Licence conditions for controlled computing exports under OFAC: legal support

A multinational technology exporter has a signed purchase agreement, a ready shipment, and a counterparty in a destination where advanced computing products require an OFAC-specific authorisation. The deal is live. The licence is not. Every week the application sits unanswered, the commercial window narrows – and the risk of proceeding without a completed authorisation grows. That is the pressure point our clients bring to us most often in this practice area.

Licence conditions for controlled computing exports under OFAC (the obligations attached to any authorisation OFAC issues for the export, re-export, or transfer of advanced computing hardware, software, or related technology) govern not just whether a shipment may proceed but precisely how it must proceed, to whom, and with what ongoing obligations. OFAC administers these conditions under its authority in IEEPA and the relevant programme regulations. A specific licence – specific licence (a case-by-case authorisation to conduct an otherwise prohibited transaction) – for controlled computing will typically carry delivery verification, end-use reporting, and record-keeping requirements that survive the transaction itself.

This page sets out the legal basis for OFAC's computing-export licensing regime, the conditions that attach to authorisations, the cross-border interaction with BIS export controls and with the UK and EU regimes, the risk flags that arise in practice, and how Calder & Vance assists businesses that need to move from stalled to authorised.

Why controlled computing exports create a distinct licensing problem

Advanced computing products sit at the intersection of two overlapping US regulatory regimes: OFAC's economic-sanctions programmes and the BIS Export Administration Regulations. A single shipment can require both an OFAC authorisation and a BIS licence, and the conditions attached to each are not identical. Treating one as a substitute for the other is a common and costly mistake.

OFAC's jurisdiction over computing exports arises where a destination, end-user, or beneficial purchaser is caught by a sanctions programme. That can mean a comprehensive territorial restriction, a named entity on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons), or, less obviously, an entity captured by the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked). In our experience, the 50 percent analysis is the step most exporters underweight. The question is not only who signs the purchase order but who owns the buyer, at every layer of its corporate structure.

Advanced computing exports add a second dimension. The technology itself may be subject to independent BIS controls under the EAR (Export Administration Regulations) – with its own ECCN classifications, licence requirements, and end-use restrictions – regardless of any OFAC issue. A business that obtains an OFAC-specific licence and then ships without addressing its BIS obligations has replaced one regulatory exposure with another. The conditions attached to an OFAC authorisation do not override, satisfy, or supersede BIS requirements.

As of January 2026, the US regulatory environment for advanced computing exports continues to evolve rapidly. The interaction between OFAC programme conditions and BIS country-group classifications means that an authorisation obtained in one period may need to be reviewed when BIS rules change – even if OFAC's underlying programme has not moved.

What licence conditions on controlled computing exports actually require

An OFAC specific licence for a controlled computing transaction is not a blank permission. It is a bounded authorisation, and every condition in it creates a continuing obligation on the licensee.

In our cross-border practice, the conditions that most often give rise to post-issuance compliance failures fall into four categories. First, delivery verification: the licence specifies who may receive the goods and, in many instances, requires written confirmation of delivery to that named party. Second, end-use reporting: the licensee may be required to obtain and retain documentation from the end-user confirming the actual use of the technology. Third, diversion prohibitions: the licence explicitly prohibits onward transfer to any party not named in the authorisation, and any such transfer requires a separate application. Fourth, record-keeping: five years of records relating to the licensed transaction must be maintained, as required under OFAC's framework.

A breach of any of these conditions is itself a sanctions violation. It does not matter that the original transaction was licensed. OFAC's civil-penalty liability is assessed on a strict basis – knowledge of the underlying breach is not a pre-condition to liability. That is why condition-compliance deserves the same legal attention as the licence application itself, not a lighter treatment once the authorisation has been issued.

A specific licence will also state its duration. That window is not extendable by implication. If a transaction runs beyond it, the licensee must determine whether the authorisation remains valid, whether the underlying facts have changed, or whether a new application is needed. Missing that review point is one of the more common enforcement triggers we see in practice.

How does the OFAC licensing process work for controlled computing?

The OFAC specific-licence process for a controlled computing export proceeds in a defined sequence, though the timeline is not fixed and varies considerably by programme and by the complexity of the end-use case.

The starting point is eligibility: not every computing transaction that is prima facie prohibited is licensable. OFAC's licensing policy differs materially between programmes. Comprehensive territorial programmes may have a more constrained licensing basis than list-based programmes targeting named individuals or entities. Establishing the correct programme, identifying the applicable licensing policy, and framing the application accordingly is work that shapes whether an application is approved or refused – not just how quickly it is processed.

The application itself must set out the parties, the transaction, the technology (described without unnecessary ambiguity), the proposed end-use, the end-user's profile, and the basis on which OFAC is asked to exercise its discretion. A poorly framed application invites a request for additional information, which extends the timeline. It can also generate a public record of the transaction that persists regardless of outcome.

Once filed, OFAC may approve, deny, return for further information, or – for complex matters – refer the application to other agencies. Timelines are measured in weeks to months for straightforward applications and can extend considerably where interagency review or national security considerations arise. We advise clients to treat the licensing period as a live compliance project: the facts stated in the application must remain accurate, and any material change in the transaction, the parties, or the technology should be reported to OFAC and assessed for its effect on the application.

Where a general licence (a standing authorisation that permits a defined category of transactions without a separate application) appears to cover the transaction, the analysis does not end there. General licences carry their own conditions. They are typically subject to reporting requirements, exclusions for named parties or categories, and in some programmes an obligation to retain supporting documentation. Relying on a general licence without a careful reading of its terms is one of the myths we address in this practice area – and the subject of the risk section below.

Cross-border interaction: OFAC, BIS, OFSI, and the EU

A business operating between the United States and a third market for advanced computing products is almost always subject to more than one regulatory regime. The interaction between those regimes is not additive in a simple sense: where two regimes both apply, the stricter prohibition governs. A transaction that an OFAC general licence appears to permit may still be blocked by a BIS licence requirement. A shipment cleared for export from a US perspective may face import restrictions in the EU or a requirement under UK rules that has no OFAC equivalent.

Under BIS and the EAR, advanced computing hardware and software are typically classified with an ECCN (Export Control Classification Number under the US Commerce Control List). The ECCN determines the applicable licence requirements, the available licence exceptions, and the destinations and end-users to which those exceptions apply. Foreign direct product rules can bring foreign-produced items within US jurisdiction where they are the direct product of controlled US technology or software – a reach that has expanded materially in the context of advanced computing. A deemed export – the release of controlled technology to a foreign national within the United States, including through remote access – can trigger licence requirements independently of any physical shipment.

In the UK, OFSI administers financial sanctions under SAMLA and the relevant thematic regulations. The ownership and control test under UK law can catch a non-listed entity that a designated person controls – and "control" is assessed on actual, objective evidence, not merely on formal ownership structure. UK case law distinguishes existing, exercised influence from a theoretical ability to exert it. Where a counterparty has UK-connected shareholders or debt, an OFAC analysis alone does not complete the picture.

The EU position adds a further dimension. EU asset-freeze prohibitions extend to making funds or economic resources available, directly or indirectly, to or for the benefit of listed persons. The EU control test looks at both ownership and the broader question of actual control. For an EU-incorporated exporter supplying controlled computing technology, the EU dual-use rules under the recast Dual-Use Regulation and the relevant Council Regulation on sanctions may both engage, and the EU Blocking Regulation may constrain how an EU operator responds to US compliance requirements in specified circumstances.

We regularly advise on these multi-regime interactions. The practical output of that work is a unified compliance analysis – not a sequential checklist – that identifies the strictest applicable restriction and structures the authorisation strategy around it.

Risk flags in controlled computing export licence conditions

Certain patterns in computing export transactions raise the risk of a condition breach, a licence invalidity, or an enforcement referral. Identifying them early is materially less expensive than addressing them after the fact.

The first risk flag is a mismatch between the named end-user in the licence and the actual recipient. Controlled technology has a way of moving after delivery. Where the buyer is a distributor, a systems integrator, or a value-added reseller, the ultimate end-user may not be the party named in the application. An OFAC specific licence for a named end-user does not authorise diversion to a different recipient, even one that appears commercially uncontroversial.

The second flag is a change in the ownership or control of the buyer between the date of the application and the date of delivery. The 50 percent rule is assessed at the time of the transaction, not only at the time of application. If the buyer is acquired by, or a significant stake passes to, a blocked person during the application period, the licence terms may no longer reflect the legal reality of the transaction. We advise clients to build a verification step into the pre-shipment checklist, not to treat the licence as a fixed authorisation that survives all subsequent changes in the counterparty's structure.

The third flag is reliance on a general licence without confirming that none of its exclusions apply. A general licence that covers a defined category of computing transactions will commonly carve out dealings with named parties, specific destinations, or technology above a certain classification level. The myth that "a general licence covers everything" is persistent in our practice area – and it is wrong. What does the general licence actually say? That is the question to answer before a shipment moves.

The fourth flag is inadequate documentation. Condition-breach enforcement by OFAC frequently turns not on whether the transaction was authorised but on whether the licensee can prove it complied with the conditions. Record-keeping obligations run for five years. That includes not only the licence itself and the transaction record but the delivery confirmations, the end-use certificates, and the communications relevant to the authorisation decision. A firm that cannot produce those records on a regulator's request is in a materially weaker position even where the underlying transaction was lawful.

The fifth flag is a voluntary self-disclosure decision made without legal advice. VSD (voluntary self-disclosure to a regulator) is a recognised mitigating factor in OFAC's Enforcement Guidelines. But the decision to disclose, the timing, and the framing of the disclosure all affect the outcome in ways that a compliance team handling its first potential breach is unlikely to anticipate. Counsel should be involved before the disclosure is made, not after it has been filed.

The common misconception: general licences as a complete solution

The most persistent myth our practice area encounters is that a general licence covering computing-related transactions removes the need for a case-specific review. It does not.

General licences are programme-specific, time-limited in their scope, and typically subject to conditions that mirror those in a specific licence – including end-use restrictions, diversion prohibitions, and reporting requirements. They also contain exclusions. A general licence may exclude dealings with entities on the SDN List, dealings above a specified technology threshold, or dealings involving a named destination or sector. A transaction that falls within those exclusions is not authorised by the general licence and requires a separate specific-licence application.

In our experience, the exclusion that causes the most difficulty in computing exports is the named-party exclusion. A buyer who is not on any list at the time of first screening may be added to the SDN List, the Entity List, or both during the transaction lifecycle. General licence terms that exclude SDN-listed parties do not grandfather transactions already in progress. The exclusion applies at the time of the act, not at the time of the original review.

A second common misconception is that an OFAC authorisation – general or specific – satisfies the BIS licensing requirement for the same transaction. The two regimes operate in parallel. OFAC administers sanctions programmes targeting designated persons and territories. BIS administers export controls targeting controlled items regardless of end-user. A shipment can be fully authorised for OFAC purposes and still require a separate BIS licence. We advise on both. The more common problem is the exporter who obtains one authorisation and assumes it is sufficient.

How Calder & Vance assists with OFAC licence conditions for computing exports

Our licensing and authorisations practice for controlled computing exports covers the full scope of the matter, from initial eligibility assessment through to post-issuance condition compliance.

At the application stage, we assess the governing OFAC programme, confirm the applicable licensing policy, identify the relevant BIS licence requirements and exceptions, and prepare the application. We map the ownership structure of both the applicant and the counterparty to confirm that the 50 percent rule analysis is complete before the application is filed. An application that omits a relevant ownership fact is worse than no application: it generates a record that may be used against the applicant in enforcement.

Where an applicable general licence exists, we review its terms, confirm whether any exclusions apply, and document that analysis. If the transaction is not clearly within the general licence, we advise on whether a specific-licence application is the correct route or whether a no-action letter or other regulatory engagement is preferable.

In a recent matter, a technology manufacturer sought to supply advanced computing hardware to a distributor in a third market. A preliminary screen suggested the transaction might fall within a general licence. On review, we identified that one shareholder of the distributor's parent entity was on a list that triggered a named-party exclusion in the general licence. We prepared and filed a specific-licence application, managed OFAC's information requests, and advised on the interim compliance position while the application was pending. The transaction proceeded within the authorised window.

At the post-issuance stage, we review the licence conditions with the compliance and logistics teams, build the condition-compliance checklist into the transaction close process, and advise on the record-keeping obligations that attach to the authorisation. Where a material change in the transaction arises after the licence has been issued, we assess the effect on the authorisation and advise on whether an amendment or a new application is required.

We also advise on the multi-regime interaction across OFAC, BIS, OFSI, and the EU, so that a controlled computing export does not receive a clean OFAC analysis and an unexamined BIS or UK position. For exporters subject to all three regimes, we structure the advice to identify the strictest applicable restriction and work from that point.

For exporters facing a potential condition breach or a regulator's inquiry, we scope the apparent violation, advise on voluntary self-disclosure, and prepare the penalty defence under OFAC's Enforcement Guidelines. The statute of limitations for civil violations under IEEPA is a long one, as currently in force – verify the current position before relying on it. An early and well-presented disclosure, made with legal advice, consistently produces a more favourable outcome than a late or incomplete one.

For new matters, we offer a fixed-fee eligibility and application-structure review. That assessment confirms the applicable programme and licensing policy, identifies the BIS dimension, flags ownership and control issues, and gives a clear go/no-go recommendation before the application is filed. To discuss your transaction or an existing licence condition, contact Calder & Vance at info@caldervance.com.

Related practices

• Computing licence conditions – OFAC service (advanced) – in-depth support for complex or multi-stage computing authorisation matters
• OFAC vs EU licence conditions for computing exports – comparative analysis of OFAC and EU authorisation regimes for controlled technology
• OFAC vs OFSI licence conditions for computing exports – how the US and UK regimes diverge on computing export authorisations

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.