A freight forwarder discovers that several shipments of dual-use components cleared US customs under an incorrect export licence exception. The Bureau of Industry and Security has opened a review. The company has days – not weeks – to decide whether to act proactively, and how to frame that response. Getting the mitigation analysis right at the outset can be the difference between a warning letter and a substantial civil penalty.
Mitigation factors in enforcement (the range of circumstances that reduce the penalty a regulator imposes for an export-control breach) are governed under the Export Administration Regulations ("EAR"), administered by BIS, through a structured aggravating-and-mitigating analysis that BIS applies to every apparent violation. As of April 2026, voluntary self-disclosure, a strong compliance programme, and prompt co-operation remain the most powerful levers available to a respondent. No outcome is guaranteed, but how those factors are assembled and presented materially affects where the matter ends.
This page explains how the BIS mitigation analysis works, where it diverges from OFAC and EU enforcement postures, what the most common risk flags are, and how Calder & Vance assists businesses working through an EAR enforcement matter.
What is the legal basis for BIS mitigation analysis under the EAR?
BIS derives its enforcement authority from the Export Control Reform Act and exercises it through the EAR, which establishes the framework under which the Office of Export Enforcement and the administrative law process operate. The EAR sets out categories of aggravating and mitigating factors that BIS weighs when determining whether to issue a warning letter, a proposed charging letter, or a civil or criminal referral.
The governing instrument is not a simple checklist. BIS treats the analysis as a holistic weighing of the circumstances of the apparent violation against the aggravating factors present – and the mitigating factors a respondent can credibly establish. The distinction between a matter resolved at the warning-letter stage and one that proceeds to a formal charge often turns on whether the respondent understood and engaged the mitigation analysis early.
BIS publishes guidance on how it weights these factors, and that guidance is the practitioner's primary reference. Unlike OFAC's enforcement guidelines, which are largely self-contained in a single published document, the BIS position draws on both the EAR text and published agency practice. Understanding both is essential before filing any response or making contact with the regulator.
The position above covers the standard case. Your facts – the item, the end-user, the destination, the licence exception attempted – change the analysis materially. For businesses assessing an apparent violation across multiple regimes, our apparent-violation assessment service can scope the exposure before any formal response is filed. Contact Calder & Vance at info@caldervance.com for an initial review.
Which mitigation factors carry the most weight in a BIS / EAR proceeding?
BIS weighs mitigation factors across several dimensions, and the weight each carries depends significantly on the specific violation type, the destination of the goods, and the conduct of the respondent after discovery. That said, certain factors consistently affect the outcome of enforcement proceedings.
Voluntary self-disclosure (a VSD – a voluntary self-disclosure to BIS under the EAR) is among the most powerful mitigating steps available. A well-constructed VSD, submitted promptly after the business identifies an apparent violation, signals good faith and begins the clock on a co-operative engagement. In our cross-border practice, we regularly advise clients on whether the facts support a VSD and how to frame it. A poorly drafted or premature VSD can, however, introduce complications that a more carefully timed submission would have avoided.
Beyond voluntary self-disclosure, BIS gives substantial weight to:
- The existence and quality of a compliance programme at the time of the violation – not a programme built after the fact.
- Whether the violator disclosed the matter promptly after discovery and was transparent throughout the review.
- Whether the violation was isolated or part of a pattern of conduct.
- The degree to which the respondent has remediated the root cause and can demonstrate that recurrence is unlikely.
- Whether the goods or technology involved carried a high proliferation risk.
A critical point practitioners often raise with clients: the compliance programme that matters for mitigation is the one in place at the time of the violation. Retrofitting a programme after the fact can demonstrate remediation – a genuine mitigant – but it does not substitute for the mitigation value of a pre-existing effective programme. Have you documented the programme you had, not just the one you are building now?
How does the BIS mitigation analysis compare with OFAC and EU enforcement?
Cross-border businesses frequently face simultaneous exposure under more than one regime, and the mitigation analysis differs materially between BIS, OFAC, and the EU – creating a risk that a step taken to improve one position inadvertently complicates another.
Under OFAC, the mitigation analysis runs through a published enforcement guidelines document that weights factors including whether the subject is a financial institution, the size of the harm, and the degree of management involvement. The core VSD mechanism exists in both regimes, but OFAC's framework is weighted somewhat differently towards the substantive harm caused to US sanctions policy, whereas BIS tends to weight the proliferation sensitivity of the item and the reliability of the end-use controls around it.
The EU enforcement posture is administered at the member-state level. There is no single EU-wide penalty matrix. National competent authorities apply their domestic law to EU Council Regulation violations, and the mitigation factors recognised can differ considerably between, say, a German enforcement matter and one handled by a French authority. Where a transaction triggers both EAR exposure and EU export-control exposure, the two analyses must run in parallel rather than sequentially.
The UK position under ECJU adds a further layer. OFSI governs financial sanctions enforcement; ECJU and relevant customs authorities govern export-control breaches. The interaction between UK and US extraterritorial reach – particularly for items subject to the EAR's de minimis and foreign direct product rules – means that a UK exporter of goods incorporating US-origin content may face BIS jurisdiction even if the shipment never crossed a US border. We regularly advise on exactly this intersection, and the mitigation analysis for the UK entity must take account of the BIS position as well as the ECJU one.
Our EU enforcement mitigation service addresses the parallel EU position for businesses with cross-border exposure. If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact us at info@caldervance.com.
What is the voluntary self-disclosure process under the EAR, and what does it require?
A VSD under the EAR is a formal written submission to the Office of Export Enforcement describing an apparent violation that the disclosing party has identified. It is not a routine report; it is a legal document that, if well-constructed, invokes significant mitigation credit and, if poorly constructed, can create new problems.
The submission should identify the nature of the violation, the items involved, the parties, the approximate dates, and the steps taken to stop the violating conduct. It must be factually accurate. An initial submission can be followed by a more detailed narrative once the internal investigation is complete, but the initial filing should be submitted promptly once the decision to disclose has been made. Delay between discovery and VSD submission can erode the mitigation credit the filing would otherwise attract.
Internal investigation quality matters. Before filing, a business needs to understand the full scope of the apparent violation – not just the incidents it has already identified. A VSD that discloses three shipments and then requires supplementation to add twelve more is significantly less effective than a submission that captures the full picture from the outset. In our experience, the internal review phase is where the most consequential decisions are made, and it is the phase that most benefits from early specialist involvement.
The VSD process also interacts with potential criminal referrals. Where a matter involves wilful conduct, false statements, or aggravated circumstances, BIS may refer to the Department of Justice. The decision on whether and when to disclose – and how to frame the disclosure – must be made with full awareness of that possibility. This is not a decision that should be made without counsel.
What are the most common risk flags that worsen a BIS enforcement outcome?
Certain fact patterns reliably aggravate a BIS enforcement matter, and knowing them in advance allows a business to assess its exposure accurately before deciding on a response strategy.
The most significant aggravating factor is evidence of wilful conduct – that the violator knew the transaction was prohibited and proceeded anyway. BIS treats wilfulness as a serious aggravant, and it can convert a civil matter into a criminal referral to DOJ. Related aggravants include false or misleading export documentation and the involvement of items subject to heightened control because of their end-use risk.
Other common risk flags include:
- A pattern of violations rather than an isolated incident – multiple shipments to the same controlled destination under an inapplicable exception.
- Prior enforcement history with BIS or other US agencies.
- Failure to maintain adequate export-control records for the required period.
- A compliance programme that existed on paper but was not implemented or tested in practice.
- Delayed or incomplete co-operation once BIS begins its review.
The myth worth addressing directly: "Our compliance programme is documented, so we are in a good position." Documentation alone does not establish an effective compliance programme in BIS's analysis. The question is whether the programme was operationally implemented, whether staff were trained against it, and whether it actually would have caught the type of violation at issue. A well-drafted policy manual that no one used is not a mitigant; it may even highlight the gap between paper compliance and operational reality.
In a recent matter, a manufacturer of industrial equipment found that its US-origin components were incorporated into finished goods by a subsidiary and re-exported by a third party. The EAR's foreign direct product rules brought the transaction within BIS jurisdiction. We scoped the apparent violation, assessed the record-keeping position, and prepared the VSD. The matter was resolved at the administrative level. No outcome of that kind can be promised, but early, structured engagement consistently produces better results than reactive response.
How does the decision matrix work for BIS enforcement responses?
Not every apparent EAR violation calls for the same response, and choosing the wrong route is itself a risk. The decision depends on the severity of the violation, the strength of the available mitigation, and the practical position the business is in.
Situation A – an isolated, lower-risk technical violation with a strong pre-existing compliance programme, prompt discovery, and no aggravating factors: the strongest route is a well-constructed VSD with a detailed narrative, submitted promptly. The expected outcome is mitigation credit and, in many cases, resolution below the level of a formal charge. The principal residual risk is that the internal investigation identifies further violations that must also be disclosed.
Situation B – a pattern of violations involving controlled items, an inadequate compliance programme, and some evidence of internal warnings that were not acted on: the analysis is more difficult. A VSD is still likely to attract mitigation credit, but the aggravating factors are present and significant. Here the focus shifts to the quality of remediation and co-operation, and the legal strategy must be developed with a full picture of the exposure across all affected entities and jurisdictions. The risk of a DOJ referral must be assessed at the outset.
Situation C – a matter that has already been identified by BIS through an outbound shipment review or a tip: the VSD option is significantly narrowed once BIS has initiated an investigation. The mitigation analysis does not disappear, but voluntary disclosure credit is reduced or unavailable. The response strategy must focus on co-operation, remediation, and a factual challenge to any characterisation of the conduct as wilful.
The timeline for each route varies. Internal investigation and VSD preparation typically take several weeks at minimum if done properly. BIS's review of a submitted VSD can extend to several months. The administrative process that follows a charging letter operates on its own timeline. The business should plan its internal resource accordingly and should not allow speed to compromise the accuracy of the submission.
When should you involve specialist counsel for BIS / EAR mitigation work?
The short answer: before filing anything with BIS and before making any substantive representation to the agency. The longer answer turns on what is at stake and how the internal position currently looks.
Specialist counsel adds the most value at three specific points. First, at the scoping stage, when the business is trying to determine whether an apparent violation exists, how wide the exposure runs, and whether the facts support a VSD. Second, at the VSD drafting stage, when the accuracy, completeness, and framing of the submission are being decided. Third, at any point where BIS has initiated contact and the business needs to manage its responses to agency queries.
We have acted for exporters, manufacturers, freight forwarders, and financial institutions managing BIS enforcement matters. In each case, the outcome depended heavily on how the mitigation evidence was assembled, sequenced, and presented. The quality of the internal investigation record is the foundation; the legal framing is what translates that record into mitigation credit.
Related practices
- Apparent Violation Assessment – EU – scope and assess apparent EU export-control violations before filing
- Enforcement Mitigation – EU – parallel mitigation analysis for EU Council Regulation and dual-use matters
- Enforcement Mitigation – OFAC – OFAC civil penalty mitigation, voluntary self-disclosure, and enforcement defence