A technology exporter based in the European Union wins a contract to supply specialised software to a US-based integrator. The integrator's legal team asks two questions before signing: does the item require a licence under EU dual-use rules, and does OFAC's sanctions regime impose an independent constraint on the same transaction? Both questions can block the deal. Answering only one of them is not enough.
EU dual-use classification and OFAC sanctions obligations are parallel, not alternative, regimes. A business exporting dual-use goods or software from the EU must complete an EU classification analysis and screen the entire transaction against OFAC's prohibited-persons lists and country programmes. As of May 2026, failure to satisfy both can expose an exporter to administrative penalties under EU rules and, where US-origin content or US-person involvement is present, to civil or criminal liability under US law.
This guide works through the classification process step by step, identifies where the two regimes interact, and flags the points at which a matter should move from in-house compliance to specialist counsel.
Step 1: Understand what each regime controls and why both can apply
EU dual-use rules govern the export, brokering, transit, and transfer of items – goods, software, and technology – that have both civilian and potential military or proliferation applications; OFAC administers US economic sanctions that prohibit transactions involving designated persons, entities, and certain territories, regardless of where the exporter is based. These are not duplicate controls: they operate on different legal bases, apply to different triggers, and are enforced by different authorities.
The EU dual-use regime is grounded in a directly applicable Council Regulation covering the export of controlled items from EU territory. It establishes a classification list – broadly equivalent in structure to the US Commerce Control List – and requires exporters to determine whether their item appears on that list and, if so, what licence or authorisation is needed. The competent authority in each EU member state administers licensing. There is no single EU-wide licensing body.
OFAC, by contrast, is a US Treasury office that enforces economic sanctions under authorities including IEEPA. Its reach is extraterritorial. A transaction involving no US goods and no US territory can still trigger OFAC obligations if a US person – including a US-owned or US-controlled entity anywhere in the world – participates, or if the transaction uses US financial infrastructure. In our experience, this extraterritorial element surprises EU exporters most frequently when a US parent company approves a commercial contract or when US dollars clear through a US correspondent bank.
The practical consequence is that an EU-based exporter must run both analyses in parallel, not sequentially. A clean EU licence does not create an OFAC authorisation. An OFAC-cleared counterparty does not remove the EU classification obligation.
Step 2: Classify the item against the EU dual-use list
EU dual-use classification requires matching the technical parameters of the item – hardware specifications, software functions, encryption strength, controlled technology – against the entries in the EU dual-use list, which is organised into ten categories mirroring the categories used in multilateral export-control arrangements.
The process runs in three sub-steps. First, identify the category and group. The ten categories cover advanced materials and chemicals; materials processing; electronics; computers; telecommunications and information security; sensors and lasers; navigation and avionics; marine; and aerospace and propulsion. Each category is divided into groups: systems (A), test and production equipment (B), materials (C), software (D), and technology (E).
Second, check the technical parameters against the entry's control criteria. Many entries contain specific quantitative thresholds – performance levels above which the item is controlled. The exporter must assess the item's actual technical characteristics, not its marketing description. Relabelling a controlled product as a "commercial off-the-shelf" item does not alter its classification.
Third, determine whether any catch-all control applies. Even if an item does not appear on the list, EU rules impose a general prohibition on exporting an uncontrolled item where the exporter knows or has been informed by the competent authority that the item is or may be intended for weapons-of-mass-destruction-related end-uses. This catch-all operates independently of the list. We regularly advise exporters who have cleared the list check but overlooked the catch-all, particularly in life-sciences and advanced-materials supply chains.
At the end of this step, the exporter holds one of three outcomes: the item is listed and requires a licence; the item is unlisted but catch-all controls may apply; or the item is unlisted and no EU dual-use control applies. Each outcome leads to a different pathway.
Step 3: Determine the applicable EU authorisation
Where an EU dual-use licence is required, the authorisation route depends on the destination country, the item category, and the end-use. EU rules provide for several authorisation types, and selecting the correct one affects both the timeline and the compliance obligations that follow.
EU General Export Authorisations (standing authorisations covering defined categories of items to defined low-risk destinations) are the fastest route where they are available. They do not require a licence application but carry registration and record-keeping obligations that exporters frequently underestimate. Using a general authorisation for a destination or item it does not cover is a breach, not a shortcut.
Where a general authorisation does not cover the transaction, the exporter applies for an individual licence (a case-by-case authorisation for a specific item, quantity, end-user, and end-use) from the competent authority of the member state from which the item is exported. Processing timelines vary by member state and by item sensitivity. For items in the higher categories – particularly encryption, sensors, and aerospace propulsion technology – the process commonly takes a number of weeks and may involve consultation at the multilateral level.
Global licences are available in some member states for established exporters with repeat transactions to the same end-users. They reduce administrative burden for ongoing supply relationships but require a demonstrably effective internal compliance programme, including end-use monitoring, as a condition of issue.
Record-keeping obligations attach to all authorisation types. Exporters must retain export documentation, end-user undertakings, and related correspondence for the period required by the applicable national rules implementing the Council Regulation, which is commonly a minimum of several years. Verify the current requirement in the relevant member state before relying on any period stated here.
Step 4: Screen the transaction against OFAC – the cross-regime intersection
Once the EU classification analysis is complete, the OFAC screen must be run against every party in the transaction chain, including the buyer, the end-user, the freight forwarder, any intermediate distributor, and the financial institutions facilitating payment. A party may be unlisted on EU restrictive-measures lists but appear on OFAC's SDN List (OFAC's list of Specially Designated Nationals and blocked persons), and vice versa. The lists are not identical.
OFAC's ownership test – the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked, even if not individually listed) – means that a counterparty's clean appearance on public databases does not end the analysis. The exporter must look through the ownership chain to determine whether any blocked person holds, directly or indirectly, 50 percent or more of the counterparty.
EU restrictive measures apply a different test. Under EU Council regulations, the prohibition extends to entities owned or controlled by a listed person. Ownership and control (the EU and UK test for capturing a non-listed entity through a listed person's influence) encompasses both direct majority ownership and indirect control through governance, financing, or decision-making. The EU test therefore has a broader qualitative dimension than OFAC's purely quantitative 50 percent threshold. An entity that falls below the OFAC threshold may still be caught under EU rules if a listed person exercises effective control.
Does this difference matter for an EU exporter? It does. An exporter relying solely on an OFAC-compatible ownership analysis may underestimate its EU exposure on the same counterparty. Running both tests, using a consistent methodology, and documenting the conclusion is the only defensible approach.
Where the exporter or any transaction participant is a US person – or where the goods incorporate US-origin content above the applicable de minimis threshold (the percentage of US-controlled content above which US re-export rules apply to a foreign-made item) – OFAC's jurisdiction is engaged independently of the EU analysis. In our practice, the most common triggers for OFAC exposure in EU dual-use transactions are: a US ultimate parent approving the contract; US-dollar payment routing through a US correspondent bank; or US-origin software or technology embedded in an otherwise EU-manufactured product.
Step 5: Assess end-use controls and post-shipment obligations
Both the EU regime and OFAC impose obligations that survive the moment of export. End-use controls are the most operationally demanding of these.
Under EU rules, the exporter is responsible for ensuring that the item reaches the stated end-user and is used for the declared purpose. Where the competent authority has required an end-user undertaking as a condition of licence, the exporter must obtain it before shipment and retain it for the required period. Post-shipment verification visits are available in some member states and are becoming more common in higher-risk categories.
Under OFAC, the prohibition on facilitating a transaction by a blocked person extends to conduct that occurs after the initial export. A technology exporter that continues to provide maintenance, software updates, or technical support to an end-user who is subsequently designated must stop the supply immediately upon designation. Continued performance after a designation is itself a sanctionable act. The designation date – not the date the exporter discovers it – is the legally relevant moment.
This creates a monitoring obligation. Exporters with long-term supply agreements must screen counterparties and end-users not only at contract inception but throughout the life of the agreement, at a frequency consistent with the risk profile of the end-user and the end-use. In our experience, many exporters screen at onboarding and then rely on alert systems that generate a high rate of false positives, creating alert fatigue and, paradoxically, a greater likelihood of missing a genuine designation.
Step 6: Identify risk flags and decide when to involve counsel
Certain patterns consistently generate heightened dual-use and sanctions risk and should prompt immediate specialist review rather than resolution at the compliance-operations level.
The first pattern is diversion risk – indicators that the stated end-user is not the actual recipient. These include a buyer whose stated business is inconsistent with the item's technical complexity, a request to ship to an intermediate third country with no obvious commercial rationale, or a customer that is reluctant to provide end-user documentation. Diversion is the primary enforcement concern of both EU competent authorities and OFAC in dual-use export matters.
The second pattern is US-person involvement in a transaction that the EU analysis suggests is low-risk. An EU exporter that dismisses OFAC analysis because the transaction appears EU-domestic, but which has a US parent, a US co-investor, or a US technology partner, may expose the entire group to OFAC liability. The US parent's knowledge of the transaction may be sufficient to constitute facilitation.
Third, encryption and information-security items require particular care. Both the EU list and the US Commerce Control List contain detailed, technically complex entries for encryption products. The parameters that determine whether an encryption item is controlled are granular. Classification errors in this category are common and, given the prevalence of encryption in software products, the volume of potentially mis-classified items in the market is significant.
Fourth, transfers of technology and software – as distinct from shipments of physical goods – are frequently overlooked. EU dual-use controls extend to the transfer of controlled technology by electronic means, including email attachments, cloud access, and remote technical assistance. A demonstration of a controlled technology to a non-EU national at a trade fair may constitute a controlled export. OFAC's parallel concept of a deemed export (treating the release of controlled technology to a foreign national within the United States as an export to that person's country of citizenship) operates in a similar but distinct space; see our analysis on deemed exports and BIS/EAR compliance.
A myth worth addressing: many EU exporters believe that because their item is mass-market or widely available commercially, it cannot be controlled. The EU dual-use list does contain exceptions for mass-market goods, but those exceptions are technically defined and have precise criteria. Commercial availability does not equal non-controlled status. We have acted for businesses that applied the commercial-availability assumption incorrectly and found themselves with an unlicensed export in a category that carries significant administrative penalties.
How Calder & Vance advises on EU dual-use classification and OFAC compliance
Our practice handles the full sequence of dual-use and sanctions work that an EU exporter faces in a cross-border transaction: classification analysis, authorisation strategy, OFAC counterparty screening, ownership-chain mapping, and post-shipment monitoring design.
We classify items against both the EU dual-use list and the US Commerce Control List where US-origin content is present or where a US person is involved. We advise on the interaction between EU general authorisations and OFAC general licences, identifying where a transaction can proceed under an existing authorisation and where a specific application is required.
In a recent matter, a mid-sized European electronics manufacturer had been shipping a sensor product under an EU general authorisation for several years. A review of the technical parameters against an updated list entry revealed that the product no longer met the criteria for the general authorisation following a revision to the control thresholds. We identified the gap, advised on the correct individual licence route, and assisted with the application to the relevant competent authority. The matter was resolved without enforcement action. This kind of periodic classification review is part of a sound compliance programme, not a one-time exercise.
Where a transaction has already proceeded and a potential classification error or OFAC breach has been identified, we advise on VSD (voluntary self-disclosure to the relevant regulator), scope the apparent violation, and prepare the disclosure or penalty response. Early action consistently preserves more options than delayed response.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential assessment.
Related practices
- Deemed export and BIS/EAR compliance – US export control classification and technology-transfer analysis for dual-use items
- EU dual-use classification under OFSI – how UK financial sanctions interact with EU export-control obligations
- EU dual-use and OFSI: advanced considerations – deeper analysis of licensing, ownership tests, and enforcement posture