A cross-border acquisition closes. The buyer's counsel inserts a clause requiring the target to confirm that no export-controlled goods have been shipped to parties on the Entity List and that no licences have been violated. Two months later, a BIS audit surfaces a pattern of undisclosed shipments. Who bears that exposure – and was the representation adequate in the first place? These questions are decided long before the deal closes.
Sanctions representations and warranties under the Export Administration Regulations (the EAR – the US Commerce Department's primary export-control instrument, administered by the Bureau of Industry and Security (BIS)) allocate contractual risk for export-control violations across transaction parties. As of January 2026, BIS enforcement posture remains active, and inadequately drafted reps can leave a buyer exposed to successor liability for a seller's pre-closing conduct.
This briefing covers who administers the EAR, what the core prohibitions are, how reps and warranties should be structured, where cross-regime divergence creates additional exposure, and when counsel should be involved before execution.
Who administers the EAR and what is its legal basis?
BIS administers the EAR under authority derived from the Export Control Reform Act and the International Emergency Economic Powers Act (IEEPA). The EAR governs the export, re-export, and transfer of dual-use goods, software, and technology with a US nexus. It operates alongside – but independently of – OFAC's financial-sanctions regime. A transaction can be clean under OFAC and still violate the EAR. Cross-border counsel who treat these as interchangeable create gaps.
The key enforcement unit within BIS is the Office of Export Enforcement (OEE), which investigates potential violations and can refer criminal matters to the Department of Justice. The Entity List (a BIS-maintained roster of foreign parties subject to licence requirements) and the Denied Persons List (DPL, covering individuals and companies denied export privileges) sit at the centre of most rep-and-warranty disputes. In our cross-border practice, we regularly advise transaction teams that conflate these two lists – they operate on different legal bases and carry different consequences.
The EAR's jurisdictional reach extends beyond the United States. The de minimis rule and the foreign direct product rule (FDP rule) can subject non-US goods and technology to EAR controls where a sufficient US-origin content or technology nexus exists. This extraterritorial dimension is the single most common surprise in cross-border M&A: a European seller may have shipped non-US goods that nonetheless required a BIS licence.
Related practices
- Correspondent banking and de-risking under OFAC – sanctions risk management for financial institutions in cross-border payment flows
- Sanctions reps and warranties under BIS / EAR – advanced drafting – deeper analysis of clause construction and allocation mechanisms
The position above covers the standard EAR framework. Your specific transaction – the goods involved, the counterparty's ownership chain, the shipping history, the jurisdictions touched – changes the analysis materially.
For an initial assessment of your BIS / EAR exposure on a pending transaction, contact Calder & Vance at info@caldervance.com.
What does a sanctions representation under the EAR cover?
A well-structured EAR representation goes beyond a simple "no violations occurred" statement; it maps to each layer of the regulatory regime and confirms the accuracy of those claims through due-diligence verification. There are four distinct layers that practitioners typically address.
First, classification accuracy: the party confirms that all dual-use items have been classified against the Commerce Control List (CCL – BIS's schedule of controlled goods, software, and technology, each assigned an Export Control Classification Number (ECCN)) and that classification was performed by a qualified person, not assumed by default. Default-to-EAR99 is the single most common classification error we see in transaction diligence – and EAR99 does not mean "uncontrolled in all circumstances".
Second, end-user and end-use screening: the party confirms it has screened counterparties against the Entity List, the DPL, the Unverified List, and OFAC's Specially Designated Nationals list (SDN List – OFAC's roster of blocked persons and entities). A rep that covers only one list is inadequate. Entity List restrictions can apply even where the ultimate end-user is not an SDN.
Third, licence and exception compliance: where a licence or licence exception was used, the representation should confirm that the conditions were met and records maintained. A licence exception used outside its terms is a violation, not a defence.
Fourth, no knowledge violations: the party confirms it had no actual knowledge and no reason to know of a prohibited end-use or end-user at the time of shipment. This tracks BIS's "red flags" standard. In our experience, this is the most heavily contested element in post-closing disputes – particularly where a compliance officer had raised concerns that were overridden commercially.
How does BIS / EAR diverge from OFAC and UK / EU export-control regimes?
The EAR is not the only regime a cross-border transaction party must address, and the divergences between the major regimes produce real drafting risk. A rep that covers BIS perfectly may leave EU dual-use or UK export-control exposure unaddressed.
Under OFAC's sanctions programmes, the primary test for entity-level blocking is the 50 percent rule (OFAC's rule treating any entity owned 50 percent or more in the aggregate by blocked persons as itself blocked, regardless of whether it is named on the SDN List). BIS's Entity List operates differently: listing is based on a reasonable probability of diversion to controlled end-uses, not ownership. A company can be on the Entity List without any OFAC designation, and vice versa. Transaction reps that reference only "OFAC lists" miss this entirely.
The UK's export-control regime, administered by the Export Control Joint Unit (ECJU), follows a similar classification structure to the EAR in many respects but operates under the Export Control Order and distinct Strategic Export Licensing rules. Critically, the UK does not automatically mirror EU or US controls post-Brexit. A shipment lawful under the EAR may require a UK licence; a rep drafted solely to EAR standards will not capture UK exposure. We regularly advise on exactly this gap in dual-listed UK-US corporate transactions.
The EU's export-control regime operates under the relevant Council regulation on dual-use items. EU controls apply at the point of export from EU territory and through catch-all provisions that can extend controls to unlisted items where the exporter has knowledge of a prohibited end-use. An EU seller's rep in a cross-border deal must address both the EU dual-use schedule and any applicable national controls of the member state of export – these are not identical.
For transactions with a Swiss, Japanese, Singaporean, or Australian dimension, each jurisdiction maintains its own export-control list and licensing regime. Where goods have a US-origin content or are produced from US-controlled technology, the EAR may still apply extraterritorially under the FDP rule even after export from the US, layering obligations across multiple regimes simultaneously.
The practical implication: a rep-and-warranty package for any cross-border deal involving dual-use goods, advanced technology, or defence-related items should address each regime to which the parties or their goods are subject. A US-only EAR rep in a deal with EU and UK legs is a known gap. Does your transaction documentation address all three?
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential review.
How is the EAR enforced, and what are the successor-liability implications?
BIS enforcement can result in civil penalties, denial of export privileges, and – where DOJ is involved – criminal prosecution. Civil penalties under the EAR are significant and are calculated on a per-violation basis; each unlicensed shipment can constitute a separate count. The penalty framework distinguishes between egregious and non-egregious violations, with voluntary self-disclosure (VSD – a proactive disclosure to BIS of a potential violation before the agency independently discovers it) treated as a significant mitigating factor. Record-keeping obligations under the EAR are substantial: exporters must maintain documentation for a period after the transaction, and BIS audits routinely test this.
In a corporate acquisition, successor liability is the mechanism by which a buyer inherits the seller's pre-closing violations. BIS can pursue enforcement against the acquiring entity for conduct that predates the transaction. This is why the rep-and-warranty package matters operationally, not just contractually: if the seller's reps are false and the buyer has no indemnity protection or escrow, the buyer bears the cost of remediation and any penalty. In our practice, we have acted for buyers who discovered Entity List violations only after closing – the absence of a specific rep on BIS-list screening materially affected their indemnity position.
A voluntary self-disclosure by the seller before closing – or a decision by the buyer to self-disclose post-closing after discovering a violation – is a strategically significant step. BIS treats timely VSD as a major mitigating factor. But a VSD also creates a disclosed record; the decision requires careful judgement about timing, scope, and the nature of the conduct. This is not a process to manage without counsel.
The divergence between OFAC and BIS enforcement posture is relevant here. OFAC enforcement settlements are public. BIS enforcement orders are also published. A post-closing discovery that generates a BIS enforcement order will therefore be visible to counterparties, correspondent banks, and future transaction partners – a reputational dimension that purely contractual indemnity does not address.
What are the common drafting failures and risk flags?
The most reliable risk indicator in a transaction is not a specific violation – it is a compliance programme that was never designed to address BIS obligations at all. We see this pattern consistently in mid-market acquisitions involving technology companies that export to global customers: the target has a functional OFAC screening programme but has never classified its products under the CCL. Every shipment to a non-US customer has been made on an assumed EAR99 classification. That assumption is often wrong.
The second most common failure is list coverage. A rep that references only the SDN List and the Consolidated List (the UN Consolidated List – the UN Security Council's list of designated individuals and entities subject to UN-mandated measures) omits the Entity List, the DPL, and the Unverified List entirely. Each carries its own implications. Shipping to an Unverified List party without resolving the red flags is itself a risk marker, even without a completed violation.
Third: the "to the best of the seller's knowledge" qualification. This is standard drafting but creates a due-diligence obligation. If the seller's knowledge is determined by the state of its compliance programme, and that programme is inadequate, the qualification can be rendered hollow. Buyers should insist on a "what should have been known with a reasonable programme" standard, not merely "what the compliance officer was told".
Fourth: geographic scope gaps. A rep that covers only direct exports from the US misses re-exports and in-country transfers by non-US subsidiaries or distributors. The EAR applies to re-exports of US-origin items regardless of where the re-exporting party is incorporated. A European distribution subsidiary of a US-origin business may have re-exported items to Entity List parties for years without the parent's compliance function ever reviewing it.
Finally, record-keeping. The EAR imposes obligations to maintain export records for a prescribed period. If the seller cannot produce records to support its rep on classification and screening, the rep is unverifiable – and an indemnity against an unverifiable obligation has reduced value.
What should a compliance counsel do before execution?
Pre-closing EAR diligence follows a defined sequence, and each step builds on the one before it. Missing a step does not make the transaction faster – it relocates the cost to post-closing remediation, enforcement exposure, or litigation.
The first step is scope identification. What goods, software, or technology does the target develop, manufacture, or trade? Which of those have US-origin content, are produced from US-controlled technology, or incorporate controlled components? This scope exercise determines whether the EAR applies at all, and to what degree. The FDP rule can apply even where the target is non-US.
The second step is classification review. Each item in scope should be reviewed against the CCL. For targets with large product portfolios, this typically requires a sampling approach prioritising the highest-risk product lines and export destinations. EAR99 should be confirmed, not assumed.
The third step is counterparty screening. The target's customer list and distributor network should be screened against the Entity List, the DPL, the SDN List, and any applicable secondary-sanctions lists. Where the target operates in sectors with significant counterparty risk – defence, advanced semiconductors, certain chemical or biological research applications – a deeper end-use review is warranted.
The fourth step is licence and exception review. Where licences were held, confirm they were used in accordance with their terms. Where exceptions were relied on, confirm the conditions were met and documented. A licence exception used outside its terms is a prior violation, not a compliance asset.
The fifth step is programme assessment. Was the target's export-compliance programme adequate to support the reps it is being asked to give? If not, the buyer faces a choice: require a rep it knows is inadequately supported (with corresponding indemnity exposure), re-price or restructure around the gap, or require remediation as a condition of closing.
In a recent matter, a technology sector business was party to a cross-border sale process in which the target had never conducted a formal CCL classification exercise. We assessed the product portfolio, identified a subset of items that required licence analysis, confirmed exception availability for the majority, and identified two product lines for which prior shipments to a specific region required a VSD assessment. The transaction closed after the disclosure issue was resolved and appropriate indemnity protections were structured. The matter illustrates that pre-closing BIS diligence is not merely a legal exercise – it is a transaction-value exercise.
A common misconception: "EAR99 means no BIS obligation"
The most persistent myth in this area is that an EAR99 classification (the default classification for items not controlled under any ECCN) removes all BIS obligations. It does not. EAR99 items can still require a licence when destined for parties on the Entity List, when the exporter knows or has reason to know they will be used for a prohibited end-use, or when they are being exported to certain destinations subject to comprehensive or near-comprehensive controls. The catch-all provisions in the EAR can also impose licence requirements on EAR99 items where an end-use concern exists.
Compliance counsel should frame EAR99 as the starting point of a screening analysis, not the conclusion of it. The classification tells you the item has no ECCN-specific controls. It does not tell you the counterparty is clean, the destination is unrestricted, or the end-use is permitted. Those are separate questions – and they each require a separate answer in the rep-and-warranty package.
A second misconception: that a BIS licence exception, once identified, can be applied indefinitely without review. Licence exceptions carry conditions; those conditions can change when BIS amends the EAR. An exception that applied to a shipment two years ago may not apply today on the same terms. Transaction reps that rely on prior exception determinations without confirming current applicability contain a latent gap.