An exporter preparing to ship controlled technology receives a routine compliance query: does one of the end-users on the transaction chain appear on a restricted-party list maintained by the Bureau of Industry and Security? The screening tool returns a partial match. Two indirect shareholders of the buyer each hold a stake – but neither appears on the Entity List themselves. Does the buyer inherit the restriction? The answer depends entirely on how ownership and indirect interest are assessed under the Export Administration Regulations (the EAR, the US export-control rules administered by BIS, the Bureau of Industry and Security).
As of July 2026, the BIS/EAR regime applies the 50 percent rule and ownership analysis differently from OFAC's financial-sanctions approach. Under the EAR, listing on the Entity List or Denied Persons List attaches to the named party; it does not automatically extend to entities that party owns. However, the analysis does not stop there. BIS applies a knowledge standard and an end-use/end-user control framework that can capture transactions involving affiliates of listed parties even when no automatic blocking rule operates. The gap between the OFAC rule and the BIS/EAR approach is one of the most misunderstood points in cross-border trade compliance.
This guide walks through the ownership analysis under BIS/EAR step by step – covering who administers the lists, how the tests differ from the OFAC 50 percent rule and from EU and UK ownership tests, and where the practical risk points arise for exporters, re-exporters, and technology transferors.
Step 1: Understand which BIS lists are in scope and what they prohibit
The starting point in any BIS/EAR ownership analysis is identifying which list is at issue, because the operative restriction – and therefore the ownership question – depends on the specific list and the specific prohibition it carries.
BIS maintains several restricted-party lists. The Entity List imposes licence requirements for exports, re-exports, and in-country transfers of items subject to the EAR to named entities; a licence is typically required and is assessed against a presumption of denial. The Denied Persons List prohibits any transaction with listed persons in connection with an item subject to the EAR. The Unverified List is a flag list: BIS has been unable to verify an end-user's bona fides, and dealing with them carries specific obligations. The Military End User List targets specific entities for which a licence is required for a defined subset of controlled items.
Each list has its own legal basis, its own prohibition scope, and its own analysis for what happens when a counterparty is affiliated with – or partially owned by – a listed entity. That differentiation matters before any ownership calculation begins. In our practice, a recurring error is treating all BIS lists as functionally equivalent to the OFAC SDN List, and then applying the OFAC 50 percent mechanical ownership rule to them. The analytical frames are distinct.
Step 2: Apply the correct ownership test for BIS/EAR – and understand why it is not the same as the OFAC rule
Under OFAC, the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) is automatic and mechanical: if blocked persons hold an aggregate 50 percent or more of an entity, that entity is treated as blocked even without a separate listing. Ownership percentage is the determinative criterion; intent and control are irrelevant.
BIS/EAR does not operate the same automatic attribution rule. A subsidiary or affiliate of an Entity List party is not automatically caught unless that subsidiary or affiliate is itself named on the list. The restriction travels with the named party, not with its ownership structure. This is the single most important structural difference a compliance officer needs to internalise when moving between OFAC and BIS analysis.
Why does this matter in practice? Consider a technology exporter screening a buyer. The buyer's parent company appears on the Entity List. Under OFAC logic, a 50 percent or more ownership by a restricted party would treat the buyer as restricted. Under BIS/EAR logic, the buyer is not automatically placed on the Entity List simply because its parent is listed – but the transaction may still require a licence, may still be prohibited, and may still attract criminal liability. The mechanism is different: it operates through the knowledge standard and end-use and end-user controls, not through automatic status attribution.
This distinction does not mean the ownership and corporate structure are irrelevant under the EAR. They are central – but the analysis runs through a different channel. A compliance counsel advising on a BIS matter will look at ownership not to determine automatic listing status, but to assess knowledge, red flags, and whether a stated end-user is a reliable indicator of the true end-use.
For a cross-regime comparison, see our guide on the 50 percent rule and ownership analysis across regimes, which sets out the OFAC, UK OFSI, and EU positions side by side.
Step 3: Work through the knowledge standard and end-use / end-user controls
Where BIS ownership analysis does substantial work is in the knowledge standard – and specifically in how an exporter or transferor is expected to assess the true end-use and the true end-user of a transaction.
The EAR prohibits exports, re-exports, and in-country transfers of items subject to the EAR when the exporter knows – or has reason to know – that the item is intended for a prohibited end-use or will be received by a prohibited end-user. "Knows" under the EAR encompasses not only actual knowledge but also a high probability of the outcome where the exporter takes deliberate steps to avoid learning the facts. This is the standard that transforms ownership analysis from a box-ticking exercise into a genuine investigation.
How does ownership structure feed into this? Several ways. If the named buyer is a subsidiary of an Entity List party, the question is whether that structure creates a reasonable basis to conclude that the controlled item will pass to, be used by, or benefit the listed parent. If the buyer and the listed entity share management, premises, or operational functions, the inference that the buyer is acting on behalf of or in the interest of the listed parent becomes difficult to rebut. In our experience, transactions structured to place a clean-named subsidiary between the end-user and the supplier are precisely the pattern BIS enforcement focuses on.
Compliance counsel working through this step should document: the beneficial ownership of the buyer; any shared management or control links with a listed entity; the stated end-use and its plausibility given the item's technical characteristics; and any red flags in the transaction documentation. Red flags are not a defined list, but the BIS guidance on red flags identifies patterns such as payment in cash for high-value controlled items, requests to ship without standard documentation, reluctance to provide end-use information, and a stated end-use that appears inconsistent with the buyer's known business.
Step 4: Map the corporate structure – a practical sequence
Having established the applicable list, the prohibition, and the knowledge standard, the next step is the actual corporate mapping exercise. This is where the ownership analysis under BIS/EAR becomes a structured, document-driven process.
First, identify the immediate counterparty and obtain whatever corporate registration or incorporation information is available. For parties in jurisdictions with accessible company registries, a direct register search is the baseline. For parties in opaque jurisdictions, reliance on information supplied by the counterparty alone is generally insufficient; third-party corporate intelligence is typically needed.
Second, map the ownership chain upward from the immediate counterparty to the ultimate beneficial owner. For BIS purposes, the interest is not in reaching a threshold percentage that triggers automatic attribution – as it is under OFAC – but in establishing whether any node in that chain is a named listed party, and whether the structural relationship between that listed party and the counterparty is close enough to give rise to knowledge concerns or end-use risk.
Third, map the ownership chain laterally as well as vertically. Two entities under common ownership or common control by a listed parent present effectively the same risk profile as a direct subsidiary. The concern is operational relationship, not percentage ownership alone.
Fourth, consider whether any of the identified owners or affiliates carry an OFAC designation. This is where the two regimes interact: a party clear of all BIS lists may still be an OFAC SDN or carry a designation under another regime. A BIS clean bill does not mean the transaction is unrestricted. The analysis must cover both dimensions.
Finally, record the methodology, the sources, and the conclusions. BIS's enforcement guidance recognises that a good-faith, documented compliance review can be relevant to penalty calculations. An undocumented review – however well-intentioned – provides no such protection.
What are the main risk flags in BIS/EAR ownership analysis?
Several patterns consistently produce elevated risk under the BIS/EAR ownership analysis, and a compliance programme that does not test for them will underperform.
The first is the interposed clean subsidiary. A transaction is routed through a named buyer with no BIS listing, but that buyer is owned by or closely operationally linked to an Entity List party. The named buyer is clean on the list; the item is almost certainly reaching the listed entity. This pattern is the core of many BIS enforcement actions, and it is the analytical gap that a knowledge-standard review is designed to close.
The second is aggregation through common ownership. Two parties neither of which is listed may together be wholly controlled by a listed entity. Neither party triggers a list match, but the end-user risk is unchanged. A screening tool that runs names only, without mapping ownership, will miss this entirely.
The third is jurisdictional mismatch. A buyer in one jurisdiction holds the contractual position, but the stated delivery or installation address – or the end-use documentation – points to a different jurisdiction with a higher-risk profile. Under the EAR, this is a red flag that the knowledge standard requires to be addressed, not set aside.
The fourth is re-export risk. Even where the initial export is clean, the EAR applies to re-exports of US-origin items. If the immediate buyer's supply chain or distribution network includes parties with BIS listings or OFAC designations, the exporter may have downstream exposure. This is a dimension of ownership and structure analysis that is often missed in a first-level screen.
Have you stress-tested your screening programme against these four patterns? In our practice, a compliance audit that tests only first-level name matches against a single list will routinely miss the structural risks the EAR is designed to address.
How BIS / EAR differs from other regimes: a cross-border perspective
The BIS/EAR ownership analysis operates in a materially different way from the ownership and control tests applied by OFSI in the UK, the EU, and OFAC within the US sanctions perimeter – and understanding those differences is essential for any business operating across multiple jurisdictions.
Under OFAC, as noted above, the 50 percent rule is automatic and percentage-driven. A single calculation determines whether an entity is blocked. The rule applies regardless of operational connection or knowledge.
Under OFSI and the EU, the operative concept for financial sanctions is ownership and control (the UK and EU test for whether a non-listed entity is caught through a listed person). The UK and EU tests look beyond percentage ownership to include de facto control – meaning that a listed person may capture an entity through management influence, board composition, veto rights, or contractual control even where the ownership percentage falls below 50 percent. This is a broader and more fact-intensive inquiry than the OFAC mechanical test.
BIS/EAR is different from both. The restriction does not automatically travel to affiliates through ownership percentage, and it is not extended by a de facto control test. Instead, the question is always: given the corporate structure and the operational relationships, does the knowledge standard create an obligation not to proceed, or does it require a licence that the exporter must apply for?
The practical consequence for a multinational running a single screening and ownership-analysis process is significant. A counterparty that is clean under the OFAC 50 percent test may still present BIS knowledge-standard risk. A counterparty that is clean under BIS list checks may be captured under the OFSI or EU control test. The regimes must be applied in parallel, not sequenced as alternatives.
For a detailed comparison of the EU position, see our guide on the 50 percent rule and ownership analysis under EU sanctions.
Secondary sanctions risk adds a further layer. US secondary sanctions, administered through OFAC under IEEPA, can affect non-US parties transacting with certain designated parties even where no US-origin goods, technology, or services are involved in the transaction. A BIS/EAR analysis does not address secondary sanctions risk; a separate OFAC analysis is required. In our cross-border practice, we regularly advise businesses that assume a BIS clearance covers their full US-law exposure – it does not.
Step 5: When does the analysis require a licence, and when does it require refusal?
After completing the ownership mapping and knowledge-standard review, the compliance team faces a decision: can the transaction proceed, does it require a licence, or must it be refused?
Where the counterparty or any node in the ownership chain is on the Denied Persons List, the answer is straightforward: no transaction involving items subject to the EAR may proceed. The Denied Persons List prohibition is absolute within its scope.
Where the Entity List is the relevant list, the analysis is more nuanced. An Entity List designation typically imposes a licence requirement with a presumption of denial. The exporter must determine whether the item to be exported is subject to the EAR, whether it falls within the scope of the Entity List entry, and whether any licence exception is available. In most Entity List cases, a licence exception will not apply, and the exporter must either apply for a licence (with awareness that the presumption of denial makes approval unlikely) or decline the transaction.
Where the issue is not a direct listing but a knowledge-standard concern arising from ownership structure, the decision is more judgment-intensive. The compliance team must assess whether the red flags can be resolved through additional due diligence, whether the transaction can be restructured to remove the end-use risk, or whether the risk is sufficient to require refusal. A voluntary self-disclosure (VSD – a voluntary self-disclosure to a regulator) process may also become relevant where a past transaction has already proceeded in circumstances that, on review, created knowledge-standard exposure.
The bridge from analysis to action is documentation. BIS enforcement guidance indicates that a documented, good-faith compliance effort is a factor in any penalty assessment. A business that has mapped the ownership chain, applied the knowledge standard, consulted counsel where needed, and recorded its conclusions is in a materially stronger position than one that has not.
If a filing has already been refused, or a shipment has been detained or an inquiry received, early engagement with counsel preserves options that narrow over time. For a review of your compliance programme's treatment of restricted-party ownership, contact Calder & Vance at info@caldervance.com.
Addressing a common misconception: the BIS analysis is not a simpler version of the OFAC test
A persistent misconception among compliance teams is that because BIS does not apply a mechanical 50 percent ownership rule, the BIS ownership analysis is simpler or less demanding than the OFAC test. The reality is the opposite.
The OFAC rule, for all its mechanical severity, produces a binary answer from a quantitative input. Ownership percentage is calculable; the result is deterministic. The BIS knowledge-standard analysis requires a qualitative assessment of operational relationships, documentary patterns, transaction context, and red-flag indicators. It is a judgment call, documented against a legal standard, in a regulatory environment where the penalties for getting it wrong are substantial.
We have acted for exporters who invested heavily in OFAC-grade ownership tracing – running beneficial-ownership chains to four levels of depth – while applying only a first-name-match screen for BIS purposes. The gap between those two programmes is where enforcement exposure lives.
A well-designed compliance programme for BIS/EAR purposes will include: a restricted-party screening tool that covers all relevant BIS lists and is updated on a regular schedule; a defined ownership and corporate-structure mapping methodology; a knowledge-standard checklist applied to each transaction above a defined risk threshold; a documented red-flag review process; and a clear escalation path to compliance counsel for transactions that do not resolve cleanly.
For firms subject to both US export controls and financial-sanctions regimes, the programme must integrate the BIS and OFAC analyses, not treat them as separate silos. Ownership mapping done for one purpose should be shared with the other review function; a finding under one regime is a red flag for the other.
For a practical review of your current programme's treatment of these issues, see our sanctions compliance audit and testing service.
When should a business involve external sanctions counsel?
Not every BIS/EAR ownership question requires external legal input. A well-resourced compliance team with current training, good screening tools, and clear internal escalation paths can handle a significant volume of standard cases. External counsel becomes necessary in specific circumstances.
The first is where the ownership chain is complex, opaque, or multi-jurisdictional and the internal team cannot reach a reliable conclusion on corporate structure within a reasonable timeframe. An inconclusive ownership assessment is itself a red flag under the knowledge standard; proceeding without resolution is not a defensible position.
The second is where a transaction involves a party in a jurisdiction subject to heightened BIS controls, or where the goods or technology involved are subject to high-level export controls under the Commerce Control List. In these cases, the licence analysis is itself a specialist exercise.
The third is where an apparent violation has already occurred. A shipment has proceeded in circumstances that, on review, may have created BIS liability. In this situation, the VSD question – whether, how, and when to disclose to BIS – is a legal decision with material consequences for penalty exposure. It should not be made without legal advice.
The fourth is where the business is facing a BIS investigation, a Temporary Denial Order, or a request for information from BIS. These are enforcement postures that require legal representation.
The position above covers the standard analytical case. Your facts – the goods, the end-user, the ownership chain, the regime in play – change the analysis materially. For an assessment of your exposure under the BIS/EAR regime, contact Calder & Vance at info@caldervance.com.
Related practices
- Sanctions compliance audit and testing – structured review of screening programmes, ownership analysis, and risk controls
- The 50 percent rule across regimes – cross-border comparison of OFAC, OFSI, EU, and BIS ownership tests