Remediation after a sanctions breach under BIS / EAR: step by step

An export compliance team at a trading house discovers that a shipment cleared customs three months ago – but the end-use declaration now looks wrong. The exporter's internal review confirms the item was controlled under the Export Administration Regulations (EAR) and the licence exception relied upon did not apply. The shipment is an apparent violation. What happens next, and in what order, determines whether this becomes a civil settlement or a criminal referral.

Remediation after a sanctions breach under BIS / EAR follows a defined sequence: scope the apparent violation, preserve evidence, conduct a legal-privilege-protected internal review, assess voluntary self-disclosure eligibility, file the disclosure, and rebuild the compliance programme. The governing authority is the Bureau of Industry and Security (BIS), operating under the Export Control Reform Act and the EAR. How quickly and thoroughly a business moves through these steps materially affects the penalty outcome.

This guide walks through each stage, identifies the risk flags that derail remediation, and flags where the BIS / EAR process diverges from OFAC, OFSI, and the EU – because many apparent violations carry cross-border exposure that must be managed in parallel.

Step 1: Contain and preserve – the first hours matter

The immediate priority after identifying an apparent EAR violation is to stop ongoing exposure and secure the record. Do not delete, overwrite, or transfer any document, communication, or data that relates to the transaction in question. Preservation is not optional; destruction of records after a potential violation comes to light can transform a civil matter into an obstruction issue.

In our experience, the first response is often the most damaging phase – not because of what the exporter did, but because of what it does in the hours after discovery. A compliance officer who immediately emails the commercial team with a plain-language summary of the problem has potentially waived privilege over that communication. The internal notification path should go to legal counsel first, not to operations or sales.

Practical containment steps:

• Place a litigation hold on all records touching the transaction – emails, shipping documents, end-use certificates, and any internal approval memos.
• Suspend any pending shipments to the same counterparty or under the same licence exception until the review is complete.
• Identify all jurisdictions whose rules may apply (see Step 4 on cross-border exposure).
• Notify in-house legal counsel or instruct external sanctions counsel before any further action.

Record-keeping under the EAR requires businesses to retain relevant export records for a defined period. As a working assumption, treat the retention obligation as running from the latest of the transaction date and any enforcement contact. Verify the current position before relying on any specific period.

Step 2: Scope the apparent violation – what exactly occurred?

Scoping means establishing, under legal privilege, precisely what happened: which items, which destinations, which end-users, which licence exceptions were relied upon, and which EAR obligations were not met. This factual map drives every subsequent decision.

Begin with the classification question. Was the item correctly classified against the Commerce Control List (CCL)? An item that was misclassified as EAR99 (no Export Control Classification Number, no licence required) when it in fact carries an ECCN (Export Control Classification Number under the US Commerce Control List) – and therefore a licence requirement for the destination – is a common starting point for BIS apparent violations. Classification errors often run across multiple shipments, not just one.

Next, map the parties. Does the counterparty, end-user, or intermediate freight forwarder appear on BIS's Entity List (a list of parties to whom exports are restricted or prohibited without a specific licence), the Denied Persons List, or the Unverified List? A party-screening failure adds a separate legal issue to a classification error.

Scope also the period. If a licence exception was systematically misapplied, the apparent violation may extend back over many shipments. BIS does not limit its review to the specific transaction that triggered the internal discovery.

The scoping exercise should produce a privilege-protected written chronology: dates, items, classifications applied, licence exceptions used, parties, and the basis on which each element was approved internally. That document becomes the foundation for the voluntary self-disclosure.

Step 3: Assess voluntary self-disclosure – is VSD the right path?

A voluntary self-disclosure (VSD – a formal notification to BIS of an apparent violation before the agency independently discovers it) is the single most consequential procedural decision in BIS / EAR remediation. BIS treats a timely, complete, and accurate VSD as a significant mitigating factor in penalty calculations. The decision is not automatic.

VSD is appropriate where the internal review has established, with reasonable confidence, that an apparent violation occurred and that BIS has not already initiated an investigation. It is not appropriate where the facts remain genuinely unclear, where there is a material risk of criminal exposure that would require Department of Justice co-ordination, or where the entity has reason to believe BIS has already identified the violation.

What makes a BIS VSD materially different from an OFAC voluntary self-disclosure? OFAC has published guidance treating a VSD as a strong mitigating factor capable of reducing a base penalty by a significant proportion. BIS operates under a comparable framework but with its own distinct procedure: an initial notification (sometimes called a "initial notification letter") is typically filed promptly, followed by a more detailed submission. The initial letter preserves the VSD credit while the full investigation is completed.

The position above covers the standard case. Your facts – the items involved, the end-users, the destinations, and the scope of the apparent violation – will change the analysis significantly.

For a confidential review of a potential BIS breach, contact Calder & Vance at info@caldervance.com.

Step 4: Cross-border exposure – where else does this bite?

A BIS / EAR apparent violation rarely sits in isolation. Cross-border exposure is the rule, not the exception, and managing it in parallel – not sequentially – is essential. Missing a parallel disclosure obligation in another jurisdiction can produce a compounded enforcement result.

Consider four common overlaps:

• OFAC: if the controlled item reached an OFAC-sanctioned country or person, or if a US-dollar payment was involved, the same transaction may constitute an OFAC sanctions violation. OFAC and BIS are separate agencies with separate enforcement tracks. A BIS VSD does not satisfy OFAC's disclosure process, and vice versa.
• OFSI and ECJU (UK): UK exporters or UK-incorporated intermediaries in the transaction chain may have their own licensing obligations under the Export Control Order. OFSI's financial sanctions exposure attaches separately if UK-nexus payments or UK persons are involved.
• EU dual-use controls: EU-origin items or EU-based re-exporters may trigger the EU dual-use rules. The EU regime is administered at member-state level, so the specific authority depends on the country of export. Divergence between BIS and EU classification is common – an item may require a licence under the EAR but not under the applicable EU category, or the reverse.
• Extraterritorial reach: BIS's de minimis rules and foreign-direct product rules can extend EAR jurisdiction to shipments by non-US companies using US-origin technology or US-made equipment in production. If the exporter in the apparent violation is not itself a US entity, it may still be subject to EAR obligations and therefore to BIS jurisdiction.

In our cross-border practice, we regularly advise clients whose initial apparent violation under one regime expands, on proper analysis, into a multi-regime matter requiring co-ordinated disclosures. Identifying all affected regimes at the scoping stage – Step 2 – prevents the most serious form of remediation failure: a disclosure that is accurate but incomplete because it addressed only one regulatory track.

For businesses operating across the EU and UK, our parallel analysis of EU apparent-violation procedures is available at apparent violation assessment under EU sanctions and export controls. For Canadian cross-border exposure, the equivalent guide is at post-breach remediation under Canadian export-control and sanctions rules.

Step 5: File the disclosure and manage the BIS review

Once the decision to file a VSD is made, the submission process has two stages: an initial notification and a final narrative submission. The initial notification should be filed promptly after the decision is taken – timeliness is part of the credit. It identifies the company, provides a brief description of the apparent violation, and states the intention to file a full submission. It does not need to resolve every factual question.

The full submission is the substantive document. It sets out:

1. The factual chronology of the apparent violation, including all relevant shipments, parties, and items.
2. The applicable EAR provisions and how they were not met – in generic terms, without reproducing regulatory text verbatim in a way that invites dispute about characterisation.
3. The root-cause analysis: why the violation occurred.
4. The remediation steps already taken or committed to, including specific programme changes.
5. Supporting documentation: shipping records, internal approvals, classification evidence, party-screening records.

BIS may accept the submission, request supplemental information, or in more serious cases refer the matter to its Office of Export Enforcement (OEE) for investigation. Where OEE investigates, the business should expect formal requests for documents and potentially for interviews with personnel. All responses to OEE in that process should be managed through counsel.

If a transaction has already been flagged by BIS, or a filing has been questioned, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com to discuss next steps.

Step 6: Root-cause analysis and programme remediation

A BIS submission that documents an apparent violation without credible programme remediation is treated less favourably than one that pairs the disclosure with concrete, implemented changes. Root-cause analysis and remediation are not an afterthought; they are part of the filing.

Root-cause analysis identifies the specific failure that produced the violation. Common categories in EAR matters:

• Classification failure: the item was not correctly assessed against the CCL, or the assessment was done by someone without the technical knowledge to do it accurately.
• Screening failure: the party-screening process did not cover the relevant lists, used stale data, or was applied only at the point of first engagement and not at shipment.
• Licence-exception misapplication: the exception was used for a transaction that did not meet all of its conditions.
• End-use control failure: the end-use certificate was obtained but not verified against shipment routing or delivery documentation.
• Training gap: the personnel responsible for export decisions did not have adequate EAR training.

Remediation maps directly to root cause. A classification failure requires a reclassification exercise across the product range, a written classification methodology, and a technical review process for new items. A screening failure requires updated list coverage, a re-screening trigger on shipment (not only on customer onboarding), and documented screening records. Each remediation commitment in the BIS submission should be specific – named system changes, named process owners, committed implementation dates.

We regularly advise businesses on programme redesign after an apparent violation. The remediation plan we help structure is written for two audiences simultaneously: the BIS reviewer assessing the submission, and the compliance committee that will be asked to fund and implement it.

Common mistakes that derail BIS / EAR remediation

The most frequent error is speed applied to the wrong task. Businesses move quickly to disclose before completing even a basic scope of the apparent violation. A VSD that understates the number of shipments or omits a related party-screening failure will require amendment – and an amended VSD that expands the scope of the violation is treated differently from one that got the facts right the first time.

Is your organisation prepared to identify all related shipments before the initial notification goes in? That question is worth pausing on before the submission is filed.

Other common errors:

• Privilege loss: conducting the internal review through business channels, not legal counsel, means the analysis can be obtained by BIS in a subsequent investigation.
• Incomplete cross-border analysis: filing a BIS VSD without assessing OFAC exposure (or UK / EU exposure) leaves parallel violations unaddressed.
• Remediation promises that are not delivered: BIS monitors committed remediation steps. A submission that promises a reclassification exercise within ninety days and then does not implement it is noted.
• Continuing violations during the review: failing to suspend shipments to the same counterparty or under the same licence exception while the investigation is live adds post-disclosure exposure.

One common misconception is worth addressing directly. Some businesses assume that because an item eventually reached a permitted end-user, or because no harm resulted, the violation is not serious. BIS does not require harm. The violation is the unauthorised export or the failed licence requirement; the destination and end-use affect aggravating and mitigating factors, not the underlying breach.

When does this require external counsel – and what do we do?

Not every apparent EAR violation requires external counsel from day one. A minor, isolated classification error with no party-screening issue, no sanctioned-country connection, and a clean compliance history can often be managed by a competent in-house team with access to reliable BIS guidance. The calculation changes when:

• The apparent violation involves military end-users, controlled items in sensitive technology categories, or parties on the Entity List.
• The scope analysis reveals multiple shipments or a systemic failure across a product line.
• There is potential OFAC, OFSI, or EU parallel exposure.
• BIS or OEE has already made contact – even informally.
• A criminal referral is possible (for example, where there is evidence of wilful conduct).
• The business lacks an established legal-privilege structure for the internal review.

At Calder & Vance, we scope the apparent violation, advise on voluntary self-disclosure eligibility, prepare and submit the BIS disclosure, manage OEE queries, and design the programme remediation. We also co-ordinate parallel OFAC, UK, and EU tracks where the same transaction carries multi-regime exposure. For matters with criminal dimension, we work alongside criminal-defence counsel.

For a full treatment of multi-regime post-breach remediation strategy, the cross-border guide is available at post-breach remediation: cross-border strategy guide.

In a recent matter, a manufacturer of precision equipment faced an apparent EAR violation after a reclassification exercise revealed that several export shipments had used a licence exception that did not cover the controlled parameter of the item. We conducted the privilege-protected scope review, assessed the OFAC parallel exposure (which did not apply), prepared and filed the BIS VSD, and redesigned the classification and screening process. The matter was resolved through the civil enforcement track.

Related practices

• Apparent violation assessment – EU sanctions and export controls – parallel analysis for EU-regime apparent violations and disclosure obligations
• Post-breach remediation – Canada – step-by-step guide for apparent violations under Canadian export-control and sanctions rules