A freight forwarder in the Netherlands receives a routine post-shipment audit request from its US parent. The parent's export-compliance team has spotted an anomaly: a consignment of electronic components, routed through a third country, reached an end-user that does not match the declared destination on the export licence. The question is immediate – was there a violation of the Export Administration Regulations ("EAR"), the US Commerce Department's rules governing the export, re-export, and transfer of dual-use and commercial items controlled by the Bureau of Industry and Security ("BIS")? And if so, what must the business do next?
Running an internal sanctions investigation under BIS / EAR requires a structured, legally privileged process: preserve records, scope the apparent violation under the EAR, assess whether a voluntary self-disclosure ("VSD") is warranted, and engage qualified export-control counsel before any communication with BIS. The regime is governed by IEEPA and the Export Control Reform Act, administered by BIS, with criminal referrals handled by the Department of Justice. A poorly managed investigation can convert a civil matter into a criminal one.
This guide walks through each phase of a BIS / EAR internal investigation – from the initial trigger to the decision on disclosure – and identifies where the analysis diverges from investigations under OFAC, OFSI, the EU Council regulations, and other regimes.
Step 1: Recognise the trigger and impose a litigation hold
The first action in any BIS / EAR internal investigation is to recognise the trigger event and immediately preserve all relevant records before anything is altered, overwritten, or deleted. A trigger can arise from many sources: a failed screening hit, an audit finding, a tip from a logistics partner, a denied-party list match on a retrospective review, or a direct inquiry from BIS or the Department of Justice.
Speed matters. Export-control records – shipping documents, export licences, end-use certificates, email correspondence, purchase orders, and Electronic Export Information filings – are the raw material of any investigation. Losing them, even inadvertently, raises separate legal exposure. The litigation hold must cover all document custodians: the compliance team, the sales team that managed the transaction, freight brokers, and any intermediaries whose records the business can access.
In our experience, the single most common failure at this stage is a hold that covers the compliance function but misses the commercial team. Salespeople often hold the most material evidence – the calls in which an end-user's stated purpose was probed (or not probed), the emails in which a red flag was raised and then set aside. Capture everything before you scope anything.
Consider also whether the apparent issue involves conduct in other jurisdictions. A re-export through a European subsidiary may engage EU dual-use rules simultaneously. A shipment via a Singapore trading house may trigger Singapore's strategic goods controls. The hold should extend to records held by those entities even if the primary investigation is US-focused.
Step 2: Scope the apparent violation – what is actually at issue under the EAR?
Scoping means identifying precisely which provisions of the EAR may have been breached, which controlled items were involved, and which countries, end-users, or end-uses are in question. This step determines the severity of the potential violation and the realistic range of outcomes.
Start with the item. Every item subject to the EAR carries an Export Control Classification Number ("ECCN"), which determines what licence requirements and exceptions apply. Was the item correctly classified at the time of export? Has the classification changed since? An item originally classified as EAR99 – the catch-all category for items not specifically listed but still subject to the EAR – may have been reclassified. Or the item may always have warranted a controlled ECCN and was simply mis-classified by the exporter.
Next, examine the destination, the end-user, and the end-use. The EAR's controls operate on all three axes. An export to a close ally under an open general authorisation is a different matter from a transfer, even of the same item, to an entity on the Entity List (BIS's list of persons subject to heightened licence requirements) or to a jurisdiction subject to a comprehensive embargo administered under the EAR. Where the end-user appears on the Entity List or the Denied Persons List, the exposure is near-absolute: no licence exceptions apply to Entity List parties for controlled items without specific authorisation, and any transaction with a Denied Person is prohibited outright.
Red-flag awareness is a statutory obligation under the EAR. The regime requires exporters to act on red flags that suggest a stated end-use or end-user is false. Was there a red flag? Was it documented? Was it resolved? If the answer to the first is yes and to the second or third is no, that gap will matter to BIS.
Step 3: Assess extraterritorial reach and cross-regime exposure
The EAR has explicit extraterritorial reach. It applies to US-origin items, US-origin technology, and items incorporating US-controlled content at or above the applicable de minimis threshold, wherever those items travel in the world. A re-export from Germany to a third country requires BIS authorisation to the same extent as a direct export from the United States, if the item is of US origin or contains sufficient US content.
This is the point at which a BIS / EAR internal investigation almost always becomes a multi-regime matter. The same transaction that raises EAR concerns may simultaneously engage EU dual-use Regulation controls in the EU subsidiary that handled the re-export, ECJU licensing requirements in any UK-incorporated entity in the supply chain, and local export-control rules in Singapore, the UAE, or Japan if the item passed through those jurisdictions. Each regime has its own investigation obligations, disclosure timelines, and penalty exposure.
We regularly advise clients who have opened a BIS-focused investigation and then discovered that the EU leg of the same transaction requires a separate notification to a national competent authority under EU dual-use rules, with its own deadline running in parallel. Treating the investigation as US-only, when the facts are cross-border, is a material risk. It is also, in our experience, the mistake that creates the most difficult conversations with regulators.
There is a further dimension specific to BIS: the Export Control Reform Act and IEEPA give BIS the authority to pursue non-US persons who re-export controlled items in violation of the EAR. A European trading company that re-exports a US-origin controlled item without the required authorisation is directly subject to BIS jurisdiction, even if it has no US presence. That exposure must be assessed as part of the investigation scope – not treated as a secondary concern.
For assistance with an EU parallel investigation, see our guide on apparent violation assessment under EU sanctions and export controls.
Step 4: Decide on voluntary self-disclosure – the central strategic question
The decision whether to make a voluntary self-disclosure to BIS is the most consequential judgment in any BIS / EAR internal investigation. A well-prepared and timely VSD can substantially reduce civil penalty exposure and is one of the mitigating factors BIS weighs heavily in its enforcement guidelines. An incomplete, delayed, or inaccurate VSD can make the position worse than no disclosure at all.
BIS operates a two-step VSD process. An initial notification – brief, factual, preserving privilege – is filed early to establish the voluntary character of the disclosure. A final submission follows once the investigation is substantially complete, setting out the full facts, the applicable controls, the root-cause analysis, and the remedial measures taken. The interval between initial and final submission is used to complete the internal investigation properly, not to delay.
The calculus is different from OFAC. Under OFAC's enforcement guidelines, a VSD is one of the most heavily weighted mitigating factors, capable of reducing a base penalty by a significant proportion. BIS applies a similar philosophy, but the comparison is not mechanical: the facts, the aggravating factors, the entity's compliance history, and whether the conduct was wilful all shape the outcome. Wilful violations under the Export Control Reform Act carry criminal liability. A VSD does not immunise against criminal referral where the evidence supports it, but it is generally considered by prosecutors as evidence of good faith.
Should you file? Not automatically. The VSD decision requires an honest assessment of: (a) how likely is BIS to discover this without disclosure; (b) how strong are the aggravating factors; (c) does the investigation evidence support a finding of wilfulness; (d) what is the remedial programme already in place; and (e) does disclosure create collateral exposure in other jurisdictions? Our practice assists clients to work through that analysis before any decision is made.
Step 5: Structure the investigation to preserve privilege
Legal professional privilege – whether in its US attorney-client or work-product form – is the structural protection that makes an honest internal investigation possible. Without it, the investigation findings become discoverable by BIS, by the DOJ, and by private litigants. That risk changes the behaviour of witnesses and ultimately corrupts the investigation.
To preserve privilege, the investigation must be directed by counsel from its inception. In-house counsel can fulfil this role for some elements, but where the investigation is material – where it may lead to a VSD, where parallel criminal exposure exists, or where the investigation spans multiple jurisdictions – external sanctions and export-control counsel should be engaged to direct the factual inquiry. Witness interviews conducted by counsel, legal memoranda recording factual findings, and documents generated for the purpose of obtaining legal advice are the three pillars of a privileged investigation record.
Privilege does not mean concealment. BIS does not expect companies to disclose privileged investigation materials in a VSD. What it expects is an accurate and complete account of the facts, the controls applicable to those facts, and the remediation taken. The investigation findings inform that account; the privileged record remains protected.
One practical point: in cross-border investigations involving EU-based employees or entities, the scope of legal professional privilege differs. EU competition law privilege rules, and the rules in some EU member states, do not recognise privilege for in-house counsel advice in the same way US or English law does. The investigation architecture must account for that from the start – not as an afterthought when a national authority requests documents.
Step 6: Build the remediation package
Remediation is not a formality. For BIS, a credible and already-implemented remediation programme is one of the most important mitigating factors in any enforcement outcome. Remediation announced before an investigation is complete carries less weight than remediation that was designed, implemented, and tested before the final VSD submission was filed.
An effective remediation package addresses the root cause of the apparent violation, not just its symptoms. If the issue arose from a mis-classification of an item's ECCN, the fix is not a one-off review of the item in question – it is a reclassification audit of the full product range, a training programme for the people who make classification decisions, and a quality-control check on the classification process going forward. If the issue arose from a failure to screen an end-user against the Entity List before completing a transaction, the fix requires an examination of how and when screening is triggered in the order-management process, not simply a confirmation that the specific end-user is now screened.
In a recent matter, a manufacturing business discovered during an internal audit that its logistics team had processed a small number of re-exports through an intermediary without confirming that the re-exporter held the necessary EAR authorisation. We assisted the client to scope the transactions, assess VSD eligibility, and build a remediation programme that included revised contractual controls on intermediaries, enhanced end-use verification procedures, and a targeted training programme for the commercial and logistics teams. The programme was substantially implemented before the final VSD submission was filed.
Remediation must also address any cross-border dimension. If an EU subsidiary was involved, its compliance programme – including its approach to EU dual-use classification, end-user screening, and catch-all controls – should be reviewed and strengthened in parallel. See also our cross-border internal investigation guide for a full account of how to co-ordinate parallel investigations across multiple regimes.
Risk flags: when the investigation changes character
Certain findings in a BIS / EAR internal investigation alter the risk profile materially and should prompt immediate escalation to senior management and external counsel. Recognising these inflection points early is what separates a managed enforcement outcome from a disorderly one.
The first is evidence of wilfulness. If the investigation reveals that compliance concerns were raised and overridden, that a red flag was documented and then deliberately set aside, or that a manager directed a transaction to proceed despite a known licence requirement, the matter has potential criminal dimensions. The DOJ has jurisdiction over wilful export-control violations. The moment evidence of intent surfaces, the investigation must be reconfigured to reflect that reality.
The second is the involvement of a party on the Denied Persons List. Transactions with denied persons are prohibited without exception. If an investigation reveals that such a transaction occurred, the severity of the exposure is near-maximum. An immediate legal assessment of the disclosure position – and of any parallel exposure under OFAC or other sanctions regimes – is required.
The third is a parallel OFAC dimension. Export-control violations and financial-sanctions violations often arise from the same transaction. A controlled item shipped to an embargoed destination without a BIS licence may also be a prohibited transaction under an OFAC programme. The two regimes have different penalty structures, different VSD processes, and different timelines. Running two parallel VSDs requires careful co-ordination so that the factual record in each is consistent and neither disclosure prejudices the other.
A fourth flag is the involvement of a senior officer or director. Investigations implicating a member of the board or executive team require a separate governance structure – typically an investigation committee of independent directors – to avoid conflicts between the company's interest in a managed resolution and the personal interests of the implicated individual.
Common objections – and what practitioners actually see
One persistent myth in BIS / EAR investigations is that a voluntary self-disclosure always results in a materially better outcome, so the decision is straightforward. It is not. A poorly structured or incomplete VSD – one that is filed before the investigation is complete, one that understates the scope of the conduct, or one that does not accurately describe the applicable controls – can be treated as an aggravating factor rather than a mitigating one.
The corollary myth is that self-disclosure is never worth it because BIS "rarely finds out anyway". That position has become increasingly untenable. BIS's enforcement resources have grown. Customs data, third-country regulatory co-operation, and financial-intelligence sharing mean that the probability of independent discovery is meaningfully higher than it was a decade ago. A company that sits on a known violation and is then investigated faces a significantly worse starting position than one that filed a timely VSD, even an imperfect one.
What practitioners see in practice is a spectrum of outcomes that correlates strongly with the quality of the investigation, the completeness of the remediation, and the timeliness of the disclosure. The investigation process described in this guide is the mechanism that produces the factual record on which all three of those determinants depend.
Related practices
- Apparent violation assessment – EU sanctions and export controls – parallel assessment when the same facts engage EU dual-use or sanctions rules
- Internal investigation guide – Canada – how the SEMA regime compares and where disclosure obligations diverge
- Cross-border internal investigation guide – co-ordinating parallel investigations across multiple regimes simultaneously