An electronics distributor with operations spanning North America, Europe, and South-East Asia received a written request from the Bureau of Industry and Security. The request concerned an export of commercial-grade components to a distributor in a third market. The items had been shipped two years earlier. No one on the compliance team had flagged the transaction at the time. Now BIS wanted records, correspondence, and a description of the end-use controls applied.
Responding to regulator information requests under BIS / EAR is a high-stakes, time-sensitive obligation. The Bureau of Industry and Security – the US agency that administers the Export Administration Regulations (the EAR, the primary US dual-use export-control regime) – holds broad authority to compel production of records. A poorly managed response can convert a routine enquiry into a formal investigation. A well-managed one can demonstrate a co-operative posture and limit the scope of any further review.
This case comment examines the anatomy of a real-pattern BIS information request, the legal environment that governs the response obligation, the cross-regime dimensions that surface in most multi-jurisdictional businesses, and the practical lessons that apply to any exporter receiving a similar letter. The account is anonymised and illustrative; no real client, penalty notice, or case number is named.
The situation: how a routine shipment became a regulatory file
The initial request arrived as a written enquiry – not a subpoena, not a search warrant – asking the distributor to produce shipping records, end-use certificates, and internal communications relating to a defined set of transactions over an approximately two-year window. The items involved were dual-use components that had been exported under an EAR licence exception rather than a specific licence. BIS wanted to understand whether the conditions of that exception had been satisfied and whether the stated end-user had in fact received the goods.
Two features defined the initial risk. First, the business's record-keeping had not been structured around the EAR record-retention standard (the obligation under the EAR to retain export-control records for a defined period after the transaction date). Some records existed in a US entity's systems; others resided with the European subsidiary that had co-ordinated the logistics. Producing a coherent response meant pulling documents from at least three jurisdictions, translating some of them, and reconciling discrepancies between shipping documents and internal approvals.
Second, and more seriously, a review of the records showed that a small number of the items may have reached a consignee that differed from the one stated on the original export documentation. That discrepancy – even if innocent – was exactly the pattern BIS was examining. The question was not whether to respond, but how.
What governs the response obligation under BIS / EAR?
Under the EAR, administered by BIS (the Bureau of Industry and Security within the US Department of Commerce), exporters and re-exporters are subject to record-keeping obligations covering export documentation, end-use statements, licence applications, and related correspondence. The governing instrument is the Export Control Reform Act and the implementing EAR. The retention period runs from the date of the relevant transaction or event, and BIS has authority to request, inspect, and copy those records in the course of an investigation or compliance review.
A BIS information request sits at an early point in the enforcement continuum. At this stage, BIS has not made a finding of violation. It is gathering information. That distinction matters for how the response is calibrated. An overly broad or imprecise response – one that produces documents beyond what was requested, or that creates new inconsistencies – can shift BIS's attention toward matters it was not originally examining. An under-inclusive or delayed response, on the other hand, signals non-co-operation, which BIS weighs heavily in any subsequent penalty calculation.
The EAR also intersects with the jurisdiction of the Department of Justice. Where BIS's review discloses conduct that is potentially criminal – wilful violations, knowing export to prohibited end-users – the matter can be referred. That referral risk is not theoretical. In our cross-border practice, we advise exporters at the outset of any BIS enquiry to assess the spectrum of potential exposure before a single document is produced.
A practical note on timing: response deadlines in BIS information requests are typically short. The request in this matter set a deadline of less than a month for initial production. If your records are distributed across subsidiaries in different time zones and jurisdictions, that window is tight. Have you tested your document-retrieval capability under that kind of time pressure?
Related practices
- Apparent violation assessment – EU regime – structured review of potential EU export-control and sanctions violations before they escalate.
- Responding to regulator information requests – OFAC matter – parallel lessons from an OFAC-led information request in a financial-institution context.
The position above covers the standard BIS information-request scenario. Your facts – the commodity, the end-user, the licence exception relied upon, the geography of your records, and whether a re-export by a third party is in the picture – change the analysis significantly.
For a confidential assessment of your exposure under BIS or another regime, contact Calder & Vance at info@caldervance.com.
Cross-border dimensions: when a US information request has EU and UK implications
A BIS information request does not stay within US borders. In this matter, the distributor's European subsidiary had processed the shipping documentation and held the majority of the relevant commercial records. Producing those records in response to a US government request immediately raised three cross-regime considerations that are common to multi-jurisdictional businesses.
First, EU data-protection rules govern the transfer of personal data from EU entities to non-EU government authorities. The relevant EU instrument imposes restrictions on compelled transfers of personal data outside the bloc. Producing employees' internal communications to a US agency without first assessing whether that production is lawful under EU rules can create a secondary compliance problem in the very jurisdiction where you have a subsidiary. We have acted for businesses that resolved the US-facing request efficiently but then faced regulatory enquiries in Europe over how the data was transferred.
Second, the EU Blocking Regulation (the EU instrument that prohibits EU persons from complying with extraterritorial US measures in defined circumstances) is a live consideration for EU-incorporated entities. Its application to BIS/EAR information requests requires careful analysis. The Blocking Regulation was designed primarily for OFAC-related secondary sanctions and certain other US trade measures; its scope in relation to a BIS dual-use inquiry is narrower, but it cannot be dismissed without legal advice. Ignoring it entirely is not defensible; neither is using it as a reflexive reason to refuse production, which itself creates US enforcement risk.
Third, the UK's post-Brexit position means that a UK subsidiary operates under a separate legal regime. OFSI and the ECJU administer the UK sanctions and export-control environment. A UK entity receiving a BIS request will need to consider both the US obligations and the UK legal constraints on producing documents to a foreign regulator. These do not always point in the same direction.
The practical lesson here is that any multi-jurisdictional business receiving a BIS information request should, from the outset, map which entities hold responsive records and which legal regimes govern each of those entities. That mapping shapes the production strategy and avoids creating new violations while responding to existing enquiries.
Risk flags identified in this matter
Four specific risk flags emerged during the response process. Each is common enough in cross-border export businesses to warrant attention by any compliance team that has not recently stress-tested its record-keeping against the EAR standard.
The first was fragmented record ownership. Records were distributed across the US parent, the European logistics subsidiary, and the freight forwarder. None of the three held a complete picture. Reconstructing the transaction trail required a co-ordinated data-gathering exercise across three organisations, two of which were not legally obligated to co-operate with the US response effort. That co-operation had to be negotiated, and it took time the business did not have.
The second was undocumented licence-exception reasoning. The business had applied an EAR licence exception at the time of export. But the internal approval was a single line in an export spreadsheet. There was no contemporaneous record of who had assessed the exception, what information they had reviewed, or whether the end-use certificate had been checked against the stated exception criteria. BIS places significant weight on documented, contemporaneous compliance decisions. A decision that was correct at the time becomes very difficult to reconstruct two years later without documentation.
The third was a consignee discrepancy. As noted above, a small number of items appear to have been delivered to a location that differed from the stated end-user address. This may have reflected a routine logistical re-direction. But it was undocumented and it was exactly the type of fact pattern that BIS treats as potential evidence of diversion. Even innocent discrepancies of this type require a clear, documented explanation.
The fourth was absence of a VSD trigger assessment. When the internal review uncovered the consignee discrepancy, the immediate question was whether a VSD (voluntary self-disclosure to BIS) was appropriate. Under BIS practice, a timely and complete VSD is treated as a significant mitigating factor in penalty calculations. The decision whether to file one is not automatic; it depends on an honest assessment of whether a violation has in fact occurred and what the totality of the facts shows. Failing to consider a VSD, or deferring the consideration until BIS has completed its review, removes optionality that may have value.
How the matter was resolved
The response was structured in stages. The first stage was a rapid document-preservation notice issued across all three record holders to stop any routine deletion or overwriting of relevant records. That notice went out within the first forty-eight hours of receiving the BIS request. The second stage was an internal document review to understand what BIS would see once the records were produced, before they were produced. That sequencing is standard practice. You do not want your first view of the full record to coincide with BIS's.
The internal review confirmed the consignee discrepancy. It also confirmed that, in the assessors' judgment, the discrepancy reflected a logistical re-routing arranged by the freight forwarder without the exporter's knowledge – a fact that, if properly documented and presented, substantially changed the risk profile. Counsel assessed the VSD question and concluded that a proactive, supplementary disclosure to BIS, accompanying the document production, was the appropriate course. That disclosure acknowledged the discrepancy, explained the freight-forwarder involvement, and provided a revised end-use account.
The production itself was structured to respond precisely to what BIS had asked. Documents that fell clearly outside the scope of the request were not produced. A cover letter set out the search methodology, confirmed the record-retention period applied, and noted the steps taken to locate records held outside the United States. That transparency about methodology is itself a signal of good faith.
The matter did not proceed to a formal enforcement action. BIS acknowledged receipt of the production, asked two follow-up questions, received answers, and closed its review. We regularly advise that this outcome – an enquiry that resolves at the information-request stage – is available in many more cases than clients expect, provided the response is managed carefully from the outset. It is not guaranteed, but the steps that make it achievable are knowable in advance.
A common myth about BIS information requests
The myth we encounter most consistently is this: "A BIS information request is just a records exercise. We can handle it internally without outside counsel." The reasoning is understandable. The request is in writing, it cites specific transactions, and it has a deadline. It looks like a document-retrieval task.
It is not only a document-retrieval task. It is also a legal assessment of whether the underlying transactions were lawful, a VSD decision point, a cross-regime data-transfer question, and a potential intersection with DOJ criminal jurisdiction. The documents you produce shape the frame through which BIS views your business. Producing them without first understanding what they show – and what their legal significance is – is the single most common mistake we see in this type of matter.
The second part of the myth is that responding slowly is safer than responding promptly. In fact, the opposite is usually true. BIS weighs co-operative behaviour throughout the process. A well-organised, timely response with a transparent methodology signals a business that takes its obligations seriously. That signal has real value when BIS is deciding whether to close a review or open a formal investigation.
If a BIS information request has arrived, or if your internal compliance review has identified a potential EAR violation before BIS does, an early review can preserve options that narrow with time.
To discuss a VSD, an information-request response strategy, or an internal investigation, write to Calder & Vance at info@caldervance.com. You may also find relevant parallel lessons in our account of voluntary self-disclosure under Australia's autonomous sanctions regime.