Licence conditions for controlled computing exports under OFAC: support

A technology exporter has a signed purchase order, a creditworthy buyer, and a delivery schedule. Then the compliance team flags the destination. The shipment requires a licence from the Office of Foreign Assets Control, and the licence – when it comes – will carry conditions. Those conditions are not boilerplate. They are binding legal obligations. A breach, even an inadvertent one, can void the authorisation and expose the exporter to the full force of civil penalties under IEEPA. Transactions stall while teams wait for approvals they do not fully understand, and then discover that receiving the licence was only the beginning of the obligation.

Licence conditions for controlled computing exports under OFAC are legally binding requirements attached to a specific licence that authorise an otherwise prohibited transaction involving advanced computing goods or technology. They govern how the export is carried out, how the items are used at destination, what the recipient may do with them, and what the exporter must report to the regulator. As of January 2026, OFAC administers two licence types – specific licences (case-by-case authorisations) and general licences (standing authorisations for defined categories of transactions) – and computing-related specific licences routinely carry end-use, reporting, and record-keeping conditions that require active management throughout the life of the transaction.

This page sets out what is in scope for this service, how the authorisation and condition-management process works, where BIS and OFAC obligations interact, where the UK and EU regimes diverge, what the principal risk flags are, and how Calder & Vance assists exporters who need specialist counsel for licence conditions for controlled computing exports.

What does the service cover, and who needs it?

The service covers the full lifecycle of a specific-licence authorisation for a controlled computing export: from pre-application assessment through to condition monitoring, breach risk review, and voluntary self-disclosure support if a condition is missed. It is designed for exporters, in-house compliance teams, and general counsel who already hold or are applying for an OFAC specific licence for advanced computing goods or technology and need a law firm for licence conditions for controlled computing exports with practitioner-level knowledge of how OFAC administers these approvals in practice.

Controlled computing exports sit at the intersection of two US regulatory regimes. OFAC controls who the goods go to and under what authority, based on the destination, the end-user, and the applicable sanctions programme. BIS controls what goes, through the Export Control Classification Number (ECCN) system on the Commerce Control List and the separate licence requirements that attach to the item itself. A business may require both an OFAC specific licence and a BIS licence for the same shipment. The conditions attached to each authorisation may not be identical, and where they differ the more restrictive obligation governs the conduct of any person subject to both.

The clients who engage us on this work share a common position: they have a commercially important transaction in a sensitive destination or with a counterparty requiring close scrutiny, and they cannot afford to have that transaction collapse, or to proceed with it without understanding what the licence actually requires them to do. We regularly advise multinationals, component manufacturers, cloud-infrastructure providers, and dual-use technology exporters at exactly this point in a deal.

What is the legal basis, and which authority governs?

OFAC's authority to issue specific licences for otherwise prohibited transactions is grounded in IEEPA and the regulations implementing each sanctions programme. A specific licence is a departure from a prohibition, and the conditions attached to it define the perimeter of the departure. Operating outside those conditions is not a technical formality – it is a violation of the underlying prohibition, because the licence is the only lawful basis for the transaction.

OFAC's civil-penalty regime is largely strict-liability. Knowledge of the violation is not a prerequisite to a civil penalty. OFAC's Enforcement Guidelines distinguish egregious from non-egregious cases and recognise voluntary self-disclosure (a VSD – a proactive report of an apparent violation before the regulator discovers it) as a mitigating factor. A missed licence condition that is discovered and reported by the exporter sits in a materially different place in the enforcement calculus than one that OFAC finds through its own inquiry. That asymmetry is one reason condition management matters from day one, not only when something goes wrong.

Record-keeping obligations run in parallel. OFAC requires that sanctions-related records be kept for five years. For a multi-year computing contract with ongoing delivery obligations, that window may extend well beyond the last shipment. Reports of blocked property and rejected transactions must reach OFAC within 10 business days of the triggering event – a deadline that runs whether or not the exporter is still reviewing the position internally.

How does our process work, from scope to deliverables?

We work through four phases. The first is a transaction and classification review: we map the proposed export against the relevant sanctions programme, confirm whether a specific licence is required or whether a general licence applies, and identify the BIS classification of the item and any concurrent BIS-licence requirement. This phase answers a question we encounter often: the assumption that a general licence covers everything, when in fact general licences for computing goods carry their own conditions and may not authorise the specific transaction at all.

The second phase is licence application preparation. Where a specific licence is needed, we assess eligibility, prepare the application, draft the supporting narrative – including the end-use and end-user information that OFAC requires – and manage the regulator's queries during review. OFAC specific-licence timelines vary by the complexity of the request and the programme involved; we set realistic expectations and maintain contact with OFAC through the review period. We do not promise a particular outcome, and the decision rests with OFAC.

The third phase is condition analysis and operational implementation. When the licence issues, we review every condition, translate each one into an operational obligation, and advise on what the exporter's compliance team must do before shipment, at the point of delivery, and for the duration of any post-shipment obligation. This includes end-use verification requirements, re-export restrictions, diversion risk controls, and any monitoring or reporting timeline OFAC has specified.

The fourth phase is ongoing condition monitoring and breach risk review. For multi-delivery or multi-year licences, conditions must be managed continuously. We advise on changes in the counterparty's ownership or control structure that could affect the validity of the licence, on new designations that could bear on the permitted use, and on whether a VSD is warranted if a condition has or may have been breached. We also assist with licence renewal and with the record-keeping obligations that run alongside the authorisation.

How do BIS and the UK and EU regimes interact with OFAC conditions?

This is the dimension that most often catches exporters by surprise. An OFAC specific licence addresses the sanctions prohibition. It does not address the BIS licence requirement that may attach to the same shipment under the Export Administration Regulations (the EAR). BIS conditions and OFAC conditions can each restrict the item's use, re-export destination, or end-user in ways that are not identical. Where the two sets of conditions diverge, the exporter must comply with whichever condition is more restrictive on each point.

The EAR's Foreign Direct Product rules can bring foreign-made items within US jurisdiction where those items are the direct product of controlled US technology or software. That means an exporter who is not a US person may still face EAR obligations alongside the OFAC analysis, depending on the item's origin and the technology used to produce it. In our cross-border practice, this is a dimension we address explicitly for every computing export, because the consequences of missing it are not limited to the exporter's own jurisdiction.

The UK position is administered by OFSI under SAMLA and the relevant thematic regulations. OFSI operates its own licensing regime with defined licensing grounds. A UK exporter dealing with a counterparty who is designated in the US but not in the UK still faces the question of whether US secondary-sanctions exposure affects the transaction – and a UK financial institution financing the deal may itself be exposed through correspondent-banking relationships. The interaction is not theoretical.

EU exporters face a parallel set of questions. EU sanctions are imposed by Council Regulation, which is directly applicable in member states. The EU's dual-use export-control rules under the recast Dual-Use Regulation apply to the item in parallel with any sanctions licence. The EU Blocking Regulation can further complicate the picture by restricting EU operators from complying with specified third-country measures – a provision that requires careful analysis where an EU entity is party to a transaction that OFAC is also reviewing. An EU-based supplier may be in a legally asymmetric position relative to its US-based customer or intermediary.

For a transaction that touches multiple jurisdictions, the OFAC specific licence is one piece of a larger legal puzzle. We advise on the full cross-regime picture and, where local counsel in the relevant jurisdiction is needed, we coordinate the analysis so that the whole is consistent.

What are the principal risk flags in managing licence conditions?

The risk flags we encounter most often in this work fall into three groups. The first is structural: assuming that a general licence authorises what a specific licence is actually required for. General licences for advanced computing goods exist, but their scope is defined by the text of the authorisation itself, and that text frequently contains conditions – on destination, on end-use, on the identity of the end-user – that are overlooked in operational implementation. The myth that a general licence covers everything dissolves rapidly on close reading, and the cost of discovering it mid-shipment is real.

The second group is operational: failing to implement condition obligations at the point where they bite. An end-use verification requirement that sits in the licence file but is never actioned, a re-export restriction that is not communicated to the logistics provider, a reporting obligation that is not calendared. In our experience, these are the failure modes that produce enforcement exposure for companies with genuinely good intent. The condition is present; the process to meet it is not.

The third group is dynamic: changes in the counterparty's legal situation that affect the validity of the licence after it issues. A new designation of a shareholder who crosses the 50 percent rule (the rule treating entities owned 50 percent or more in the aggregate by one or more blocked persons as themselves blocked) affects the licence even though nothing in the exporter's conduct has changed. A change of end-user, a sub-licence to a third party, or a re-export to a destination not covered by the licence are each independent violations if they occur without prior authorisation. Does your compliance calendar flag these triggers, or does it assume that a licence, once received, requires no further attention?

A fourth flag, specific to computing exports, relates to the intersection between OFAC and BIS. A transaction approved under an OFAC specific licence may still require a BIS authorisation that has not been obtained. Conversely, a BIS licence exception that permits the shipment under the EAR does not address an OFAC prohibition that applies to the end-user or destination. Neither authorisation is a substitute for the other.

When should a business engage specialist counsel?

The clearest answer is: before the application, not after the licence issues. The conditions attached to a specific licence are negotiated in the sense that the application and supporting narrative shape what OFAC puts in the licence. An application that fully describes the intended use, the end-user controls, and the monitoring framework the exporter will apply gives OFAC the basis to issue conditions that are workable. An application that is incomplete or imprecise creates the risk of conditions that are operationally difficult or, in the worst case, that the exporter cannot meet for the duration of the authorisation.

Engagement early also means that the BIS classification question, the Foreign Direct Product analysis, and the multi-regime picture are addressed before the deal structure is fixed. Restructuring a transaction after the application has been filed – or after the licence has issued – is significantly more complex than building the right structure from the outset.

Where a business is already holding a licence and has identified a potential condition breach, specialist counsel should be involved immediately. The choice between VSD and a monitored wait is a judgment that turns on the facts, the programme, and OFAC's enforcement posture at the time. It is not a decision to take without OFAC licensing specialist advice. VSD is a recognised mitigating factor under OFAC's Enforcement Guidelines, but the decision to disclose and the timing and form of that disclosure require careful preparation. The position can improve or worsen depending on how it is handled.

In a recent matter, a technology business held an OFAC specific licence for computing exports to a third-country distributor. A corporate restructuring at the distributor's parent introduced a new shareholder. Our team was asked to review whether the restructuring affected the licence. We mapped the new ownership chain, confirmed that the 50 percent threshold was not crossed, and advised on the record to be maintained to document that analysis. The licence remained valid. Had that review not been done, and had the counterparty's position changed beyond the threshold, the next shipment would have constituted an unauthorised dealing without the exporter's awareness.

We act for multinationals, financial institutions, and exporters on sanctions and export-control matters across the major regimes. For OFAC specific-licence work in the computing sector, we offer a scoped initial assessment to identify the authorisation requirements, the applicable conditions, and the immediate compliance steps, at a defined fixed-fee entry point.

Related practices

• OFAC computing licence conditions: service overview – core authorisation and condition guidance for controlled computing exports
• OFAC versus EU: computing licence conditions compared – how the US and EU regimes diverge on authorisation requirements and conditions
• OFAC versus OFSI: computing licence conditions compared – the cross-regime picture for UK and US licensing obligations

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.