An exporter discovers, six months after shipment, that a controlled item left without the required licence. The item is on the Commerce Control List (the CCL – BIS's catalogue of items subject to export-licence requirements under the Export Administration Regulations). The question arrives on a compliance officer's desk on a Monday morning: disclose now, wait, or say nothing? That decision shapes everything that follows.
A voluntary self-disclosure (VSD – a proactive report to the Bureau of Industry and Security of a potential violation of the Export Administration Regulations before BIS discovers it independently) is the primary mechanism by which exporters, re-exporters, and in-country transferees mitigate civil and criminal exposure under the EAR. BIS treats a timely, well-constructed VSD as a significant mitigating factor when calculating a penalty. The regime is distinct from OFAC's VSD process and from the UK, EU, and Canadian disclosure regimes – and those differences matter for businesses operating across jurisdictions.
This guide walks through the VSD process step by step: when to disclose, how to structure the submission, what BIS examines, where the parallel risks sit, and how to frame the decision when more than one regime is in play.
What is BIS, and why does a VSD matter under the EAR?
The Bureau of Industry and Security administers the Export Administration Regulations under the authority of the Export Control Reform Act, and it holds both civil and criminal referral power over potential violations. The EAR controls the export, re-export, and in-country transfer of dual-use items – goods, software, and technology with both commercial and potential military applications. When a transaction occurs without a required licence, or when an end-use undertaking is breached, the exporter is exposed to a civil penalty, a denial order, and, in serious cases, criminal prosecution.
The VSD mechanism exists because BIS has a published interest in incentivising self-reporting. A disclosure made before BIS opens an investigation is treated as a significant mitigating factor. That mitigation can translate into a substantially reduced penalty – in some cases, a no-action letter. The commercial stakes are equally real: a denial order can bar an exporter from all export privileges, which is an existential consequence for a manufacturing business whose revenue depends on global sales.
In our cross-border practice, we find that exporters underestimate one dimension of VSD decisions: BIS is not the only regulator with an interest. Where the same transaction touches OFAC-administered sanctions, a UK export licence, or an EU dual-use restriction, the disclosure strategy must account for all of them simultaneously. A filing with BIS that resolves the US exposure can nonetheless leave a parallel UK or EU obligation unaddressed.
Step 1 – Identifying a potential violation and deciding whether to disclose
The first step is confirming that a reportable event has occurred – and doing so before the internal review hardens into a legal position. A potential violation arises when a controlled item (identified by its Export Control Classification Number – ECCN, the alphanumeric code on the CCL that determines licence requirements) was exported, re-exported, or transferred without the licence the EAR required, or when a stated end-use or end-user condition was not met.
Several triggers prompt this review in practice: a routine internal audit, a compliance hotline report, a customs query, a red-flag from a freight forwarder, or a counterparty disclosure. In our experience, the most frequent source is an audit that post-dates the shipment by months – which means the business must act quickly once the issue surfaces, because the period between internal discovery and BIS learning of the matter independently is a closing window.
The disclosure decision is not binary. BIS guidance distinguishes between a voluntary self-disclosure (a full, substantive report) and the situation where the potential violation is minor, isolated, and unlikely to recur – where a decision to remediate and document without disclosure may be defensible. But that assessment requires careful legal analysis. Making the wrong call – deciding not to disclose and then facing a BIS inquiry – removes all mitigation.
Do the facts support a good-faith belief that no violation occurred? Or is there a genuine uncertainty that a reasonable compliance reading would resolve against the exporter? Those questions must be answered before the clock runs on the disclosure window.
Step 2 – Preserving evidence and scoping the internal review
Before any external filing, the business must secure the record. That means a litigation hold: preserving all transaction documents, shipping records, export declarations, licence determinations, end-user statements, and internal communications that relate to the transaction. BIS will expect to see these; gaps in the record are treated as aggravating.
The internal review should be scoped to answer six questions. First, what was the item, and what is its correct ECCN? Second, what was the stated end-use, end-user, and destination? Third, what licence or licence exception was relied upon, and was it available? Fourth, was the classification correct at the time of export? Fifth, was there a red-flag review, and did it satisfy the EAR's standard? Sixth, are there other transactions in the same series, with the same counterparty, or involving the same item classification, that are potentially affected?
The last question is critical. BIS does not limit its review to the transaction disclosed. If the VSD submission reveals a systemic classification error or a repeated use of an inapplicable licence exception, the agency will ask whether other shipments were affected. Scoping the review broadly protects the exporter: it is far better to disclose the full scope voluntarily than to have BIS identify additional transactions during its own examination.
Record preservation and the internal review should be managed under legal privilege from the outset. This is not formalism. In our experience, the practical guidance that shapes a VSD submission – what to say, how to frame the root cause, what remedial steps to lead with – is developed in the privileged review. Waiving privilege inadvertently, by circulating a draft report to business teams without counsel's involvement, creates risks that are difficult to recover.
Step 3 – Structuring and submitting the VSD to BIS
A BIS VSD submission has two stages: an initial notification, followed by a complete report. The initial notification is a brief letter to the Office of Export Enforcement identifying the general nature of the potential violation, the parties involved, and the goods or technology. Its purpose is to establish the date of disclosure. That date matters because BIS's mitigation policy turns on whether the disclosure was made before the agency was aware of the matter.
The complete report, filed within a short period following the initial notification, must contain a full account of the transaction: the item, its ECCN, the destination, the end-user, the licence or exception relied upon, the date of the export, the facts that give rise to the potential violation, a root-cause analysis, and a description of the remedial steps already taken or planned. BIS expects the report to be candid and complete. Understating the scope, or omitting a related transaction identified during the internal review, is treated as aggravating.
The root-cause analysis deserves particular attention. BIS is interested not only in what went wrong but in why – was this a classification error, a failure of the red-flag review process, a gap in export management system controls, or a deliberate decision by a business unit acting without compliance oversight? The character of the root cause informs the agency's view of the exporter's compliance culture. A systemic failure acknowledged and addressed in the submission reads differently from an isolated error with no prior pattern.
Remedial action taken before or alongside the submission strengthens the mitigation case. That includes corrective classification, retraining, updates to export management procedures, and, where the item has reached a restricted end-user, notification to BIS of steps taken to recover or disable it. In a recent matter, a technology exporter discovered a series of shipments made under an inapplicable licence exception. We assisted the business in scoping the internal review, preparing the initial notification and complete report, and designing a remediation programme that addressed both the classification gap and the management-system failure. The matter resolved without a denial order.
What does BIS examine, and what makes a penalty lighter or heavier?
BIS applies a published set of general factors when determining the appropriate response to a potential violation. On the mitigating side, the most significant are: the VSD itself, the absence of prior violations, a strong compliance programme, evidence of genuine cooperation, and prompt remediation. On the aggravating side: harm to US export-control policy objectives, the involvement of a controlled item with heightened sensitivity, a pattern of violations, concealment, and a compliance programme that was nominal rather than operational.
The VSD is listed as a significant mitigating factor – but it is not a blanket exemption. Where the item involves particularly sensitive technology, where the end-user has connections to a restricted party, or where the pattern of conduct suggests deliberate disregard, BIS will weigh those factors against the credit for disclosure. The mitigation is real; it is not absolute.
One point that practitioners consistently observe: the quality of the VSD submission itself affects the outcome. A submission that is thorough, clearly organised, candid about root cause, and supported by a credible remediation plan reads as evidence of a functioning compliance culture. A submission that is vague, minimises the facts, or omits obviously related transactions undermines the mitigating effect of the disclosure.
The position above covers the standard case. Your facts – the item's sensitivity, the end-user profile, the export destination, and the pattern of conduct – change the analysis. For a confidential assessment of your potential disclosure, contact Calder & Vance at info@caldervance.com.
Cross-border exposure: when BIS is not the only regulator you face
A BIS VSD addresses US export-control exposure. It does not extinguish parallel obligations under OFAC, the UK's Export Control Joint Unit, the EU's dual-use regime, or the regimes of Canada, Australia, or Singapore. For a business exporting from the United States to a third country and then re-exporting to a fourth, multiple regulators may have concurrent jurisdiction over the same transaction.
Under OFAC, if the transaction also involved a sanctions-relevant party or destination – even if the export-control violation is the primary concern – a separate OFAC VSD may be required. The two processes are independent. BIS and OFAC coordinate where the same facts give rise to both an EAR and a sanctions exposure, but the submissions are prepared and filed separately, and the timelines differ. A business that discloses to BIS without considering OFAC exposure is solving half the problem.
Under the UK regime, OFSI administers financial-sanctions enforcement and the ECJU administers export licensing. A re-export from a UK affiliate involves the UK Export Control Order and, if a sanctioned party is involved, OFSI's enforcement guidance. The UK ownership and control test – the UK and EU standard for catching non-listed entities through a listed person – differs from OFAC's mechanical 50 percent rule. That divergence can mean an entity that is not blocked under OFAC is nonetheless subject to a UK restriction.
The EU dual-use regulation, applied by member-state competent authorities, covers exports and re-exports of dual-use items from within the EU. Where a European subsidiary of a US group re-exports an item that originated in the United States, the transaction may engage both the EAR (through re-export controls) and the EU regime (through the subsidiary's EU obligations). These run in parallel, not in sequence.
In our cross-border practice, we regularly advise groups that face concurrent BIS, OFAC, and EU exposure on the same transaction. The sequencing of disclosures, the coordination of submissions across jurisdictions, and the management of privilege in a multi-authority context are among the most consequential decisions in these matters. Getting the sequencing wrong can inadvertently waive privilege or create inconsistencies between submissions that each regulator reads.
If a filing has already been refused, or a transaction has been flagged by more than one authority, an early review can preserve options that narrow with time. Contact us at info@caldervance.com.
For a comparative view of how the Canadian VSD regime operates alongside BIS, see our guide on voluntary self-disclosure under the Canadian export-control regime. For a cross-border analysis of how VSD processes interact across jurisdictions, see our cross-border voluntary self-disclosure guide.
Common risk flags and the myth that "minor violations don't need disclosure"
Certain facts consistently elevate risk in BIS VSD matters. Each of the following, if present, should be treated as a reason to seek legal advice before deciding not to disclose.
- The item has a sensitive ECCN – particularly in categories covering electronics, sensors, lasers, telecommunications, or information security.
- The end-user or consignee appears on the Entity List (BIS's list of parties subject to enhanced licence requirements for national security reasons) or the denied-persons list, even if the exporter was unaware at the time of shipment.
- The transaction involved a third-country intermediary whose role was not clearly documented.
- Red-flag indicators were present and not adequately assessed: the buyer's business did not align with the item's stated use, payment terms were unusual, or the buyer requested removal of standard compliance features.
- The classification was performed informally, without a documented analysis or a commodity-classification request.
- The same item has been exported to the same or similar counterparties on multiple occasions without a licence.
- The exporter or its personnel have prior violations, warnings, or informal contacts with BIS on related matters.
The myth that minor violations do not need disclosure is one we address directly. It persists because it contains a partial truth: BIS does have a category of minor or technical violations that may be resolved at the staff level with low or no penalty, and a VSD in that context can still produce a favourable outcome. But "minor" is assessed by BIS against its own criteria, not the exporter's self-assessment. An exporter who concludes internally that the violation is minor and decides not to disclose, and who is later subject to a BIS inquiry, loses the mitigation entirely. The decision not to disclose must itself be defensible and documented.
We have acted for businesses that made exactly this error: a compliance team determined, without external review, that a classification uncertainty did not require disclosure; BIS later opened an inquiry; and the business faced the matter without mitigation. The time between the internal discovery and that inquiry was the window that closed.
When to involve export-control counsel and what that engagement looks like
Counsel should be involved as soon as the potential violation is identified – before the internal review produces a written record, before any disclosure decision is made, and before any informal contact with BIS. These are not formalities. The shape of the internal review, the scope of the evidence preservation, and the framing of the root cause in the submission are all decisions that carry legal consequence.
In our practice, a VSD engagement begins with a rapid scoping assessment: what happened, what item, what destination, what end-user, what licence or exception was in play, and whether the transaction touches any other regime (OFAC, ECJU, EU). That assessment drives the disclosure strategy. Where the exposure is clearly limited to BIS and the facts are straightforward, the pathway to a complete report can move quickly. Where parallel regimes are involved, or where the internal review reveals a systemic issue, the timeline and the strategy must account for the additional complexity.
Exporters sometimes ask whether they need external counsel for a simple VSD. Our answer: the cost of external review on a genuinely simple disclosure is modest and predictable. The cost of an unrepresented submission that inadvertently broadens BIS's inquiry, or that fails to identify a parallel OFAC exposure, is not. We offer fixed-fee entry points for the initial scoping assessment so that the business can understand the exposure before committing to a full engagement.
Related practices
- Apparent violation assessment – EU – assessing and managing EU enforcement exposure across dual-use and sanctions regimes
- Cross-border voluntary self-disclosure guide – coordinating VSD submissions across BIS, OFAC, OFSI, and other concurrent regimes