A trading company in the Netherlands re-exports a batch of dual-use items to a distributor in a third country. The distributor then moves those goods onward – to a destination the original exporter never anticipated. Six months later, the EU authority begins an inquiry. The question is no longer whether the initial export was lawful. The question is whether the re-export itself, and who authorised it, attracted obligations that the Netherlands entity can be held to account for.
Re-export and extraterritorial reach under EU export-control rules means that goods, technology, and software classified as dual-use may require an EU authorisation not only at the point of first export from the EU but also when they are subsequently moved from one third country to another – where the re-exporter is an EU person or entity, or where the items remain subject to an EU-origin condition. The governing instruments are the EU dual-use rules and the relevant Council Regulations. Controls bite on EU persons wherever they operate, and the extraterritorial dimension is expanding as the EU aligns its measures with the broader range of regimes it works alongside.
This page sets out who carries the obligation, how the test works, where EU rules diverge from OFAC and UK positions, and what a business should do before it approves a re-export instruction.
What the EU re-export service covers and who needs it
Re-export controls under EU rules apply to any person or entity established in the EU that authorises or facilitates the movement of dual-use goods, software, or technology from one third country to another, and to any non-EU entity that is majority-owned or controlled by an EU person where that entity acts in connection with the original export. The dual-use regulation (the EU's principal instrument governing items with both civil and military applications) is the anchor text, supplemented by the relevant Council Regulations that impose autonomous measures on specific destinations and end-users.
The businesses that most frequently need specialist re-export advice include EU-headquartered multinationals with global distribution networks, EU-based trading intermediaries handling goods on behalf of non-EU manufacturers, freight-forwarders and logistics providers arranging multi-leg shipments, and financial institutions financing or guaranteeing transactions in dual-use goods. In our experience, the risk is highest where the supply chain has two or more handoffs outside the EU and the original export authorisation was silent on onward transfer.
A further category – and one we regularly advise – is the EU subsidiary of a non-EU group. Where a parent company in a third country issues a re-export instruction to its EU-based logistics arm, that arm cannot shelter behind the instruction. EU-established entities carry independent obligations under EU rules, regardless of where the group's management sits.
The legal basis and the governing authority
The EU dual-use framework derives from the primary regulation governing the export, brokering, transit, and technical assistance of dual-use items. The regulation establishes the EU Common List of dual-use items (the list of controlled goods, software, and technology requiring authorisation before export), and it creates several categories of EU-level authorisation alongside the national authorisations issued by Member State competent authorities.
Enforcement sits with national competent authorities – the relevant ministry or customs and trade agency in each Member State – coordinated through the European Commission's system for information sharing. Criminal and administrative penalties are a matter of national law, though the regulation harmonises the definitions of infringements across the EU. That means a re-export authorisation failure identified by the German competent authority can trigger parallel inquiries in other Member States where the same entity operates, and can attract attention from third-country regulators who monitor EU-origin goods in their jurisdictions.
The EU Blocking Regulation (the regulation protecting EU persons from the extraterritorial effect of specified third-country laws) is a distinct instrument but is directly relevant in practice. Where a US secondary-sanctions measure would otherwise require an EU operator to refuse a re-export that EU rules permit, the Blocking Regulation creates a legal tension that cannot be resolved without advice on both regimes simultaneously. We advise on that intersection as a matter of course.
The position above covers the standard structural analysis. Your facts – the goods, the destination, the end-user, and the route through which the re-export runs – change the analysis considerably. For an assessment of your EU re-export exposure, contact Calder & Vance at info@caldervance.com.
How the re-export test works: the EU procedure and decision sequence
The EU re-export analysis follows a defined sequence. Working through it before approving any onward transfer instruction reduces both the risk of an unlicensed movement and the risk of over-compliance that kills a lawful trade.
- Classify the item. Confirm whether the goods, software, or technology appear on the EU Common List. The classification must be done by reference to the current list, not the classification assigned at first export, because control parameters are updated periodically. Where an item was classified by the original exporter and time has passed, re-verify.
- Check the destination. Certain destinations attract an embargo or a heightened-scrutiny requirement under a Council Regulation. A re-export to an embargoed destination requires separate legal analysis regardless of the classification of the item. Check the destination against the EU's consolidated sanctions list and the relevant thematic regulations before proceeding.
- Assess the end-user. EU export-control rules place significant weight on end-user risk. Is the end-user a named entity in any EU restrictive-measures list? Does the end-user's business profile raise concern about diversion to a prohibited military or proliferation end-use? The end-user statement (a declaration from the consignee setting out the intended use and committing to non-re-export without prior consent) is the standard documentary control, but it does not substitute for substantive due diligence on the end-user's profile and supply chain position.
- Identify the applicable authorisation. EU dual-use authorisations fall into three categories: General Export Authorisations (GEAs – standing authorisations covering defined categories of items to listed destinations, available without a separate application), national general authorisations issued by Member States, and specific individual authorisations. For re-exports, the applicable GEA – if one exists for the destination and item combination – may cover the movement. Where no GEA applies, a specific authorisation application is required from the competent authority of the Member State through which the re-export is administered or from which the EU person operates.
- Submit or verify the authorisation. Where a specific authorisation is required, the application is made to the national competent authority. Processing times vary by Member State and by the sensitivity of the item; consult the relevant authority's published guidance for indicative windows, and plan for a period of weeks for standard applications.
- Record and retain. EU rules require exporters to maintain records of all export and re-export transactions, including the authorisation reference, the end-user documentation, and the shipping records. The standard retention period is several years; verify the exact requirement in the applicable national implementing measure before relying on a shorter retention practice.
A missed step at any stage – particularly step two (embargo check) or step three (end-user due diligence) – is the pattern most frequently cited in enforcement findings. In our experience, firms that run the classification and the embargo check but skip a substantive end-user assessment account for a disproportionate share of re-export enforcement matters.
Cross-border comparison: how EU rules diverge from OFAC and UK positions
The EU approach to re-export controls is materially different from the US and UK regimes in scope, mechanism, and enforcement posture. Understanding the divergences is essential for any business operating across more than one jurisdiction.
Under OFAC, the extraterritorial dimension of US sanctions operates principally through secondary sanctions (measures that expose non-US persons to designation or restricted market access if they transact with designated parties or in sanctioned sectors, even without a US nexus). The reach of US export controls under the EAR (the Export Administration Regulations administered by BIS) extends to re-exports of US-origin items, US-controlled technology incorporated into foreign-made goods, and items produced abroad using certain US equipment – a concept with no direct EU equivalent. An EU-established entity re-exporting US-origin goods is simultaneously subject to EU dual-use rules and the EAR's re-export provisions. The two analyses must be run in parallel; a licence obtained under one regime does not satisfy the other.
Under the UK regime, OFSI administers financial sanctions and the ECJU administers export licensing. Post-Brexit, the UK maintains its own strategic export-control list, which is broadly aligned with the EU list but not identical. Divergences have grown as the EU and UK update their respective lists on different schedules. A re-export authorised under an EU Member State GEA does not carry over to cover the same movement if it transits through, or is handled by an entity established in, the United Kingdom. Separate UK authorisation may be required.
A further divergence concerns the catch-all control (the power to require an export or re-export licence even for items not on the control list, where the exporter has reason to believe the goods will be used for weapons-of-mass-destruction proliferation, military end-use in specific destinations, or similar concerns). Both the EU and the UK operate catch-all controls. The triggering standard and the obligation to apply for a licence differ in detail between the two regimes; an item that does not trigger the EU catch-all may still trigger the UK catch-all, or vice versa. Where a re-export involves both an EU-established entity and a UK-connected entity – a common structure in cross-Channel supply chains – both analyses are required.
For businesses with US-linked supply chains, this three-regime picture is the operative reality. Our practice spans OFAC, BIS, OFSI, ECJU, and EU competent authorities. We do not advise on one in isolation when the facts engage more than one.
If a re-export has already been executed and you are now assessing your position, time matters. An early review preserves options – including voluntary disclosure to the competent authority – that narrow as the inquiry progresses. Contact Calder & Vance at info@caldervance.com for a confidential review.
What are the main risks in re-export and extraterritorial reach under EU rules?
The main risks divide into three categories: regulatory risk, reputational risk, and the compounding risk that arises when a re-export breach under EU rules triggers parallel action under another regime.
Regulatory risk arises directly from an unlicensed re-export of a controlled item. National competent authorities in EU Member States hold powers to impose administrative penalties, suspend export authorisations, and refer matters to criminal authorities. The severity depends on the item, the destination, the end-use, and whether the breach was deliberate or the result of negligence. A finding of deliberate or reckless conduct in one Member State can affect the entity's licence profile in others.
Two particular risk patterns appear repeatedly in our practice. First, the assumption that a GEA covers a re-export when it does not – because the destination is excluded from the GEA's scope or the item's classification falls outside the GEA's coverage. Second, the failure to identify that a re-export instruction from a non-EU parent creates an independent EU-law obligation on the EU entity receiving it. The EU entity cannot act merely as a conduit. It must apply EU rules to the instruction before carrying it out.
Reputational risk is distinct. A re-export that results in controlled goods reaching a prohibited end-use – even where the EU entity acted without awareness of the diversion – can attract regulatory scrutiny, press attention, and contractual consequences with customers and insurers. Due-diligence failures are difficult to explain retrospectively. The obligation is to know the supply chain, not merely to document it.
The compounding risk is the most serious in value terms. Where a re-export of EU-origin goods involves US-origin components, or where the re-exporting entity has US-connected financing or US-based customers, a breach of EU export-control rules can simultaneously expose the entity to BIS enforcement under the EAR. BIS has demonstrated its willingness to act against non-US entities in EU Member States. The penalties under the EAR are significant; verify the current position under the applicable regime and take advice before acting.
A common misconception: do EU re-export rules apply only to EU residents?
A recurring myth in this area is that EU re-export controls apply only to companies physically established in an EU Member State. The position is more nuanced and the consequences of the misunderstanding are serious.
EU dual-use rules apply to EU persons – a category that includes individuals who are nationals of EU Member States, regardless of where they are resident, and entities that are incorporated under the laws of a Member State. An EU national acting as a broker or intermediary for a re-export from Singapore to a third country may be caught by EU rules even if the goods never touch EU territory. In our experience, this point is consistently underestimated by trading companies that have moved their logistics operations outside the EU while retaining EU nationals in key decision-making roles.
The brokering provisions of the EU dual-use regulation extend the obligation further. An EU person providing brokering services – negotiating or arranging the transfer of controlled items between two non-EU parties – may require authorisation even where the items never enter EU territory. That is a meaningful extension of territorial reach, and it mirrors (though it does not replicate) the US concept of re-export control over US persons.
Firms that have taken the view that "we only handle the paperwork" or "the goods do not go through Europe" should revisit that analysis. If EU persons are involved in the transaction in a decision-making or intermediary capacity, EU rules are engaged.
How Calder & Vance assists with EU re-export and extraterritorial reach
Our EU export-control practice covers the full lifecycle of a re-export matter – from pre-transaction classification and authorisation advice through to enforcement response and voluntary disclosure.
For transactions in progress, we classify the item against the current EU Common List, confirm whether a GEA covers the re-export or whether a specific authorisation application is required, assess the end-user against the EU consolidated list and the relevant Council Regulations, and prepare the authorisation application and supporting documentation for submission to the national competent authority. Where the transaction also has US-origin or UK elements, we run the EAR and UK export-control analysis in parallel.
For businesses building or reviewing their re-export compliance programme, we test the existing screening logic against the EU dual-use framework, map the ownership and control structure of the entity to identify which EU persons carry personal obligations, and redesign the programme to cover brokering, catch-all triggers, and multi-leg supply chains. We also advise on the record-keeping obligation and the documentation standard required to support an authorisation or to defend an enforcement inquiry.
In a recent matter, a mid-size EU trading house with a global distribution network discovered that a long-standing distributor arrangement in a third country had been re-exporting items under a GEA that did not, on its terms, cover the destination in question. We scoped the potential exposure, advised on the voluntary self-disclosure process to the competent authority, prepared the disclosure filing, and redesigned the entity's re-export compliance controls. The matter concluded without a referral to criminal authorities.
For enforcement matters and inquiries that are already under way, we advise on the scope of the apparent violation, counsel on the advantages and risks of voluntary self-disclosure, and prepare the penalty defence or the formal response to the competent authority. Where the matter has a cross-border dimension – and most re-export enforcement matters do – we coordinate with local counsel in the relevant jurisdiction.
Related practices
- Deemed export and technology controls under BIS and the EAR – US classification, licence exceptions, and technology-transfer controls for cross-border transactions
- Re-export and extraterritorial reach under OFAC – secondary-sanctions risk, US-origin controls, and the EAR re-export regime for non-US businesses
- Re-export controls: OFAC and BIS enforcement posture – enforcement trends, voluntary self-disclosure, and penalty mitigation across the US regime