A distributor based in Germany receives US-origin software from a domestic reseller. Months later, it routes part of that licence to a buyer in a third country. No application is made to the Bureau of Industry and Security. No one asks whether the software carries an Export Control Classification Number (ECCN – the code under the US Commerce Control List that determines which controls apply to an item). The original US exporter learns about the onward shipment through a compliance audit. At that point, the exposure is already theirs.
Re-export risk under the Export Administration Regulations (EAR – the US export-control rules administered by BIS) is real, pervasive, and frequently underestimated by businesses that never touch US soil. The EAR reaches any item that has US-origin content above a defined threshold, regardless of where it sits or who now holds title. As of May 2026, BIS enforcement of extraterritorial re-export violations is an active priority.
This guide walks through the classification step, the re-export trigger, the licence and licence-exception analysis, the comparisons with UK and EU controls that trip up cross-border supply chains, and the practical risk flags that counsel looks for first.
Step 1 – Understand the extraterritorial reach of the EAR
The EAR controls items wherever they are, once they carry US-origin character above defined thresholds – this is the core principle of re-export and extraterritorial reach under BIS / EAR that every non-US business must internalise before it moves goods or technology onward.
The regime operates on three categories of item. First, items physically exported from the United States. Second, foreign-produced items that incorporate US-controlled content above certain percentage thresholds – the de minimis rule. Third, foreign-produced items that are the direct product of certain US technology or software – the foreign direct product rule (FDPR). The FDPR has been expanded in recent years, and its current scope is broader than many compliance programmes assume. Verify the current position before relying on your last FDPR assessment.
A re-export, under the EAR, is a shipment of an EAR-controlled item from one foreign country to another. Transfer within a country of technology or source code to a national of a different country is a deemed re-export – treated as if the item moved across a border. That distinction matters enormously in a multinational with engineers from multiple countries in the same office. Does your HR function know which nationalities are working on US-origin technology?
In our experience, the most overlooked aspect of extraterritorial reach is the deemed re-export risk inside organisations. A single technology transfer within a foreign subsidiary – showing a controlled schematic to the wrong engineer – can constitute a re-export without a licence. Businesses that have mapped their physical shipments often have not mapped their internal knowledge flows.
Step 2 – Classify the item and confirm its ECCN
Classification is the gateway step: until you know the ECCN, you cannot determine whether a re-export licence is required or whether a licence exception is available.
The Commerce Control List assigns an ECCN to each controlled item. The ECCN is a five-character alphanumeric code. Items not listed on the CCL are classified as EAR99 – a residual category subject to the EAR but not to most licence requirements unless the end-use or end-user triggers a separate control. The common compliance error is to assume that EAR99 means no risk. An EAR99 item destined for a party on the Entity List (BIS's list of parties subject to enhanced licence requirements), or for a prohibited end-use, is still controlled.
Classification requires a technical review of the item against the CCL parameters – not a generic description, not the customs tariff code, and not the supplier's label. Where an item sits on the boundary between two ECCNs, the analysis turns on the most sensitive controlled characteristic. In our practice, we regularly see classification done at the commodity description level rather than at the parameter level, which routinely misses dual-use characteristics in items that look commercial on the surface.
For technology and software, the classification analysis must also address whether any licence exception covers the re-export. The Technology and Software – Unrestricted exception and the Technology and Software – Controlled exception have different eligibility conditions. Confirm which country group applies to the destination, which reason for control applies to the ECCN, and whether the transaction meets the conditions of the exception precisely – not approximately.
Related practice: our deemed export and technology transfer service covers the classification, licence requirement, and exception analysis for technology and software under the EAR.
Step 3 – Run the re-export licence and exception analysis
Once the ECCN is confirmed, the licence requirement analysis for a re-export follows the same logic as for an original export: identify the destination country group, the reason for control on the ECCN, and then check whether a licence exception applies – or whether a specific licence (a case-by-case BIS authorisation) is required.
BIS organises destinations into country groups. The treatment of a re-export depends, first, on which group the re-export destination sits in. An item that moved to a close-ally destination under a licence exception may face a fresh licence requirement on the next leg to a different destination. The exception used on the first leg does not automatically carry through.
Licence exceptions under the EAR are condition-specific. Each has its own scope, its own eligible destinations, its own end-use restrictions, and its own record-keeping requirements. An exporter relying on a licence exception for a re-export must verify that every condition is met at the time of the re-export – not only at the time the item left the United States. A changed end-user, a revised product use, or a shift in the end-user's status can break the exception eligibility mid-chain.
Where no exception applies, a specific licence application to BIS is required. BIS reviews applications against the Export Administration Regulations licensing policy and, where the item is subject to national-security or foreign-policy controls, against interagency review. Timelines for BIS licence applications vary and are not guaranteed; build realistic lead times into supply-chain planning and do not commit to a delivery date before the licence is in hand.
The position above covers the standard case. Your facts – the item, the destination, the end-user, the routing, and the ECCN – change the analysis materially. If your chain involves multiple hops through different country groups, or if the final destination is not the stated destination, the exposure profile changes at each node.
For an assessment of your re-export exposure under the EAR, contact Calder & Vance at info@caldervance.com.
Step 4 – Screen end-users and end-uses at every stage
An item that qualifies for a licence exception can still be prohibited if the end-user or end-use falls within one of the EAR's general prohibitions – the General Prohibitions that apply regardless of ECCN or destination.
The Entity List is the most operationally significant control. A re-export to any party on the Entity List requires a specific BIS licence, regardless of the ECCN. The Entity List is not static; BIS adds and modifies entries on a rolling basis. Screening must be current at the time of the re-export, not only at the time of the original transaction. In a supply chain where items were sold to a distributor months before re-export, the distributor's own customers must be screened at the point of onward shipment.
The Denied Persons List covers parties subject to an order denying US export privileges. Transacting with a denied person – directly or indirectly, including through an intermediary – is a General Prohibition. Compliance programmes that screen only on a transaction-by-transaction basis, rather than on a relationship basis, tend to miss intermediary involvement. The question is not only "is the buyer on a list?" but "is anyone in the chain on a list?"
End-use controls also bite independently of end-user status. The EAR prohibits certain end-uses – military end-use, weapons of mass destruction end-use – regardless of whether the end-user is listed. A red-flag inquiry standard applies: if there is reason to know that a prohibited end-use is intended, the transaction is prohibited. Willful blindness does not avoid liability.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow quickly. Contact us at info@caldervance.com to discuss next steps.
How does re-export risk under the EAR differ from UK and EU export controls?
The EAR's extraterritorial reach has no direct equivalent in UK or EU export controls – and that divergence is the central cross-border compliance risk for businesses operating under more than one regime.
UK export controls, administered by the Export Control Joint Unit (ECJU), apply to items exported from the United Kingdom or brokered by UK persons. They do not, as a general rule, assert jurisdiction over items that have left the UK based on UK-origin content in a subsequent shipment. An item that left the UK years ago under a valid open or specific licence is not, as a matter of UK law, subject to a fresh UK licence requirement when a foreign buyer re-exports it – unless a UK person is involved in arranging the transfer.
The EU dual-use regime under the applicable EU rules operates on a similar territorial basis. Exports from EU member states require authorisation under the applicable regulation; re-exports from non-EU countries of EU-origin goods are not generally caught by EU jurisdiction in the same way the FDPR operates. The EU does maintain catch-all controls, which can require a licence even for non-listed items where the exporter has reason to believe the goods may be used for certain prohibited purposes. But catch-all controls are end-use-triggered, not origin-triggered.
The practical implication is layered. A European manufacturer of a product with US-origin components above the de minimis threshold must comply with both its local controls and the EAR. The EAR may require a licence or impose an end-user restriction that the EU controls do not. Conversely, an EU catch-all concern may arise for an item that the EAR treats as EAR99. The stricter prohibition governs in each case; compliance counsel must run both analyses in parallel and advise on the intersection.
Canada's export-control regime, administered under the applicable national instruments, is similarly territorial in the basic re-export sense. However, Canada maintains specific controls on the re-export of US-origin controlled goods, as a result of bilateral commitments, and those controls interact with the EAR in a distinctive way. For a cross-border perspective on Canadian re-export controls, see our guide to re-export and extraterritorial reach under the Canadian regime.
For a broader cross-jurisdictional comparison, our cross-border re-export and extraterritoriality guide maps the divergences across the major regimes.
Step 5 – Identify and address the main risk flags
In our cross-border practice, certain patterns recur as the immediate risk flags in re-export matters. Recognising them early is the difference between a compliance finding and an enforcement referral.
The first risk flag is a distributor or reseller that does not itself classify the items it holds. If a foreign distributor received US-origin goods years ago and has never obtained an ECCN, it cannot determine whether a re-export licence is needed. Where we are instructed after a potential violation, the classification gap is often foundational – every subsequent transaction was done without knowing whether it was controlled.
The second flag is a transaction routing that passes through a third country to an ultimate destination the parties did not want to document. Compliance counsel identifies this pattern from the commercial documentation: freight routes inconsistent with the stated destination, contractual silence on end-use, or unusual payment routing. The EAR's red-flag standard applies to the exporter's actual and constructive knowledge; a compliance team that does not look does not escape liability for what it would have found.
The third flag is a change in end-user or end-use after the original export. An item exported lawfully under a licence exception to a foreign manufacturer may be re-exported by that manufacturer to a customer the original exporter never screened. The original licence exception does not run to the downstream buyer. Unless the distribution agreement contains effective re-export controls, with audit rights, the exporter has no practical visibility into where the item ends up.
A fourth flag that we see with increasing frequency is the FDPR gap: businesses that have updated their controls for direct exports but not reviewed whether their foreign-produced products are themselves subject to the EAR through the foreign direct product rule. If your product is made outside the United States using US equipment, US technology, or US software, the FDPR analysis is not optional.
Step 6 – Build and maintain the compliance controls
A one-time classification review is not a compliance programme. The EAR requires businesses that regularly export or re-export controlled items to maintain an internal compliance programme commensurate with their risk profile.
The minimum operational controls for re-export risk are: a current ECCN for every product line; a destination and end-user screen on every transaction at the time of the transaction; a written re-export clause in every distribution agreement, requiring the counterparty to comply with the EAR and to flow down the clause to its own customers; a process for reviewing and updating classifications when product specifications change; and a voluntary self-disclosure procedure (VSD – the mechanism for self-reporting apparent violations to BIS) for any apparent violation identified internally.
Record-keeping under the EAR is mandatory for all transactions involving EAR-controlled items, including those proceeding under a licence exception. Records must be maintained for the period the EAR specifies from the date of the export or re-export; verify the current period before relying on it. The records must cover the transaction documentation, the classification basis, the screen results, and any correspondence about end-use or end-user.
VSD is not an admission of culpability, but it is a significant step that requires careful preparation. The timing, scope, and framing of a VSD affects how BIS assesses the matter. In our experience, businesses that disclose promptly, accurately, and with a credible remediation plan receive more favourable treatment than those that disclose incompletely or late. Involve counsel before making a VSD, not after.
Related practices
- Deemed export and technology transfer – BIS / EAR – classification, licence requirement, and exception analysis for technology and software
- Re-export and extraterritorial reach – Canada – how the Canadian regime interacts with EAR re-export obligations
- Re-export and extraterritoriality – cross-border guide – a comparative map of the major regimes for cross-border businesses
Common misconceptions about re-export obligations
A persistent misconception is that the EAR is a US exporter's problem, not a foreign business's problem. That is incorrect. Any party that re-exports an item subject to the EAR – wherever incorporated, wherever located – is subject to EAR jurisdiction for that transaction. BIS has pursued enforcement actions against non-US businesses. The extraterritorial reach is not theoretical.
A second misconception is that if the original US exporter obtained a licence, the foreign buyer can re-export freely. A licence authorises the specific transaction it covers. It does not automatically authorise any onward shipment by the licensee. The re-export analysis runs fresh at each leg.
A third misconception is that EAR99 items carry no re-export risk. EAR99 items are subject to the General Prohibitions, to Entity List restrictions, to denied-party restrictions, and to end-use controls. The absence of an ECCN entry does not mean the absence of control – it means the control structure is different. In our practice, some of the most complex re-export matters involve EAR99 items destined for a party with Entity List status, precisely because the classification step was bypassed on the assumption there was nothing to check.
When should you involve export-control counsel?
Involve counsel before the transaction closes, not after the shipment departs. The moments where early instruction preserves the most options are: when a classification is genuinely uncertain; when the destination or end-user is in a country group or sector that raises controls questions; when a distribution agreement is being drafted and re-export controls need to be built in; when a potential violation has been identified internally; and when a BIS audit or inquiry arrives.
A micro-scenario from our practice: a manufacturing business in a third country was supplying industrial control components to a distribution network that included buyers in several markets. An internal review triggered by an acquisition uncovered that several components had been classified without a technical review, and that the reseller agreements contained no re-export clause. We conducted a classification review across the product range, identified two product lines that required a BIS licence for re-export to one destination, prepared a VSD for the apparent violations, and advised on the redesign of the distribution agreement. The matter was resolved without an escalated enforcement proceeding.
BIS can pursue civil penalties and criminal referrals for EAR violations. Civil penalties can reach significant amounts per violation, and each unlicensed re-export counts as a separate violation. Criminal exposure arises where there is willful conduct. The penalty calculus changes dramatically once a matter is under formal investigation; the window for voluntary disclosure closes at the point BIS opens an investigation independently.