A technology company based in the European Union receives a purchase order from a distributor in a third country. The goods are commercial electronics with potential dual-use applications. The compliance team asks a straightforward-sounding question: does this shipment need a US export licence? The answer is rarely obvious. It depends on the item's classification, the destination, the end-user, and the end-use – and getting it wrong can result in a significant civil penalty or a criminal referral.
Export-licence determinations under the Export Administration Regulations (the EAR, administered by the Bureau of Industry and Security – BIS) follow a structured five-step sequence: classify the item, identify the destination and party controls, check applicable licence exceptions, assess end-use and end-user restrictions, and submit the licence application if no exception covers the transaction. As of May 2026, BIS administers one of the most actively enforced export-control regimes in the world, with extraterritorial reach that extends to non-US companies re-exporting US-origin goods or technology.
This guide walks through each step of that determination sequence, flags where businesses most commonly go wrong, and explains where the US regime diverges from its UK and EU counterparts – information that matters to any cross-border operator.
Step 1 – Classify the item: assigning the correct ECCN
The starting point for every export-licence determination is the Export Control Classification Number (ECCN) – a five-character alphanumeric code on the Commerce Control List (CCL) that identifies the item, its control reason, and, by cross-reference, whether a licence is required for a particular destination. Classification is the single decision that drives every subsequent step.
Each ECCN is structured around ten categories (from nuclear materials through electronics, telecommunications, sensors, navigation, aerospace, propulsion, and into catch-all categories) and five product groups within each category. The classification is not a formality. It determines which licence requirements apply, which licence exceptions are available, and which inter-agency review process a licence application will follow.
Where a product does not appear on the CCL at all, it falls under the catch-all designation EAR99. EAR99 items are generally exportable without a licence to most destinations, but they are not licence-free in every case. Exports to embargoed countries, to parties on BIS's Entity List or Denied Persons List, or for prohibited end-uses remain controlled even for EAR99 items.
In our experience, misclassification is the most common source of export-control violations. A business that self-classifies a product without reviewing BIS's technical parameters in detail – or that carries forward a classification from a previous product generation without re-testing it – creates an exposure that may not surface until a BIS audit or a customs query. If there is genuine uncertainty about the correct ECCN, the correct route is a binding Classification Request to BIS, which produces a formal written determination. That determination provides a record that can significantly affect the penalty analysis in an enforcement context.
The position under the EU's dual-use rules and under the UK's Export Control Order differs structurally. Both regimes use their own control lists, though these lists are largely harmonised with the international Wassenaar Arrangement, the Nuclear Suppliers Group, and the Australia Group schedules. A classification reached under the EAR may or may not correspond to an equivalent control entry in the EU or UK lists, and a licence exception available under the EAR may have no equivalent under the applicable country regime. Businesses operating across all three jurisdictions must run three separate classification exercises. That step is frequently skipped, and the consequences can be significant.
Step 2 – Identify the destination: the Country Chart and embargo controls
Once the ECCN is established, the next step is to cross-reference it against BIS's Country Chart to identify whether a licence is required for the specific destination. The Country Chart assigns reason-for-control columns to each country. An ECCN carries one or more control reasons; if that reason appears in the column for the destination country, a licence is required unless an exception applies.
For a small number of destinations subject to comprehensive or near-comprehensive US sanctions, BIS's controls operate alongside – and are reinforced by – OFAC's economic-sanctions prohibitions. The distinction matters in practice. BIS governs the transfer of items and technology through the EAR. OFAC governs financial transactions and dealings with designated parties under IEEPA and other statutes. A transaction to a heavily sanctioned destination is likely to trigger both regimes simultaneously, and compliance with one does not produce compliance with the other. In our practice, businesses frequently focus on the BIS licence question and overlook the OFAC dimension entirely – or vice versa – and that gap is where enforcement cases begin.
Comprehensive controls apply to specific country programmes administered by OFAC. These are separate from, and in addition to, BIS's country-based licence requirements under the EAR. Where both apply, the stricter prohibition governs. This principle – applicable across the major export-control and sanctions regimes – means that a BIS licence does not authorise what OFAC prohibits, and an OFAC licence does not authorise what BIS independently controls.
Step 3 – Screen the parties: Entity List, Denied Persons, and the 50 percent rule
Party screening sits at the intersection of export controls and sanctions compliance, and it is the step where the analysis most often reveals a problem that re-classifying or re-routing cannot solve. BIS maintains several restricted-party lists; the Entity List and the Denied Persons List are the most consequential.
The Entity List names foreign persons, companies, research institutions, and government entities against which specific licence requirements apply – requirements that in many cases permit no licence exception. An entity on the List with a presumption-of-denial review policy cannot receive controlled items under most circumstances. BIS adds entities to the List on national-security grounds through an inter-agency review process; the list changes frequently, and screening needs to be conducted close to the date of export, not only at contract signing.
The Denied Persons List records individuals and companies whose export privileges have been revoked by BIS through an enforcement order. Exports, re-exports, and in-country transfers to denied persons are prohibited regardless of the item's ECCN or the destination.
Alongside the BIS lists, the transaction must be screened against OFAC's Specially Designated Nationals and Blocked Persons List (SDN List) and the other OFAC consolidated lists. The 50 percent rule – OFAC's rule treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked – applies even where the counterparty does not itself appear on any list. Many screening tools match against listed names only. They miss the ownership-aggregation risk that the 50 percent rule creates.
For UK-nexus transactions, OFSI applies an ownership and control test (the test for whether a non-listed entity is caught through a listed person's control) that goes beyond the mechanical 50 percent threshold. The EU applies a comparable test under the relevant Council regulations. A shipment that clears OFAC screening may still be caught under OFSI or EU controls if a listed person controls the end-user without holding a majority ownership stake. In our experience, businesses in the EU running US-origin goods through their own logistics chains frequently perform the BIS and OFAC screening but omit the OFSI and EU control tests – and the gap can be material where a UK or EU financial institution sits in the payment chain.
Step 4 – Evaluate licence exceptions: where the EAR provides standing authorisations
The EAR provides a set of licence exceptions (standing authorisations permitting defined categories of exports without a separate application) that can eliminate the licence requirement where all conditions are met. The applicable exceptions vary by ECCN, by country group, by end-user type, and by the nature of the transaction.
Common exceptions relevant to commercial and technology exporters include exceptions for low-value shipments, for items to governments and international organisations in certain circumstances, for technology transferred within affiliated groups under controlled conditions, and for certain encryption items. Each exception carries specific eligibility conditions. A single failure to meet any one condition makes the exception unavailable, and an exporter that has proceeded on the basis of an exception it does not qualify for has made an unlicensed export.
The documentation obligation that attaches to exception use is a practical trap. The EAR requires that an exporter be able to demonstrate, on review, that the conditions of the exception were satisfied at the time of export. That means contemporaneous records: end-user statements, classification documentation, value calculations where relevant, and a record of the screening results. Record-keeping obligations under the EAR extend to five years from the date of export.
Neither the UK nor the EU uses the concept of a licence exception in the same way. The UK system under the Export Control Order provides open general export licences (OGELs) as the closest equivalent. EU regulations use both open general and specific licences for different categories. The criteria, the eligible destinations, and the post-shipment reporting obligations under each system differ substantially. A business that assumes an EAR exception maps cleanly onto an OGEL or an EU open licence has not completed the analysis.
Step 5 – Submit the licence application: what BIS reviews and how long it takes
Where no licence exception applies, the exporter must apply for a specific BIS export licence before the shipment proceeds. The application is submitted through BIS's Simplified Network Application Re-engineering System. It is reviewed by BIS and referred, where required, to other agencies including the Departments of Defense, State, and Energy depending on the control reason and the destination. The process is inter-agency and the timeline varies by item type, destination, and the agencies involved.
The application itself must cover the item description and classification, the exporter and consignee details, the end-user, the stated end-use, the transaction value, and the export route. BIS may issue a Request for Information during the review. Responding promptly and completely to such requests is important; unexplained delays in a response can extend the review period significantly.
Incomplete or inconsistent applications are a frequent source of delay and refusal. In our practice, we have seen applications denied not because the underlying transaction was impermissible but because the stated end-use was too general to allow the reviewing agency to assess the risk. A well-drafted application anticipates the questions the reviewer will need to answer, structures the end-use statement with sufficient specificity, and provides supporting documentation that resolves ambiguity rather than adding to it.
The review outcomes are: approved, approved with conditions (limiting re-export rights or end-use, for example), returned without action (procedurally deficient, and resubmittable), or denied. A denial is not necessarily final. In appropriate cases, applicants can request reconsideration or seek an advisory opinion on the specific transaction before reapplying.
Under the UK system, ECJU processes licence applications through a separate portal with its own review timeline and policy criteria. EU Member State export-control authorities apply national procedures for specific licences, although the legal standards derive from the EU dual-use regulation. Timelines and inter-agency referral practices differ across all three jurisdictions. For a cross-border manufacturer shipping the same product to the same destination from multiple origin countries, all three processes may run simultaneously.
The position above describes the standard case for items controlled under the EAR. Your facts – the specific ECCN, the destination, the consignee's ownership structure, the stated end-use, and the route of the shipment – change the analysis at each step.
For a confidential review of a classification question or a licence application, contact Calder & Vance at info@caldervance.com.
Risk flags: where export-licence determinations most often go wrong
The five-step determination is a well-defined procedure, but several recurring patterns produce compliance failures even in organisations that follow it in principle. Recognising these risk flags before a transaction is filed – rather than after a BIS query arrives – is where the analysis pays for itself.
Stale classification records. Products evolve. A classification conducted on a version-one product may not apply to version three if new features alter the technical parameters that determine the ECCN. Many businesses use a single classification for an entire product family without reviewing whether individual variants cross a control threshold. The correct practice is to review classification on any material technical change and to document that review.
Re-export risk in the supply chain. The EAR applies not only to original exports from the United States but also to re-exports of US-origin items from third countries, and to the export of foreign-made items that incorporate US-origin components above the de minimis threshold (the percentage of US-controlled content above which EAR controls apply to a foreign-made product). A European manufacturer that sources US-origin components may be producing items subject to the EAR even if no part of its operation is in the United States. This extraterritorial reach is frequently underestimated. The equivalent in the EU dual-use rules and in the UK Export Control Order is more limited in scope, though both contain catch-all controls for items not on the control list where the exporter knows or suspects a weapons-related end-use.
Deemed exports. The EAR extends to the release of controlled technology or source code to a foreign national within the United States. That release is treated as an export to the person's country of nationality. Research institutions, technology companies, and manufacturers with internationally diverse workforces carry this risk in their day-to-day operations without necessarily recognising it as an export-control matter at all. Our deemed export and controlled technology advisory service addresses this specific exposure in depth.
Ownership changes at the counterparty. A counterparty that passed screening at contract signature may have changed hands before delivery. A new majority owner on the SDN List or the Entity List changes the entire analysis. Screening should be refreshed before each shipment and, for long-running contracts, at regular intervals during the contract term.
Inconsistent end-use statements. Where the stated end-use in a licence application does not match publicly available information about the consignee's activities – or where the shipping route is unusually indirect for the stated destination – BIS is likely to scrutinise the application more closely. An exporter should be able to document how it verified the end-use before it applied. Red-flag indicators in the EAR (such as a customer who is unwilling to provide end-use information, or who requests packaging inconsistent with the stated use) are markers that the EAR explicitly asks exporters to consider. Ignoring them is not a neutral choice in an enforcement context.
If a transaction has already been flagged by BIS, or if a prior export may have been made without the required licence, an early internal review can preserve options that narrow over time. A voluntary self-disclosure (VSD – disclosure of an apparent violation to BIS before the agency independently discovers it) is a factor BIS takes into account in determining the appropriate penalty. The decision whether to file a VSD, and how to structure it, benefits from legal guidance at the outset.
For a confidential review of a potential compliance gap or an apparent violation, contact Calder & Vance at info@caldervance.com.
How the BIS / EAR determination compares with UK and EU export-control processes
Export-licence determinations under the EAR share structural features with the UK and EU systems – a control list, a classification exercise, a licensing procedure, and enforcement – but the practical differences are significant enough that a compliance approach designed for one regime does not transfer directly to another.
The three main points of divergence relevant to cross-border operators are as follows.
Extraterritorial reach. The EAR's extraterritorial application to non-US persons re-exporting US-origin items, and its de minimis rule capturing foreign-made items with US-controlled content, has no direct equivalent in EU or UK law. The EU dual-use regulation and the UK Export Control Order apply primarily to items located within the EU or UK at the time of export. The practical implication is that a European exporter of items containing US-origin technology must run a EAR determination even when shipping from a non-US origin point. That determination runs in parallel with, not instead of, the EU or UK determination.
Party-list architecture. BIS's Entity List operates on a presumption-of-denial basis for many entries, with no automatic route to a specific licence for listed parties. OFSI's financial-sanctions designation regime and the EU's designation list operate differently: licences (specific authorisations to conduct an otherwise prohibited transaction) are available through OFSI and through the relevant EU competent authority for defined categories of activity, even where a party is designated. The licensing criteria and procedural timelines differ between the three regimes, and a licence from one authority does not cover the obligations arising under another.
Catch-all controls. The EAR includes end-use controls under which a licence may be required even for EAR99 items where the exporter knows or has reason to know the item is intended for a prohibited use. The EU and UK systems contain analogous catch-all provisions, but the trigger conditions and the notification and denial procedures differ. In the UK system, the ECJU may issue a notice requiring a licence where catch-all criteria are met; in the EU system, the competent authority in the exporting Member State plays an equivalent role.
For a business operating across all three regimes, the correct practice is to maintain a classification matrix that records the ECCN, the corresponding EU dual-use entry (if any), and the UK control entry (if any) for each product. That matrix should be updated whenever the product changes and verified against the current control lists, which are amended periodically. Divergences between the three lists – items controlled under the EAR but not under the EU or UK list, or vice versa – are not uncommon and require individual attention.
You can explore the cross-border dimension of these determinations further in our guide on export-licence determinations across multiple jurisdictions, and in our companion guide on advanced BIS / EAR licence exception analysis.
A common misunderstanding: why EAR99 does not mean licence-free
The most persistent myth in export-licence determinations is that an EAR99 classification means the item can be exported to any destination without further analysis. That reading is incorrect, and it produces enforcement exposures that a correct analysis would have avoided.
EAR99 removes a product from the control-reason matrix on the Country Chart. It does not remove the transaction from the EAR's scope entirely. An EAR99 item cannot be exported to a party on the Entity List or the Denied Persons List. It cannot be exported for a prohibited end-use under the end-use controls in the EAR. It cannot be shipped to a destination subject to a comprehensive OFAC embargo without an OFAC licence. And the party-screening obligation applies in full, including the 50 percent rule and the OFSI and EU control tests for any transaction with UK or EU dimensions.
In practice, an EAR99 classification simplifies the determination but does not complete it. The correct interpretation is that an EAR99 item has no ECCN-based licence requirement for most standard commercial transactions to most destinations. The five-step sequence still applies; it is simply shorter in the middle. Steps 1, 3, and the end-use assessment in Step 4 all remain relevant.
In a recent matter, a logistics provider assumed that a shipment of commercial items with an EAR99 classification required no further analysis before shipping to a third-country distributor. The distributor's parent company had been placed on the Entity List several months after the distribution agreement was signed. The exporter had not refreshed its screening at the point of shipment. We advised on the voluntary self-disclosure process and on the compliance-programme adjustments needed to ensure that Entity List screening was conducted at the time of each shipment, not only at contract execution. The matter illustrated how an EAR99 classification can create a false sense of clearance where party-list controls are not properly tracked.
Related practices
- Deemed export and controlled technology advisory – BIS/EAR advice on technology releases to foreign nationals within the US
- Cross-border export-licence determination guide – multi-regime comparison of BIS/EAR, ECJU, and EU dual-use controls