A Singapore-based distributor purchases dual-use components from a German manufacturer. Twelve months later, those components are on-sold to a buyer in a third country. No one informed the German exporter. No one asked Brussels. The question that follows – whether the EU rules still apply to that second movement of goods – can determine whether the original transaction exposes the manufacturer to enforcement in Europe, regardless of where the re-export physically occurs.
Re-export and extraterritorial reach under EU export-control and sanctions rules are not theoretical concerns for multinationals. The EU dual-use regime imposes obligations that follow goods and technology beyond the first point of export, and EU financial-sanctions rules reach non-EU actors in ways that are often underestimated. As of May 2026, the EU's approach to extraterritorial application has become considerably more assertive, particularly in relation to items that may ultimately reach destinations of concern.
This guide explains the legal basis for the EU's reach beyond its borders, sets out the practical steps businesses must take at each stage of an export and re-export chain, and identifies the risk flags that should trigger immediate legal review. It also compares the EU position with those of OFAC and BIS, because the two regimes frequently apply to the same goods and the same actors simultaneously.
Step 1: Understand the legal basis for the EU's extraterritorial reach
The EU dual-use regime – established under the relevant Council regulation governing the control of exports, brokering, technical assistance, transit, and transfer of dual-use items – applies to any natural or legal person conducting export activities from the European Union. That scope is defined by the act of export, not by the nationality of the exporter. A non-EU company exporting from an EU member state is bound by EU rules. A wholly EU-owned subsidiary operating outside the EU is not directly subject to the EU regime for that subsidiary's own export acts, but its parent's licensing and compliance obligations remain.
The more complex extraterritorial question concerns re-exports of EU-origin goods. The EU regime does not operate a general re-export-licence requirement equivalent to the US re-export authorisation system under the Export Administration Regulations. However, the regime does require exporters to take reasonable steps to understand their goods' intended final destination and end-use. The catch-all control – which allows a member state competent authority to impose a licence requirement on items not otherwise controlled where there is awareness or grounds to suspect diversion to a problematic end-use – is an important mechanism here. It operates in personam: it attaches to the exporter who has the knowledge, not to the goods.
EU financial-sanctions regulations add a further layer. They apply to any person "within the Union", to EU nationals and to EU-incorporated entities wherever they are located, and – in most enacted sanctions regulations – to conduct wholly outside the Union if it is connected to a transaction processed in euros or involves goods cleared through an EU-based intermediary. In our experience, the euro-clearing nexus is the single most frequently overlooked extraterritoriality trigger for non-EU financial institutions.
Step 2: Classify your goods accurately before the first export
Correct classification under the EU Combined Nomenclature and the EU dual-use list is the foundation of every subsequent re-export analysis. A misclassification at the point of original export does not insulate the exporter from liability if the goods are later re-exported to a destination that would have required a licence.
Classification begins with the technical specification of the item against the relevant dual-use list entry. Most dual-use categories address both hardware parameters (throughput, frequency, accuracy) and software and technology that is specially designed or prepared for controlled applications. Technology transferred electronically – design files, source code, calibration data – is controlled in the same way as physical goods. This matters enormously in re-export scenarios because technology transferred digitally by an EU person to a non-EU distributor may constitute an export requiring a licence, even before the distributor does anything with it.
Where goods are unlisted but may have a military, WMD-related, or internal-repression application, the catch-all may apply. Member state authorities have used the catch-all to impose licensing requirements mid-shipment chain when new intelligence about an end-user has emerged. That possibility is not extinguished by the absence of a list classification. Have you documented the specific technical parameters that led to your classification conclusion? Without that record, a later challenge from a competent authority is difficult to rebut.
Comparison with the BIS and EAR system is instructive here. Under US rules, an Export Control Classification Number (ECCN – a code assigned by BIS under the Commerce Control List to determine whether a US-origin item requires a licence for a particular destination, end-use, or end-user) governs the item regardless of where in the world it subsequently travels. EU rules do not carry a direct analogue for non-EU movements, but the classification underpinning the original EU export licence remains relevant evidence in any competent-authority review of the re-export chain. For further analysis of how the BIS approach to deemed-export and re-export obligations interacts with EU rules, see our analysis of deemed-export and technology controls under BIS and the EAR.
Step 3: Assess the re-export destination and end-use against the current EU regime
The EU does not issue general re-export licences in the way that BIS issues a licence exception for re-exports of US-origin goods. Instead, the re-export analysis under EU law operates at two levels: whether the original EU export licence imposes any re-export condition, and whether the re-export destination itself is subject to an EU arms embargo, dual-use restriction, or financial-sanctions programme that would independently prohibit or restrict the movement.
Many EU export licences – particularly individual export licences for sensitive dual-use categories – contain explicit re-export restrictions. They may require the original exporter to obtain written assurance from the first-tier buyer that the goods will not be re-exported to named destinations or end-uses without further authorisation. A failure to obtain, verify, or enforce those assurances exposes the original EU exporter to enforcement under the applicable regulations and under member state implementing law, even if the actual re-export is carried out by a foreign entity.
EU financial sanctions complicate this further. Where the proposed re-export destination is covered by an EU programme, both the goods and the associated financing, brokering, and technical assistance are potentially caught. The scope of what counts as "brokering" under the EU dual-use regime is broad: it includes negotiating or arranging transactions between parties in third countries, where the broker is an EU person or is acting from within the EU. Providing logistics coordination, payment facilitation, or even introductory commercial introductions for a re-export chain can constitute brokering.
Risk factors that in our practice consistently indicate the need for a detailed legal review at this stage include: a distributor that operates in a jurisdiction bordering a destination subject to an EU restrictions programme; a stated end-use that is inconsistent with the buyer's apparent commercial capacity; pricing that is substantially below market; and requests from the buyer for unusually specific packaging, documentation, or delivery instructions. These are not proof of diversion. But they are the indicators that competent authorities examine.
Step 4: Check whether you need an authorisation – and which type applies
EU export authorisations for dual-use items come in four forms under the governing regulation: national general export authorisations, Union general export authorisations (UGEAs), global licences, and individual licences. The applicable type depends on the item, the destination, the end-use, and the exporter's compliance record.
Union general export authorisations permit exports to certain low-risk destinations without a case-by-case application, but they carry conditions – including record-keeping obligations and, for some UGEAs, registration requirements with the relevant member state authority. An exporter cannot assume that a UGEA covers a re-export or a follow-on shipment; the UGEA applies to exports from the EU, not to goods already placed outside the EU and subsequently moving between third countries.
For higher-sensitivity items, individual licences are the norm. Individual licences tie the authorisation to a named end-user, a stated end-use, and a defined quantity. Any material deviation – a change in the stated end-user, a variation in delivery routing – triggers a fresh assessment. In our experience, mid-chain changes in shipping routing are one of the most common triggers for an inadvertent licence violation, because the exporter updates the logistics without revisiting the licence conditions.
Global licences, issued to exporters with well-established compliance programmes, permit multiple exports to a range of pre-approved destinations under a single authorisation. They are operationally efficient but carry heightened documentation and internal audit requirements. A competent authority reviewing a global licence holder's exports will expect a mature internal compliance programme and evidence of systematic end-user screening.
The position diverges materially from the US OFAC regime, which operates through specific and general licences in the sanctions space rather than through an export-licence taxonomy. OFAC's licensing process for sanctions-controlled transactions applies a different analytical framework from the BIS export-licence system. The EU dual-use authorisation regime sits alongside, not within, the EU financial-sanctions licences issued by member state authorities or, in some programme contexts, by the Council directly. A transaction touching both regimes needs both authorisations, and they are not interchangeable. For additional guidance on managing this intersection in an OFAC context, see our guide on re-export and extraterritoriality under OFAC.
Step 5: Implement contractual protections and end-use undertakings
Contractual end-use undertakings are not a substitute for a licence, but they are a recognised element of an exporter's compliance architecture and a material factor in any enforcement assessment of culpability.
An end-use undertaking – also called an end-user statement or an international import certificate – is a written commitment by the buyer that the goods will not be re-exported to prohibited destinations or end-uses without the exporter's prior consent. Some member state competent authorities require such undertakings as a condition of issuing an individual licence. Others strongly recommend them. Even where they are not required, obtaining them demonstrates that the exporter took reasonable steps to manage re-export risk.
The contractual architecture should also include: a right to audit the buyer's records relating to the disposition of the goods; a termination right tied to any breach of export-control or sanctions obligations; a notification obligation requiring the buyer to report any government enquiry related to the goods; and a representation that the buyer is not on any EU or UN designation list and does not have controlling shareholders that are. These provisions serve a dual function. They give the exporter a practical mechanism to detect and respond to diversion. They also evidence to a competent authority that the exporter did not turn a blind eye to the risk.
Under the EU dual-use regime, an exporter who has actual knowledge of a diversion risk and proceeds without taking appropriate steps faces the most serious category of enforcement consequence. The contractual protections reduce the risk of that knowledge being imputed from general due diligence failures.
Step 6: Maintain records and report obligations
Record-keeping under the EU dual-use regime is mandatory and the obligation extends to all commercial documents relating to a controlled export: purchase orders, invoices, shipping documents, licences, end-user statements, and correspondence relating to the end-use. The required retention period under the governing regulation is five years from the date of the export. That five-year window is the minimum; some member state implementations impose longer periods.
Records must be sufficient to allow a competent authority to verify the classification decision, the licence condition compliance, and the identity of the end-user at each stage of the chain. In practice, this means retaining not only the formal documents but also the underlying technical analysis supporting classification, the screening records for end-users and intermediaries, and any catch-all assessments conducted in relation to unlisted items.
Reporting obligations vary by member state. Some authorities require annual or periodic reporting of exports made under global licences. Others require prior notification of certain high-sensitivity exports even under a UGEA. An exporter using a UGEA should confirm with the relevant member state authority whether registration or periodic reporting applies, because the failure to register can void the benefit of the UGEA for past exports, creating retroactive unlicensed-export exposure.
Compared to the BIS and EAR record-keeping obligations, which also extend to re-exports and cover records held by US-owned foreign entities, the EU obligations are focused on the EU exporter and the EU export act. But where goods are dual-origin – containing both EU-origin and US-origin controlled components – both records obligations apply simultaneously to the exporter, and a single set of records should be organised to satisfy both regimes. The compliance counsel advising on such dual-origin chains must map both obligations explicitly.
Step 7: Identify the risk flags that require immediate legal review
Several patterns in re-export and distribution chains consistently precede enforcement actions. Recognising them early is the difference between a proactive compliance response and a reactive penalty defence.
The first category is the unexpected or unexplained routing change. A shipment that was cleared for direct delivery is redirected through a jurisdiction that the original licence did not contemplate. In our experience, routing changes requested at the last stage of logistics planning – particularly changes that add a transit stop in a jurisdiction of concern – are the most reliable signal of an impending compliance failure.
The second is a mismatch between the stated end-use and the buyer's known business. An industrial-automation company purchasing precision-measurement equipment in quantities that exceed its stated production capacity, or a medical-device distributor purchasing items with clear dual-use military parameters, presents exactly the profile that catch-all controls are designed to address.
The third is a payment structure that obscures the ultimate payer. Third-party payments, letters of credit drawn on institutions in jurisdictions that are not the stated destination, and requests for documents that name a party other than the contracting buyer are all indicators of a more complex beneficial-ownership picture behind the transaction.
The fourth is a designation hit on the screening of an intermediary. A freight-forwarder, logistics agent, or financing bank that appears – or whose affiliates appear – on the EU Consolidated List, the UN Consolidated List, or the relevant national lists is a structural risk to the whole transaction chain, not only to the specific step at which the hit is identified.
When any of these flags appear, the appropriate response is to pause the transaction, preserve all communications and documents, and seek legal review before proceeding. Proceeding in the face of red flags is the fact pattern most likely to produce a finding of aggravated culpability in a subsequent enforcement action.
Related practices
- Deemed-export and technology controls under BIS and the EAR – US re-export obligations and licence exceptions for technology transfers to foreign nationals
- Re-export and extraterritoriality: advanced EU guide – deeper analysis of catch-all controls, brokering, and enforcement posture
The position above covers the standard case. Your facts – the item's classification, the jurisdictions involved, the structure of your distribution chain, and the end-user profile – change the analysis materially.
If you are building or reviewing an export-compliance programme that covers re-export risk, or if a competent authority has raised questions about a past export, contact Calder & Vance at info@caldervance.com for a structured assessment of your position.