A mid-sized technology exporter operating across two continents receives a routine trade-compliance audit query. The query is narrow: does a recently shipped product qualify for a licence exception under the applicable OFAC authorisation structure? The compliance team believes the answer is yes. It has been answered the same way for three successive shipments. Then counsel reviews the documentation and finds a gap that invalidates all three.
Licence-exception eligibility under OFAC turns on a precise, documented set of conditions that must be satisfied at the time of each transaction. The conditions are set by OFAC's programme-specific authorisations and, where applicable, supplemented by the Export Administration Regulations administered by the Bureau of Industry and Security. A single unmet condition renders the exception unavailable – and a pattern of reliance on an unavailable exception can constitute a series of apparent violations, each attracting its own civil-penalty exposure.
This case comment walks through an anonymised engagement in which a technology-sector business discovered a systemic eligibility gap, the steps we took to scope and address the exposure, and the lessons that apply to any business relying on licence exceptions across the US, UK, and EU regimes.
The situation: a technology exporter and a gap in the compliance record
The exporter had shipped dual-use hardware to a distributor in a third market over a period of roughly eighteen months. Each shipment was documented as covered by a programme-level authorisation that included a licence exception for certain categories of item and recipient. The compliance team had applied the exception consistently. No specific licence had been sought.
The exporter's compliance programme was structured around a checklist that mapped the item against the stated exception criteria. The checklist was completed for each shipment. On its face, the record appeared clean. In our experience, that appearance of order is precisely what conceals structural gaps in exception analysis: the checklist is only as reliable as the conditions it tests.
The audit query arose because the distributor had, during the relevant period, added a new shareholder. The new shareholder was not itself listed on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons). However, the shareholder held an interest that, when aggregated with a pre-existing holding by an affiliated party, crossed the 50 percent threshold applied under the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked).
The distributor was therefore itself blocked by operation of the rule. The licence exception, which expressly required the recipient to be a non-blocked person, was unavailable for all shipments after the ownership change. The checklist had not tested for ownership through the full chain. It had tested only first-tier ownership.
The legal question: what does licence-exception eligibility actually require?
Licence-exception eligibility under the applicable OFAC programme requires that every condition of the authorisation be met at the point of each transaction: the item, the destination, the recipient, the end use, and the parties involved must all satisfy the stated criteria simultaneously. A failure on any single condition removes the exception for that shipment.
The governing authority is OFAC, acting under the International Emergency Economic Powers Act (IEEPA) and the programme-specific regulations. The conditions are expressed in those regulations and in OFAC's published guidance. They are not general presumptions. They are specific, enumerated tests.
In this matter, the critical condition was the recipient test. The applicable authorisation excluded any recipient that was a blocked person or owned 50 percent or more by a blocked person. The exporter had screened the distributor at onboarding and at annual intervals. It had not screened for ownership changes between those intervals. The change in ownership occurred between two annual screens.
This is a pattern we see regularly. Screening is treated as a point-in-time event rather than a continuous obligation. For long-term distributor relationships, that approach leaves a structural gap. The question for any compliance team is not only "is this recipient clean today?" but "do our procedures catch changes during the life of the relationship?"
On the export-control side, the BIS classification of the items was also reviewed. The items carried an ECCN (Export Control Classification Number under the US Commerce Control List) that required a separate licence-exception analysis under the Export Administration Regulations. That analysis overlapped with but did not replicate the OFAC analysis. Both had to be satisfied. Treating the two frameworks as equivalent is an error we encounter frequently in cross-border compliance programmes.
How the matter unfolded: scoping the exposure
The first step was to scope the apparent violations precisely. That meant identifying the date of the ownership change, mapping each shipment that fell after that date, and confirming the classification and value of each item. It also meant establishing whether any general licence or other standing authorisation could have applied as an alternative basis for any of the shipments.
We reviewed the full ownership chain of the distributor as it stood at the time of each shipment. That required the exporter to obtain corporate-registry documentation and, where registry data was incomplete, to request ownership declarations from the distributor. The distributor cooperated. The ownership change was confirmed as occurring at a specific date within the shipment period.
Shipments before that date were covered by the exception. Shipments after that date were not. The number of post-change shipments was limited – six in total. The items were commercial-grade hardware with no military end-use identified. These facts were relevant to the penalty analysis and to the voluntary self-disclosure decision.
A VSD (voluntary self-disclosure to a regulator) was considered. OFAC's enforcement guidelines treat timely, good-faith voluntary self-disclosure as a significant mitigating factor. The absence of a prior compliance violation, the limited number of shipments, the commercial nature of the items, and the absence of any identified sanctions-programme harm all pointed toward disclosure. So did the systemic character of the gap: correcting only the known shipments without disclosing would leave the exporter exposed if the issue were independently identified.
We prepared the disclosure package, including a root-cause analysis, a description of the remediation steps already taken, and an updated compliance-programme design. The disclosure was submitted within the period that OFAC's guidance identifies as relevant to the mitigation assessment. The matter was resolved without a penalty proceeding. No guarantee of that outcome was given at any point in the process, and none should be assumed from this account.
The cross-regime dimension: how OFSI and the EU handle equivalent situations
The exporter also had a European subsidiary that had separately supplied compatible products to the same distributor during a partially overlapping period. That triggered parallel questions under UK and EU rules.
Under OFSI's rules, the ownership and control test (the UK test for whether a non-listed entity is caught through a listed person) is broader than the OFAC 50 percent rule. OFSI looks at both ownership and control. An entity that is not owned at the 50 percent threshold may still be caught if a designated person can exercise control over it – for example, through board appointment rights or contractual mechanisms. OFSI has published guidance on this distinction, and it matters operationally: a counterparty that passes the OFAC mechanical test may not pass the OFSI control assessment.
The EU position mirrors the UK approach. EU Council regulations apply an ownership-and-control test. The EU General Court has examined what constitutes control in a number of cases, and EU guidance makes clear that a non-listed entity can be caught where a designated person exercises determining influence over its decisions, regardless of whether the 50 percent ownership threshold is met.
In this matter, the cross-regime analysis showed that the European subsidiary's shipments were also affected. Under the applicable EU Council regulation, the distributor was caught through the control test even for a period when ownership was just below 50 percent, because the incoming shareholder held appointment rights over the distributor's senior management. The EU analysis therefore extended the at-risk period beyond what the OFAC analysis had identified.
This divergence is consequential. A business that scopes its exposure solely through the OFAC lens will underestimate the position if it also has EU or UK nexus. The stricter prohibition governs in each jurisdiction. Where the regimes diverge, each must be satisfied independently. In our cross-border practice, we routinely find that EU and UK analysis flags issues that would not appear in a US-only review – and vice versa.
What went wrong – and the three systemic gaps that produced it
The core failure was not the individual screen that was missed. It was the design of the compliance programme that allowed a missed screen to produce six shipments of exposure before anyone caught it. Three structural gaps drove the outcome.
The first gap was screening frequency. The programme screened counterparties at onboarding and annually. For distributors in sensitive markets, annual screening is a minimum. It is not sufficient where ownership structures are known to be dynamic or where the counterparty is involved in a sector with active M&A activity. The programme had no trigger for event-based rescreening – for example, a change reported by the counterparty, a press alert, or a regulatory update for the relevant market.
The second gap was the ownership-chain depth of the checklist. The checklist tested first-tier ownership. It did not require a review of second-tier or beneficial ownership. The 50 percent rule operates through the full ownership chain, direct and indirect. A programme that tests only direct ownership will not catch an indirect blocked-person holding. This is a gap we see in roughly a third of the programmes we review.
The third gap was the assumption of equivalence between the OFAC analysis and the export-control classification under the EAR. The compliance team treated a clean OFAC screen as sufficient to confirm the exception under the EAR as well. The two analyses are related but distinct. Each has its own recipient, end-use, and destination conditions. They must be run separately.
Remediation: what the exporter changed
Remediation addressed all three gaps. On screening frequency, the programme was updated to require event-based rescreening in addition to annual screens. Triggers included any reported change in ownership, any change in the counterparty's key personnel, any material press event, and any update to the applicable sanctions regime that affected the geographic market.
On ownership depth, the checklist was revised to require a second-tier ownership review for all counterparties above a defined transaction-value threshold, and a beneficial-ownership declaration for distributors in markets identified as higher-risk. The exporter engaged local counsel in the relevant jurisdiction to assist with corporate-registry research where public data was limited.
On the dual analysis requirement, the compliance team was retrained to treat OFAC and EAR analysis as separate sequential steps, each requiring independent sign-off. The shipment documentation template was updated to include two distinct clearance sections: one for sanctions eligibility, one for export-control classification and exception confirmation.
The exporter also introduced a cross-regime check for the European subsidiary: a parallel process aligned to the EU and UK ownership-and-control tests, which – as the analysis above shows – can capture situations that the OFAC test does not.
Common objections: why businesses underestimate the risk
One objection we hear often is that the exporter was acting in good faith and should therefore not face significant exposure. That objection misunderstands the civil-penalty structure. OFAC's civil-penalty regime does not require knowledge or intent. Strict liability applies to most civil violations. Good faith is a mitigating factor in the penalty calculation, but it does not negate the violation.
A related myth is that small exporters with no direct sanctions nexus – no operations in a programme country, no listed counterparties at the time of contracting – are outside the practical enforcement perimeter. In practice, enforcement actions do reach mid-sized exporters, particularly where the violation involves a pattern of conduct rather than a single transaction and where the item has dual-use characteristics. Extraterritorial reach under IEEPA means that non-US entities with US-origin goods or US-person involvement can also face OFAC exposure.
The practical implication is straightforward. Whether you are a multinational with a dedicated sanctions team or an exporter running compliance through a two-person trade function, the eligibility conditions for a licence exception must be tested against the full ownership chain, at each transaction, across all regimes with jurisdiction over the parties and goods involved.
Related practices
- Deemed export and technology controls under BIS and the EAR – classification, licence requirements, and deemed-export risk for technology transfers
- Licence-exception eligibility: a further OFAC matter – a second case comment extending the analysis to a different sector and shipment pattern
- Military end-use rules under BIS and the EAR – how end-use restrictions interact with licence-exception eligibility in practice