A technology exporter reviews its pipeline and finds a distributor in a third market whose ultimate parent has recently been added to the Entity List (the Commerce Department's list of parties to which exports, re-exports, and transfers are subject to heightened controls under the Export Administration Regulations). The shipment is already prepared. The licence exception the company assumed covered the transaction may no longer apply. What does BIS actually require, and what does a properly structured sanctions risk assessment under the EAR look like? As of August 2026, these questions are becoming more urgent across cross-border supply chains as the Bureau of Industry and Security ("BIS") has expanded both the scope of its restricted-party lists and its enforcement posture.
The Export Administration Regulations ("EAR"), administered by BIS under the authority of the Export Control Reform Act, govern the export, re-export, and in-country transfer of US-origin and certain foreign-produced items. A sanctions risk assessment under the EAR is not a single filing: it is a continuous process of item classification, end-use and end-user screening, licence-requirement determination, and documentation. The governing standard requires exporters to know their customers, to screen against multiple BIS and OFAC-maintained lists, and to apply licence requirements to controlled items before any shipment moves.
This briefing explains who administers the EAR, what its key prohibitions cover, how the risk assessment process works in practice, where the EAR interacts with OFAC and with allied-nation regimes, and how Calder & Vance assists exporters, manufacturers, and distributors in building compliance programmes that hold up under BIS scrutiny.
Who administers the EAR and what is its legal basis?
BIS, a component of the US Department of Commerce, administers the EAR under the Export Control Reform Act and the authority of the International Emergency Economic Powers Act. The EAR applies to any person, wherever located, who exports a US-origin item, re-exports a foreign-produced item containing US-controlled content above a defined threshold, or transfers a controlled item within a third country. US persons are always subject to the EAR. Foreign persons become subject to it when they handle items in which the United States retains a sufficient interest.
This extraterritorial reach is not a technicality. We regularly advise European and Asian clients who have no US office and no direct US customer but who buy components from US suppliers or use US software in their own products. The de minimis rule and the foreign-direct-product rule are the two EAR mechanisms through which BIS extends its authority beyond the United States border. A foreign manufacturer who incorporates controlled US technology into its own product may find that the finished product itself requires a BIS licence before it can be shipped to certain destinations – a result that surprises many businesses encountering the EAR for the first time.
The Commerce Control List ("CCL") is the instrument BIS uses to classify items. Every item on the CCL carries an Export Control Classification Number ("ECCN"), a five-character alphanumeric code that specifies the reasons for control (national security, anti-terrorism, missile technology, and so on) and the destinations, end-uses, and end-users to which licence requirements apply. Items not on the CCL fall under EAR99, the default classification – but even EAR99 items may require a licence if the destination, end-user, or end-use is controlled.
What are the key prohibitions and where do they sit?
The EAR imposes three interrelated layers of prohibition, each of which a well-structured BIS / EAR sanctions risk assessment must address before a shipment is cleared.
The first layer is item-based. If a controlled item – one with an ECCN – is destined for a country, end-user, or end-use listed in the CCL's country-chart requirements for that ECCN, a licence is required unless a licence exception applies. Licence exceptions are defined categories of transactions that BIS has determined do not require a case-by-case licence; they are not blanket exemptions and carry their own conditions. A business that misapplies a licence exception – by, for example, relying on an exception that the relevant transaction does not satisfy – is in violation as if it had exported without a licence at all.
The second layer is party-based. BIS maintains several restricted-party lists: the Entity List, the Denied Persons List, and the Unverified List. The Denied Persons List names individuals and entities against whom export privileges have been denied; no licence exception applies and BIS will not grant a licence for a transaction involving a denied person. The Entity List imposes a licence requirement – often with a policy of denial – for transactions involving the listed entity. The Unverified List is a red-flag indicator: BIS has been unable to verify the end-user through a pre-licence check or post-shipment verification. Shipping to an Unverified List party without taking steps to resolve the uncertainty is itself a compliance risk.
The third layer is end-use-based. The EAR contains prohibitions on exports, re-exports, and transfers to end-uses associated with weapons of mass destruction, certain rocket systems, and other enumerated activities, regardless of the item's ECCN. These prohibitions apply even to EAR99 items. In our experience, end-use screening is where many mid-size exporters have the weakest controls – they screen against lists but do not interrogate the actual purpose for which the item will be used.
The position above covers the standard case. Your facts – the counterparty, the goods, the route, the licence exception invoked, and the regime in play – change the analysis materially. For an initial assessment of your exposure under the EAR, contact Calder & Vance at info@caldervance.com.
How does a BIS / EAR sanctions risk assessment work in practice?
A BIS / EAR sanctions risk assessment follows a defined sequence. Each step gates the next: a business cannot sensibly assess licence requirements without first knowing what the item is, and it cannot confirm the licence requirement without knowing who the end-user is and what they will do with the item. Compliance counsel who skip a step in the sequence regularly discover the gap at enforcement, not before.
Step one is item classification. Every item a business ships must be classified against the CCL to determine its ECCN – or confirmed as EAR99. BIS provides a self-classification pathway; for complex or borderline items, an advisory-opinion request to BIS or formal commodity-classification request is available. Misclassification is one of the most common sources of EAR violations we see. A product developed for commercial use may nonetheless contain technology controlled for national-security reasons; the commercial purpose of the finished item does not determine its ECCN.
Step two is counterparty and end-user screening. The exporter must screen every party to the transaction – the buyer, the freight forwarder, intermediate consignees, the ultimate end-user – against all BIS-maintained lists and, separately, against the OFAC SDN List (OFAC's list of Specially Designated Nationals and blocked persons) and the OFAC non-SDN consolidated lists. The two regimes run in parallel: a clean BIS screen does not resolve an OFAC issue, and vice versa. Businesses that conflate these two separate screening exercises regularly miss one of them.
Step three is licence-requirement determination. For a controlled item (i.e., one with an ECCN), the exporter applies the CCL's country-chart matrix to determine whether a licence is needed for the destination, the end-use, and the end-user. If a licence is required, the exporter then checks whether a licence exception covers the transaction and, if so, whether all conditions of that exception are met.
Step four is documentation and record-keeping. The EAR imposes a record-keeping obligation: exporters must retain records of their export transactions for a defined period. These records include classification determinations, screening results, licence applications and approvals, end-user statements, and correspondence on which the transaction decisions were based. Adequate records are not optional; in an enforcement context, a business that cannot produce contemporaneous documentation of its compliance decisions is in a materially worse position than one that can.
What is the cross-regime picture – how does the EAR interact with OFAC and allied-nation controls?
The EAR and OFAC's economic sanctions programmes are distinct regimes administered by different agencies, but they overlap significantly in practice. A shipment that clears EAR licensing requirements may still be prohibited by an OFAC programme if the end-user or destination is subject to primary or secondary sanctions. The converse is equally true. A business that holds an OFAC licence for a transaction to a sanctioned jurisdiction must still separately evaluate whether a BIS licence or licence exception covers the EAR-controlled items in the shipment.
The cardinal rule here is that the stricter prohibition governs. If OFAC prohibits the transaction outright, a BIS licence exception is irrelevant. If BIS requires a licence and none is available, an OFAC licence that permits the financial transaction does not authorise the physical export. The two authorisation streams must both be satisfied independently.
The interaction extends internationally. The United Kingdom's Export Control Order, administered by the Export Control Joint Unit ("ECJU"), controls dual-use and military items under a parallel classification system. The European Union's dual-use rules, which cover both item-based controls and catch-all provisions, apply to EU-based exporters and, in some circumstances, to EU persons handling items outside the EU. Where a transaction involves a US-origin item, UK components, and an EU intermediary, the exporter may face simultaneous obligations under the EAR, the UK regime, and the EU rules – each with its own licence requirement, exception criteria, and enforcement authority. We have acted for businesses caught precisely in this position and know that the analysis cannot be conducted in regime silos.
Canada, Australia, and Singapore each maintain national export-control regimes that can apply alongside or independently of the EAR where goods transit or re-export through those jurisdictions. Japan's Foreign Exchange and Foreign Trade Act export controls are particularly significant for technology exporters into the Indo-Pacific. The practical implication is that a risk assessment designed for EAR compliance alone may leave a business exposed in the destination or transit jurisdiction.
If a transaction has already been flagged or a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com.
What are the enforcement mechanisms and what do they mean for risk?
BIS enforces the EAR through its Office of Export Enforcement. The civil enforcement track can result in significant financial penalties per violation, calculated on a per-transaction basis. Criminal enforcement, pursued through the Department of Justice, applies to wilful violations and can result in imprisonment as well as financial penalties. The breadth of BIS's civil jurisdiction – covering any person who causes, aids, or abets an EAR violation – means that carriers, freight forwarders, and banks can face liability for transactions in which they played a facilitative role, even without direct knowledge of the controlled nature of the goods.
A voluntary self-disclosure ("VSD") is the mechanism by which a business or individual reports an apparent EAR violation to BIS before BIS discovers it. BIS's published guidance acknowledges that a timely, complete, and accurate VSD is a mitigating factor in any penalty determination. A business that discovers a pattern of violations – say, through an internal audit revealing systematic misclassification of a product line – has a genuine decision to make about whether and how to disclose. That decision should never be made without legal advice. The VSD must be accurate and complete; a partial or inaccurate VSD can worsen the outcome.
The Deemed Export rule adds another enforcement dimension. A deemed export is the transfer of controlled technology to a foreign national within the United States. If a company shares ECCN-controlled technical data with a foreign employee or researcher in the United States, that transfer is treated as an export to the employee's country of nationality. Companies with international research and development teams frequently underestimate this risk.
What are the common risk flags a BIS / EAR sanctions risk assessment must address?
In our cross-border practice, certain patterns recur across the businesses we assess. A well-designed EAR compliance programme must be built to catch each of them before they become enforcement issues.
The first is customer behaviour that is inconsistent with the stated end-use. An industrial buyer that requests unusual quantities of a component, resists providing an end-user statement, or requests that items be shipped through an unusual route is presenting a red flag. The EAR's "know your customer" standard does not require certainty; it requires reasonable enquiry. Ignoring apparent red flags is not a defence – it is aggravating conduct.
The second is reliance on outdated classification determinations. The CCL changes. An ECCN determination made three years ago may not reflect current controls. Businesses that operate on static product classifications without a periodic review cycle are carrying hidden compliance risk.
The third is inadequate coverage of digital and cloud-delivered products. The EAR applies to technology and software, including items transferred electronically. A company that carefully controls physical shipments but sends controlled technical data by email or makes controlled software available through a cloud environment without checking the nationality or location of the recipients may be making daily EAR violations without realising it.
The fourth is the gap between parent-level and affiliate-level compliance. A business that has a well-designed compliance programme at the parent level but whose regional subsidiaries operate without adequate training, list-screening, or classification capability is not compliant in any meaningful sense. BIS holds the enterprise to the highest available standard.
A common myth we address with new clients is that the EAR only applies to physical goods. It does not. Technology – defined as specific information necessary for the development, production, or use of a controlled item – is itself subject to the EAR. So is software. A company that develops and licences software incorporating controlled encryption technology, or that provides cloud-based services embedding controlled functions, is as firmly within the EAR's scope as a manufacturer of controlled hardware.
How does Calder & Vance assist with BIS / EAR sanctions risk assessment?
Our export-control practice assists exporters, manufacturers, distributors, and technology businesses at every stage of the BIS / EAR compliance cycle. The services available cover the full scope of a sanctions risk assessment: item classification and ECCN determination, counterparty and end-user screening against BIS and OFAC lists, licence-requirement analysis and licence-exception review, end-use programme design, deemed-export assessment, record-keeping architecture, and VSD preparation.
For businesses encountering the EAR for the first time – often because a new product line, a new customer, or a new market has brought them within scope – we provide a structured initial assessment that maps the regulated items, identifies the applicable controls, and sets out a prioritised remediation plan. For businesses with existing compliance programmes, we conduct testing and gap analysis against BIS's own published compliance guidance, identifying systemic weaknesses before enforcement does.
In matters where an apparent violation has occurred, we advise on the VSD question, scope the conduct, assess aggravating and mitigating factors, and prepare the penalty defence or voluntary disclosure documentation. Outcomes in enforcement matters are never guaranteed; the VSD and penalty process is subject to BIS's discretion. What we can offer is thorough preparation, accurate documentation, and the cross-regime knowledge to identify whether an OFAC issue runs alongside the BIS matter – which it frequently does.
Our work in this area regularly intersects with related practices. Cross-border transactions involving controlled technology require diligence that covers both the EAR and the full sanctions overlay.
Related practices
- Compliance audit and testing – assessing whether your sanctions and export-control programme holds up under regulatory scrutiny.
- Sanctions risk assessment under OFAC – the parallel US economic sanctions regime and how it interacts with the EAR.
- Sanctions risk assessment under OFSI – UK financial sanctions obligations and how they apply alongside US controls in cross-border transactions.