A United Kingdom-based engineering firm secures a contract to supply specialist testing equipment to a customer in continental Europe. The compliance team asks two questions in quick succession: does this item appear on the EU dual-use list, and does OFSI have anything to say about the transaction? The two questions are related – but they are answered by different instruments, different authorities, and different legal tests.
EU dual-use classification determines whether a good, software, or technology requires an export authorisation under EU rules before it leaves an EU member state. As of May 2026, UK businesses operating post-Brexit must understand both the retained EU rules that informed UK export-control law and the live EU regime that governs their EU-based subsidiaries, customers, and supply chains. OFSI – the Office of Financial Sanctions Implementation – is the UK financial-sanctions authority; it does not administer export licences, but its prohibitions can intersect with a dual-use transaction in ways that are easy to miss.
This guide sets out the classification process step by step, explains where OFSI's reach overlaps with export-control obligations, identifies the most common risk flags, and tells you when to bring in specialist counsel.
Step 1 – Understand the governing authorities and their distinct roles
The first step is to be precise about who does what. EU dual-use classification is governed by EU rules on the control of exports and brokering of dual-use items – a Council Regulation that applies directly across EU member states and is administered nationally by each member state's competent authority. In the United Kingdom, the post-Brexit equivalent is the UK Strategic Export Licensing system, administered by the Export Control Joint Unit (ECJU) within the Department for Business and Trade. These are export-control regimes. OFSI sits in a different column entirely.
OFSI administers UK financial sanctions under the Sanctions and Anti-Money Laundering Act ("SAMLA") and the relevant thematic regulations made under it. Its prohibitions are asset-freezing and transaction-blocking measures. They apply to designated persons (individuals or entities on the UK Consolidated List) and, critically, to any entity owned or controlled by a designated person. OFSI does not issue export licences. ECJU does. But a transaction that requires an export licence may also require OFSI clearance if the end-user, the financier, or an intermediate party is subject to UK financial sanctions. Neither regime operates in isolation.
In our experience, the most damaging compliance failures arise not within a single regime but at the boundary between them. A business that obtains a valid ECJU export licence but fails to check whether the end-user is an OFSI-designated entity has not completed its compliance work. Equally, a business that confirms the end-user is not listed may still breach UK export controls if the classification is wrong or the licence type is insufficient.
Step 2 – Classify the item against the applicable control list
Classification is the process of determining whether a specific good, software, or technology falls within a control list entry and, if so, what licence requirement follows. Under the EU dual-use regime, the reference list is Annex I to the applicable Council Regulation. In the UK, the equivalent reference is the UK Strategic Export Controls: Rating List. Both lists derive from multilateral export-control arrangement schedules – the Wassenaar Arrangement, the Nuclear Suppliers Group, the Australia Group, and the Missile Technology Control Regime – and they remain closely aligned, though divergence is accumulating as each list undergoes independent review.
The classification exercise involves three layers. First, identify the item's physical, technical, and performance parameters. Second, match those parameters against the relevant category and product group in the list. Third, determine whether the parameters meet the threshold – the control parameter – stated in the entry. Items that do not meet the threshold for a listed entry are classified as EAR99-equivalent under US terminology, or as NL (not listed) in UK practice. They may still require a licence for catch-all or end-use reasons, but they are not controlled by the list entry itself.
Where does OFSI intersect at this stage? If the item is destined for, or will transit through, a jurisdiction subject to a UK sanctions regime – or if any party in the transaction is a designated person – the classification outcome determines the severity of the restriction. A listed item destined for a sanctioned end-user or an OFSI-designated entity is almost certainly prohibited outright. A non-listed item destined for the same person may still be caught by the financial-sanctions prohibition on making funds or economic resources available to a designated person. Classification narrows the question; it does not resolve it alone.
Step 3 – Apply the ownership and control test before proceeding
Before a business can confirm that its counterparty is clear of OFSI restrictions, it must work through the ownership and control test – the UK rule that extends financial-sanctions prohibitions to entities owned or controlled by designated persons, even if those entities are not themselves listed. The test under SAMLA is broader than a mechanical ownership threshold. It includes both direct and indirect ownership and a control limb that can catch entities where a designated person directs or has significant influence over the entity's decisions, regardless of ownership percentage.
This is one of the key divergences between the UK and US positions. Under OFAC's 50 percent rule (the rule treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked), the test is arithmetical. If the aggregate beneficial ownership by blocked persons reaches 50 percent or more, the entity is blocked. Below that line, OFAC's list-based prohibition does not automatically extend – though other risks remain. OFSI's control test has no fixed threshold. An entity could be majority-owned by persons who are not designated but effectively directed by one who is. That entity may still be caught.
For EU operations, the EU ownership and control analysis under the relevant Council Regulations follows a similar two-limb approach: ownership of 50 percent or more by a designated person triggers the prohibition, and a control test applies alongside it. In our cross-border practice, we regularly advise clients whose EU subsidiary and UK parent face different outcomes on the same counterparty because the control facts meet one regime's test but not another's. Verify before the transaction closes, not after it has executed.
Step 4 – Identify licence requirements and exceptions across both regimes
Having classified the item and checked the counterparty, the next step is to identify what authorisations – export licences and, if relevant, OFSI licences – are required before the transaction can lawfully proceed.
On the export-control side, the EU dual-use regime offers several licence types: a national general export authorisation (covering low-risk destinations for lower-risk items), a Union general export authorisation (a standing permission for specified items to specified destinations), and a national individual licence for case-by-case authorisations. The UK system mirrors this with open general export licences (OGELs), standard individual export licences (SIELs), and open individual export licences (OIELs). Whether a UK business exporting to an EU customer needs an ECJU licence turns on the classification of the item and the destination and end-use risk.
On the OFSI side, if any aspect of the transaction would otherwise breach a financial-sanctions prohibition – because a counterparty, financier, or intermediary is a designated person – a specific licence from OFSI may be sought. An OFSI specific licence is a case-by-case authorisation permitting a transaction that would otherwise be prohibited. OFSI will consider applications under the licensing grounds set out in the relevant thematic regulations: most commonly humanitarian grounds, legal expenses grounds, or extraordinary circumstances grounds. The application must be supported by detailed factual evidence; OFSI does not grant licences on the basis of a general assurance that the activity is legitimate.
What happens when both authorisations are needed simultaneously? A business may need to apply to ECJU for an export licence and to OFSI for a financial-sanctions licence in parallel. The two processes run independently. Obtaining one does not satisfy the other. And if OFSI refuses, the export licence – even if granted – cannot lawfully be used for the designated-person counterparty.
The position above covers the standard case. Your facts – the counterparty, the goods, the route, the regime in play – change the analysis materially. For an initial assessment, contact Calder & Vance at info@caldervance.com.
Step 5 – Address record-keeping, reporting, and the voluntary self-disclosure question
Both the EU dual-use regime and the UK OFSI regime impose record-keeping obligations. Under the EU rules, exporters must retain documentation relating to export transactions for a period that varies by member state implementation but is typically aligned with the minimum standard set in the applicable Council Regulation. In UK practice, businesses should maintain records of licence applications, classification decisions, end-user undertakings, and transaction documentation for the period required under the relevant regulations – in our experience, a minimum of five years from the transaction date is the working standard, and firms should verify the precise requirement under each applicable instrument.
Where a business identifies a past or ongoing breach – a shipment made without the required export licence, or a transaction with a person who was, at the time, a designated person – the question of voluntary self-disclosure (VSD) arises immediately. Under OFSI's enforcement approach, a VSD made promptly and with full particulars is a mitigating factor that can reduce the civil penalty that would otherwise apply. It does not guarantee a reduced outcome, but withholding disclosure when a breach has occurred and is known to the business almost always produces a worse result.
ECJU has a parallel disclosure mechanism for export-control breaches. The two should not be conflated. A breach of export-control rules is reportable to ECJU. A breach of financial-sanctions rules is reportable to OFSI. Some transactions will disclose to both. Coordinate the process carefully, because the two disclosures must be consistent, and a misalignment between them can create additional exposure.
If a transaction has already been flagged, or an internal audit has surfaced a potential breach, early counsel input preserves the options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential review.
Step 6 – Manage cross-border divergence and secondary-sanctions risk
UK businesses with US operations, US-person employees, or US-dollar transactions face an additional layer. US export-control rules under the Export Administration Regulations (the EAR), administered by BIS, impose their own classification requirements using Export Control Classification Numbers (ECCNs – the alphanumeric codes on the Commerce Control List that determine licence requirements under the EAR). An item that is not controlled under the EU or UK list may nonetheless carry an ECCN that requires a BIS licence for the intended destination. And OFAC's secondary-sanctions risk means that a transaction touching a sanctioned party can expose a non-US business if it involves US-origin goods, US-dollar clearing, or a US-person decision-maker.
In our cross-border practice, we regularly advise clients who have completed a thorough EU and UK classification and OFSI check but have not asked whether any element of the transaction triggers US jurisdiction. The question is not academic. BIS's extraterritorial reach under the de minimis and foreign-direct-product rules means that goods incorporating US-origin components above a specified threshold are subject to the EAR even when exported from outside the United States. OFAC's secondary-sanctions risk adds a further dimension: a transaction that is lawful under EU and UK rules can still carry reputational and financial exposure if it involves a party targeted by US secondary sanctions.
Japan, Singapore, and the UAE each operate their own export-control and sanctions-screening requirements. A supply chain that passes through any of these jurisdictions requires verification against the applicable country regime before the goods move. We have acted for businesses that obtained all necessary EU and UK authorisations, then encountered a hold at a transshipment point in a third country because the applicable country regime flagged the classification or the end-user. Build multi-jurisdictional checking into the transaction timetable, not as a final-stage afterthought.
Common risk flags and when to involve counsel
Several patterns recur in the matters we see. Recognising them early reduces cost and risk.
- Incomplete ownership mapping. A counterparty check that stops at the first registered entity misses the designated persons upstream. Map the full ownership chain before classifying the transaction risk.
- Classification by analogy. Applying a prior classification to a new product generation without re-classifying is a routine error. Technical parameters evolve; list entries do not automatically follow. Every new product configuration should be re-assessed.
- Assuming the EU list mirrors the UK list. Post-Brexit divergence is real and growing. An item cleared on the UK rating list may require an EU authorisation if exported from an EU subsidiary. Do not assume parity.
- Missing the control test for OFSI purposes. A counterparty with no designated-person shareholder at the first layer may still be controlled by a designated person within the meaning of SAMLA. The control analysis requires investigation, not assumption.
- Treating an OGEL as a universal clearance. An open general export licence covers specified items to specified destinations. It is not a general permission. Check that the item, the destination, and the end-use all fall within the licence's parameters before relying on it.
- Running export-control and financial-sanctions checks as separate, non-communicating processes. The two regimes intersect. Integrate them.
Is your current classification process robust enough to catch a cross-regime exposure? If you are not certain, the answer is probably no. Counsel should be involved when: a new product line is being classified for the first time; a counterparty's ownership structure is complex or opaque; a transaction involves a jurisdiction subject to a UK sanctions regime; a past transaction has been flagged internally as potentially non-compliant; or a licence application has been refused.
Related practices
- Deemed export and technology controls under the BIS / EAR – classification, deemed-export analysis, and licence applications for US-origin technology.
- EU dual-use classification guide – part 3 – advanced analysis of catch-all controls and end-use risk.
- EU dual-use classification under UN sanctions – how UN Security Council measures interact with EU and UK export-control obligations.