Goods-origin verification under OFAC: compliance counsel

A trading company sources components from a supplier in a transit hub. The paperwork shows a neutral country of origin. The goods arrive, clear customs, and enter the supply chain. Six months later, a compliance review flags the manufacturer. The actual origin may be subject to OFAC controls. The deal is done. The goods are shipped. And the company is now assessing whether it has a voluntary self-disclosure problem. This is the scenario that goods-origin verification under OFAC is designed to prevent.

Goods-origin verification (the process of establishing the true country of origin, manufacture, and ownership provenance of an item for purposes of US sanctions and export-control compliance) sits at the intersection of OFAC's economic-sanctions regime and the Export Administration Regulations administered by BIS. A misclassified or mis-origin-attributed item can trigger strict-liability civil penalties under IEEPA, create deemed-export exposure, and activate the Foreign Direct Product rules (FDP rules – provisions that extend US jurisdiction to certain foreign-produced items incorporating controlled US technology or software). As of January 2026, OFAC's guidance on the 50 percent rule and the parallel BIS ownership-threshold rule both reinforce the principle that legal form does not determine liability: substance and economic reality do.

This page explains the problem that goods-origin mis-attribution creates for exporters and importers, the legal basis that makes it a sanctions issue, the procedure for conducting a defensible verification, the cross-regime picture, and how Calder & Vance assists clients who need specialist goods-origin verification OFAC legal support.

Why goods-origin mis-attribution is an OFAC problem, not just a customs issue

OFAC liability is strict. The regulations do not require knowledge of an underlying violation for civil-penalty purposes. An exporter or importer that ships, receives, or processes goods whose true origin is subject to an OFAC comprehensive or list-based programme may have committed a sanctionable act regardless of whether it knew the origin was mis-stated. That strict-liability standard is what separates an origin error from an ordinary customs classification dispute.

The risk is compounded by facilitation. OFAC's rules prohibit US persons from facilitating transactions that they could not themselves conduct directly. A US company that processes invoices, arranges finance, or provides logistics for a third party whose goods have been transshipped through a neutral country to obscure their origin can be within scope even though it never directly handled the sanctioned-origin goods.

There is also the question of where the BIS rules reach. The EAR can apply extraterritorially through the FDP rules: if a foreign-produced item is the direct product of controlled US technology or software, or is produced by a plant that is itself such a product, it may be subject to US export controls regardless of the country in which it was manufactured. That means a component marketed as locally produced in a transit jurisdiction can still carry US export-control obligations. In our experience, this is the single most common gap in supply-chain origin reviews conducted by in-house teams working without specialist export-controls counsel.

What triggers an OFAC review of origin? A sharp change in trade flows to a neighbouring jurisdiction, invoice values that do not match market norms, and suppliers that lack credible manufacturing capacity are all treated as diversion red flags. OFAC and BIS coordinate on enforcement, and a diversion finding under BIS will often run in parallel with an OFAC inquiry.

The legal basis: which instruments govern goods-origin verification OFAC compliance?

The primary legal authority for goods-origin controls on the US side is IEEPA, which empowers OFAC to administer comprehensive and list-based sanctions programmes, and the Export Control Reform Act, which gives BIS authority over the EAR and the Commerce Control List. These are distinct instruments with separate enforcement tracks, but they frequently apply to the same goods, the same transaction, and the same company.

OFAC's comprehensive programmes prohibit dealings in property in which a sanctioned country or a Specially Designated National (SDN – a person on OFAC's list of blocked parties whose property must be blocked) has an interest. Where goods originate from a sanctioned-country source, they may carry a property interest of that source even after transshipment. OFAC's guidance makes clear that the analysis turns on beneficial origin and ownership, not on the label applied by an intermediate shipper.

On the BIS side, items classified under an Export Control Classification Number (ECCN – a five-character alphanumeric code on the Commerce Control List that determines what licence requirements apply) carry those controls with them when re-exported or when incorporated into foreign-produced items above applicable thresholds. Items that are subject to the EAR but not on the CCL are designated EAR99, but EAR99 status does not insulate an item from origin-based controls where the destination or end-user is separately restricted.

BIS also maintains the Entity List and the Denied Persons List: dealings with listed parties require a licence or are outright prohibited, independent of the item's classification. A supplier that appears on the Entity List because of diversion-related findings becomes a controls problem for every customer in its supply chain, regardless of where the goods are physically located at the time of the finding.

The interaction between these two instruments is not theoretical. We regularly advise clients where an OFAC strict-liability exposure and a BIS entity-list concern arise from the same shipment, requiring a coordinated response rather than two parallel compliance reviews.

How does an OFAC goods-origin verification actually work?

A defensible goods-origin verification under OFAC has five sequential phases, each of which must be documented contemporaneously to support a voluntary self-disclosure or a penalty-mitigation argument if a problem later surfaces.

Phase 1 – Identify the goods and the counterparty chain. Establish the full commercial description of the item, its ECCN (or a reasoned basis for EAR99 status), and the complete chain of legal entities from original manufacturer to end-user. This means going beyond the contract counterparty to the beneficial owner of the goods at each stage of transit. The 50 percent rule applies here: where any entity in the chain is owned 50 percent or more in the aggregate by a blocked person, that entity is treated as blocked even if it does not appear on any list by name. Aggregation across multiple listed persons with minority stakes is the trap most automated screening tools miss.

Phase 2 – Establish the true country of origin. Commercial invoices, certificates of origin, and customs entries are the starting point, not the conclusion. Where goods have been processed or assembled in a transit country, the substantial-transformation and tariff-classification analyses used in customs law inform but do not determine the sanctions and export-controls origin question. OFAC looks to beneficial origin: where the goods were manufactured, by whom, and whether a sanctioned country's property interest attaches.

Phase 3 – Apply the FDP rules to foreign-produced components. For each foreign-produced item or component in the goods, assess whether it is the direct product of controlled US technology. This analysis is item-specific and depends on the technology used in production, not merely the final product's classification. Where the FDP rules reach the goods, US export-control licensing requirements follow the item wherever it travels.

Phase 4 – Screen against OFAC lists and the Entity List. Run every legal entity in the chain against the SDN List, the Non-SDN lists, and the BIS Entity List and Denied Persons List. Sanctions screening (the systematic checking of names and identifiers against OFAC and other regulator-maintained lists) is a necessary but not sufficient step: a counterparty can be effectively blocked through the 50 percent rule without appearing by name on any list. Ownership mapping must accompany list screening.

Phase 5 – Document, escalate, and decide. The output of the verification is a written record of the analysis, the data reviewed, the conclusions reached, and the residual uncertainties. Where material uncertainty remains, the decision to proceed, hold, or decline must be escalated and recorded. If a potential violation is identified, the firm must assess whether a voluntary self-disclosure (VSD – a self-initiated report to OFAC or BIS of a potential violation, which is a recognised mitigating factor under OFAC's Enforcement Guidelines) is appropriate. The decision not to disclose is itself a position that must be documented and supportable.

Blocked-property reports are due to OFAC within 10 business days of the blocking event, and records relating to a sanctions matter must be maintained for five years. Both timelines are live from the moment a blocking determination is made, not from the moment the issue is escalated to legal counsel.

How do the UK and EU origin-verification obligations compare?

OFAC's goods-origin rules do not operate in isolation. Cross-border businesses face parallel obligations under OFSI, the EU Council regulations, and the export-control regimes of ECJU and the EU's dual-use rules, and the tests they apply differ in important ways from the US approach.

OFSI's financial-sanctions regime applies an ownership and control test (the UK test for whether a non-listed entity is caught through a listed person's interest). Under UK rules, control is assessed as an actual ability to direct decisions, not merely a formal ownership percentage. A non-listed entity can be within scope even where a designated person holds less than 50 percent, if that person exercises de facto control. UK case law distinguishes existing, exercised influence from a hypothetical ability to exert control: control must be actual, not theoretical. That is a materially different analysis from OFAC's mechanical 50 percent threshold.

The EU position is similar to the UK in its control dimension but adds a further element: EU asset-freeze prohibitions extend to making funds or economic resources available, directly or indirectly, to or for the benefit of listed persons. In a supply-chain context this means that goods supplied to an entity that ultimately benefits a listed person may be caught even without a direct ownership link. An EU court ruling has confirmed that control must be established by objective and sufficiently weighty evidence, not by inference from general circumstances alone.

EU dual-use controls, governed by the recast Dual-Use Regulation, also impose an origin-independent assessment: the question is whether the item as supplied, wherever produced, has dual-use potential and meets the classification criteria. A foreign-produced item supplied into the EU by a non-EU exporter is not outside EU controls simply because it was not produced in the EU.

For businesses that are simultaneously subject to US, UK, and EU obligations – which describes most multinationals and financial institutions operating in international trade – the rule is that where two regimes both apply, the stricter prohibition governs. You cannot satisfy one regime's requirement by relying on the other's licence or exemption. In our cross-border practice, the origin verification that resolves the OFAC question frequently leaves an EU or UK question open, and clients benefit from a single integrated analysis rather than sequential advice from separate counsel.

Switzerland, Canada, and Australia all maintain autonomous sanctions regimes that can extend controls to the same goods and counterparties. SECO ordinances frequently align with EU measures, which means a goods-origin clearance that passes EU screening should also be tested against the Swiss position where Swiss entities are in the chain.

What are the principal risk flags in a goods-origin review?

A sharp change in trade flows to a neighbouring or transit jurisdiction is the most consistently cited diversion red flag in current enforcement practice. Where a supplier was previously sourcing directly and has recently rerouted through a third country without a credible commercial explanation, the origin question demands heightened scrutiny.

The following risk factors, individually or in combination, should escalate a standard review to a specialist origin investigation.

• Supplier invoices showing a transit-country address but shipping from a different origin.
• Certificates of origin that are inconsistent with the supplier's stated manufacturing location.
• Beneficial ownership chains that include entities in jurisdictions associated with diversion, where the chain cannot be verified beyond two levels.
• Goods that are near-identical in specification to items that appear on the CCL or that have historically attracted FDP-rule treatment.
• A supplier that has changed its name, registration, or ownership structure recently without a clear commercial reason.
• Payment routing through financial institutions or jurisdictions that are themselves subject to OFAC scrutiny.
• End-user certificates that are inconsistent with the buyer's known operations or capacity.

The myth that commercial-grade goods escape control deserves direct attention here. If an item is commercial, off-the-shelf, or marketed for consumer applications, it is not automatically outside the EAR or OFAC's reach. The classification question turns on the item's technical parameters, not its marketing description. Advanced computing components, precision-tolerance parts, and telecommunications equipment are regularly controlled at ECCN level even when widely available commercially. A mis-classification on that basis is a genuine source of penalty exposure – and the strict-liability standard means the firm cannot point to commercial availability as a defence after the fact.

We have acted for exporters and their supply-chain partners who identified an origin problem mid-shipment, after goods had already crossed a transit jurisdiction. The position at that stage is more constrained, but it is not unmanageable. An early, structured assessment of what was known and when, combined with a credible VSD where appropriate, consistently produces a better outcome than delay.

When should a business instruct specialist goods-origin verification OFAC legal advice?

Not every origin review requires specialist counsel. Where the goods are straightforward, the ownership chain is short, and no list hits appear, a well-designed in-house procedure with documented screening will satisfy the compliance standard for most transactions. The question is whether the facts are straightforward – and that question is harder to answer correctly without specialist input than it appears.

Specialist counsel is warranted, at a minimum, in the following situations.

First, where the goods or any component has a potential FDP-rule dimension. The analysis is item-specific, depends on the technology used in production, and requires classification expertise that few in-house teams maintain.

Second, where any entity in the ownership chain is located in a jurisdiction associated with diversion, cannot be verified beyond public-record level, or has recently restructured its ownership.

Third, where a transaction has already been executed and an origin concern has emerged after the fact. This is the scenario where the VSD decision, the record-preservation obligation, and the 10-business-day blocking report deadline all run simultaneously. Managing three concurrent obligations correctly under time pressure is a specialist task.

Fourth, where the client is simultaneously subject to OFAC, OFSI, and EU controls and needs a single integrated analysis rather than a patchwork of jurisdiction-specific opinions. The interaction between the 50 percent rule (OFAC), the ownership-and-control test (UK), and the EU's beneficial-availability principle is not self-resolving, and treating them as independent questions can produce a gap.

Fifth, where a regulator has already made contact – whether through an administrative subpoena, an information request, or an informal inquiry. At that stage the self-disclosure window may have closed and the defence posture must be established promptly. The law firm for goods-origin verification OFAC situations involving active regulatory contact needs litigation-ready export-controls expertise, not merely a transactional compliance review.

The position above covers the standard case. Your facts – the goods, the counterparties, the route, and the regimes in play – change the analysis. For a confidential assessment of your goods-origin verification exposure, contact Calder & Vance at info@caldervance.com.

How Calder & Vance assists with goods-origin verification OFAC legal support

Our practice covers the full sequence of a goods-origin compliance matter, from initial classification and origin analysis through to regulatory response and enforcement defence where needed. We are an OFAC export controls specialist practice operating across the major regimes, which means a single engagement can address the US, UK, EU, and other applicable regimes without requiring the client to instruct separate counsel in each.

For origin-verification mandates, we classify the item, confirm licence requirements and exceptions under the EAR, assess the FDP-rule position for foreign-produced components, and map the ownership and control chain against OFAC's 50 percent rule, OFSI's ownership-and-control test, and the EU's beneficial-availability standard. We design end-use controls and supplier-due-diligence procedures calibrated to the goods and the supply-chain structure, so that the origin review is embedded in a repeatable compliance process rather than a one-off exercise.

Where a potential violation has been identified, we scope the apparent violation, advise on voluntary self-disclosure, and prepare the penalty defence. Where a filing has been refused or a transaction blocked, we assess the licensing route and, where appropriate, prepare and submit the licence application and manage the regulator's queries.

For businesses in the advanced computing, semiconductors, or precision-components sectors, origin verification intersects directly with the current BIS and OFAC enforcement priorities. Our work in the advanced-computing controls space is described at Advanced Computing Controls: BIS and EAR service. For a comparative analysis of how OFAC and the Canadian regime treat advanced-computing origin questions differently, see Advanced computing controls: OFAC vs Canada. For the OFAC and OFSI comparison on the same topic, see Advanced computing controls: OFAC vs OFSI.

We act for multinationals, financial institutions, and exporters on sanctions and export-control matters across the major regimes. Our engagements combine technical export-control classification with sanctions-law analysis – a combination that pure export-control practices and pure sanctions practices frequently cannot provide under one roof.

If a transaction has already been flagged, or if a post-shipment review has surfaced an origin concern, an early structured review can preserve options that narrow with time. To discuss your position, contact us at info@caldervance.com.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.