A US-headquartered components manufacturer receives an order for precision electro-optical assemblies. The stated end-user is a commercial research institute. Screening passes. The transaction closes. Eighteen months later, the compliance team receives a voluntary disclosure query from outside counsel: evidence suggests the assemblies were diverted to a military end-user. The question is no longer whether to ship – it is how serious the exposure is, and what to do now.
Military end-use rules under the Export Administration Regulations administered by the US Bureau of Industry and Security – and the parallel prohibitions that apply when an OFAC-designated entity sits in the end-use chain – together create an interlocking compliance obligation that many exporters underestimate. A shipment that clears standard screening can still generate severe civil liability if the actual end-use or end-user triggers a "military end-use" or "military end-user" control.
This case comment walks through an anonymised matter we handled, the legal analysis that governed it, the cross-border dimensions that complicated the picture, and the practical lessons for exporters and their compliance counsel.
The situation: what the exporter believed it was selling
The client – a mid-sized manufacturer of precision optical components – had an established export-compliance programme. It classified its goods, applied for licences where required, and maintained an end-user screening process calibrated to OFAC's SDN List (the list of Specially Designated Nationals and blocked persons maintained by the Office of Foreign Assets Control). The buyer was a registered commercial entity. No SDN hit. No derogatory open-source result. The order proceeded.
The components carried an ECCN (Export Control Classification Number under the US Commerce Control List) that placed them in a category controlled for national-security and anti-terrorism reasons. Licence exceptions were available, and the client applied one. The transaction was consistent with prior shipments to the same region.
What the client did not identify was that the stated end-user was acting as an intermediary. The assemblies moved on within weeks to a state-owned defence enterprise in a third country. That enterprise was the actual end-user – and it was a military end-user within the meaning of the relevant controls under the Export Administration Regulations.
The client's compliance programme had passed the transaction because it screened the named buyer, not the full end-use chain. It is a gap we see regularly. Have you stress-tested your screening against the actual destination of the goods, not just the first named counterparty?
The legal question: what controls apply to military end-users?
The Export Administration Regulations establish a category of control that activates when an item is destined for a "military end-user" or for a "military end-use," and that control applies to certain ECCNs even when a licence exception would otherwise be available. BIS maintains a list of identified military end-users; if an entity appears on that list, a licence is required for a defined set of controlled items regardless of the exception that would otherwise apply.
That is the BIS dimension. The OFAC dimension is distinct but intersects with it. Where the actual end-user is itself designated – on the SDN List or on a derivative list such as the Non-SDN Menu-Based Sanctions list – the transfer of goods, technology, or services to or for the benefit of that entity is prohibited under the relevant OFAC sanctions programme, regardless of what BIS classification applies. A company can satisfy BIS licensing requirements and still violate OFAC prohibitions simultaneously.
In this matter, the state-owned defence enterprise had not been formally designated at the time of the shipment. It was, however, added to BIS's military end-user list after the transaction – and evidence emerged that the enterprise had pre-designation ties to listed entities. That evidence was relevant to the question of whether the client had "reason to know" the actual end-use at the point of sale. "Reason to know" is a lower standard than actual knowledge, and regulators apply it broadly.
The position above covers the standard case. Your facts – the goods, the named counterparty, the intermediate routing, the end-user's ownership and affiliations – change the analysis materially.
To discuss a BIS or OFAC matter before it becomes a formal inquiry, write to us at info@caldervance.com.
How do OFAC and BIS authority interact in an end-use matter?
OFAC and BIS are separate agencies with separate legal bases and separate enforcement tracks, but an export-control matter involving a sanctioned or potentially sanctioned end-user will typically attract both. The analytical sequence matters.
The first question is classification: what does the item control under the Commerce Control List, and does the relevant ECCN place the item within the military end-use or military end-user rule? If it does, and if the actual end-user is on BIS's military end-user list, a licence exception cannot save the transaction: a specific licence is required.
The second question is the OFAC question: is the actual end-user – or any entity that owns 50 percent or more of it – designated on the SDN List or captured under an OFAC programme? This inquiry runs in parallel. It does not depend on the BIS classification. An item that is EAR99 – the residual classification for items that do not warrant a higher ECCN – can still be the subject of an OFAC violation if it passes through or to a blocked person.
The third question is causation: did the exporter's act cause the prohibited transfer? For BIS, the "reason to know" standard governs. For OFAC, the analysis turns on whether the exporter caused a transaction "for the benefit of" a blocked person, directly or indirectly.
In the matter we handled, the first and third questions were the operative ones. The enterprise had not been designated by OFAC at the point of shipment, so there was no SDN violation. But the item was within the military end-user rule, and the "reason to know" evidence was the central dispute with the agency.
What is the cross-border dimension that complicated the analysis?
The components were manufactured in the United States and exported under a US licence exception. But the routing involved a jurisdiction with its own parallel export-control regime – and that regime also imposed controls on items of the relevant specification when destined for a state-owned military entity.
Under the EU's dual-use rules (Council Regulation on controls on the export of dual-use items), the re-exporting intermediary in an EU member state was itself subject to an obligation to conduct end-use due diligence before re-transferring the goods. The EU rules, much like the US rules, impose a "know-your-customer" standard that activates when there is reason to suspect a military end-use.
The UK position, administered by ECJU under the Export Control Order, runs in parallel with – but since Brexit is no longer identical to – the EU regime. For shipments routed through UK entities, a separate analysis of the applicable UK end-user undertaking requirements was necessary.
What this created was three parallel compliance exposures: the US BIS exposure for the originating exporter; the EU exposure for the re-exporting intermediary; and, because some technical data had been shared by electronic communication with contacts in a further jurisdiction, a potential deemed-export question under US rules. The deemed-export rule under the EAR treats a transfer of controlled technology to a foreign national as an export to that person's country of nationality. Our cross-border analysis had to address all three simultaneously. In our experience, matters that originate as a BIS question almost always acquire an OFAC or a multi-regime dimension once the full transaction chain is mapped.
What were the risk flags that should have caught this earlier?
With the benefit of the full factual picture, several indicators were present at the time of the original transaction that a more thorough pre-shipment review would have surfaced.
First, the stated commercial purpose for precision electro-optical assemblies of the relevant specification was implausible for a research institute of the buyer's stated size and sector. Purpose-plausibility review – asking whether the named end-user has a credible commercial need for goods of this specification – is a standard element of a diligent end-use check.
Second, the payment routing deviated from the buyer's registered address: payment came from an account in a third jurisdiction. That pattern is a recognised red flag in BIS guidance on transaction risk.
Third, the order volume was larger than what a research institute would ordinarily require. Quantity mismatches are explicitly called out in published BIS guidance as a diversion indicator.
Fourth, the client's end-use certificate process did not reach beyond the first named buyer. A certificate from the named buyer is a useful but insufficient control when the goods are of a type that commands a premium on secondary markets and when the destination region has active diversion risk.
Were any of these flags present in your most recent export of controlled goods? If the answer is uncertain, the screening process may need review before the next shipment moves.
If a transaction has already been flagged, or if an inquiry has been received, an early review preserves options that narrow with delay. Contact us at info@caldervance.com.
How the matter was resolved and what the process involved
The client's first decision, which we advised on in the initial engagement, was whether to make a voluntary self-disclosure – VSD – to BIS. A VSD is a proactive disclosure to the regulator of an apparent violation, made before the agency initiates its own inquiry. BIS's published guidance treats a timely and complete VSD as a significant mitigating factor in penalty calculation.
In this matter, the legal basis for proceeding by VSD was sound. The apparent violation had been identified by the client's own compliance team; there was no indication of a pre-existing BIS inquiry; and the facts, while adverse, were capable of being presented in a manner that demonstrated good-faith compliance intent and a systemic root cause rather than wilful misconduct.
We prepared a disclosure that set out the full transaction history, the root cause of the control failure, the remediation steps already taken, and the enhancements to the client's compliance programme that had been implemented before the disclosure was filed. Programme enhancements undertaken before filing – not announced as future intentions – carry greater weight with the agency. The disclosure package was submitted with a structured programme remediation plan.
In parallel, we reviewed whether the same transaction gave rise to any OFAC exposure. It did not: the enterprise had not been designated at the time, and no SDN or OFAC-administered list applied to it on the shipping date. That finding was documented and retained as part of the client file, because the absence of an OFAC violation at the time of shipment is not self-evident when a military-end-user question is in play and must be demonstrable if the agency ever asks.
The matter was resolved through the BIS administrative track. No criminal referral was made. The client's remediation plan was accepted, and the client retained its export privileges – which had been at risk through the course of the review. No specific outcome can be promised in any similar matter: the facts, the disclosure quality, and the agency's current enforcement posture all affect the result. What this matter illustrated is that early, structured action by counsel materially changes the trajectory.
The lesson: building a compliance programme that reaches the actual end-user
The core lesson of this matter is structural: most export-compliance programmes are built around the named counterparty. The military end-use and military end-user rules are built around the actual end-use and the actual end-user. When those two differ – because of an intermediary, a re-routing, or a commercial cover story – the programme fails at the point of greatest legal exposure.
A programme that meets the standard for this category of goods must include, at minimum, purpose-plausibility review for every shipment of controlled items; end-user certification that reaches beyond the first buyer where the goods have known diversion appeal; payment-routing checks against counterparty registration; and a post-shipment monitoring process that can surface diversion indicators in the months after export.
The second lesson is multi-regime readiness. An exporter that tracks only BIS obligations will be unprepared when OFAC or a non-US regime enters the picture. We regularly advise clients whose BIS compliance is well-constructed but whose OFAC screening process was not designed to catch indirect exposure through end-user chains or ownership structures. The 50 percent rule for OFAC-blocked entities captures not just direct SDN counterparties but any entity that a blocked person owns in that aggregate, directly or indirectly. That rule applies to the end-user chain just as it applies to the buyer.
The third lesson is timing. The VSD option, and the mitigating effect it carries, depends on filing before the agency has opened its own inquiry. Compliance teams that are uncertain whether a transaction falls within a reporting obligation should seek legal advice quickly – the window for the most favourable treatment closes once an external inquiry begins.
We do not advise on circumventing or evading sanctions.
Related practices
Related practices
- Deemed export and technology controls under BIS and the EAR – classification, deemed-export analysis, and licence exceptions for controlled technology.
- Re-export and extraterritoriality – an OFAC matter – how US export-control reach extends beyond the originating transaction.
- Re-export extraterritoriality – OFAC matter (continued) – a further analysis of extraterritorial jurisdiction in re-export scenarios.