A precision-components exporter in a key allied-country market received an order from a regional distributor it had supplied for several years. The distributor served industrial customers across multiple jurisdictions, some of which were subject to active US sanctions programmes. The exporter – a mid-sized manufacturer whose products carried dual-use classifications under the US Export Administration Regulations – had been relying on a standard licence exception to ship without obtaining an individual authorisation. When the compliance team carried out a deeper review before the next shipment cycle, it discovered that the exception's eligibility conditions had not been consistently met. The transaction was already in the pipeline. The question was whether a breach had already occurred, and how to proceed lawfully.
Licence-exception eligibility under the US regime is not a one-time determination. It is a condition that must be satisfied for every transaction. An exporter that fails to re-verify eligibility at each shipment stage – whether because of a change in the end-user, the end-use, or the item's classification – may be in violation of the Export Administration Regulations even where earlier shipments were fully compliant. The governing authority is the Bureau of Industry and Security, operating under the Export Control Reform Act and the EAR; OFAC's sanctions programmes operate in parallel and may impose additional or more restrictive prohibitions on the same transaction.
This analysis sets out the situation, the legal questions it raised, the analysis applied across the US export-control and sanctions regimes, the options the business considered, and the lessons it produces for exporters managing dual-use goods in multi-jurisdiction supply chains. As of April 2026, the position described reflects the current requirements, but verify the current rules before relying on anything stated here.
The Situation: What the Exporter Thought It Had Authorised
Licence exceptions under the EAR are standing authorisations that permit a defined category of transactions without the exporter obtaining an individual export licence from BIS. Their convenience is real, but their terms are precise. An exporter using a licence exception is certifying, at each shipment, that the specific transaction meets the exception's conditions: the item, the destination, the end-user, and the end-use must all fall within the permitted scope.
In this matter, the exporter had originally confirmed that its products and the distributor's markets qualified. Over the subsequent contract period, two things changed without triggering a fresh review. First, the distributor's customer base had expanded to include buyers in a destination where the specific exception was unavailable for the relevant classification. Second, the exporter's internal product-engineering team had modified a component in a way that the compliance function had not reviewed for Export Control Classification Number purposes. The ECCN (Export Control Classification Number under the US Commerce Control List) assigned to the original design may not have remained accurate for the modified item.
Neither change was flagged through the compliance system. The exception was being cited on shipping documentation as if nothing had changed. When the anomaly came to light during a pre-shipment audit, the question was no longer hypothetical: had export-controlled goods been shipped under an exception that did not apply?
The Legal Questions: OFAC, BIS, and the Relationship Between Two Regimes
Two distinct US regulatory regimes were potentially engaged, and understanding the relationship between them was the first analytical task. BIS administers export controls under the EAR; OFAC administers economic sanctions programmes under IEEPA and related statutes. The regimes operate independently. A transaction may be permissible under the EAR yet still require an OFAC authorisation – or be prohibited by OFAC even where BIS has not restricted the export.
The exporter's lawyers and its compliance team needed to answer four questions in sequence. First, what was the correct ECCN for the modified item, and what licence requirements and exceptions applied to that ECCN and those destinations? Second, had any shipments gone to a destination, end-user, or end-use that was caught by an OFAC programme? Third, if so, had any general licence authorised the transaction? Fourth, if no authorisation applied, what was the appropriate response?
The OFAC dimension turned on whether any of the distributor's downstream customers were on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons), or were entities that the 50 percent rule (OFAC's rule treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked) would capture. An entity need not appear on the SDN List to be a blocked person. In our experience, exporters who screen only the immediate distributor – and not the distributor's known end-customers – routinely miss this risk in multi-tier supply chains.
What Was Found: The Eligibility Gap and Its Scope
The classification review confirmed that the modified item had moved into a different export control classification. The new classification attracted more restrictive licence requirements for several of the destinations the distributor served. The exception the exporter had been citing did not cover shipments to those destinations under the revised classification. This gap had existed for a period long enough to cover multiple shipments.
The OFAC screen, run against the distributor's disclosed customer list and against third-party shipping and customs data, identified one intermediary entity in a third market that fell within the SDN List's scope through the 50 percent ownership rule. The distributor had not disclosed this customer as a regular buyer; it had appeared as a one-off addressee on a small number of orders. The financial value of the implicated shipments was limited. But the regulatory exposure was not measured in dollars alone.
Two distinct apparent violations had now been identified: an export-control matter before BIS, arising from shipments made under an exception that did not apply to the re-classified item; and a potential sanctions matter before OFAC, arising from the small number of shipments that had been directed, via the distributor, to an entity blocked by operation of the 50 percent rule. The analysis and the remediation path for each were different. They needed to be managed separately while also being coordinated.
Have you reviewed your own shipment history against the current classification of your products? A change to a component, a new firmware load, or a revised specification can shift an item's position on the Commerce Control List without any change to its commercial name or part number.
The Options: Voluntary Self-Disclosure, Licensing, and Structural Remediation
Three options were assessed. Each carried different risk and timeline implications. The decision depended on the nature and scope of the apparent violations, the exporter's prior compliance record, and the practical steps available to interrupt any ongoing exposure.
Option one was to consider a VSD (voluntary self-disclosure to a regulator) to BIS in respect of the EAR violation and a separate self-disclosure to OFAC in respect of the sanctions-related shipments. VSD regimes exist under both authorities. Voluntary disclosure is not a guarantee of a reduced penalty, but it is a recognised factor in the enforcement calculus of both BIS and OFAC. The decision to disclose is itself a legal judgment: the disclosure must be accurate and complete, and an improperly scoped disclosure can create additional liability.
Option two was to apply for a specific licence from BIS to regularise future shipments under the correct classification, and separately to seek an OFAC licence or confirm the availability of a general licence for transactions affected by the SDN exposure. A specific licence (a case-by-case authorisation to conduct an otherwise prohibited transaction) application to OFAC requires a detailed account of the transaction, the parties, the goods, and the policy basis for the request. The timelines for specific-licence review vary and are not guaranteed; verify the current position with counsel before planning around an assumed timeline.
Option three was to restructure the distribution arrangement to remove the end-users and destinations that could not be served within the authorised scope, then re-commence shipments to compliant customers only. This addressed the ongoing exposure but did not resolve the historic apparent violations.
In this matter, the exporter's counsel advised a combination: voluntary self-disclosure to both BIS and OFAC in respect of the historic violations, accompanied by a detailed compliance-enhancement report; and a parallel restructuring of the distribution agreement to make end-customer disclosure mandatory and to build in a re-screening trigger whenever the customer list changed. Future shipments were suspended pending confirmation of the correct classification and the applicable authorisation for each destination.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. For a confidential review of a potential breach, contact us at info@caldervance.com.
Cross-Border Dimension: UK and EU Obligations in the Same Supply Chain
Export-control and sanctions compliance for a multi-jurisdiction exporter does not stop at the US regulatory boundary. In this matter, the exporter was incorporated in a jurisdiction subject to both UK and EU export-control obligations, and the goods passed through a UK intermediary before reaching the distributor.
Under the UK export-control regime, administered by the Export Control Joint Unit, the items required their own classification check against the UK dual-use list. The UK list reflects the international Wassenaar Arrangement parameters, but the national instrument, the Export Control Order, and the relevant regulations operate independently of the EAR. A UK licence exception or open general licence that covered the product did not follow automatically from the US classification or vice versa.
The EU regime, operated under the relevant dual-use regulation and administered through the competent authority of the relevant member state, added a further layer. Any re-export through an EU entity – or a shipment that transited an EU member state – engaged the EU rules in addition to the US ones. Where the US regime is more restrictive, its prohibition governs the US-nexus element of the transaction; where the EU or UK rules are more restrictive, those govern the EU- or UK-nexus element. There is no automatic harmonisation, and a transaction can be permissible under one regime and prohibited under another.
In our cross-border practice, we regularly advise exporters who have assumed that a US licence exception covers their entire supply chain. It does not. Each regime applies to its own nexus – and the strictest applicable prohibition governs that leg of the transaction. The UK OFSI financial-sanctions regime also ran in the background: any entity captured by UK financial-sanctions designations in the relevant thematic regulations would have required a separate OFSI analysis, independent of the OFAC SDN screening that had already been conducted.
The Myth: "The Exception Was Good Once, So It Remains Good"
The most persistent misconception we encounter among exporters managing dual-use goods is that a licence exception, once confirmed as applicable, remains applicable indefinitely. The myth has a surface plausibility: the exception's text does not change; the product looks the same; the distributor is the same. Why would the analysis change?
The analysis changes because the eligibility conditions attach to each transaction, not to the relationship. A modification that changes the item's technical parameters, a shift in the end-use that takes it outside the exception's permitted scope, a new customer in a destination that the exception does not cover, a change in the end-user's ownership that engages the 50 percent rule – any of these collapses eligibility, often invisibly, without any change to the shipment paperwork.
We regularly advise businesses that have strong compliance intentions but have not built the trigger mechanisms that re-run the eligibility test when upstream facts change. The compliance system must connect the product-engineering, sales, and logistics functions so that a change in any of them prompts a fresh classification and screening review. A static procedure that checks eligibility once at onboarding is not adequate for a dynamic product or a growing distributor network.
The companion risk is in the opposite direction. Some exporters over-read the exception's restrictions and apply for individual licences for transactions that an exception would have covered, adding unnecessary cost and delay. A well-calibrated compliance programme is precise in both directions.
What This Matter Produces for Similar Businesses
The lesson is not that licence exceptions are unreliable. They are a well-designed feature of the export-control architecture, and in our practice we use them routinely and effectively. The lesson is that their reliability depends entirely on the quality of the eligibility monitoring that surrounds them.
Three operational conclusions follow. First, product modifications must trigger a re-classification review. The process by which an engineering change request moves through approvals should include a mandatory export-control check before the modified item is offered for sale or shipped. The ECCN must be confirmed, not assumed.
Second, distributor contracts should require end-customer disclosure and a fresh-screening obligation whenever the distributor adds a significant new customer or enters a new geography. The exporter bears the legal exposure; the contractual mechanism is how it ensures it receives the information it needs to meet that obligation.
Third, screening must reach the end-user level and apply the 50 percent rule, not merely the SDN List's literal entries. In our experience, the most common screening gap in multi-tier distribution arrangements is the failure to trace ownership of intermediary buyers to the point where blocked-person ownership can be confirmed or excluded.
What would a re-classification trigger look like in your engineering-change process? If the answer is "it depends on whether compliance is copied on the change request," the control environment has a gap.
Related practices
- Deemed Export and Technology Controls under BIS and the EAR – classification, licence exceptions, and deemed-export authorisation for US-controlled technology.
- Military End-Use Rules under BIS and the EAR: a practice matter – how the military end-use and end-user controls interact with standard dual-use licensing.
- Military End-Use Rules and OFAC: a practice matter – the OFAC dimension when military end-use risk coincides with sanctions-programme exposure.