Affiliate-level restrictions on listed entities under BIS / EAR: in practice

An electronics manufacturer with subsidiaries across three continents runs its standard third-party screening process before shipping a batch of dual-use components. Every name on the order clears. The shipment proceeds. Weeks later, the manufacturer's compliance team discovers that the buyer's parent company appears on the BIS Entity List – and that an affiliate-level restriction on the listed entity extended to its subsidiaries by operation of the listing language itself. The transaction was already prohibited. This scenario is not hypothetical.

Affiliate-level restrictions on listed entities under the BIS / EAR case examined here turned on a single compliance failure: the assumption that a clean name screen on the direct counterparty is sufficient. Under the Export Administration Regulations (the EAR, administered by the Bureau of Industry and Security), a listing on the Entity List can expressly extend to named affiliates of the listed party, imposing a licence requirement – or a presumption of denial – on dealings with those affiliates even where their names do not independently appear on the list. The governing instrument is the EAR and the administering authority is BIS; the entity-level control architecture operates alongside, and sometimes more strictly than, OFAC's ownership-based 50 percent rule.

This case comment traces the situation that produced the exposure, the legal question it raised, the analytical framework BIS applies to affiliate-level controls, and the practical lessons that apply to any business exporting controlled items to corporate groups with a listed member.

The situation: a clean direct screen, a prohibited indirect dealing

The immediate counterparty – a regional distributor – carried no adverse listing. The compliance team screened the legal name, the address, and the registration number. Each returned negative results. The distributor was, however, a wholly owned subsidiary of a technology conglomerate that appeared on the Entity List with a listing entry that named several subsidiaries and affiliates as subject to the same end-use and licence restrictions.

The manufacturer's screening system did not search the Entity List entry text for affiliate language. It queried names against the consolidated list only. That architectural gap meant that the restriction imposed on the parent's listed affiliates never surfaced during the transaction review. The order was released. The items shipped.

In our experience, this pattern is a recurring one. Screening tools are generally configured to match names, not to parse the descriptive text of a listing entry. An entity can be expressly captured by a parent's listing without ever appearing as an independent row in the list data feed.

The facts that came to light afterwards were straightforward: the distributor was majority-owned by the listed entity, the listing entry explicitly extended the restriction to subsidiaries and affiliates, and the items shipped were subject to the EAR with an Export Control Classification Number (ECCN – the classification that determines which controls apply) that required a licence to the destination involved.

The legal question: what does an affiliate-level restriction actually require?

Under the EAR, BIS maintains the Entity List as a tool for imposing additional licence requirements – including licence requirements where the applicable licence exception would otherwise apply – on named parties. The critical feature of affiliate-level restrictions is that they operate through the express terms of the listing entry rather than through a separate independent listing. BIS may, and routinely does, include language in an entity's listing that reaches identified subsidiaries, affiliates, and related organisations.

The legal consequence is significant. A person subject to the EAR cannot simply treat the unlisted subsidiary as uncontrolled merely because its own name does not appear. The obligation to read and apply the full listing entry is part of the due-diligence standard expected of exporters, re-exporters, and transferors. If the entry text extends the restriction to affiliates, then dealings with those affiliates require a licence – or, if the listing carries a presumption of denial, such a licence will not readily be available.

BIS distinguishes the Entity List from OFAC's SDN List (OFAC's list of Specially Designated Nationals and blocked persons) in a critical way: Entity List controls are export-licence requirements and presumptions, not asset-freeze or blocking measures. There is no automatic prohibition on all dealing. But the licence requirement is real, enforceable, and applies regardless of the exporter's knowledge of the affiliate relationship – provided the listing entry text is clear.

Does this mean that every affiliated entity of every listed company is automatically restricted? Not quite. The restriction attaches to the affiliates and subsidiaries that the listing entry expressly names or identifies. An unexpressed affiliation – an ownership link that BIS has not chosen to capture in the listing language – does not, by itself, trigger the additional licence requirement. That is the point where the EAR regime diverges from OFAC's 50 percent rule, which operates automatically by ownership percentage without requiring BIS to name the entity.

How do OFAC, OFSI, and the EU treat the same ownership question differently?

The cross-regime contrast here matters for any business that operates across US, UK, and EU jurisdictions. Under OFAC's rules, an entity is treated as itself blocked whenever one or more blocked persons own it 50 percent or more in the aggregate, directly or indirectly. That test is automatic and mechanical. BIS lists do not work that way.

Under the EAR, the affiliate-level restriction is a product of the listing language, not an ownership threshold that self-applies. An exporter can, in principle, deal with an unlisted subsidiary of a listed entity without an additional BIS licence – provided the listing entry has not extended to that subsidiary and provided the items, end-use, and destination do not otherwise trigger a control. In practice, however, BIS regularly captures subsidiaries in the entry text precisely because the automatic-ownership rule does not apply, so the listing itself must do the work.

The UK position, administered by OFSI under SAMLA, uses an ownership and control test (the test for whether a non-listed entity is caught because a listed person owns or controls it). This test can reach an entity that a designated person controls in fact, even absent a majority stake. The EU applies a comparable control assessment under the relevant Council Regulations, looking at ownership exceeding 50 percent and at actual control. Both UK and EU tests therefore operate more broadly in the control dimension than the EAR's express-listing approach, but less automatically than OFAC's percentage-threshold rule.

In our cross-border practice, the practical consequence of this divergence is that a transaction analysis cannot apply a single group-level test across regimes. The OFAC analysis, the BIS analysis, and the OFSI / EU analysis must each be run on their own terms. A business that has conducted only one of those analyses has, at best, a partial answer.

What are the risk flags for affiliate-level restrictions on listed entities under BIS / EAR?

Several patterns repeatedly produce affiliate-level exposure in the transactions we review. The first is the structural one described in this matter: screening systems that query list rows but do not parse entry text. Most list-management software uses structured data fields; the affiliate language in a BIS listing may sit in a free-text description that the system's matching engine does not treat as a restriction trigger.

The second risk flag is corporate group complexity. A distributor, agent, or technology-transfer partner that is part of a large conglomerate presents a categorically different screening challenge from a standalone company. The larger the group, the greater the likelihood that at least one member has drawn regulatory attention and that its listing carries affiliate language.

A third flag is geographic concentration in sectors that attract heightened BIS scrutiny. Advanced computing, semiconductor supply chains, and certain aerospace and defence-related sectors have seen significant Entity List activity in recent years. A counterparty in those sectors operating from a jurisdiction that BIS has identified as presenting elevated diversion risk warrants deeper review of group-level listings, not just a name check on the direct buyer.

A fourth, and often overlooked, flag is the re-export and transfer dimension. The EAR can apply extraterritorially to re-exports and to foreign-produced items through the Foreign Direct Product rules (the mechanism by which certain foreign-made goods become subject to US jurisdiction because they are the direct product of controlled US technology or software). An affiliate-level restriction on an end-user therefore affects not only the original exporter but any intermediary in the supply chain who re-exports EAR-subject items to that affiliate.

Have you reviewed the Entity List entry text – not just the name field – for every corporate group member involved in your transaction? That question is a reasonable starting point for any pre-transaction review involving complex ownership structures.

What happened when the exposure came to light, and how was the matter resolved?

When the manufacturer's compliance team identified the affiliate restriction, the immediate steps were to contain the position, assess the scope of the apparent violation, and obtain qualified export-control counsel. No further shipments proceeded to the distributor pending the analysis.

The question of voluntary self-disclosure (a VSD – a proactive disclosure to BIS, which is a recognised mitigating factor in BIS enforcement proceedings) was considered early. Under the EAR's enforcement framework, a well-documented VSD can materially affect the outcome of a matter. The decision to make a VSD is not automatic: the scope of the apparent violation, the items involved, the destination, the end-use, and the prior compliance record are all relevant to the assessment. Counsel's role at this stage is to scope the apparent violation accurately before a disclosure is made, because an inaccurate or incomplete VSD is itself a problem.

The items shipped in this matter were dual-use components subject to the EAR. They were not items subject to strict national-security controls or items moving to destinations subject to a comprehensive embargo. That characterisation mattered: it placed the matter within a range of outcomes that included a no-action letter or a cautionary letter, rather than the more serious end of the enforcement spectrum. It also informed the VSD decision.

We acted for the manufacturer through the review, the VSD preparation, and the submission. The matter reached a resolution appropriate to its facts. No outcome is guaranteed by the filing of a VSD or by a well-structured compliance response, and nothing in this account should be read as a promise of any particular result. What the process demonstrated, however, was that an early, accurate, well-documented response framed the matter correctly from the outset.

The lesson: what does this affiliate-level restrictions on listed entities BIS / EAR risk example tell compliance programmes?

The central lesson is architectural. A compliance programme that treats name screening as its primary or sole export-control diligence mechanism is exposed to exactly the failure described here. BIS / EAR affiliate-level restrictions on listed entities compliance failure of this type is preventable, and the prevention is not technically complex. It requires three adjustments.

First, the screening process must include a review of full Entity List entry text, not only structured name fields. If the screening system does not support text parsing of listing entries, that gap must be addressed either by a system upgrade or by a manual review protocol for counterparties operating as part of larger corporate groups.

Second, the ownership and affiliation mapping exercise must reach the ultimate beneficial owner of the direct counterparty, not merely the entity named in the contract. For corporate group members, this means identifying all entities expressly named in any relevant listing entry, including entries for parent and sibling companies. The 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) provides a useful parallel framework to check alongside the BIS listing text review, but the two are legally independent tests and both must be run.

Third, the programme must address re-exports and the Foreign Direct Product dimension. An affiliate-level restriction on an end-user does not disappear when the item crosses a border. The EAR's extraterritorial reach means that downstream recipients in the supply chain face the same obligation analysis as the original exporter, as currently in force, verify before reliance.

In our experience, the businesses that manage this risk most effectively are those that have integrated entity-level ownership mapping into their pre-transaction due diligence, rather than treating it as a post-screening manual step reserved for flagged results. The investment in process design is substantially smaller than the cost of responding to an apparent violation after the fact.

Common myths about BIS / EAR affiliate-level restrictions on listed entities lessons

One persistent and genuinely dangerous myth in this area is that name screening alone is enough to meet the rules. It is not. The EAR imposes a standard of due diligence that includes reading and applying the full terms of a listing entry. That obligation does not vary with the size of the exporter or the volume of the transaction. Strict liability is not the governing standard for every EAR violation, but the scope of the restriction is determined by what the entry says, not by what the exporter's system retrieved.

A related misunderstanding is that the EAR's entity-level controls are equivalent to OFAC's SDN-based blocking regime. They are not. Entity List controls generate licence requirements and, in serious cases, presumptions of denial. They do not freeze assets. But they do affect every export, re-export, and in-country transfer of EAR-subject items to the listed or affiliated party, and the absence of a blocking effect does not reduce the obligation to screen correctly.

A third myth, which appears in compliance training materials more often than it should, is that a counterparty in a jurisdiction not subject to a comprehensive US embargo presents no material EAR risk. Item classification, end-use controls, entity controls, and destination-based licence requirements operate independently. A non-embargoed destination can still host an Entity List member. The two analyses do not substitute for each other.

Related practices

• Affiliate-level BIS / EAR restrictions – compliance advisory service – practical guidance on entity-level exposure mapping and programme design
• Aggregating holdings under OFAC – a related matter – how the 50 percent aggregation rule operates in a comparable fact pattern

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.