A freight forwarder in Singapore receives a BIS warning letter. Its parent company in Europe has already been notified. The underlying shipment – dual-use components routed through a third country – may have breached the Export Administration Regulations ("EAR", the US export-control rules administered by the Bureau of Industry and Security). The question is not only whether a violation occurred. The question that actually determines the business outcome is: what will BIS do about it, and what can be done to influence that outcome?
As of April 2026, the Bureau of Industry and Security applies a published set of mitigation factors in enforcement under BIS / EAR rules when calculating the appropriate penalty or disposition for an apparent violation. Those factors can reduce – sometimes substantially – the civil penalty that would otherwise apply under the Export Control Reform Act ("ECRA") and the EAR. Their weight depends on what the company did before, during, and after the conduct in question.
This briefing sets out the governing authority and legal basis, explains how BIS structures its penalty analysis, identifies the mitigation factors that carry the greatest practical weight, addresses the cross-border dimension (including how a BIS enforcement action interacts with OFAC, OFSI, and EU export-control authorities), and explains when to involve counsel.
Who administers BIS export-control enforcement, and what is the legal basis?
BIS – the Bureau of Industry and Security within the US Department of Commerce – administers the EAR and is the primary authority for export-control enforcement in the civilian-goods space. Its Office of Export Enforcement ("OEE") investigates potential violations. The Office of Chief Counsel for Industry and Security oversees penalty negotiations. BIS derives its authority from the Export Control Reform Act, enacted as the statutory successor to the previous export-control legislative regime. ECRA gives the Department of Commerce broad civil-penalty powers and authorises the use of denial orders, which effectively bar a person or entity from all EAR-privileged transactions.
The Department of Justice ("DOJ") retains criminal jurisdiction over wilful export-control violations. Serious cases – those involving deliberate evasion, falsified export documentation, or unlicensed transfers of items controlled for national-security or proliferation reasons – can be referred to DOJ alongside the BIS civil process. These two tracks are not mutually exclusive. A business facing a BIS civil inquiry should assess, from the outset, whether the facts could also attract criminal exposure. We regularly advise on that risk-mapping at the investigation's earliest stage.
The EAR governs the export, re-export, and in-country transfer of items subject to US jurisdiction – defined by their origin, their US-origin content, or their classification under the Commerce Control List ("CCL"). Items on the CCL carry an Export Control Classification Number ("ECCN", a classification code that determines which countries and end-uses require a licence). Items that do not fall under a specific ECCN are classified as EAR99; they are still subject to the EAR's general prohibitions but face fewer licence requirements in most destinations.
How does BIS structure its penalty analysis?
BIS uses a published penalty matrix that distinguishes between "egregious" and "non-egregious" violations, and between cases with a voluntary self-disclosure ("VSD", a proactive report to BIS of a potential violation before BIS initiates an investigation) and cases without one. The base penalty differs materially across those four cells. A non-egregious case with a VSD attracts a significantly lower starting point than an egregious case discovered through an OEE investigation. That structural design makes both the VSD decision and the egregiousness assessment the two most consequential threshold questions in any enforcement matter.
Egregiousness is assessed against a list of factors published in BIS's administrative penalty guidance. Those factors include: whether the conduct involved items controlled for national-security, chemical-weapons, nuclear nonproliferation, or missile-technology reasons; whether the destination or end-user was a prohibited party; whether the business had knowledge of the violation; and whether the conduct was isolated or part of a sustained pattern. High-control items shipped to restricted destinations, with knowledge, in volume – that is the profile that produces an egregiousness finding and a penalty calculated at or near the statutory maximum per transaction.
The position above covers the standard structural analysis. Your facts – the classification of the goods, the knowledge of the people involved, the destination, the volume of transactions – change the egregiousness calculus materially. If you are assessing exposure before a disclosure decision, contact Calder & Vance at info@caldervance.com for a confidential review.
What are the mitigation factors that carry the most weight under the EAR?
BIS's published guidance identifies specific mitigating circumstances that reduce a civil penalty from its base amount. Not all of them carry equal weight in practice. Experienced practitioners – and, in our experience, OEE investigators themselves – treat a small number of factors as having a disproportionate effect on the final disposition.
The most significant mitigating factors are:
- Voluntary self-disclosure. A timely, accurate, and complete VSD is the single most powerful mitigant in the BIS regime. It signals cooperation, reduces investigative cost for OEE, and under the penalty matrix it directly determines the base from which any reduction is calculated. A VSD must precede BIS awareness of the violation. Once OEE has opened an investigation or made contact, the VSD opportunity is lost.
- Existence of an effective compliance programme at the time of the violation. BIS gives meaningful credit to businesses that had a functioning export-control programme in place. The key word is "effective" – a programme that was documented but not implemented will not carry this weight. BIS looks at training records, screening evidence, classification records, and whether the programme was tested.
- Isolated nature of the conduct. A single inadvertent transaction in an otherwise clean record looks very different from a pattern of repeated shipments to the same restricted destination. Businesses with strong transaction records outside the apparent violation benefit from this factor directly.
- Remedial action. Steps taken after discovery – corrective procedures, additional training, enhanced screening, termination of the problematic supply relationship – are relevant mitigants. BIS treats credible, implemented remediation differently from a list of promised future steps.
- Cooperation with the investigation. Cooperation that goes beyond bare compliance with document requests – for example, proactively identifying related transactions, making personnel available for interview, or flagging connected issues – is a recognised mitigant. Cooperation must be genuine and consistent throughout the investigation.
- Absence of prior violations. A clean enforcement history is a mitigant. Conversely, a prior warning letter, a prior VSD, or a prior penalty settlement that addressed similar conduct will weigh against the business as an aggravating factor.
Aggravating factors work in the opposite direction. They include: wilful or reckless conduct; concealment of the violation; harm to US national-security or foreign-policy objectives; and the business's relative sophistication as an exporter. A large multinational with a dedicated trade-compliance team is held to a higher standard than a small manufacturer exporting for the first time.
What is voluntary self-disclosure, and when should a business consider it?
A voluntary self-disclosure is a proactive written report to BIS – specifically to OEE's Office of Export Enforcement – describing the potential violation in as much detail as the submitting party has assembled at the time of filing. A VSD does not require perfect information at submission; it requires timely disclosure followed by a complete follow-up submission. BIS's guidance is explicit that an incomplete initial VSD, submitted promptly and supplemented as the internal review proceeds, is treated as a genuine VSD for penalty purposes.
The timing question is therefore not "do we know everything before we file?" but "do we know enough to file, and have we not delayed unreasonably?" Delay in itself becomes an aggravating consideration. In our cross-border practice, we have seen businesses lose the VSD credit by waiting for internal review to conclude before approaching BIS – a decision that, in each case, was driven by a reluctance to disclose before the facts were fully understood. That reluctance is understandable. It is also costly.
The VSD decision cannot be taken in isolation from related obligations. A business operating across jurisdictions may simultaneously face disclosure obligations to OFAC (for sanctions-related issues arising from the same transaction), to OFSI in the United Kingdom, and to national authorities in the EU member states where operations are based. The sequencing and coordination of those disclosures matters. Disclosing to one authority can inadvertently affect the posture adopted before another. We structure multi-regime disclosure strategies as a core part of our enforcement work.
If a transaction has already been flagged by OEE, or if a business has received a request for information from BIS, the VSD window may have closed. An early review can identify whether any disclosure credit remains available and preserve options that narrow rapidly once the investigation is formalised.
How does BIS enforcement interact with OFAC, OFSI, and the EU export-control regimes?
BIS and OFAC are separate authorities with overlapping jurisdiction over many cross-border transactions. A shipment of dual-use goods to a restricted destination may simultaneously involve: an EAR licence requirement (BIS jurisdiction); a sanctions prohibition if the end-user or destination is subject to OFAC-administered measures; and potentially a secondary-sanctions risk for non-US parties involved in the transaction chain. It is uncommon, in practice, for a serious EAR violation to have no sanctions dimension. For this reason, the BIS penalty analysis is only one part of the picture.
OFAC's penalty framework is structured differently from BIS's. OFAC also recognises VSD, cooperation, and the existence of an effective compliance programme as mitigants – but its egregiousness analysis, its penalty matrix, and its licence framework operate under the IEEPA statutory base and OFAC's own published guidance. The two agencies may each open separate investigations and each impose separate penalties for conduct arising from the same facts. Coordinating the response to both authorities simultaneously requires a unified legal strategy. Our practice advises on OFAC mitigation factors in a related briefing, available at caldervance.com/insights/regimes/enforcement-mitigation-factors-ofac-explained/.
In the United Kingdom, OFSI administers financial-sanctions enforcement under SAMLA-derived thematic regulations. OFSI's enforcement guidance also includes published mitigation criteria: disclosure, cooperation, and effective compliance programmes are each relevant. However, OFSI's enforcement posture – and its approach to the ownership and control test (the UK and EU test for whether a non-listed entity is caught through a listed person) – differs from OFAC's mechanical 50-percent test. A company that is not blocked under OFAC's rule may still fall within OFSI's control analysis, and vice versa. Those divergences affect how a multi-regime enforcement situation is managed in practice.
EU export controls are administered at the member-state level under the EU dual-use rules, with each national authority applying the regime in its jurisdiction. The EU General Court provides the judicial-review mechanism for designation challenges and related matters. The interaction between BIS's extraterritorial reach – its jurisdiction extends to re-exports of US-origin items and to items with US-origin content exceeding the applicable de minimis threshold – and EU authorities' own controls means that a single supply-chain incident can trigger parallel investigations in multiple jurisdictions. Our cross-regime enforcement practice is designed precisely for this scenario.
For matters that involve apparent violations with an EU dimension, our analysis of EU enforcement procedure is available at caldervance.com/services/enforcement-investigations/apparent-violation-assessment-eu-service/.
What risk flags indicate that counsel should be involved immediately?
Not every potential EAR violation requires external counsel from day one. But several risk patterns indicate that the exposure is serious enough that delay in involving specialist legal advice is itself a risk-management failure.
The clearest flags are:
- Receipt of a request for information, a warning letter, or a formal notification from BIS or OEE. Once BIS has initiated contact, the strategy shifts materially, the VSD credit position changes, and all further communications with the agency are on the record.
- Discovery of a potential violation involving items controlled for national-security, chemical-weapons, nuclear nonproliferation, missile-technology, or regional-stability reasons. These classification categories are associated with higher egregiousness findings and with DOJ criminal referral risk.
- The apparent violation involves a denied person, a party on the Entity List (BIS's list of parties subject to enhanced licensing requirements or a presumption of denial), or an end-use that would have required a licence if disclosed to BIS at the time of export.
- Multiple transactions are involved. A pattern of conduct is harder to characterise as an isolated error and is more likely to produce an egregiousness finding.
- The same facts also raise OFAC or OFSI exposure. Multi-agency situations require coordinated legal advice that addresses the inter-relationship between the enforcement tracks, not sequential advice from separate advisers with no cross-regime view.
- Senior personnel had knowledge of the activity, or the compliance programme was deliberately bypassed. These facts increase the risk of personal liability alongside corporate liability.
There is a common myth worth correcting directly: that a compliance programme's existence, by itself, will protect a business from a serious penalty. A programme that was in place but ineffective – or that was systematically circumvented by the very transactions under review – will not carry meaningful mitigation weight. BIS looks at whether the programme was real, implemented, and tested, not whether a policy document existed on a server.
Common misconceptions about mitigation under the EAR
The first misconception is that self-disclosure is always advisable. It is frequently the right decision, and the mitigation value is substantial. But the decision depends on: whether BIS is already aware of the conduct; whether the facts, fully disclosed, reveal a pattern more serious than the business currently appreciates; whether related OFAC or OFSI obligations apply; and whether the VSD could affect parallel criminal exposure. A VSD that is filed without that analysis can accelerate an investigation into territory the business did not intend to open. The decision requires legal advice on the full picture, not a procedural choice made in isolation.
The second misconception is that a Canadian or EU counterpart regime will apply the same approach to mitigation. Canada's export-control enforcement, administered under applicable national legislation and coordinated through Global Affairs Canada, has its own disclosure and mitigation framework – one that diverges from BIS's on several points that matter in practice. We address the Canadian position directly in a related regime briefing at caldervance.com/insights/regimes/enforcement-mitigation-factors-canada-explained/. The EU dual-use regime, as noted above, is administered at member-state level and reflects the national authority's own enforcement priorities and procedural rules. What counts as effective mitigation in a BIS context may be weighted differently by a Dutch, German, or French export-control authority.
The third misconception is that small-value transactions attract small penalties. The BIS penalty calculation is, in significant part, transaction-count-based and can also reflect the value of the items exported in an unlicensed condition. Low-value items with a high strategic classification – components that affect national-security or proliferation controls – can attract penalties that bear no relationship to their commercial price. The sophistication of the exported technology matters more to the penalty analysis than the invoice value.
In our experience, businesses that approach a BIS matter with an early, structured assessment – scope the apparent violation, map the ownership chain, audit the compliance programme, and take a considered view on disclosure sequencing – achieve meaningfully better outcomes than those that react to each agency contact as it arrives. We have acted for exporters, intermediaries, and their foreign affiliates in multi-regime enforcement situations, and the pattern holds consistently.
Related practices
- Apparent Violation Assessment – EU – assessing EU export-control enforcement exposure and structuring a response
- Mitigation Factors in Enforcement – Canada – how Canada's export-control authority approaches mitigation and voluntary disclosure
- Mitigation Factors in Enforcement – OFAC – OFAC's mitigation framework and its interaction with the BIS process