A US-headquartered technology firm finalises a distribution agreement with a partner in a third market. The goods are commercial off-the-shelf software with encryption features. The in-house team assumes no licence is needed. Weeks later, a BIS audit surfaces the transaction. The firm had not classified the software, had not checked the partner against the Entity List, and had not confirmed whether a licence exception applied. The deal was a violation waiting to be discovered.
Export-licence determinations under the Export Administration Regulations ("EAR"), administered by the Bureau of Industry and Security ("BIS"), require a structured four-step sequence: classify the item by its Export Control Classification Number ("ECCN" – a code on the Commerce Control List that describes the item's technical parameters and the reasons for control), identify the destination, end-user, and end-use, check the applicable licence requirements or exceptions, and, where a licence is needed, prepare and submit an application to BIS. As of May 2026, the EAR reaches not only items shipped from the United States but also foreign-produced items containing more than a de minimis proportion of controlled US-origin content – a point that catches many non-US exporters by surprise.
This guide walks through each step in the determination sequence, explains where the analysis branches, flags the most common errors, and sets out when to involve export-control counsel.
Step 1: Classify the item against the Commerce Control List
The first question in any export-licence determination is whether the item is subject to the EAR at all, and if so, what ECCN applies. Items that appear on the Commerce Control List carry an ECCN that specifies the product category, the technology parameters, and the reasons for control – for example, national security, missile technology, or anti-terrorism grounds. An item that does not appear on the list is classified as "EAR99", the catch-all category for lower-risk commercial goods.
EAR99 status does not mean uncontrolled. An EAR99 item still requires a licence if the destination, end-user, or end-use triggers a separate prohibition – for example, if the consignee is on BIS's Entity List (a list of parties subject to licence requirements based on their involvement in activities contrary to US national-security interests). In our experience, assuming EAR99 means "no further action needed" is the single most reliable route to an inadvertent violation.
Classification requires a technical review of the item's specifications against the control list parameters. For complex items – dual-use electronics, encryption software, advanced materials – that review can be detailed. Where there is genuine doubt, BIS offers a commodity jurisdiction or classification request procedure, allowing the exporter to obtain a formal determination from the agency. That route adds time but removes uncertainty. A compliance counsel advising on BIS matters will map the technical specifications against the control list before the export transaction is committed.
Step 2: Screen the destination, end-user, and end-use
Licence requirements under the EAR depend not only on what is being exported, but on where it is going, who receives it, and what they will do with it. Once the ECCN is established, the exporter must cross-reference it against the Country Chart in the EAR to determine whether any of the reasons for control generate a licence requirement for the specific destination.
The end-user screen runs in parallel. BIS maintains several restricted-party lists: the Entity List, the Denied Persons List, and the Unverified List, among others. OFAC's Specially Designated Nationals list ("SDN List" – OFAC's list of blocked persons with whom US-nexus transactions are prohibited) is also relevant, because engaging with an SDN can simultaneously trigger BIS and OFAC exposure. Screening must cover not only the direct buyer but the ultimate consignee – the party that will actually receive and use the item – and any known intermediary.
End-use controls add a further layer. The EAR contains prohibitions on exports for certain end-uses regardless of the item's classification: nuclear, chemical, biological, and missile-related applications are the most significant categories. An exporter who has reason to know that an item will be used in a prohibited way may not proceed, even if the item's ECCN and the destination would otherwise permit the export. This "red-flag" standard is fact-specific and requires genuine due diligence, not a box-tick.
The position above covers the standard case. Your facts – the counterparty, the goods, the route, the jurisdictions touched – change the analysis materially. For an initial assessment of your classification and screening obligations under BIS / EAR, contact Calder & Vance at info@caldervance.com.
Step 3: Identify applicable licence exceptions
A licence requirement does not automatically mean an application is necessary. The EAR contains a set of licence exceptions – standing authorisations that permit defined categories of export without a separate application – and determining whether an exception applies is a critical step in the sequence before any application is prepared.
The principal exceptions relevant to commercial exporters include provisions for low-value shipments, items for personal use, certain technology and software, and intra-company transfers for internal use. Encryption software has its own dedicated exception structure tied to notification requirements. Temporary exports for trade shows or repair attract different treatment from permanent transfers.
Each exception carries eligibility conditions, and those conditions must be satisfied in full. An exception that is claimed on incorrect facts is not a defence – it is the violation. The exporter bears the burden of establishing that every condition is met. In practice, exception analysis requires the same diligence as a licence application: a record of the conditions checked, the facts relied on, and the conclusion reached. That record is the first thing BIS requests in an audit.
One practical point: licence exceptions under the EAR interact with controls imposed by other regimes. The UK's Export Control Order and the EU's dual-use regulation both operate their own licence-exception systems, and an item that qualifies for an EAR exception may still require a licence under the applicable country regime at the point of re-export. Cross-border transactions cannot be cleared under one regime and assumed clean under others.
How does the EAR reach non-US exporters – and why does that matter?
The extraterritorial scope of the EAR is one of the most significant features of the US export-control regime and the one most frequently underestimated by non-US businesses. The de minimis rule and the Foreign Direct Product ("FDP") rule extend BIS jurisdiction to foreign-produced items that contain, are produced with, or are the direct product of, US-origin controlled technology or software above defined thresholds.
The FDP rule means that a European or Asian manufacturer using US-origin equipment or software in a production process may find that its finished product is subject to the EAR for certain destinations. Amendments in recent years have expanded the FDP rule's reach, and compliance counsel routinely advise clients outside the United States who have not previously considered themselves subject to BIS jurisdiction.
The practical consequence is straightforward but significant. A non-US exporter shipping a product to a third country may need to determine whether US-origin inputs trigger EAR jurisdiction, whether any licence or exception applies, and whether the consignee is on a US restricted-party list – all before the shipment leaves a non-US jurisdiction. Failure to do so does not insulate the exporter from BIS enforcement; BIS has pursued enforcement actions against non-US parties, and DOJ criminal exposure is a realistic consequence of wilful violations.
For exporters operating between two or more jurisdictions, this question sits precisely at the intersection of divergent regimes. The UK's extraterritorial reach under the Export Control Order operates differently, and the EU's dual-use controls take a third approach. Businesses need a clear map of which rules apply before the contract is signed, not after the shipment has departed. Our practice addresses exactly this cross-regime analysis. For a confidential review, contact Calder & Vance at info@caldervance.com.
Step 4: Preparing and submitting a BIS licence application
Where the classification, destination, end-user, and end-use analysis shows that a licence is required and no exception applies, the exporter must submit an application to BIS through the Simplified Network Application Re-Engineering Modernised ("SNAP-R") system. The application requires a detailed description of the item, its ECCN, the end-user, the ultimate consignee, the stated end-use, and the export value.
BIS reviews applications against US foreign-policy and national-security criteria, and in some cases refers them to other agencies for interagency review. Processing times vary significantly by item, destination, and the agency-referral picture. Applications for items with sensitive technology parameters or for certain destinations may take considerably longer than standard commercial cases. There is no published guarantee of outcome; a licence may be approved, approved with conditions, or denied.
Preparing an application that supports approval requires more than completing a form. The supporting documentation – end-user certificates, consignee undertakings, descriptions of the transaction structure – must be accurate, consistent, and tailored to the specific concerns that BIS and any reviewing agency will bring to the file. In a recent matter, a technology business seeking a licence for advanced semiconductor equipment assembled its supporting documentation without correlating the end-use description to the technical parameters of the item. BIS came back with a request for further information that delayed the transaction by several months. A pre-submission review by export-control counsel would have identified the gap before filing.
Post-licence obligations also apply. A licence issued by BIS is subject to conditions: limits on re-export, record-keeping requirements, and in some cases reporting obligations. Exporters who treat the licence as a one-time clearance rather than an ongoing compliance commitment create exposure that can materialise at renewal or audit stage.
Risk flags and when to involve export-control counsel
Certain transaction features consistently raise the level of risk in BIS / EAR determinations, and recognising them early is the difference between a managed compliance process and a post-violation scramble. Compliance counsel advising on export-control matters see the same patterns repeatedly.
The first risk flag is an incomplete or assumed classification. Items that have not been formally classified against the Commerce Control List – or that were classified years ago against a version of the list that has since been updated – are a common source of violations. Controls tighten; ECCNs are amended; classification work done at product launch may not reflect the current list.
The second flag is over-reliance on a single restricted-party screening tool. List screening is a floor, not a ceiling. BIS's guidance makes clear that an exporter must act on "red flags" – facts that suggest a prohibited end-use or a problematic end-user – even where the specific party does not appear on a published list. A transaction with unusual payment routing, a buyer with no apparent commercial use for the item, or a delivery destination that is inconsistent with the stated application all warrant deeper inquiry.
Third: deemed exports – the transfer of technology to a foreign national within the United States, which is treated under the EAR as an export to that person's home country – are widely missed. Businesses with international workforces or research-and-development programmes that involve foreign-national employees or visitors frequently underestimate this exposure. Our practice includes a dedicated service on deemed-export classification and programme design; see deemed export and technology controls under BIS / EAR for the full analysis.
Fourth: re-export and in-country transfer obligations. A US-origin item exported lawfully to a first destination remains subject to the EAR for any onward transfer. Distributors and intermediaries in third markets who receive US-origin goods must be contractually committed to compliance, and the original exporter bears residual responsibility for ensuring that downstream transfers meet EAR requirements.
When should export-control counsel be involved? Early involvement is far less costly than post-violation remediation. Specifically: at the product-development stage for items near control thresholds; before entering a new market or engaging a new distributor; when a supply chain audit surfaces an unexpected US-origin input; when BIS issues an inquiry; and whenever a voluntary self-disclosure ("VSD" – a report to BIS of an apparent violation, which can mitigate penalty exposure) is under consideration.
Common myths and the reality of BIS determinations
A persistent myth in export-control practice is that EAR obligations apply only to direct US exporters – that is, businesses shipping goods from US soil. That position is incorrect. As set out above, the FDP rule and de minimis thresholds bring foreign-produced items and non-US businesses within BIS jurisdiction in defined circumstances. The reach of the regime is broader than most non-US businesses assume, and it has been extended further in recent years through targeted rule-making.
A second misconception is that EAR99 classification eliminates compliance obligations. In practice, an EAR99 item shipped to a party on the Entity List, to a destination subject to a comprehensive OFAC embargo, or for a prohibited end-use remains subject to BIS and OFAC controls. The classification exercise reduces – but does not remove – the need for end-user and end-use screening.
Third: some exporters assume that because a competitor ships the same item without a licence, the same approach is safe for them. Enforcement is not uniform; BIS's priorities shift; and a contemporaneous enforcement action in the same product category can make a previously tolerated practice a priority target. What was overlooked last year may be scrutinised this year.
We regularly advise businesses that have built export-compliance programmes around these assumptions and are seeking to reset them before an audit or an enforcement inquiry arrives. The work involves reviewing the classification basis for each product line, stress-testing the screening logic, and confirming that licence-exception conditions are properly documented.
Cross-regime considerations: EAR, UK export controls, and EU dual-use rules
For exporters with operations or supply chains spanning multiple jurisdictions, BIS / EAR determinations are one element of a broader cross-regime picture. The UK's export-control regime, administered by the Export Control Joint Unit ("ECJU"), operates its own control list derived from the Wassenaar Arrangement and its own licence-exception structure. The EU's dual-use regulation, which applies across EU member states and has extraterritorial features, adds a third layer.
The regimes are broadly aligned at the level of multilateral control lists – Wassenaar, the Australia Group, the Missile Technology Control Regime, and the Nuclear Suppliers Group all feed into US, UK, and EU controls simultaneously. But implementation diverges in important ways: the FDP rule is a US-specific feature with no direct equivalent in the UK or EU; the licence-exception structures differ in their conditions; and enforcement posture varies between the agencies.
A practical consequence is that the same shipment may be licence-free under BIS but require a UK or EU open or specific licence, or vice versa. Where a transaction involves a UK or EU-based subsidiary, a re-export from a European hub, or goods that have passed through multiple jurisdictions, the determination sequence must be run separately for each applicable regime. Cross-regime determinations are a core part of our export-controls practice; for further reading on the cross-border dimension, see our analysis at cross-border export-licence determination: a guide and the companion piece at export-licence determinations: cross-border considerations – Part 2.
Where a US-linked transaction also involves OFAC-administered sanctions – for example, a destination subject to a comprehensive sanctions programme – the BIS licence determination and the OFAC sanctions analysis must proceed in parallel. A BIS licence does not authorise a transaction that OFAC prohibits, and OFAC authorisation does not override a BIS licence requirement. In multi-regime situations, the stricter prohibition governs.
Related practices
- Deemed export and technology controls under BIS / EAR – classification, programme design, and foreign-national access controls
- Cross-border export-licence determination – mapping BIS, ECJU, and EU dual-use requirements across a single transaction