Goods-origin verification under BIS / EAR: a practical guide

A manufacturer ships a product it has sold for years into a new market. The item looks commercial. The end-customer is a distributor, not a government. Nobody flags it at the door. Six months later, a BIS inquiry arrives. The product contained controlled US-origin technology, and the shipment went to an Entity List party that the distributor supplied on the next leg. The question is no longer whether controls applied. It is whether the company knew enough to have caught it.

Goods-origin verification under the BIS / EAR (the US Bureau of Industry and Security's Export Administration Regulations, governing the export, re-export and in-country transfer of controlled items) is the process of establishing whether an item, its components, or the technology embedded in it is subject to US jurisdiction – and, if so, what licence requirements or exceptions apply. As of January 2026, the EAR applies not only to goods leaving the United States but also, through the Foreign Direct Product rules (provisions that extend US jurisdiction to foreign-made items that are the direct product of certain controlled US technology or software), to items manufactured abroad with US-origin technology content. A single mis-classified item can expose an exporter to significant civil penalties and, in serious cases, criminal liability.

This guide walks through what you need before you start, the key requirements at each stage of origin verification, and a practical readiness check for exporters, manufacturers, and their compliance teams.

What you need before you start: pre-verification requirements

Before any shipment analysis begins, a business subject to the EAR must have three things in place: a complete product inventory mapped to the Commerce Control List, a counterparty-screening process that covers the BIS Entity List and Denied Persons List, and documented procedures that assign ownership of the verification task. Without all three, origin verification becomes ad hoc – and ad hoc is not a defence.

The Commerce Control List (CCL) organises items subject to the EAR into ten categories and five product groups. Each controlled item carries an ECCN (Export Control Classification Number – a five-character alphanumeric code that defines the item's control reason and the destinations and end-uses for which a licence may be required). Items that are subject to the EAR but do not appear on the CCL are designated EAR99. EAR99 status is not a free pass: EAR99 items still cannot be exported to certain destinations, end-users, or for certain end-uses without a licence, and they remain subject to the de minimis principle when incorporated into foreign-made goods.

Does your product team know the ECCN for every item in your catalogue? In our experience, most classification gaps arise not in technically complex products but in software updates, technology transfers via cloud access, and spare-part shipments that were never separately classified because they were sold as accessories.

You also need a current understanding of the BIS Entity List and Denied Persons List. Dealings with listed parties require a licence unless a specific exception applies, and no exception cures a transaction with a party on the Denied Persons List. Build this check into procurement and sales onboarding, not only at point of shipment.

Requirement 1 – Classify the item correctly under the CCL

Accurate ECCN classification is the foundation of goods-origin verification under the EAR. An incorrect classification – whether overstated or understated – produces the wrong licence analysis, the wrong destination restrictions, and the wrong exceptions eligibility. Classification is a legal determination, not a product-marketing one.

The classification exercise has three steps. First, establish what the item is: its technical parameters, performance characteristics, and the function it enables. Second, work through the CCL categories that could apply, starting with the most specific. Third, confirm whether any licence exception is available based on the item's ECCN, the destination, the end-user, and the stated end-use.

A deemed export is a particular classification risk that many businesses miss. A deemed export occurs when controlled technology or source code is released to a foreign national inside the United States – for example, through access to a technical dataroom, a laboratory tour, or a shared engineering environment. The release is treated as an export to the person's country of nationality. This matters acutely for businesses with international R&D teams, joint-venture partners, or technical consultants working across borders.

Classification errors in either direction carry risk. Under-classify, and you may export without a licence when one was required. Over-classify, and you may apply unnecessary controls that create operational friction and trigger incorrect reporting. Both outcomes attract BIS scrutiny. We regularly advise clients on re-classification exercises after a corporate acquisition brings in a new product line that was classified under a different standard or not classified at all.

Requirement 2 – Apply the Foreign Direct Product rules and de minimis analysis

One of the most significant features of the EAR for non-US businesses is its extraterritorial reach. Under the Foreign Direct Product rules, a foreign-made item can fall within US jurisdiction if it is the direct product of controlled US technology or software, or if it is produced by a plant or major component of a plant that is itself the direct product of such technology. This means a European or Asian manufacturer using US-origin design tools, wafer-fabrication equipment, or software may produce items that are subject to the EAR even if no US-origin component is physically incorporated.

The de minimis principle operates alongside the FDP rules. Where a foreign-made item incorporates controlled US-origin content – hardware, software, or technology – it may fall within US jurisdiction when that content exceeds applicable thresholds, which are destination- and item-specific. Because those thresholds are not stable across all destinations and contexts, treat this analysis as requiring specialist input rather than a standard percentage calculation.

Cross-border supply chains amplify both risks. A goods-origin verification programme that looks only at the direct export step and ignores re-export routes, interim manufacturing steps, and technology transfers embedded in licensing agreements is not complete. Where two regimes both apply – for instance, where a shipment engages both the EAR and the UK Export Control Order – the stricter prohibition governs. You cannot net out the regimes against each other.

In our cross-border practice, we see the FDP analysis most commonly missed in three situations: technology transferred by licence rather than as a physical good; embedded software loaded on hardware in a third country; and manufacturing lines built under US-origin design specifications. Each of these can create an EAR nexus where the business assumed none existed.

Requirement 3 – Screen end-users and verify end-use

Classification confirms what you are exporting. End-user and end-use analysis confirms to whom, and for what purpose. Both matter: a correctly classified item can still require a licence or be prohibited entirely depending on the destination, the end-user, and the stated use.

BIS administers the Entity List, which identifies parties for whom specific licence requirements apply. It also maintains the Denied Persons List, against whom virtually all transactions are prohibited. The military end-use / end-user rules (MEU restrictions, as currently in force) impose additional licence requirements for items exported to specified destinations when the exporter knows or has reason to know the item will be used in military end-uses. These restrictions are destination-specific and are updated periodically: verify the current position before relying on any prior analysis.

End-use verification goes beyond asking the buyer to sign a statement. It includes considering whether the stated end-use is consistent with the buyer's business, whether the buyer is an established commercial actor or a newly incorporated entity with no visible operations, and whether the transaction structure – intermediaries, routing, payment terms – raises diversion red flags. A sharp change in trade flows to a neighbouring jurisdiction, or a buyer located in a high-risk transit point, is treated by BIS as a diversion red flag and should trigger enhanced due diligence before shipment.

Does your team have a clear procedure for what happens when a red flag is identified? Documenting the escalation path and the decision reached – including a decision not to proceed – is as important as the initial screen. Records must be kept for five years, as currently in force.

Requirement 4 – Determine licence requirements and applicable exceptions

Once the item is classified and the end-user and end-use are verified, the next step is to determine whether a licence is required and, if so, whether any exception is available. Licence exceptions are standing authorisations built into the EAR that permit certain exports, re-exports, or in-country transfers without a separate licence application, provided all eligibility conditions are met.

Eligibility for a licence exception is item-, end-use-, end-user-, and destination-specific. An exception that applies to an EAR99 item does not automatically apply to an item on the CCL. An exception available for a commercial end-user may not be available where there is a red flag of military end-use. And an exception cannot be used if the exporter knows or has reason to know the item will be used in a prohibited end-use or by a prohibited party.

Where no exception is available, a specific licence (a case-by-case authorisation from BIS to conduct an otherwise-controlled transaction) is required. Specific licence timelines vary by matter and by the processing load at BIS; plan for this in your transaction timeline rather than treating licence processing as a formality. BIS can and does impose conditions on licences, including end-use assurance requirements and periodic verification rights.

The cross-regime comparison matters here. Under the UK Export Control Order administered by the ECJU, equivalent assessments cover SIELs (Standard Individual Export Licences) and OIELs (Open Individual Export Licences), with different eligibility conditions and application timelines. Under the EU's recast Dual-Use Regulation, national competent authorities administer licence applications under a common framework but with some national variation in practice. Where an item engages both BIS and ECJU or EU requirements, both sets of conditions must be met independently. We regularly advise businesses that assume a US licence clears the path in the UK or EU – it does not.

Requirement 5 – Document, record, and maintain

Documentation is not the final step of goods-origin verification: it runs throughout. Every classification decision, every end-user screen, every exception determination, and every licence application – and the reasoning behind each – must be recorded and retained. Records must be kept for five years, as currently in force under the EAR.

The practical documentation package for each export includes: the classification record (ECCN or EAR99 determination with the basis for it), the end-user and Entity List screen (date, source, result), the end-use analysis (supporting documents obtained), the licence or exception determination (with the specific exception code or licence number), and the shipping documentation (confirming that what was shipped matched what was authorised). For technology transfers and deemed exports, the record should also include the nationality of the recipient and the basis for any technology-release decision.

A voluntary self-disclosure (VSD – a voluntary report to BIS of an apparent violation, before the agency opens an investigation) is a recognised mitigating factor in BIS's enforcement posture, as it is in OFAC's Enforcement Guidelines. A strong documentation record is what makes a credible VSD possible. Without it, even a business that acted in good faith cannot demonstrate that good faith to the regulator. In our experience, the quality of the documentation – not just the decision it supports – is what BIS reviewers assess first in an enforcement inquiry.

Record-keeping also has a cross-border dimension. Where UK or EU licence conditions impose their own record-keeping requirements, those obligations apply independently and may have different retention periods or formats. A single records-management system that satisfies all applicable regimes is achievable but requires deliberate design.

Readiness check: five questions before the next shipment

Before approving a shipment that involves goods with US-origin content or US-technology provenance, a compliance team should be able to answer five questions clearly and with supporting documentation.

First: is the item classified, and is the classification current? Classifications must be revisited when product specifications change, when the CCL is updated, or when the item moves to a new destination or end-user category. Second: has the end-user been screened against the BIS Entity List, Denied Persons List, and relevant OFAC lists? A screen conducted six months ago for a different transaction is not a screen for this one.

Third: is the end-use verified and consistent with the buyer's business? Stated end-use that cannot be corroborated by independent evidence should be treated as a red flag, not a resolved question. Fourth: if an exception is being used, has the eligibility analysis been documented? "We used TMP" is not a compliance record. The eligibility conditions, the item's ECCN, the destination, and the end-user must all support the exception claimed.

Fifth: do the Foreign Direct Product rules or de minimis analysis create a nexus for any other jurisdiction's export controls? Where they do, the additional licence requirements in that jurisdiction must be assessed and met before shipment proceeds. A business that can answer all five questions with dated, signed documentation is well-positioned. One that cannot should stop before the shipment leaves – not after it arrives.

The myth that commercial goods cannot be controlled costs businesses dearly. Commercially available items – mass-market electronics, industrial sensors, standard software – can carry ECCNs, can be captured by the Foreign Direct Product rules, and can require a licence for specific destinations or end-uses even when they are freely sold on the open market. The commercial nature of a product changes the marketing; it does not change the legal analysis.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.