A freight forwarder based in the Netherlands ships electronic components to a distributor in a third market. Months later, a BIS notice of investigation lands in the legal department. The components had a US-origin content above the applicable threshold. The forwarder had no licence. The compliance team now faces a multi-stage US enforcement process it has never encountered before – and the clock is already running.
Penalty defence and settlement under the Export Administration Regulations (EAR, the US export-control rules administered by the Bureau of Industry and Security, or BIS) follows a defined procedural sequence: from the initial agency inquiry through charging, a penalty negotiation, and a final settlement order. The outcome turns on the quality of the legal and factual record assembled in the earliest stages. A well-prepared response, submitted to BIS before charging decisions are made, is the most effective lever a respondent holds.
This guide walks through each stage of a BIS / EAR enforcement matter, explains where the major mitigating factors are earned or lost, and sets out how the process compares with analogous regimes in the UK and EU. As of March 2026, BIS enforcement activity across dual-use and advanced-technology sectors remains at an elevated level; the steps below are drawn from current procedural guidance and active practice.
What authority does BIS hold and what triggers an enforcement action?
BIS administers the EAR under authority derived from the Export Control Reform Act and IEEPA. It can impose civil penalties, seek criminal referrals to the Department of Justice, and place individuals and entities on the Entity List (a list of foreign parties subject to licence requirements beyond the standard EAR rules) or the Denied Persons List (parties prohibited from participating in any EAR-controlled transaction). An enforcement matter typically begins in one of three ways: a voluntary self-disclosure by the exporter, a tip or referral from another agency, or a transactional audit triggered by end-use checks or commodity jurisdiction review.
The distinction between a civil matter and a criminal referral is made early. BIS handles the civil track. DOJ handles criminal prosecution, typically for wilful violations involving national-security-controlled items. In our cross-border practice, we see the civil track far more frequently for multinationals that have identified a systemic classification error or a missed licence requirement. Criminal exposure is reserved for conduct that BIS characterises as deliberate or showing conscious disregard of the rules. Knowing which track you are on – and why – shapes every subsequent decision.
Step 1: Scope the apparent violation before you respond
The first step in any BIS / EAR penalty defence is to define the boundaries of the apparent violation before submitting anything to the agency. That sounds straightforward, but it is the step most businesses get wrong. A compliance officer who identifies one unlicensed shipment and assumes it is isolated is taking a risk; experience consistently shows that a single identified transaction points to a classification gap or a screening failure that extends across multiple shipments and counterparties.
Scoping requires pulling the transaction record, the Export Control Classification Number (ECCN, the classification code under the Commerce Control List that determines whether a licence is required) for each item shipped, the end-use certificates or screening records, and the contractual chain back to the US-origin supplier. Where items have an ECCN that attracts controls for national-security, anti-terrorism, or regional-stability reasons, the analysis of whether a licence exception applied must be reconstructed transaction by transaction.
A scoping exercise is not just internal housekeeping. BIS weighs the quality of a company's internal investigation when it assesses mitigating factors. A shallow review that misses related violations – and is later contradicted by BIS's own evidence – is treated as evidence of a poor compliance posture, which aggravates the penalty rather than reducing it. Do you have a documented record of what was shipped, to whom, under what ECCN, and on what licence-exception basis?
Step 2: Decide whether to make a voluntary self-disclosure
A voluntary self-disclosure (VSD, a proactive submission to BIS disclosing an apparent violation before the agency independently discovers it) is the single largest mitigating factor available in a BIS enforcement matter. BIS guidance treats a timely, complete, and accurate VSD as a basis for a substantially reduced civil penalty and, in many cases, a warning letter rather than a penalty order. The mitigation is not automatic; it depends on the quality of the disclosure and the seriousness of the underlying conduct.
The procedural mechanics matter. A VSD should be submitted to the Office of Export Enforcement within a reasonable period of discovering the apparent violation. It should identify the items, the ECCNs, the destinations, the parties, and the facts that explain why the licence requirement was not met. A VSD that omits transactions later discovered by BIS destroys the mitigating value of the disclosure and may be treated as worse than no disclosure at all.
Not every apparent violation warrants a VSD. Where the items involved are classified as EAR99 (items subject to the EAR but not listed on the Commerce Control List and therefore carrying the lowest control level), the violation involves only a procedural defect rather than a substantive export-control failure, and the destination and end-user present no elevated risk profile, a VSD may not be the proportionate response. The decision requires a careful assessment of the aggravating and mitigating factors as BIS applies them, before anything is submitted. We regularly advise clients on this exact threshold – because the choice has lasting consequences.
The position above covers the standard case. Your facts – the counterparty, the goods, the ECCN, the destination, and what your records show – change the analysis materially. For an initial confidential assessment of whether a VSD is the right step in your matter, contact Calder & Vance at info@caldervance.com.
Step 3: Respond to a charging letter and build the mitigation record
If BIS concludes that the conduct warrants formal enforcement, it issues a charging letter setting out the alleged violations and the proposed civil penalty. The respondent has the right to respond in writing, and that response is the cornerstone of the penalty defence. It is the document that the Office of Chief Counsel at BIS will read when deciding whether to settle, reduce, or proceed to a formal administrative hearing.
A strong response to a charging letter does five things. First, it challenges any factual assertions by BIS that are incorrect or incomplete – including the ECCN classification, the licence-exception analysis, and the characterisation of the counterparty's end-use profile. Second, it presents the full mitigation record: the VSD (if one was filed), the company's compliance programme, remedial steps already taken, cooperation with BIS during the investigation, and the absence of prior violations. Third, it contextualises the conduct within the company's overall compliance posture rather than treating each shipment as an isolated event. Fourth, it makes the proportionality argument: the proposed penalty against the economic value of the transactions and the realistic harm to export-control objectives. Fifth, it signals willingness to settle – because settlement, rather than a formal hearing, is the norm in the civil track.
What the response must not do is overstate the remediation that has actually occurred, make commitments the business cannot keep, or characterise the violation in a way that is later contradicted by the company's own records. BIS has seen every mitigation argument many times. Credibility is earned through documentary precision, not narrative flourish.
Step 4: Negotiate settlement terms and understand what BIS is weighing
Settlement negotiations with BIS occur at the Office of Chief Counsel level. The agency applies a structured analytical approach: it identifies the base penalty for each violation, applies its published aggravating and mitigating factor matrix, and arrives at a settlement range. The respondent's task is to present the factual and legal record that pushes the analysis toward the low end of that range – or, in appropriate cases, toward a warning letter rather than a penalty order.
The key aggravating factors are: items controlled for national-security reasons at a high level; destinations or end-users that raise proliferation or diversion concerns; a large number of violations; evidence that the responsible employee was aware of the licence requirement; and a prior enforcement history with BIS. The mitigating factors are: a timely, complete VSD; a strong pre-existing compliance programme; full cooperation; prompt remediation; and the absence of any harm to US national-security objectives in fact.
Settlement terms typically include a civil monetary penalty, enhanced compliance reporting obligations for a defined period, and sometimes an independent audit requirement. In more serious matters, BIS may require the business to engage an external export-control compliance officer under a settlement agreement. None of those terms is fixed; all are negotiable within limits that the case record determines.
Is the proposed settlement figure the agency's final word? Not necessarily. In our experience, a well-constructed mitigation record submitted promptly – before the charging letter is issued, where possible – narrows the penalty range before formal negotiations begin. The best outcomes in BIS penalty matters are built before the charging letter arrives, not after.
If a notice has already been received, or a charging letter is expected, an early review of the factual record preserves options that narrow rapidly once formal proceedings begin. Contact Calder & Vance at info@caldervance.com for a confidential assessment.
Step 5: Implement the remediation programme that supports the settlement
A settlement with BIS is not the end of the matter. The settlement order will specify compliance obligations that the business must meet during a defined monitoring period. These typically include enhanced screening of transactions against the Entity List and Denied Persons List, periodic internal audits of classification and licence-exception determinations, and mandatory reporting of any subsequent apparent violations. Failure to meet these obligations during the monitoring period is itself an aggravating factor in any future enforcement matter – and may constitute a separate breach of the settlement agreement.
Effective remediation addresses the root cause of the original violation. If the failure was a classification error, the remediation programme redesigns the classification process and provides documented training. If it was a counterparty-screening gap, the programme rebuilds the screening logic to catch Entity List parties, the Denied Persons List, and – critically – the MEU List (the Military End User List, which imposes enhanced licence requirements for exports to listed parties in defined destinations). If the failure was a contractual gap in the supply chain, the programme adds destination-control statement requirements and end-use certificate controls to the standard terms of sale.
We have acted for businesses across the manufacturing, technology, and logistics sectors in designing post-settlement compliance programmes that meet BIS's requirements and withstand the scrutiny of the monitoring period. The programme must be documented, testable, and proportionate to the actual risk profile of the business – not a generic checklist that satisfies the letter of the settlement while leaving the underlying risks in place.
Cross-regime comparison: how does BIS enforcement differ from OFSI and the EU?
A BIS / EAR enforcement matter sits within a wider cross-border enforcement environment that any multinational must understand. Three divergences are material for a business operating across the UK, EU, and US simultaneously.
First, the VSD mechanism in the UK differs from the BIS model. OFSI – the Office of Financial Sanctions Implementation – has its own reporting obligation and a separate voluntary disclosure framework under SAMLA and OFSI's enforcement guidance. The mitigation logic is similar: a prompt, complete, and accurate report is weighted in the respondent's favour. But OFSI's enforcement posture and the penalty range differ from BIS's, and the two disclosures must be managed independently. A single disclosure covering both jurisdictions is not available; the submissions must be calibrated to each regime separately.
Second, under the EU, the enforcement of export-control violations occurs at the member-state level under the dual-use rules rather than through a single centralised authority. The EU does not have a BIS equivalent with pan-EU enforcement power over export controls. Businesses operating through multiple EU entities face a patchwork of national enforcement authorities, and the penalty and procedural standards vary materially between member states. The EU Blocking Regulation adds a further layer for businesses with US-nexus exposure who must manage obligations running in opposite directions.
Third, the extraterritorial reach of the EAR is a category of exposure that neither OFSI nor the EU export-control regime replicates in the same way. The de minimis rule (which brings foreign-made items within EAR jurisdiction when US-controlled content exceeds a defined percentage threshold) and the foreign direct product rule (which extends jurisdiction to foreign-produced items derived from certain US technology or software) mean that a company with no US operations, no US employees, and no US assets can nonetheless face BIS enforcement if its products contain sufficient US-controlled content or technology. In our practice, this is the point that surprises non-US businesses most. See also our guide on penalty defence and settlement in cross-border matters for a fuller treatment of how these extraterritorial rules operate across regimes.
The divergence has a practical consequence: a single transaction that triggers BIS enforcement may also trigger parallel reviews under OFSI (if a US-sanctioned party is involved), under the relevant EU national authority (if an EU affiliate shipped the goods), and under the local export-control regime of the destination market. Managing those parallel processes requires coordinated advice across jurisdictions, with clear instruction boundaries between each set of advisers and a consistent factual record across all responses. For matters with an EU enforcement dimension, see our service on apparent violation assessment under EU rules.
Common risk flags and the myth that size determines outcome
Several patterns recur in BIS enforcement matters that a compliance team should treat as early-warning signals. The most common is the gap between the company's stated ECCN classification and the actual technical parameters of the item – a gap that arises most frequently when product specifications change without a corresponding review of the classification. A component that was EAR99 at the time of initial classification may migrate to a controlled ECCN after a design revision. Classification is not a one-time exercise; it must track the product lifecycle.
The second risk flag is reliance on licence exceptions without adequate documentation. Licence exceptions under the EAR require specific conditions to be met at the time of export. Where the conditions are satisfied but not documented, BIS treats the exception as unavailable – because the exporter cannot demonstrate, after the fact, that the conditions were present. Documentation is not bureaucratic overhead; it is the legal proof that the exception applied.
The third risk flag is supply-chain opacity. Businesses that ship through distributors or freight forwarders without adequate end-use controls are exposed when the intermediary routes goods to a party or destination that would have required a licence. The EAR's know your customer obligation is not satisfied by a single upfront screening. It requires ongoing monitoring and clear contractual mechanisms to prevent re-export to prohibited destinations.
A common objection we hear is that only large companies with significant US export volumes attract BIS scrutiny. That is not accurate. BIS enforcement targets the nature of the item, the destination, and the end-user profile – not the size of the exporter. A small manufacturer of a specialised electronic component that inadvertently exports to a party on the Entity List faces the same analytical framework as a major defence supplier. The penalty range scales with the volume and seriousness of the violations, but the enforcement trigger does not. Size does not create a de facto safe harbour. For those assessing how Canada's comparable enforcement regime compares, our guide on penalty defence and settlement under the Canadian regime sets out the parallel process in detail.
Related practices
- Apparent violation assessment – EU – evaluating potential violations under EU dual-use and sanctions rules
- Penalty defence and settlement – Canada guide – step-by-step guide to the Canadian enforcement and settlement process