanced scenarios – extraterritorial reach, re-export analysis, and multi-party transaction structures
- Encryption export controls under OFSI – UK licensing, OFSI financial-sanctions interaction, and post-Brexit divergence