A fintech processes hundreds of cross-border payments daily. Its compliance team screens counterparties against the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) but pays less attention to a separate and increasingly active body of rules: the Export Administration Regulations (the EAR), administered by the Bureau of Industry and Security (BIS). Then a transaction routes through a processor that supports technology transfers to a restricted destination – and the question of whether payment-processing itself constitutes an export-control violation lands without warning.
Payment-processing controls under BIS / EAR rules govern whether a financial intermediary or payment processor participates in a transaction that results in the unauthorised export, re-export, or transfer of items subject to the EAR. The governing authority is BIS, a bureau of the US Department of Commerce. As of August 2026, BIS applies the EAR to a wide range of transactions – including financial services that facilitate the movement of controlled technology – meaning that payment processors, banks, and fintech platforms with US-dollar clearing or US-person involvement can face export-control exposure that runs parallel to, and is legally distinct from, their OFAC obligations.
This briefing sets out who administers the regime, what the key prohibitions mean for payment intermediaries, how BIS enforcement operates, how the US position compares with the EU and UK, and what practical steps a cross-border business should take now.
Who administers BIS / EAR payment-processing controls, and what is their legal basis?
BIS administers the EAR under the authority of the Export Control Reform Act (ECRA) and, more broadly, the framework inherited from the predecessor statutes that it consolidated. The EAR controls the export, re-export, and in-country transfer of items – goods, software, and technology – that appear on the Commerce Control List (CCL). The CCL assigns each item an Export Control Classification Number (ECCN), the identifier that determines which destinations, end-users, and end-uses require a licence.
Payment processors and financial intermediaries matter to BIS because the EAR's prohibitions are not limited to physical shipment. Technology transfers – including the release of controlled software, technical data, or source code to a foreign national – can occur electronically. A payment that clears the path for such a transfer, or that is made by a US person in furtherance of a prohibited export, can bring the paying institution within the EAR's reach. The critical question is whether the payment "facilitates" a transaction that itself violates the EAR. BIS has made clear that facilitation – including financing and payment processing – is within scope.
The EAR also applies extraterritorially in specific circumstances. Where items contain US-origin content above defined de minimis thresholds, or where they are the direct product of US technology or software, the re-export by a non-US party can still require US authorisation. Non-US payment processors handling transactions for such items therefore face potential exposure even where no US-person nexus is immediately obvious.
The position above sets out the standard legal basis. Your facts – the item being transacted, the parties involved, and the payment route – change the analysis significantly.
For a review of your payment-processing programme's alignment with current export-control requirements, contact Calder & Vance at info@caldervance.com.
What does BIS / EAR prohibit in relation to payment processing?
BIS prohibits US persons – and, under the extraterritorial provisions, non-US persons in defined circumstances – from financing, facilitating, or otherwise supporting transactions that would violate the EAR. For a payment processor or bank, this produces three principal exposure categories.
First, processing a payment that directly funds an export to a destination that requires a licence and for which no licence has been obtained. Certain destinations are subject to comprehensive or near-comprehensive controls under the EAR. A payment that clears funds to a party in such a destination – particularly where the underlying goods include items on the CCL – may constitute facilitation of a prohibited export. The processor need not itself be the exporter; participation in the transaction chain is sufficient for exposure to arise.
Second, processing payments involving parties on BIS's Entity List, Denied Persons List, or Unverified List. The Entity List identifies foreign parties subject to specific licence requirements for all items subject to the EAR. Dealing with a listed party without the required authorisation is a violation. Payment processors that do not screen against these BIS lists – and many focus their screening exclusively on OFAC lists – create a gap that enforcement actions have begun to address. Does your screening programme query the Entity List as a separate step from SDN screening?
Third, processing transactions involving Military End-Users (MEU) or Military Intelligence End-Users in countries subject to MEU controls. The MEU rule, as amended, applies to items subject to the EAR where the end-user is a military entity in a designated country. A financial intermediary that processes payments for such a transaction without verifying the end-use status assumes meaningful exposure.
The cross-border implication is immediate. Non-US fintechs, payment networks, and correspondent banks that process US-dollar payments or that maintain US operations are routinely within the EAR's reach, even where their headquarters are outside the United States. In our experience, this extraterritorial dimension is the most consistently underestimated aspect of EAR exposure for non-US financial institutions.
How does BIS / EAR interact with OFAC, UK OFSI, and EU export-control rules?
BIS / EAR rules and OFAC sanctions are legally distinct regimes administered by different agencies. A payment may be OFAC-clean yet still raise EAR exposure, or vice versa. Payment processors need to maintain compliance programmes that address both sets of obligations independently.
OFAC administers economic sanctions – asset freezes, transaction prohibitions, and blocking orders – targeting designated persons and countries. BIS administers export controls targeting specific items, destinations, end-users, and end-uses. The regimes can overlap – a transaction involving a sanctioned person may also involve a controlled item – but compliance with one does not guarantee compliance with the other. In our cross-border practice, we regularly advise clients who have robust OFAC screening in place but have given insufficient attention to their EAR item-classification obligations.
The UK regime offers an instructive comparison. OFSI (the Office of Financial Sanctions Implementation) administers UK financial sanctions under the Sanctions and Anti-Money Laundering Act (SAMLA) and the relevant thematic regulations. Separately, the Export Control Joint Unit (ECJU) administers UK export-licensing requirements. The UK ownership and control test (the test for whether a non-listed entity is caught through a listed person) differs from OFAC's mechanical 50 percent threshold: OFSI applies a broader control analysis. A payment processor working across the Atlantic must therefore apply different ownership-assessment methodologies to the same transaction depending on which regime governs the specific element.
The EU adds a further layer. EU dual-use export-control rules apply to items exported from EU territory, and the EU Blocking Regulation creates tension for EU-established firms that seek to comply with US extraterritorial measures. A European payment processor asked to terminate processing for a transaction because of US secondary-sanctions risk may face conflicting legal obligations under EU law. This is not a theoretical tension; we have acted for clients navigating exactly this conflict in cross-border payment structures.
If a payment has already been flagged under either BIS or OFAC rules, an early review by specialist counsel can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential assessment.
What is the BIS enforcement posture for payment-related violations?
BIS has a strong and active enforcement posture for EAR violations, including those involving financial intermediaries and payment facilitators. The primary enforcement tools are civil and criminal penalties, denial orders, and in the most serious cases, referral to the Department of Justice for criminal prosecution under the Export Control Reform Act.
Civil penalties for EAR violations can reach significant amounts per violation. The civil penalty cap is indexed and periodically adjusted; the current figure should be verified against the Federal Register before any enforcement risk assessment is presented to a board or compliance committee. BIS calculates penalties on a per-transaction basis, which means that a payment processor handling high volumes of problematic transactions can accumulate substantial aggregate exposure rapidly.
BIS's enforcement guidance describes an aggravation/mitigation matrix that considers factors including the existence of a compliance programme, prior violations, whether a voluntary self-disclosure (VSD – a self-report of a potential violation to BIS before the agency discovers it independently) was made, and the harm to US national-security interests. VSD is a material factor: BIS has consistently treated timely, complete, and accurate self-disclosure as a significant mitigating element. The window for effective VSD is not unlimited; delay reduces its mitigating value.
Denial orders – orders that prohibit any person from participating in any transaction subject to the EAR with the named party – are a particularly severe tool. A denial order against a payment processor would effectively exclude it from the US export-control system, a commercially catastrophic outcome. BIS has issued denial orders in cases involving financial intermediaries, and it has shown willingness to impose them where the conduct is egregious or repeated.
What does this mean for a payment platform that discovers it may have processed transactions touching controlled items or restricted parties? The answer is a structured review, a privilege-protected internal investigation, and an early decision on whether to self-disclose. The enforcement posture BIS has maintained in recent years leaves little room for a "wait and see" approach.
How should payment processors structure their EAR compliance programme?
An effective EAR compliance programme for a payment processor has five core elements, and BIS's own guidelines endorse a similar structure. The elements are: management commitment, risk assessment, controls and procedures, testing and audit, and training. Each must be documented and demonstrable.
Risk assessment is the critical starting point. Payment processors handle a wide variety of transaction types, counterparty profiles, and destination countries. Not every payment creates the same level of EAR exposure. A processor that focuses on domestic consumer transactions has a different risk profile from one that operates in technology-transfer payments, cross-border B2B settlements, or correspondent banking. The risk assessment must be granular enough to identify the specific categories of transaction that create EAR exposure, and it must feed directly into screening and control design.
Screening is where the operational gap most often appears. Most payment-compliance programmes screen against OFAC's SDN List, the UN Consolidated List, and a selection of national lists. Fewer routinely query BIS's Entity List, Denied Persons List, Unverified List, and the MEU controls. These are separate databases that require separate integration. In our experience advising financial institutions on compliance-programme design, the failure to screen against BIS-maintained lists is one of the most common structural deficiencies we identify.
Record-keeping requirements under the EAR are precise. Businesses subject to the EAR must retain relevant export-control records. The required retention period under the EAR is five years. For a payment processor, relevant records include transaction data, screening outputs, disposition decisions, and any licence or exception relied upon. Gaps in records significantly hamper a voluntary self-disclosure or penalty-mitigation argument.
Item classification is equally important, even for a payment business. Where a processor provides technology products – payment software, APIs, cryptographic systems – those items may themselves be subject to the CCL and require ECCNs. A processor that exports its technology to foreign affiliates or clients without classifying it and confirming the applicable licence exception creates a separate category of EAR exposure distinct from its transaction-facilitation risk.
Finally, training. Compliance procedures are effective only where the people executing them understand why the rules exist and what conduct crosses the line. Training must cover the specific categories of transaction that create EAR exposure in the business's actual product mix, not generic export-control concepts. We regularly advise on training design as part of programme-implementation mandates.
Common risk flags for payment processors under BIS / EAR
Certain transaction patterns consistently generate EAR red flags for payment intermediaries. Recognising them early – ideally before a transaction is processed – is the foundation of a functioning pre-transaction control.
Technology-sector payments carry the highest baseline EAR risk. Payments for software licences, cloud-service subscriptions, semiconductor procurement, or telecommunications equipment frequently involve items on the CCL. A payment processor that does not understand the underlying commercial transaction it is facilitating – because it processes only payment data, not trade documents – cannot adequately assess EAR exposure. This "front-end blindness" is a systemic risk in platform-based payment businesses.
Unusual routing or structuring is a related flag. Where a payment is routed through multiple jurisdictions, involves a third-country intermediary not obviously connected to the commercial transaction, or is split across multiple smaller payments, EAR risk increases alongside the traditional financial-crime indicators. These patterns may suggest an attempt to obscure the true destination or end-user – precisely the categories that BIS enforcement focuses on. From a compliance perspective, the appropriate response is enhanced due diligence on the transaction structure, not processing by default.
Counterparty location is a direct trigger. Certain countries are subject to comprehensive EAR controls. Payments to or from parties in those destinations require particular scrutiny, as does the use of those countries as intermediary jurisdictions. Ensure that your screening tool captures not only the stated counterparty location but also any secondary jurisdiction appearing in the payment chain.
Do you have a clear escalation path when a transaction triggers an EAR-related concern? Many processors have robust OFAC escalation procedures but lack an equivalent for BIS export-control hits. The escalation path, the persons authorised to make hold/process decisions, and the record of the decision should all be defined in advance.
Objection: "EAR rules apply to exporters, not to payment processors"
This is one of the most persistent misconceptions we encounter among fintech and payment-sector compliance teams. The argument is that the EAR is an exporter's regulation – it controls the movement of goods, software, and technology – and that a payment processor, which moves money rather than items, falls outside its scope.
That analysis is incorrect in two respects. First, the EAR's facilitation and "cause" provisions extend the obligation to any person who causes an export to occur or who facilitates an export or re-export by a third party. Processing a payment that enables a prohibited export is participation in that export, not a neutral financial act. BIS and DOJ have pursued financial intermediaries on exactly this theory in enforcement actions involving restricted-destination transactions.
Second, many payment processors are also technology providers. They deploy software, APIs, and cryptographic tools to their clients. Those products may themselves be subject to the CCL. A payment company that delivers a controlled technology item to a foreign affiliate – even in the course of routine business operations – is an exporter for EAR purposes, regardless of how it characterises its commercial activity.
The practical upshot: every cross-border payment business operating with any US nexus – US-dollar clearing, US-person involvement, US-origin technology in its stack – should treat BIS / EAR compliance as a live obligation, not a matter reserved for goods exporters.
Related practices
- Sanctions compliance audit and testing – stress-testing screening logic and programme design against current regulatory expectations.
- Payment-processing controls under Canada's regime – a comparative briefing on GAC-administered payment-control obligations.
- Payment-processing controls under EU rules – analysis of EU dual-use and Council-regulation obligations for payment intermediaries.