A technology company based in Europe receives a subpoena from the US Department of Justice. The allegation: controlled items shipped to a restricted destination without the required authorisation under the Export Administration Regulations ("EAR", the US export-control rules administered by the Bureau of Industry and Security, known as BIS). The company's US subsidiary faces criminal exposure. The parent entity faces secondary liability. Both need counsel before the next business day.
Criminal exposure in export-control cases under BIS and the EAR is a distinct and serious category of US enforcement risk. BIS can refer matters to the Department of Justice for criminal prosecution, with potential custodial sentences and significant fines for individuals and organisations alike. The governing authority is BIS's Office of Export Enforcement, acting under the Export Control Reform Act and IEEPA. A voluntary self-disclosure submitted before a government referral can materially affect both the decision to prosecute and the eventual penalty.
This page explains the criminal-enforcement process under BIS and the EAR, the tests that determine exposure, how the US position compares with parallel criminal regimes in the UK and EU, and what a business or individual must do in the first days after learning of an investigation.
What does criminal export-control exposure mean under BIS and the EAR?
Criminal export-control exposure under BIS and the EAR arises when a person or entity is alleged to have knowingly violated the EAR – exporting, re-exporting, or transferring a controlled item without the required licence, or making a false statement to obtain one. The word "knowingly" is the critical threshold. Civil violations can be strict-liability; criminal prosecutions require proof that the violator acted with knowledge of the legal obligation and chose to disregard it.
The EAR covers a broad range of items classified on the Commerce Control List ("CCL", the schedule of items and their associated Export Control Classification Numbers, or ECCNs). Items on the CCL may require a licence to specified destinations, end-users, or for stated end-uses. The Entity List, maintained by BIS, names specific foreign parties to whom exports are restricted or prohibited. A shipment to an Entity-Listed party, even of an otherwise licenceable item, carries heightened risk and potential criminal exposure if the required licence was not obtained.
In our experience, the businesses most exposed are those that have grown their export base quickly, outpacing their compliance infrastructure. A product initially classified as EAR99 (no licence required for most destinations) may be reclassified, or its end-use may change, bringing it into a controlled category. That shift, if missed, can convert a routine shipment into the foundation of a criminal investigation.
How does BIS investigate and refer criminal matters?
BIS's Office of Export Enforcement ("OEE") is the agency's investigative arm. OEE special agents have full law-enforcement authority – they can execute search warrants, seize goods and records, interview employees, and work alongside the Federal Bureau of Investigation and Homeland Security Investigations on joint operations. A criminal referral from OEE to the Department of Justice triggers the formal criminal process.
Investigations typically begin in one of three ways. First, a tip from a freight forwarder, a foreign government, or an industry partner. Second, a customs anomaly – an item mis-declared on export documentation – flagged during routine border checks. Third, an internal report by an employee or, increasingly, a failed screening that leads a compliance officer to look backwards at prior shipments.
The timeline from initial inquiry to indictment can stretch across years. That is not necessarily reassuring. A multi-year investigation means years of document preservation obligations, potential employee restrictions on travel, and sustained reputational pressure – all before any charge is filed. Early engagement with counsel shapes the posture of the company throughout that period.
Can a company under investigation speak to OEE without counsel present? Technically, yes. In practice, the answer is almost always no. Any statement made to federal agents can be used in subsequent proceedings. Privilege and the right to review materials before engagement with investigators are best preserved by instructing counsel at the earliest possible moment.
What is the role of voluntary self-disclosure in managing criminal risk?
A voluntary self-disclosure ("VSD") is a proactive report to BIS, submitted before the agency has independently identified the apparent violation, setting out the facts, the items involved, the parties, and the apparent breach. BIS's enforcement guidance identifies VSD as a significant mitigating factor in penalty determinations. At the criminal-referral stage, a VSD submitted in good faith, before a DOJ referral, can influence whether the matter is treated as an administrative rather than a criminal case.
The decision to file a VSD is not mechanical. Several questions govern it. Has the government already identified the shipment? Is the breach isolated or systemic? Are individuals, as well as the entity, exposed? Is the apparent violation the product of a failure in classification, a failure in screening, or a deliberate decision? The answers determine whether a VSD reduces risk or accelerates investigation.
In a recent matter, a manufacturing business identified a series of shipments that had been made without required BIS authorisation following an internal review triggered by a change of ownership. We scoped the apparent violation, advised on the voluntary self-disclosure decision, and prepared the submission. The matter was resolved at the administrative level. That outcome cannot be guaranteed, but early, accurate disclosure is consistently treated more favourably than a violation discovered by the agency independently.
BIS's enforcement guidelines set out the aggravating and mitigating factors applied in penalty assessments. Aggravating factors include: the items were on the CCL for reasons related to national security or proliferation; the violation was wilful; the business took steps to obscure the transaction. Mitigating factors include: VSD; cooperation; a functioning compliance programme at the time of the violation; a limited history of prior violations.
How does criminal EAR exposure compare with parallel UK and EU regimes?
Criminal export-control exposure is not a uniquely American risk. The UK Export Control Order, administered by the Export Control Joint Unit ("ECJU"), creates parallel criminal offences for unlicensed exports of controlled goods. EU member states implement criminal penalties under the dual-use regulation, though enforcement intensity varies significantly across the Union. Businesses operating across these jurisdictions – and most of our clients do – face the possibility of simultaneous enforcement action in more than one regime.
The US position is the most extraterritorial. BIS's de minimis rule means that a product containing more than a specified percentage of US-controlled content is subject to the EAR even after export from the United States and even when re-exported by a non-US entity. A Dutch company re-exporting goods with qualifying US content to a restricted destination can face BIS enforcement – and potentially criminal referral – without any shipment ever crossing US territory. The UK and EU do not have a comparable rule of extraterritorial reach over non-domestic persons based solely on origin-of-content.
For clients with exposure in both the US and EU jurisdictions, our practice coordinates the analysis across regimes. A voluntary self-disclosure to BIS does not automatically resolve parallel exposure before ECJU or an EU competent authority. Each regime has its own process, its own penalty range, and its own mitigating-factor test. For EU-specific criminal export exposure, see our related service page: Criminal exposure in export-control cases under EU rules.
The divergence between regimes also affects individuals. A British national who is an officer of a US-incorporated entity can face criminal exposure under both the EAR (for the company's acts) and the UK Export Control Order (for their own acts). The interaction between those exposures must be managed carefully and simultaneously.
What are the specific risk flags that signal escalating criminal exposure?
Not every EAR non-compliance leads to a criminal referral. BIS resolves a large proportion of cases at the administrative level, particularly where violations were isolated, self-disclosed, and accompanied by genuine remediation. The flags that shift a matter toward criminal territory include the following.
- Wilfulness indicators. Internal emails or documents showing that employees knew a licence was required, considered applying, and chose not to – are among the most damaging evidence OEE can develop.
- Entity List or denied-party involvement. Transactions involving parties subject to specific BIS restrictions attract a higher level of scrutiny and, when violations occur, a stronger enforcement response.
- Items controlled for proliferation-related reasons. Goods classified on the CCL because of proliferation risk – biological, chemical, nuclear, or missile-related – will almost always be treated as priority enforcement matters.
- Pattern of conduct. A single erroneous shipment is very different from a series of shipments to the same restricted destination over multiple years. Pattern evidence drives criminal referrals.
- False statements. A mis-classification entered on export documentation to avoid triggering a licence requirement is, in itself, a separate criminal offence under US law, independent of the underlying EAR violation.
- Obstruction indicators. Destruction of records, coaching of employees before interviews, or spoliation of evidence after a government inquiry begins can convert an administrative matter into a criminal case irrespective of the underlying conduct.
If any of these flags are present in a matter you are reviewing, the time to act is before the government appears at the door.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. For a confidential assessment of your exposure under BIS and the EAR, contact Calder & Vance at info@caldervance.com.
What steps should a business take in the first 72 hours after identifying potential criminal exposure?
The first 72 hours after identifying a potential criminal export-control exposure are the most consequential. The steps a business takes – and, as critically, fails to take – in that window determine the posture of every subsequent stage of the matter.
- Preserve all records immediately. Issue a litigation hold covering export documentation, shipping records, internal communications, and compliance files. Do not wait for legal confirmation of whether a violation occurred. The obligation to preserve arises from the reasonable anticipation of proceedings – and that anticipation exists the moment a potential criminal matter is identified.
- Instruct specialist export-control counsel. In-house lawyers with general commercial backgrounds are often not equipped to advise on the intersection of BIS procedure, DOJ practice, and multi-regime exposure. Specialist counsel identifies the regime, scopes the conduct, and advises on privilege before any documents are produced or any statements are made.
- Identify the universe of affected transactions. A single flagged shipment is rarely isolated. Counsel will need a complete picture of the items, the destinations, the end-users, and the classification basis to assess whether the matter is narrow or systemic.
- Assess the VSD question. Is voluntary self-disclosure appropriate? Can it be filed before the government independently identifies the violation? What effect will it have on parallel regimes? This analysis should be completed within days, not weeks.
- Manage employee communications. Employees should not discuss the matter with one another or externally except through counsel. This is not about concealment – it is about preserving the integrity of the investigation and of privilege.
- Brief senior leadership under privilege. The board or executive committee needs to understand the exposure, the options, and the timeline. That briefing must be given under legal privilege to protect its contents.
The position above covers the standard case. Your facts – the items, the destinations, the individuals involved, and the regime in play – change the analysis materially. For a confidential review of your specific situation, contact us at info@caldervance.com.
A common misconception: "Our compliance programme means we cannot face criminal liability"
A well-documented compliance programme is a genuine mitigating factor in BIS's penalty analysis. It is not, however, a shield against criminal prosecution. The DOJ's policy on corporate compliance programme credit applies at the charging and sentencing stages – it does not prevent an indictment, and it does not operate as a complete defence.
We regularly advise businesses that have invested significantly in compliance infrastructure and still face enforcement action. The reasons are consistent: classification errors that accumulated before the programme was implemented, third-party intermediaries whose conduct was not adequately overseen, re-export chains that extended beyond the contractual end-user certification, or a compliance programme that existed on paper but was not operationally tested.
The question a DOJ prosecutor asks is not "Did this company have a compliance policy?" It is: "Did the company's compliance programme actually prevent or detect the conduct in question?" A policy manual that was never trained, an ECCN determination that was made without technical review, a screening system that was never calibrated against the Entity List – these do not amount to a functioning compliance programme in the eyes of enforcement authorities.
For businesses that want to test the operational effectiveness of their export-control compliance before a problem arises, our apparent violation assessment service provides a structured review of the shipment universe, classification logic, and screening integrity.
How Calder & Vance assists with criminal EAR exposure
Our export-control practice operates across the US, UK, and EU regimes. For clients facing criminal exposure under BIS and the EAR, we provide the following services.
- Apparent violation scoping. We review the relevant shipment records, classification determinations, and internal communications to define the universe of conduct at issue and assess whether it meets the threshold for criminal referral.
- Voluntary self-disclosure preparation. Where VSD is appropriate, we draft the submission, manage the timeline, and coordinate with BIS's Office of Export Enforcement through the process.
- Criminal defence coordination. For matters that have been referred to the DOJ, we coordinate with US criminal defence counsel to ensure that the export-control analysis informs the criminal defence strategy. We do not act as lead criminal-defence counsel in DOJ proceedings, but we provide the specialist export-control layer that general criminal firms are not equipped to provide.
- Multi-regime alignment. For clients with parallel UK or EU exposure, we align the BIS/EAR position with the ECJU and EU analyses. For EU-specific criminal exposure, see our page on criminal exposure in EU export-control cases. For OFAC-related criminal risk, see our page on criminal exposure in OFAC-related matters.
- Remediation and compliance redesign. Following resolution of an enforcement matter, we assist with the compliance-programme enhancements that regulators expect – classification review, screening calibration, training, and internal audit design.
We offer a fixed-fee initial review for clients seeking a scoped assessment of their exposure before committing to a broader engagement. Contact info@caldervance.com to arrange that review.
Related practices
- Apparent violation assessment – EU – structured review of conduct, classification, and disclosure options under the EU export-control regime
- Criminal exposure in EU export-control cases – specialist advice on criminal liability under EU dual-use rules and member-state enforcement