A company achieves removal from the BIS Entity List after months of engagement, enhanced compliance investment, and detailed procedural work. Relief is appropriate. But the listing decision can be revisited. A change in end-use, a lapse in the agreed compliance measures, or a renewed concern about diversion risk can return the company to the list – sometimes without prior warning. For the businesses we advise, the moment after delisting is not a moment to stand down. It is the moment when a different discipline begins.
Managing relisting risk under BIS / EAR legal support is the practice of preserving a delisted company's standing with the Bureau of Industry and Security by maintaining the behavioural and structural conditions that supported removal in the first place. The governing regime is the Export Administration Regulations administered by BIS under the Export Control Reform Act. No verified public figure exists for the frequency of relisting, but in our cross-border practice, the risk is real, under-managed, and disproportionately damaging when it materialises.
This page sets out how relisting decisions arise, what the ongoing obligations look like, where firms most commonly create renewed exposure, and how Calder & Vance assists exporters, trading houses, and their compliance teams in sustaining the conditions that keep a name off the list.
What is the BIS Entity List, and why does relisting occur?
The Entity List (a BIS-administered register of foreign parties subject to licence requirements for exports, re-exports, and transfers of items subject to the EAR) is not a permanent punishment. It is a risk-management instrument. BIS adds names when it determines that a party poses an unacceptable risk of diversion to weapons of mass destruction programmes, military end-use, or other controlled activities. The End-User Review Committee – composed of representatives of several US government departments – decides both additions and removals.
Removal is therefore conditional, not unconditional. A company that was listed because of concerns about its end-use controls or its relationships with restricted parties must demonstrate that those concerns are resolved. Where the company then reverts to prior conduct, or where its circumstances change in a way that revives the original concern, BIS has the procedural basis to re-examine and relist. In our experience, companies treat a successful delisting as the end of the matter. It is not. It is the beginning of a monitored period.
Relisting can also arise from entirely new conduct. A delisted company that subsequently supplies a controlled item to a restricted party – or that fails to screen its customers against the Denied Persons List (a separate BIS register of parties to whom exports are prohibited) or the Unverified List (a BIS register of parties whose end-use cannot currently be verified) – generates fresh grounds for listing. The connection to the original delisting matter is irrelevant: BIS assesses the new facts on their own terms.
What obligations persist after delisting?
A delisted company remains fully subject to the EAR on a going-forward basis, and in practice its obligations are more acute than those of a company that was never listed. Several obligations tend to be addressed explicitly in the delisting outcome or in any undertakings given during the review process.
First, export classification. Every item shipped must carry a correct ECCN (Export Control Classification Number under the US Commerce Control List) or a confirmed EAR99 determination. Errors in classification that a never-listed company might treat as a technical compliance lapse take on a different character for a delisted entity. BIS will read them as evidence that the compliance programme is not functioning.
Second, end-use and end-user screening. The company must screen all customers and intermediaries against the relevant BIS lists and the OFAC SDN List (OFAC's list of Specially Designated Nationals and blocked persons). It must also obtain sufficient end-use assurances for transactions involving controlled items. Where a transaction presents diversion risk – unusual routing, a customer unfamiliar with the item's technical use, or a consignee in a jurisdiction of concern – the company should apply additional scrutiny before proceeding.
Third, record-keeping. The EAR requires that export records be maintained for a defined period following the transaction. For a delisted company, record-keeping is not only a regulatory obligation: it is the primary evidence base if BIS initiates a review and asks the company to demonstrate its conduct since delisting. Gaps in records are treated as gaps in the programme.
Fourth, internal controls and audit. Where a delisting was supported by a compliance programme commitment – whether in an engagement letter with counsel, a submission to BIS, or a formal undertaking – the company must be able to show that those controls are live and functioning. A programme that existed on paper at the time of delisting and was then left unchanged will not withstand scrutiny.
The position above covers the standard case. Your facts – the nature of the original listing basis, the terms of the delisting, and the company's subsequent transaction history – change the analysis significantly. For an assessment of your ongoing obligations, contact Calder & Vance at info@caldervance.com.
Where does relisting risk most commonly arise?
In our experience advising companies through the post-delisting period, relisting risk concentrates in a small number of recurring patterns. Identifying them early is the most effective form of risk management available.
The first is ownership and corporate change. A delisted company that is acquired by, or merges with, an entity that has existing BIS concerns brings those concerns into the combined business. BIS is not bound by the prior delisting decision if the entity before it is materially different from the one that was reviewed. Similarly, a delisted company that acquires a restricted party, or that establishes a joint venture with a party on the Entity List, creates a structural problem that the original compliance programme was not designed to address.
The second is key-personnel change. Where the individuals responsible for the compliance programme – including those whose knowledge and commitment underpinned the delisting submission – leave the company, the programme can degrade quietly. New personnel may lack awareness of the heightened scrutiny the company operates under. This is not a theoretical risk. We regularly advise clients who discover, months after a personnel change, that screening procedures were not being followed as designed.
The third is geographic or product expansion. A company that was delisted in respect of a defined product line or geographic market and then expands into new markets or product categories without extending its compliance programme proportionately is creating exposure. The EAR does not give credit for past good conduct when it evaluates present risk.
The fourth is supply chain and intermediary risk. Where a delisted company sells to distributors who then re-sell into markets of concern, the company retains exposure under the EAR's knowledge standard. If the company has reason to know that its distributor is supplying controlled items to restricted parties, it cannot treat the interposition of an intermediary as a shield. In a recent matter, a manufacturing business in the precision-instruments sector faced exactly this pattern: its distributor had supplied a controlled item to a party that subsequently appeared on the Entity List. We assessed the company's knowledge at the time of sale, reviewed its end-use assurances, and prepared a response that addressed BIS's diversion concerns directly. The matter did not result in relisting. That outcome is not guaranteed, but the structured response made the critical difference.
If a transaction has already been flagged, or if a BIS inquiry has been received, an early review can preserve options that narrow with time. Contact our team at info@caldervance.com.
How does BIS relisting risk compare across the major export-control regimes?
BIS and the EAR are not the only regime with which a delisted company must engage. For most cross-border businesses, the OFAC SDN List, the EU dual-use regime, and the UK's Export Control Order present parallel obligations that interact with the BIS position.
Under OFAC, the SDN List operates on a different legal basis from the Entity List. OFAC designations are sanctions measures under IEEPA; Entity List placements are export-control risk decisions under the Export Control Reform Act. The tests for listing and delisting differ, and the agencies do not coordinate their decisions on a common timetable. A company that achieves BIS delisting may remain on the SDN List, or vice versa. The cross-regime risk is real: an exporter that screens only against BIS lists and misses an OFAC SDN will face a separate enforcement exposure.
For European businesses operating under the EU's dual-use rules, the obligations bear a structural resemblance to the EAR but differ in scope, the treatment of intangible transfers, and the licensing architecture. A company that manages its BIS exposure carefully but fails to apply equivalent discipline to EU-controlled transfers faces a gap. The divergence between BIS and EU positions on specific technologies – particularly in the emerging-technology sectors addressed by recent control expansions – means that a classification that is EAR99 may still require an EU licence.
The UK's Export Control Order, administered by ECJU, operates separately from both the EU and US regimes following the UK's departure from the EU. ECJU maintains its own list of controlled goods and its own licensing architecture. A delisted company exporting from the UK – or routing through a UK entity – must address ECJU requirements independently of its BIS obligations. In our cross-border practice, we map all three regimes against the client's transaction profile before advising on any post-delisting compliance programme. A compliance programme that addresses only BIS is incomplete for most international businesses.
Canada, Australia, and Singapore each maintain export-control instruments with varying degrees of alignment to the EAR. Where a delisted company ships through those jurisdictions, or sources components there, the applicable country regime must be assessed alongside the BIS position. The rule that the stricter prohibition governs is a useful working principle: if any applicable regime requires a licence or restricts a transaction, the company must comply with that restriction regardless of its BIS standing.
What is the relisting review process, and how should a company respond?
BIS does not follow a single published procedure for relisting. The process typically begins with an inquiry – a request for information about a specific transaction, a shipment, or a counterparty relationship. The company's response to that inquiry largely determines whether the matter progresses to a formal review.
Several response principles apply consistently. The response must be factually accurate and complete. Omissions that BIS later identifies are treated as evidence of evasiveness, which compounds the underlying concern. The response should demonstrate that the company has functioning controls – not that the controls existed at the time of delisting, but that they are operating now and that the transaction or conduct at issue was handled within them.
Where the inquiry reveals a genuine compliance failure, the company should consider whether a VSD (voluntary self-disclosure to a regulator) is appropriate. BIS has published guidance on VSD treatment in enforcement proceedings, and a well-structured VSD can be a significant mitigating factor. However, VSD decisions require careful analysis of the apparent violation's scope, the number of transactions involved, the item's classification and end-user, and the company's conduct since the apparent violation. A poorly scoped VSD can be more damaging than no disclosure at all.
The company should also conduct an internal review of its transaction records and compliance-programme documentation before BIS does so. In our experience, companies that have already identified and documented what went wrong, and have implemented corrective measures, are in a materially stronger position than those that are still reconstructing the facts when BIS asks its questions.
How does a compliance programme structure minimise relisting risk?
BIS has issued guidance identifying the elements of an effective export-compliance programme. That guidance describes a programme structure built around management commitment, risk assessment, policies and procedures, training, auditing, and response mechanisms. For a delisted company, this structure is not aspirational: it is the minimum standard against which the company will be measured.
Management commitment is the element most frequently underweighted. A compliance programme that is staffed by a compliance team but is not owned by senior management will not function under stress. When a difficult transaction is under time pressure, or when a key relationship is at stake, the compliance decision needs to be backed by authority. We advise clients to ensure that the compliance function has a direct reporting line to the board or senior leadership and that the programme's outputs – screening results, licence determinations, end-use assessments – are documented as management decisions, not administrative processes.
Risk assessment should be conducted on a rolling basis, not as a one-time exercise at the point of delisting. The company's risk profile changes as it enters new markets, adds new product lines, and changes its customer base. The compliance programme must track those changes. An annual risk assessment cycle is a reasonable baseline, but companies in high-velocity commercial environments may need to assess risk more frequently.
Auditing is the mechanism by which the company tests whether its programme is operating as designed. An audit that is conducted by the same team that runs the programme – without external review – provides limited assurance. For a delisted company operating under heightened scrutiny, an independent review of the compliance function at regular intervals is a strong risk-management position and a credible signal to BIS that the programme is genuine.
One persistent myth we encounter is that achieving delisting is proof that the compliance programme is adequate. It is not. The delisting review assesses the programme as it existed at a point in time, under the specific conditions BIS examined. A programme that was adequate at that point may be inadequate twelve months later if the business has grown, changed its product mix, or entered new markets without updating its controls. The programme must keep pace with the business.
How Calder & Vance assists with managing relisting risk under BIS / EAR
Managing relisting risk under BIS / EAR legal support is a defined service at Calder & Vance, not an ad hoc extension of delisting work. Our approach covers the full post-delisting period and is designed to operate as a standing advisory relationship, not a series of reactive engagements.
For exporters and trading houses, we classify items against the Commerce Control List, confirm licence requirements and exceptions, and design end-use controls that operate across the company's full transaction volume. For companies that have received a BIS inquiry, we scope the apparent violation, advise on VSD strategy, and prepare the compliance response. For companies planning corporate transactions that affect a delisted entity – acquisitions, joint ventures, restructurings – we assess the BIS implications before the transaction closes, not after.
Our cross-regime coverage means that we address the OFAC SDN exposure, the EU dual-use position, and the UK ECJU obligations alongside the BIS analysis. We do not treat BIS and OFAC as separate matters to be handled separately. For most cross-border businesses, a gap in one regime creates exposure in the others, and the response to a BIS inquiry needs to take account of the OFAC and EU positions simultaneously.
We also advise on voluntary self-disclosure strategy. A decision on whether and how to disclose an apparent violation is one of the most consequential decisions a company in this position will make. We have managed this process across multiple regimes and transaction types. We assess the violation, scope the disclosure, and prepare the submission to BIS.
Our engagement model includes fixed-fee entry points for the initial compliance review and an ongoing advisory service for companies that require regular counsel on a defined basis. Response times are rapid: where a BIS inquiry has been received, the timeline for an initial assessment is short, and we structure our service accordingly.
Related practices
- Delisting evidence packages – Australia – structuring the evidence package for Australian autonomous-sanctions delisting applications
- Managing relisting risk under OFAC – post-delisting compliance strategy and SDN list re-exposure assessment
- OFAC relisting risk – additional counsel – specialist support for complex OFAC relisting scenarios and enforcement response