Digital-asset counterparty diligence under BIS / EAR: specialist advice

A blockchain analytics firm in Singapore is mid-way through onboarding a new liquidity provider. The provider is a British Virgin Islands entity whose beneficial owners include a fund domiciled in a jurisdiction subject to US export-control scrutiny. Your compliance team asks the obvious question: does the Export Administration Regulations (EAR), administered by the Bureau of Industry and Security (BIS), create a problem here? As of January 2026, that question is more pressing than ever. Digital-asset platforms increasingly handle items, technology, and software that fall within BIS jurisdiction – and a counterparty's position on the Entity List or the Denied Persons List can collapse a transaction that has already passed OFAC screening.

Digital-asset counterparty diligence under BIS / EAR legal support covers the full assessment of a proposed counterparty's status under the EAR: classification of the technology or software at issue, verification of the counterparty's presence on BIS restricted-party lists, analysis of deemed-export risk (the rule that releasing controlled technology to a foreign person inside the United States constitutes an export), and an end-use and end-user review. BIS operates independently of OFAC; a counterparty that clears OFAC screening can still require a BIS licence or be entirely prohibited. The same business may also fall within OFSI and EU export-control rules – and the stricter prohibition governs.

This page explains what is in scope, the diligence process we apply, how BIS / EAR intersects with parallel regimes, the risk flags that demand early counsel, and how our Cross-Border Transactions & Diligence practice assists digital-asset businesses, financial institutions, and exporters.

What falls within BIS / EAR scope for digital-asset businesses?

The EAR applies to items – goods, software, and technology – that are subject to US jurisdiction, regardless of where they are located. For a digital-asset business, this is not a theoretical question. Cryptographic software, hardware security modules, advanced computing chips used in mining or custody infrastructure, and certain development tools can all carry an Export Control Classification Number (ECCN) on the Commerce Control List (CCL). Items that are subject to the EAR but do not appear on the CCL are designated EAR99; they are lower-risk but not outside the rules.

The practical implication is that a digital-asset platform transferring software access, sharing controlled source code with an overseas developer, or licensing its proprietary technology to a foreign counterparty must first establish whether that activity is a controlled export. The CCL is organised into ten categories and five product groups, and the classification exercise is item-specific. We regularly advise clients who discover mid-deal that software they regarded as standard commercial technology carries a dual-use classification that changes the analysis entirely.

BIS also administers military end-use and end-user (MEU) restrictions for specified destinations, as currently in force, verify before reliance. Even where a classification appears benign, the intended use and the identity of the recipient can impose separate restrictions. Digital-asset infrastructure supplied for civilian custody purposes looks very different from the same infrastructure directed to a sovereign wealth vehicle in a restricted destination.

How does the diligence process work? The BIS / EAR cross-border transactions workflow

Effective digital-asset counterparty diligence under BIS / EAR follows a defined sequence. Each stage produces a documented output that either clears the counterparty or identifies the further step required before the transaction can proceed.

1. Classification of the item at issue. Before the counterparty is assessed, the technology, software, or commodity being transacted is classified against the CCL. This determines whether a licence is required and under which controls. EAR99 items require less intensive counterparty review; ECCN-classified items trigger the full sequence.
2. Restricted-party screening. The counterparty – legal entity and its beneficial owners – is screened against the Entity List, the Denied Persons List, and the Unverified List. Unlike OFAC screening, BIS list screening is not purely name-based: the analysis considers whether a counterparty is a subsidiary, affiliate, or cover entity for a listed party, including under the 50 percent or more ownership aggregation principle that BIS guidance applies by analogy.
3. Deemed-export analysis. Where the counterparty will have access to controlled technology inside the United States – through a US-based employee, a US platform, or a US data centre – BIS deems that release an export to the foreign national's home country. The analysis maps which employees and beneficial owners would have access, and identifies whether licence requirements arise for each relevant national.
4. End-use and end-user review. The transaction documentation – onboarding agreements, know-your-counterparty questionnaires, use-of-platform terms – is reviewed for red flags: inconsistencies between stated use and actual business model, implausible volume or routing, destinations of concern, or beneficial-owner structures that obscure the true end-user.
5. Foreign direct product (FDP) rule check. Where the digital-asset platform's own technology has US-origin content, the FDP rules can extend BIS jurisdiction to products made overseas using that technology. This step is often overlooked, but BIS has been clear that the EAR can apply extraterritorially to certain re-exports and to foreign-produced items via the FDP rules, as currently in force, verify before reliance.
6. Licence or exception determination. If a restriction is identified, the analysis turns to whether a licence exception applies. Exception eligibility is item-, end-use-, and destination-specific. Where no exception is available, a licence application may be required before the transaction can proceed.
7. Documentation and record-keeping. All steps are recorded. Sanctions and export-control records must be kept for five years, and the record of the diligence exercise is the primary evidence of good-faith compliance in the event of a BIS inquiry.

In our experience, the most common failure point is step two. Screening tools calibrated for OFAC purposes often do not pull the BIS lists with the same currency or depth. A counterparty may have been added to the Entity List months before the diligence is run, and the screening tool will not surface it if its BIS-list feed is stale or if the entity name is transliterated differently.

How does BIS / EAR compare with OFAC, OFSI, and EU export controls?

The divergence between regimes is the central risk in digital-asset counterparty diligence for cross-border businesses. A compliance programme built only around OFAC will miss BIS exposure. One built for the EU dual-use rules will not automatically satisfy BIS requirements. Where two regimes both apply, the stricter prohibition governs.

Under OFAC, the threshold question is whether the counterparty is a Specially Designated National or a blocked entity under the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked). OFAC liability is generally strict: knowledge and intent are irrelevant to the violation, though they affect the penalty analysis. BIS list-based restrictions are different in character: they target specific entities for specific reasons – export-control violations, proliferation risk, diversion – and a party can be on the Entity List without being an OFAC-listed person.

The EU dual-use rules, governed by Regulation (EU) 2021/821, impose a separate classification and licensing regime. As currently in force, the EU framework applies a catch-all control for items not on the EU list where the exporter knows or suspects a military end-use or weapons-of-mass-destruction connection. That catch-all has no direct equivalent in the EAR's structure, though MEU controls and end-use-certificate requirements serve overlapping functions. A digital-asset business operating in both jurisdictions must satisfy both sets of controls, and the analysis is not always parallel.

OFSI administers UK financial sanctions, not UK export licensing; that role falls to the ECJU. UK export controls are administered under the Export Control Order, and while they share structural similarities with the EU framework, they are now independent after Brexit. For a counterparty who is listed under a UK thematic regulation but not on OFAC's SDN List, the cross-border diligence exercise must treat these as distinct determinations. We regularly advise on precisely this divergence – a counterparty cleared by one regulator that is restricted under another.

Canada's SEMA-based export controls and Australia's autonomous sanctions regime impose further obligations for businesses with operations or customers in those jurisdictions. The analysis does not stop at the primary regime.

What are the risk flags that require immediate counsel involvement?

Most digital-asset counterparty diligence proceeds through the standard workflow. Some fact patterns, however, require early specialist input before any step is taken that could worsen the position.

The following are the flags we treat as escalation triggers:

• A counterparty with a beneficial owner in a destination subject to US MEU restrictions or a BIS-administered country-group restriction. The destination's classification determines licence requirements and exception eligibility; reclassification changes the analysis prospectively. Where a counterparty's ultimate beneficial owner is in a destination that has recently changed classification, the prior analysis is no longer reliable.
• A counterparty that has recently restructured its ownership or moved its incorporation. A sharp change in the ownership structure of a digital-asset entity – a recent redomiciliation, a new holding layer, a private equity buyout that introduced a fund with opaque LP structures – is a diversion red flag. BIS guidance addresses sham and disguised transactions and looks past legal form to the practical and economic reality of a transaction.
• Technology that is the subject of a licence denial or a policy of denial. Where BIS has already denied a licence for a similar transaction to the same destination, a fresh application is unlikely to succeed, and proceeding without a licence is a serious violation. The transaction should stop.
• A counterparty with a history of unexplained AIS gaps, ship-to-ship transfers, or commodity routing anomalies. In our cross-border practice, digital-asset diligence frequently surfaces physical-trade patterns that are inconsistent with the counterparty's stated business model. These anomalies are not a BIS issue in themselves, but they indicate a counterparty whose broader compliance posture merits scrutiny.
• Deemed-export risk for a controlled item where the counterparty's beneficial owners include nationals of restricted destinations. The deemed-export question must be answered before access to any controlled platform, repository, or data room is granted. Granting access first and asking the question later is a violation that has already occurred.
• Any indication that the transaction is designed to benefit a party that has been denied a licence or is on a BIS list under any name or affiliate. Facilitation of a transaction that the person could not do directly is prohibited under the EAR as well as under OFAC rules. The structure of a deal does not cure the underlying control problem.

The position above covers the standard screening case. Your facts – the item classification, the counterparty's ownership structure, the destination, and the applicable country-group classification – change the analysis materially. If any of the flags above are present, the matter should be reviewed before the transaction documents are signed.

If a transaction has already been flagged, or a licence application has been refused, an early review can preserve options that close with time. Write to info@caldervance.com.

Common misconceptions: what sellers' representations do not cover

A persistent assumption in cross-border digital-asset transactions is that sellers' warranties and representations shift the buyer's BIS / EAR exposure. They do not.

A seller's representation that the counterparty is not subject to US sanctions or export-control restrictions is a contractual statement between the parties. It does not constitute a BIS analysis, and it does not provide a defence to a BIS enforcement action. BIS liability attaches to the person who makes the export, re-export, or transfer. If that is your entity, the liability is yours, regardless of what the seller has warranted.

This matters most in digital-asset transactions where the "export" is a software licence, a token grant, or access to a custody platform. Each of these can be an export of controlled technology or software under the EAR. The counterparty's signature on a representation that it is not a restricted party does not alter that analysis. In our experience, buyers and platform operators who have relied on reps in lieu of independent diligence are in the weakest position when BIS issues a notice.

The correct approach is to treat sellers' representations as supplementary information – useful for the record – and to conduct an independent BIS / EAR assessment as a prior step. Where the item is EAR99 and the counterparty is in a low-risk jurisdiction with no BIS-list presence, the assessment is brief. Where any of those conditions is absent, the analysis must be proportionately more detailed.

A second misconception is that passing OFAC screening is sufficient. OFAC and BIS maintain separate lists for separate purposes. A party cleared by OFAC screening may be on the Entity List, the Unverified List, or subject to MEU restrictions. The two programmes do not overlap automatically, and a firm that screens only for OFAC exposure is running an incomplete control.

How does the law firm for digital-asset counterparty diligence BIS / EAR matter selection work?

Not every digital-asset transaction requires the same level of BIS / EAR analysis. The scope of instruction depends on the item, the counterparty's geography and ownership structure, and the risk profile of the specific transaction. Our process for a new instruction follows a defined engagement structure.

At the outset, we assess eligibility and scope: what is the item, what is the transaction, who is the counterparty, and which BIS lists and controls are potentially in play. This initial scoping conversation – typically conducted within a short window of the instruction – determines whether the matter requires a desk review or a full diligence exercise. We can advise on both.

For a standard counterparty diligence instruction, we classify the item against the CCL, screen the counterparty and its ownership chain against the BIS lists, perform the deemed-export analysis, and review the transaction documents for end-use red flags. We produce a written diligence memorandum setting out our conclusions and any residual risk. That memorandum is the documented basis for the compliance record.

Where a licence is required, we assess eligibility, prepare and submit the licence application, and manage BIS's queries through the review process. Licence timelines are matters for the regulator; we do not promise an outcome. What we can do is ensure the application is complete, accurately classified, and presented in a form that addresses the concerns BIS applies to the relevant item and destination.

Where a diligence exercise surfaces a concern – a potential entity-list hit, a deemed-export issue that has already arisen, or a past transaction that may require review – we advise on voluntary self-disclosure. Voluntary self-disclosure (VSD) to BIS is a recognised mitigating factor in enforcement proceedings. Timing matters: a VSD filed before BIS opens an investigation is treated very differently from one filed after contact is received.

We act for multinationals, financial institutions, and exporters on sanctions and export-control matters across the major regimes, including BIS / EAR cross-border transactions specialist work. Matters we handle span initial classification questions through full diligence exercises, licence applications, and enforcement defence.

When does BIS / EAR cross-border transactions specialist advice become urgent?

There are moments in a digital-asset transaction when BIS / EAR analysis cannot be deferred. The following situations are those where we recommend instruction before any further step is taken.

First, where a due-diligence process has produced a potential hit on a BIS list and the deal team is uncertain whether to proceed, pause, or disclose. Proceeding on the assumption that the hit is a false positive without independent verification is a risk that cannot be unwound after completion.

Second, where a digital-asset platform is onboarding a counterparty that will have access to controlled software or technology, and the onboarding questionnaire has returned information that is inconsistent or incomplete. Granting access while the question is open is a deemed-export problem.

Third, where a transaction has already closed and a subsequent review suggests that a counterparty was on a BIS list at the time of closing. The statute of limitations for civil violations was extended to ten years in 2024, as currently in force, verify before reliance. A position that seemed safe at the time of the transaction may still be within the enforcement window.

Fourth, where a foreign counterparty has indicated that it routes transactions through third-country intermediaries. Transit through a third country does not change an item's controlled status; origin and end-use analysis follows the item, not the route. A counterparty that introduces a transit entity without explanation is presenting a red flag, not a solution.

Fifth, where your board or audit committee has requested a BIS / EAR assessment of the digital-asset compliance programme and the existing programme was designed primarily around OFAC and AML obligations. BIS / EAR requires a distinct analytical layer that AML and OFAC programmes do not supply.

For an assessment of your exposure under the EAR, or to discuss a specific counterparty diligence question, contact Calder & Vance at info@caldervance.com.

Related practices

• Digital-asset counterparty diligence under OFSI – counterparty diligence for UK financial-sanctions obligations in digital-asset transactions
• AIS anomaly indicators – EU service – assessing vessel-tracking anomalies as sanctions-evasion red flags under EU rules
• Ship-to-ship transfer risk under OFAC – OFAC compliance analysis for maritime transfers and related counterparty exposure

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.