A technology distributor operating between the United States and South-East Asia discovers that a tier-two supplier – not one it deals with directly – appears on the Entity List (BIS's list of foreign parties subject to specific licence requirements under the Export Administration Regulations). The distributor has been re-exporting US-origin components for months. Every shipment now carries potential liability. Did the distributor need a licence? Did any licence exception apply? What does it do next?
Supply-chain sanctions mapping under BIS and the EAR (Export Administration Regulations) means tracing every node in a supply or distribution chain against the full BIS restricted-party lists – the Entity List, the Denied Persons List, and the Unverified List – and confirming whether US-origin goods, software, or technology trigger a licence obligation at any point in that chain. The obligation attaches to the item and its characteristics, not only to the direct counterparty. As of early 2026, BIS enforcement posture remains active, with extraterritorial reach extending to non-US re-exporters of items produced using US-origin technology.
This page sets out what a rigorous BIS / EAR mapping engagement covers, where the cross-border complications arise, and what it means for your business to get this wrong.
What does supply-chain sanctions mapping under the EAR actually cover?
Supply-chain sanctions mapping under the EAR covers the full chain of custody for any item – goods, software, or technology – that is subject to US export controls, from the point of export or re-export through every intermediate node to the end user and the end use. BIS exercises jurisdiction over items listed on the Commerce Control List (CCL) and, in certain circumstances, over foreign-produced items that incorporate or are produced from US-origin content above defined thresholds – a concept known as the de minimis rule and the foreign direct product rule (FDPR).
The mapping exercise has three interdependent components. First, item classification: confirming the ECCN (Export Control Classification Number under the Commerce Control List) for each product or technology in scope. An item without a specific ECCN may be designated EAR99 – the lowest-control category – but even EAR99 items are prohibited to parties on the Entity List or where a prohibited end use is present. Second, party screening: checking every entity in the chain – suppliers, intermediaries, distributors, end users, freight forwarders, and financial institutions involved in the transaction – against the Entity List, the Denied Persons List, the Unverified List, and the Debarred Parties List maintained by the State Department. Third, end-use verification: confirming that the stated use matches the classification and that no red flags indicate diversion to a prohibited use or user.
In our practice, companies underestimate the scope of the party-screening obligation. They screen the direct buyer. They do not screen the freight forwarder, the transshipment hub operator, or the entity providing financing. Each gap is a potential violation.
How does the BIS / EAR regime interact with OFAC and OFSI?
BIS and OFAC operate under distinct legal authorities and maintain separate lists, but a supply chain that appears clean under one regime may be problematic under another – and the stricter prohibition governs. An exporter who has confirmed no Entity List hit may still face an OFAC bar if the end customer is on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) or is an entity in which SDN-listed persons hold 50 percent or more in the aggregate.
The UK and EU add further layers. OFSI administers financial sanctions that prohibit making economic resources available, directly or indirectly, to designated persons. Under OFSI's ownership and control test, a non-designated entity can still be caught where a designated person controls it – even without reaching the formal 50 percent threshold. The EU applies a comparable ownership and control test across its Council regulations. A supply-chain map that ignores these parallel regimes gives incomplete assurance.
The FDPR adds a specifically BIS-flavoured extraterritorial dimension. It can subject a foreign-produced item to the EAR if that item is the direct product of US-origin technology or software, or produced by a plant that itself is such a direct product. The result is that a non-US manufacturer using US-origin semiconductor equipment may find its products subject to EAR jurisdiction, regardless of where those products are manufactured or sold. In our cross-border practice, this is one of the most consistently misunderstood exposure points for non-US manufacturers and their distributors.
The position above covers the standard case. Your facts – the goods, the ownership chain, the countries of transit, and the end use – change the analysis materially.
For an assessment of your exposure under BIS / EAR, contact Calder & Vance at info@caldervance.com.
What is the procedure for a BIS / EAR supply-chain mapping engagement?
A structured mapping engagement follows a defined sequence. The steps below represent the typical order for a cross-border supply chain; the precise scope depends on the complexity of the chain and the sectors involved.
- Scope definition. Identify the items in scope: their origin, the jurisdictions of manufacture and assembly, and each leg of the intended supply chain. Confirm which entities in the chain are US persons and which are non-US persons subject to EAR jurisdiction through the de minimis or FDPR rules.
- Item classification. Confirm the ECCN for each item in scope, or confirm EAR99 status with supporting rationale. Where classification is unclear, a commodity-jurisdiction referral or a binding classification request to BIS may be appropriate.
- Party screening. Screen every entity in the chain – across the BIS restricted-party lists, OFAC's SDN and Consolidated Sanctions Lists, the OFSI Consolidated List, the EU Consolidated Sanctions List, and any other applicable national list. Where a hit is ambiguous (name match only, no address or identifier confirmation), undertake enhanced due diligence.
- End-use and red-flag analysis. Review the commercial documentation for red flags identified in BIS's publicly stated guidance: unusual payment terms, inconsistency between the stated end use and the item's technical characteristics, requests to remove markings, and routing through transshipment points disproportionate to the declared destination.
- Licence and exception analysis. Where a licence requirement is triggered, determine whether a licence exception applies. If not, assess whether a licence application is warranted or whether the transaction should be restructured or declined.
- Documentation and record-keeping. Compile and retain all supporting documentation. BIS requires records relating to export transactions to be kept for five years from the date of export or the date of any related licence, whichever is later.
Timelines vary. A focused mapping of a two-tier supply chain with straightforward items can be completed in a matter of days. A chain spanning five or six jurisdictions with dual-use goods requiring ECCN analysis may take several weeks. The critical variable is the quality and completeness of the commercial documentation provided at the outset.
Which risk flags most commonly arise in BIS / EAR supply-chain mapping?
The single most common failure point is reliance on first-tier screening only. A business screens its direct customers and suppliers, receives no hits, and assumes the chain is clear. It is not. Entity List designations are frequently targeted at intermediate distributors and end users, not at the tier-one counterparty. The item continues moving through the chain, reaches a designated end user, and the exporter is liable for the entire export – including the legs it did not control.
A second persistent risk is ECCN misclassification. Companies classify items at export and then use that classification indefinitely, even as the item's technical parameters change with software updates or hardware revisions. The ECCN that applied in year one may not apply in year three. BIS does not accept outdated classification as a defence.
Transshipment risk deserves particular attention. Goods routed through a jurisdiction that is a known transshipment hub for controlled technology carry heightened scrutiny. Where a buyer insists on routing through such a point without commercial justification, that is a red flag requiring documented explanation – and potentially grounds to decline the transaction entirely.
Finally: voluntary self-disclosure (VSD – the mechanism by which a party self-reports an apparent violation to BIS before the agency initiates an investigation). BIS guidance and enforcement precedent indicate that a timely, complete VSD is a mitigating factor in penalty determination. Companies that discover a potential violation and fail to act quickly lose that option. If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time.
For a confidential review of a potential breach, contact us at info@caldervance.com.
How does BIS / EAR supply-chain mapping differ from an OFAC diligence review?
BIS supply-chain mapping and an OFAC diligence review share a common party-screening step but diverge in everything else. OFAC's primary question is whether a counterparty or an entity it controls is a blocked person under a US sanctions programme. The analysis is person-centred: who owns and controls the counterparty, and does that ownership chain lead to a designated party? The 50 percent rule is the operative test.
BIS's primary question is whether the item is controlled and whether the destination, end use, or end user triggers a licence requirement. The analysis is item-centred: what is the ECCN, what are the applicable controls, and what exceptions are available? A company can have a perfectly clean ownership chain, with no SDN exposure and no OFAC issue, and still face a BIS licence requirement because of the technical characteristics of the goods or the identity of the end user on the Entity List.
In practice, a thorough supply-chain mapping exercise must address both dimensions. We regularly advise businesses that instruct us on an OFAC screen and then discover, during our item-classification review, that the goods also carry BIS licence requirements they had not identified. The two regimes are complementary, not alternatives. Running one without the other produces a gap in the compliance record.
Is your current supply-chain review covering item classification and not only party screening? That distinction may be the difference between full compliance and an undetected exposure.
What is the common misconception about EAR99 goods and supply-chain mapping?
The most persistent myth we encounter is that EAR99 classification means no BIS compliance obligations apply. It does not. EAR99 is not a licence exemption from party-based restrictions. A shipment of EAR99 goods to an Entity List party, to a Denied Person, or for a prohibited end use – including weapons of mass destruction proliferation – is a violation regardless of the item's classification. The EAR99 designation means only that no specific ECCN controls the item for country or use reasons; it does not disapply the person-based and end-use-based prohibitions that run independently.
A second misconception is that the EAR applies only to physical goods. It extends to technology – including technical data, source code, and know-how – and to software. Releasing controlled technology to a foreign national within the United States is a deemed export subject to the same licence requirements as a physical shipment. Supply-chain mapping for a technology licensing or software distribution arrangement therefore carries the same obligations as mapping for a physical goods export.
A third misconception concerns EU- or UK-origin goods: that the EAR has no reach. Where those goods incorporate US-origin content above the de minimis threshold, or where they are the direct product of US-origin technology or a plant using such technology, the EAR may apply through the FDPR. Non-US manufacturers operating in sectors that rely on US semiconductor or software tooling should take specific advice on their FDPR exposure before assuming they are outside BIS jurisdiction.
How does Calder & Vance approach a supply-chain mapping engagement?
We treat supply-chain mapping as a structured due-diligence exercise with a defined scope, a documented methodology, and a clear output: a written assessment of the item-classification position, the party-screening results, the end-use analysis, and the licence and exception position, together with a set of actionable recommendations.
Our approach is cross-regime by design. We assess BIS / EAR exposure alongside the OFAC position, and – where the supply chain crosses the UK or EU – the OFSI and EU Council regulation positions as well. Where a chain involves jurisdictions with autonomous sanctions programmes, such as Switzerland (SECO), Canada (Global Affairs Canada), or Australia (DFAT), we bring in those regimes as part of the scope rather than treating them as optional extras.
In a recent matter, a manufacturing business with a multi-tier distribution network in Asia had been exporting dual-use components under an ECCN that predated a product redesign. Our item-classification review identified that the revised specifications placed the components in a higher-control category requiring a licence for several destinations in the network. We assessed eligibility, prepared and submitted the licence application, and managed the regulator's queries to achieve a workable compliance position. The matter resolved without enforcement action.
We also advise on the design of internal compliance programmes for exporters: screening protocols, ECCN review cycles, end-use certificate procedures, and red-flag escalation paths. Where a voluntary self-disclosure is warranted, we scope the apparent violation, advise on the disclosure, and prepare the penalty defence.
Related practices
- Correspondent banking and de-risking under OFAC – screening and compliance support for financial institutions managing sanctions-driven relationship exits.
- Supply-chain mapping under BIS / EAR: extended programme – deeper programme design and ongoing monitoring for exporters with complex, multi-tier chains.
- Supply-chain mapping under the Canadian sanctions regime – mapping and diligence support for chains with Canadian nexus or Global Affairs Canada exposure.
Frequently asked questions: BIS / EAR supply-chain sanctions mapping
How long does map sanctions risk in the supply chain take under BIS / EAR?
Timeline depends on the number of nodes in the chain, the breadth of the item portfolio, and the quality of documentation provided at the outset. A focused engagement covering a single product line and a two- or three-tier distribution chain can produce a written assessment within one to two weeks. A complex, multi-jurisdiction chain involving dual-use goods, FDPR analysis, and several hundred counterparties will take longer – typically several weeks. We set a defined scope and indicative timeline at the start of each engagement so expectations are clear. Urgency – for example, a pending transaction or an enforcement enquiry – can compress the timeline where the documentation is available.
What are the main risks in supply-chain sanctions mapping under BIS / EAR?
The main risks are: item misclassification (wrong ECCN or unexamined EAR99 assumptions); incomplete party screening (first-tier only, missing intermediaries and end users); FDPR exposure for non-US manufacturers; end-use red flags that are not escalated; and failure to maintain records for the required five-year period. Each of these can give rise to civil or criminal liability under the EAR. The additional risk is discovering a historic violation without taking timely VSD action, which forfeits a significant mitigating factor in any subsequent enforcement proceeding.
Do we need specialist counsel for supply-chain sanctions mapping?
Specialist counsel is particularly important in three situations: where the supply chain crosses multiple regimes and jurisdictions, requiring item classification and party screening under BIS, OFAC, OFSI, or EU rules simultaneously; where a potential violation has already been identified and VSD or enforcement strategy needs to be considered; and where the product portfolio includes dual-use items with non-obvious ECCNs or FDPR exposure. For a straightforward, single-jurisdiction chain with EAR99 items and clean parties, internal compliance teams with good screening tools may manage the exercise. Where the chain is complex or the stakes are material, independent specialist review provides a documented basis for the compliance position.
About the author
Viktor Lindqvist advises exporters and trading houses on dual-use export controls, maritime and trade sanctions, and end-use compliance. Calder & Vance – International Sanctions & Export Control Counsel.
Published: 4 February 2026
About Calder & Vance
Calder & Vance is an independent international sanctions and export-control boutique. We advise multinationals, financial institutions, exporters, and individuals on the major regimes – OFAC and BIS in the United States, OFSI and ECJU in the United Kingdom, the EU Council regulations and the EU General Court, the United Nations Consolidated List, and the regimes of Switzerland, Canada, Australia, the UAE, Singapore, and Japan. Our work is limited to lawful compliance, licensing, delisting, enforcement defence, and due diligence. To discuss a matter, contact info@caldervance.com.
Disclaimer: This material is general information, not legal advice, and is not a substitute for advice on your specific facts. Sanctions and export-control rules change frequently and differ by regime; verify the current position before relying on anything stated here. Calder & Vance does not advise on circumventing or evading sanctions. For advice on your situation, contact info@caldervance.com.