How to map the perimeter for insurers and card networks under BIS / EAR

An insurer processes a premium payment. A card network routes a transaction. Neither business thinks of itself as an exporter. Yet both can sit inside the BIS / EAR perimeter – and a screening gap that surfaces only after a breach is far harder to correct than one caught in advance. For insurers and card networks operating across borders, the question is not whether export-control rules apply, but precisely where they bite and how to test the boundary before a regulator does it for you.

Under the Export Administration Regulations, administered by the US Bureau of Industry and Security, insurers and card networks in the sanctions perimeter face exposure wherever their services touch controlled items, listed entities, or prohibited end-uses. The EAR's reach extends extraterritorially through the Foreign Direct Product rules (rules that bring foreign-produced items within US jurisdiction when they are the direct product of controlled US technology or software) and through deemed-export logic (the release of controlled technology to a foreign person, including through remote access, even inside the United States). A single service relationship with a party on the BIS Entity List or Denied Persons List can constitute a prohibited dealing, regardless of whether the insurer or card network knew it was involved in an export.

This guide walks through the key questions a compliance team should answer when mapping the BIS / EAR perimeter for these businesses, compares the position under OFAC, OFSI, and the EU, and identifies the risk flags that warrant immediate escalation to counsel.

What does BIS / EAR actually cover – and does it reach financial services at all?

The EAR covers items – goods, software, and technology – that are subject to US export-control jurisdiction, and the transactions that move them. Financial services are not items. But that is not the end of the analysis. An insurer providing cover for a shipment of controlled goods, or a card network processing payments for a seller of EAR-controlled equipment, is providing a service that is integral to the export transaction. BIS treats facilitation – assisting a transaction that would be prohibited if conducted directly by a US person – as itself a potential violation.

The scope question is therefore not "do we export goods?" but "do our services enable an export transaction involving controlled items or prohibited parties?" In our experience, compliance teams at insurers and card networks frequently answer only the first question. That leaves the second unaddressed – and the second is where the exposure sits.

The Commerce Control List (the CCL, organised into ten categories and five product groups) is the map of controlled items. Items that appear on the CCL are assigned an ECCN (Export Control Classification Number under the US Commerce Control List). Items subject to the EAR but not on the CCL are designated EAR99. For most routine insurance and card transactions, the underlying goods will be EAR99 or below a licensing threshold. But advanced electronics, certain software, dual-use technology, and items with a military end-use can carry a licensing requirement – and if your service enables their movement, the EAR's prohibition framework follows.

How do you identify which transactions are in scope for BIS / EAR compliance screening?

Identifying in-scope transactions requires mapping three independent axes: the item, the party, and the end-use. A transaction that is clean on two axes can still be prohibited on the third.

Item axis. Does the transaction relate to goods, software, or technology that appears on the CCL with a reason for control that requires a licence for the relevant destination? Insurers writing cargo, marine, or trade-credit cover need to know what goods they are underwriting. Card networks processing merchant transactions need to understand whether their merchant categories correlate with controlled-item sales. Neither institution needs to classify every item itself; both need a classification procedure that flags transactions above a defined risk threshold for review.

Party axis. BIS maintains two primary control lists: the Entity List and the Denied Persons List. Dealings with listed parties require a licence or are prohibited outright. The party analysis does not stop at the named counterparty. The EAR's facilitation principle, and the 50 percent rule that OFAC applies (treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked), both require you to look behind the named entity. A company that is not on either BIS list but is majority-owned by an Entity List party may still bring the transaction within the prohibited zone.

End-use axis. BIS administers military end-use and end-user (MEU) restrictions for specified destinations, as currently in force. A transaction that is otherwise lawful becomes problematic if the underlying item is destined for a military programme in a destination where MEU restrictions apply. Insurers underwriting political-risk or cargo policies in certain markets, and card networks operating in those markets, need a procedure for flagging transactions that could involve a controlled end-use.

A practical compliance checklist for this mapping exercise covers at minimum: (a) a review of the insurer's or network's product and merchant categories against the CCL; (b) screening of counterparties and their known ownership against the Entity List, the Denied Persons List, and OFAC's SDN List; (c) a destination assessment against the MEU country schedule; and (d) a written record of the analysis and its conclusions. The last point matters because record-keeping obligations under the EAR run for a significant period after the transaction – verify the current retention requirement before implementing your policy.

What is the extraterritorial reach of the EAR, and how does it catch non-US insurers and card networks?

Non-US businesses are a principal audience for this guide. The EAR can apply extraterritorially, and that extension catches insurers and card networks headquartered and operating outside the United States.

The primary mechanism is the Foreign Direct Product rules (FDP rules). Where a foreign-made item is the direct product of US-origin controlled technology or software, that item can be brought within the EAR's jurisdiction, and the rules on dealing with Entity List parties or prohibited destinations follow it. A European insurer writing cover for a cargo that includes foreign-manufactured equipment produced using US-controlled process technology is, in principle, within the FDP rule's reach if the underlying item meets the product and destination conditions. As currently in force, verify the applicable FDP rule before relying on any specific scope conclusion.

The second mechanism is the deemed-export rule. The release of controlled technology to a foreign national, even inside the United States, is treated as an export to the foreign national's country of nationality. For card networks with US-based technical teams that have access to systems processing controlled-technology transactions, this can be a live question.

A third mechanism is the OFAC secondary-sanctions dimension. Although OFAC and BIS are distinct regimes with distinct legal bases, they interact in practice. Foreign financial institutions that process significant transactions for parties designated under OFAC programmes risk being designated themselves or facing correspondent-account restrictions – as currently in force. This is the point at which BIS compliance and OFAC compliance cease to be parallel tracks and become a single risk-management question. We regularly advise clients that a BIS Entity List analysis and an OFAC ownership-chain analysis must be run together, not in sequence.

For a card network, the extraterritorial exposure is perhaps most acute. A network that operates globally processes transactions routed through US correspondent infrastructure, uses US-origin software, and links to US-licensed card schemes. Any of these connections can pull a non-US transaction within the EAR's scope. Compliance counsel working in this space consistently identify the network's rules and operating regulations as the starting point for the scope analysis, not the end of it.

How does the BIS / EAR position compare with OFAC, OFSI, and the EU?

The cross-regime comparison is where the analysis becomes operationally difficult. BIS / EAR and OFAC are both US regimes but operate on different legal bases, target different conduct, and are administered by different agencies. The overlap creates complexity that a single-regime screening programme cannot resolve.

OFAC operates list-based programmes (the SDN List, Specially Designated Nationals and blocked persons) and comprehensive territorial programmes. Its primary tool is the asset freeze and transaction prohibition. The 50 percent rule is mechanical: ownership at or above the threshold means the entity is blocked, regardless of management or control. BIS does not use an identical mechanical rule, but its facilitation principle produces a comparable outcome where a listed-entity's ownership or influence is material to the transaction.

OFSI (the UK's Office of Financial Sanctions Implementation) applies a different test. The UK ownership and control test can catch a non-listed entity that a designated person controls, and UK case law distinguishes existing influence from a hypothetical ability to exert control. The maximum OFSI monetary penalty is currently the greater of £1,000,000 or 50 percent of the breach value, on a strict-liability basis as currently in force. For an insurer or card network operating in the UK market, this means that a OFSI breach is possible even where the BIS analysis shows no violation – and vice versa.

EU Council regulations impose asset-freeze prohibitions that extend to making funds or economic resources available, directly or indirectly, to or for the benefit of listed persons. The EU's ownership criterion for asset-freeze purposes applies to entities in which a listed person holds more than 50 percent of the equity, with a separate control limb. The EU Blocking Regulation adds a further layer: it can prohibit EU operators from complying with specified third-country measures, which in certain configurations can put an EU-based insurer or card network in a position of conflict between BIS / EAR compliance and its EU obligations.

The cardinal rule where two regimes both apply is that the stricter prohibition governs. A compliance programme that resolves conflicts by netting them out – choosing the more permissive regime and applying it alone – is wrong as a matter of law. Where two regimes overlap, you must satisfy both.

What are the risk flags that warrant immediate escalation?

Risk flags for insurers and card networks in this space divide into those that require an immediate stop and those that require a review before proceeding. Neither category is safe to handle without a qualified sanctions and export-control assessment.

Immediate-stop flags:

• A counterparty, beneficial owner, or identified party in the ownership chain appears on the BIS Entity List, the Denied Persons List, or the OFAC SDN List.
• A transaction relates to goods or technology where the CCL classification and destination combination requires a licence and no licence is held.
• A cargo or insured item is destined for a destination subject to a comprehensive OFAC territorial programme – where the transaction is prohibited regardless of the specific item.
• A card-network merchant is flagged by a reliable external source as a potential front for controlled-goods exports to a restricted destination.

Review-before-proceeding flags:

• Ownership chain information is incomplete or the ultimate beneficial owner cannot be confirmed.
• The CCL classification of the underlying goods is uncertain or has not been confirmed by a classification analysis.
• A sharp change in transaction volume to a transit jurisdiction that neighbours a restricted destination – a pattern that regulators treat as a diversion red flag.
• A policy or transaction involves a foreign financial institution that has been the subject of a regulatory notice or designation in any of the major regimes.

In our practice we find that the review-before-proceeding category is the one most often collapsed into a routine screening pass. It should not be. A screening pass that checks names against public lists does not resolve a classification question, an ownership question, or a destination-diversion question. These require substantive analysis, not list-matching alone.

What common misconceptions create compliance gaps?

The most persistent misconception in this space is that name screening alone is enough to meet the rules. It is not. Screening a counterparty's name against the SDN List, the Entity List, and the Denied Persons List is necessary. It is not sufficient.

The BIS / EAR perimeter is not defined by named parties. It is defined by items, end-uses, destinations, and the facilitation principle. A transaction involving an unlisted party, an unlisted end-user, and goods that are nominally EAR99 can still be prohibited if the end-use is a controlled military application in a restricted destination, or if the goods are re-exported through a transit point to a prohibited destination. Name screening catches none of that.

A second misconception is that financial services businesses are outside the EAR because they do not export goods. As explained above, the facilitation principle and the deemed-export rule both bring service-layer activity within the regime's scope. An insurer or card network that concludes it has no EAR exposure because it does not manufacture or sell goods has answered the wrong question.

A third misconception concerns the EU Blocking Regulation. Some EU-based compliance teams treat it as a reason not to conduct BIS / EAR analysis at all, on the basis that compliance with a US measure might itself be prohibited. The Blocking Regulation is a real legal constraint, but it does not eliminate the BIS / EAR analysis – it adds a conflict-of-laws layer that must be addressed on its own terms, with specific legal advice on the current scope of the Regulation and the specific measure in question.

We have acted for financial institutions and card-network operators that discovered a compliance gap only when a transaction was flagged by a correspondent bank or by a regulatory inquiry. In every case, the gap traced back to one of these three misconceptions. Correcting the programme after an event is possible; it is simply harder, slower, and more expensive than building the right perimeter in the first place.

When should an insurer or card network involve sanctions and export-control counsel?

Counsel should be involved at three points: when designing or redesigning the compliance programme; when a specific transaction raises a question the compliance team cannot resolve; and when a potential breach or regulatory inquiry has been identified.

Programme design is the point where early involvement produces the highest return. A compliance programme built around name-screening alone will fail BIS / EAR analysis. A programme that is correctly scoped from the start – with a classification procedure for controlled items, an ownership-chain mapping methodology, a destination-diversion red-flag process, and a record-keeping system – does not need to be rebuilt when the first difficult transaction arrives.

Transaction-level queries arise frequently in the insurer and card-network context because the underlying goods and the end-use are often not fully visible at the time of the service decision. An insurer may not know the CCL classification of the cargo it is asked to cover. A card network may not know the precise nature of the goods a merchant sells. Counsel can assist with classification analysis, with a counterparty ownership assessment, and with an end-use review that gives the compliance team a defensible record of its decision.

At the enforcement stage, early involvement is essential. The voluntary self-disclosure (VSD) process at BIS – where a business reports an apparent violation before the regulator identifies it – is a recognised mitigating factor. A VSD prepared without legal advice risks disclosing more than is necessary, or framing the disclosure in a way that increases rather than reduces exposure. If a potential breach has been identified, the first step is to stop the activity and seek advice before making any disclosure or communication with the regulator.

Related practices

• Affiliate-level restrictions under BIS / EAR – assessing how Entity List restrictions extend through ownership chains to affiliated entities
• Cross-border perimeter guide for insurers and card networks – how the BIS / EAR analysis fits within a multi-regime compliance programme

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.