A technology distributor headquartered in North America receives a purchase order from a distributor in a third country. The goods are commercial components – sensors, integrated circuits, ruggedised connectors. The buyer's end-use certificate reads "industrial automation." Two months later, a compliance officer discovers that the same buyer supplies a state defence ministry in the same jurisdiction. Does the original export comply? Could it have? These questions carry criminal as well as civil consequences under United States law.
Military end-use rules under OFAC operate alongside – and are reinforced by – controls administered by the US Department of Commerce Bureau of Industry and Security (BIS). As of May 2026, OFAC's sanctions programmes can prohibit the supply of goods, technology, and services to military, intelligence, or defence entities irrespective of whether the item sits on a commerce control list. The correct analysis examines both regimes simultaneously.
This guide sets out the governing authority, the analytical steps, the divergence between the US and comparator regimes, and the risk flags that most frequently lead to enforcement referrals.
Step 1: Map the governing authority and the legal basis
Military end-use controls under OFAC rest on the general prohibition embedded in each sanctions programme established under the International Emergency Economic Powers Act (IEEPA): no US person, and no person subject to US jurisdiction, may engage in a transaction with a target in a designated country or with a designated entity without a licence. Where a military or defence entity in a sanctioned country is the end-user, the prohibition typically attaches automatically, regardless of whether the intermediate commercial buyer appears on a list.
The critical concept is that OFAC's prohibitions follow the transaction, not just the named counterparty. A supply chain structured so that a commercial intermediary sits between the US exporter and the military end-user does not dissolve the prohibition; OFAC's guidance under the relevant thematic regulations makes clear that a US person who knows or has reason to know of the military end destination remains exposed. In our experience, the most common structural error is treating the OFAC analysis as complete once the immediate buyer clears screening.
Alongside OFAC, BIS administers the Military End-Use (MEU) and Military End-User (MEU) rules under the Export Administration Regulations (EAR). Those rules impose separate licence requirements for items classified to certain export control classification numbers (ECCNs) when destined for military end-use or military end-users in specified countries. The two regimes are cumulative: clearing one does not resolve the other, and the stricter prohibition governs.
Step 2: Identify whether the transaction has a nexus to a sanctioned military or defence entity
Identifying a military or defence nexus is a factual inquiry that goes well beyond consulting the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) and the Entity List (BIS's list of persons subject to enhanced licensing requirements). Both lists are necessary but not sufficient starting points. A buyer may be unlisted but wholly owned by a designated entity; an ostensibly civilian buyer may procure exclusively for a listed military body.
The standard screening workflow should include four parallel checks.
- Direct-list screening: confirm the buyer and all known affiliates against the SDN List, the Entity List, the Consolidated Screening List, and the UN Security Council Consolidated List.
- Ownership and control: apply the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked, whether the holding is direct or layered). Under EU and UK rules a control test supplements ownership, but under OFAC the 50 percent threshold is the operative trigger.
- End-use certificate review: assess whether the declared end-use is plausible given the buyer's sector, product portfolio, and known customer base. Implausible declared end-uses are a common red flag in enforcement cases.
- Open-source and commercial intelligence: cross-reference the buyer against publicly available corporate registries, procurement records, and defence-ministry supplier directories in the destination country.
Where the inquiry produces ambiguity rather than a clear green light, the correct step is a documented escalation before the transaction is approved, not after it has shipped.
Step 3: Apply the cross-regime analysis – where OFAC, BIS, and comparator rules interact
No military end-use analysis is complete without mapping the interaction between OFAC's sanctions prohibitions and BIS's export-control rules under the EAR. The two regimes share an enforcement ecosystem but operate on different legal bases and trigger at different points.
OFAC's prohibitions are transaction-based and territory-oriented: they prohibit dealings with named regimes and named persons, without reference to the technical classification of the goods. BIS's MEU rules are item-based and entity-oriented: they attach to specific items with controlled classifications when moving to military end-users or for military end-use in designated countries. A commercial item with a very low or nil ECCN classification may still be fully blocked under OFAC if it is destined for a sanctioned country's defence establishment.
Comparator regimes add further layers for cross-border groups. The United Kingdom's Export Control Order, administered by the Export Control Joint Unit (ECJU), imposes military end-use controls that can reach items not on the UK control lists when the exporter has knowledge of a military end-use destination. The EU's dual-use rules similarly provide for catch-all controls that activate when an exporter has knowledge or grounds to suspect that items are intended for military use in designated countries. In our cross-border practice, groups with EU or UK subsidiaries regularly discover that a transaction the US parent has assessed under OFAC must also be cleared under UK and EU catch-all controls independently. The two analyses can reach different conclusions – and both outcomes bind the relevant entity.
The principle that applies across all regimes: where two or more sets of controls apply to the same transaction, the stricter prohibition governs. A licence from one authority does not authorise the transaction under another.
The position above covers the standard multi-regime case. Your facts – the counterparty, the goods, the route, the specific regime in play – change the analysis. For an assessment of your exposure under OFAC and the applicable comparator regime, contact Calder & Vance at info@caldervance.com.
Step 4: Conduct enhanced due diligence on the supply chain
Military end-use cases turn on supply-chain depth. The immediate buyer is rarely the end-user in complex procurement chains, and enforcement actions consistently involve situations where the ultimate military destination was visible at an intermediate tier that the exporter did not reach in its diligence.
Enhanced due diligence for military end-use purposes means working through the chain to the point where a credible end-use determination can be made. That ordinarily requires the following steps.
- Obtain a detailed end-use statement, specifying the product application, the site of installation or use, and the identity of the operator. Vague statements referring to "industrial" or "commercial" use without further specification are insufficient where the risk profile is elevated.
- Verify the buyer's business model. A buyer claiming industrial automation as the end-use should be able to demonstrate a corresponding customer base. Absence of verifiable commercial customers is a strong indicator that the declared end-use is not accurate.
- Screen the buyer's known customers and affiliates against the relevant lists. Where a buyer's primary customers include entities with known defence procurement roles, that fact is material to the end-use assessment.
- Conduct site visits or appoint local counsel in the relevant jurisdiction to verify the buyer's premises and operations for high-value or high-risk transactions.
- Document every step. Under both OFAC and BIS, record-keeping obligations require that transaction records be maintained for a prescribed period. Documenting the diligence process contemporaneously is essential both for compliance purposes and for any subsequent enforcement defence. Verify the applicable record-keeping period under the current rules before relying on a specific figure.
What happens when enhanced diligence surfaces a credible military end-use risk mid-transaction? The options narrow quickly. Continuing without resolution exposes the exporter to the full range of civil and criminal penalties. Pausing to seek a licence or a legal opinion is the correct step, even at the cost of a commercial delay.
Step 5: Assess licensing options and the voluntary self-disclosure route
Where a military end-use creates a prohibition, the lawful routes are limited but real. OFAC issues specific licences (case-by-case authorisations for otherwise prohibited transactions) and, in some programmes, general licences (standing authorisations permitting defined categories of transactions). For transactions involving military or defence entities in fully sanctioned countries, general licences that would cover the activity are uncommon; the analysis typically turns on whether a specific licence application is viable.
A specific licence application under OFAC must articulate the transaction in detail, identify the parties, describe the goods and their end-use, and make the policy case for why authorisation is appropriate. OFAC's review timelines vary by programme and by the complexity of the case. In our experience, applications that lack a clear policy rationale or that present incomplete ownership information are frequently returned for supplementation, adding materially to the overall timeline. Prepare the application file thoroughly before submission.
Under BIS, MEU licence applications follow a parallel process with their own evidentiary requirements. Where both OFAC and BIS licences are required, the applications should be coordinated: inconsistent representations to the two agencies carry their own risk.
Where a transaction or a prior shipment has already occurred without the required authorisation, the question of voluntary self-disclosure (VSD – the mechanism by which a company reports an apparent violation to the regulator proactively) arises. Both OFAC and BIS maintain VSD programmes. A timely and complete VSD is a significant mitigating factor in penalty calculations under both agencies' enforcement guidelines. It does not eliminate civil liability, but it materially changes the penalty calculus. Critically, the decision whether to file a VSD, and how to frame it, requires legal advice before any submission is made.
If a transaction has already been flagged, or an apparent violation has been identified internally, an early legal review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential assessment.
Common risk flags and the myth of the "commercial grade" safe harbour
In our practice, the most persistent misconception is that items classified as "commercial grade" – consumer-standard specifications, widely available, without a specialised ECCN – are categorically exempt from military end-use scrutiny. This is incorrect.
OFAC's prohibitions do not depend on item classification. If the end-user is a military or defence entity in a sanctioned country, the transaction is prohibited regardless of whether the goods are listed on any control schedule. The "commercial grade" characterisation is relevant to BIS controls and ECCN-based licensing requirements; it has no equivalent carve-out in OFAC's programme-based prohibitions.
A related risk flag: the multiple-intermediary chain. Where the supply route passes through two or more intermediate buyers, each nominally commercial, before reaching the ultimate end-user, the chain can appear clean at every individual link while the aggregate destination is prohibited. Enforcement agencies have a clear pattern of working backward through chains of this type. Each link's compliance team should be screening the route, not just its immediate counterparty.
Other recurring risk flags that practitioners encounter include:
- Payment routing through third countries or through entities unconnected to the commercial transaction.
- Requests for atypical packaging, labelling changes, or modifications to documentation that would obscure the identity of the originating supplier.
- Buyers who decline to provide end-use certificates or who resist contractual end-use undertakings.
- Orders for quantities that exceed the buyer's plausible commercial need.
- Shipping routes that include transshipment hubs associated with known diversion activity.
Each of these flags, taken alone, requires further enquiry. Several together, in the context of a buyer with limited verifiable commercial activity, produce a risk profile that cannot be managed by standard screening alone.
When to involve counsel and how Calder & Vance assists
The threshold for involving external sanctions and export-control counsel is lower than most compliance teams assume. Counsel should be consulted before approval of a transaction where any of the following conditions are present: the goods are destined for a country subject to a US sanctions programme; the buyer has any known connection to a government ministry or state-owned enterprise; the declared end-use cannot be independently verified; a due-diligence inquiry has surfaced a concern that has not been resolved; or any party to the chain has declined to provide documentation that would be standard in a comparable commercial transaction.
In a recent matter, a manufacturing business supplying commercial industrial equipment through a regional distributor discovered, during a routine compliance audit, that a portion of its shipments over the preceding period had reached a state-affiliated procurement entity in a country subject to a US sanctions programme. We scoped the apparent violations, assessed the record of each transaction against the applicable programme, and coordinated a voluntary self-disclosure that addressed both the OFAC exposure and the parallel BIS question. The matter resolved without formal enforcement action. That outcome is not guaranteed in any similar case, but the early and structured approach materially changes the available options.
For clients who have not yet encountered a problem but want to stress-test their controls, we assess screening logic against the specific risk profile of the product line and the customer base, map the ownership chain of high-risk counterparties, and recommend programme adjustments calibrated to the actual exposure. We also assist with licence applications under both OFAC and BIS, and with the coordination of those applications where a transaction requires clearance from both agencies.
Related practices
- Deemed export and technology controls under BIS and the EAR – advice on technology transfer, deemed-export licences, and classification under the Commerce Control List.
- Military end-use rules under OFSI – a parallel guide covering the UK regime's treatment of military end-use and the ECJU catch-all controls.
- Military end-use rules under OFSI: advanced issues – deeper analysis of UK military end-use questions for complex cross-border supply chains.