Affiliate-level restrictions on listed entities under BIS / EAR: legal support

A technology exporter finalises a distribution agreement with a regional partner. Its compliance team screens the partner's name against the Entity List and the Denied Persons List. Nothing flags. The shipment proceeds. Six months later, a routine audit reveals that the distributor is a subsidiary of a group whose parent was added to BIS's restricted-party lists shortly before the deal closed. The exporter had screened the name of the entity it contracted with. It had not screened the affiliate structure behind it. That gap is the precise exposure that affiliate-level restrictions under the EAR (the Export Administration Regulations, administered by the Bureau of Industry and Security) are designed to address – and the one that enforcement actions most commonly exploit.

Under BIS and the EAR, restrictions on a listed entity do not stop at the legal person named on the Entity List or the Denied Persons List. They extend, through affiliate-level rules and the analysis of ownership structures, to entities that share ownership, control, or a significant operational relationship with the named party. As of January 2026, a pending rule – currently scheduled to take effect in November 2026, though its effective date has already shifted once – would formalise ownership-based extension of listed-entity restrictions to affiliates owned 50 percent or more by listed parties. The practical consequence is immediate: a firm that screens only the named counterparty is not screening effectively.

This page explains the legal basis for affiliate-level restrictions under the EAR, how the analysis works in practice, how the US position compares with OFSI and EU approaches, what the common risk failures look like, and how Calder & Vance assists companies that need to close the gap.

What problem does the affiliate-level restriction create for exporters?

The core difficulty is structural: export-control screening tools are built around named legal persons, and affiliate-level restrictions operate at the level of ownership chains and economic relationships that lie behind those names. An exporter that relies on a database flag as its primary control will consistently miss the exposure.

The Entity List identifies specific companies, research institutions, and individuals. A listing triggers a licence requirement – or, in the most serious cases, a presumption of denial – for specified items. The Denied Persons List imposes a harder prohibition: no person subject to the EAR may participate in any transaction with a denied person. Neither list, on its face, names every affiliate. The question is whether the rules, as interpreted and enforced, reach beyond the named entity to its corporate family.

In our experience, this is where compliance programmes most frequently break down. A named entity is identified. The counterparty is a subsidiary or sister company. The compliance team checks the subsidiary's own name, finds no listing, and approves the transaction. What it has not done is map ownership and assess whether the subsidiary sits within the corporate perimeter of the listed group. That omission can convert what appeared to be a clean transaction into an apparent violation – and one that the exporter cannot easily attribute to honest error when the ownership connection was publicly available information.

The problem compounds in joint-venture and distribution structures. A distributor may be locally incorporated, locally managed, and locally branded. It may have no visible connection to a listed parent. Identifying that connection requires affirmative ownership research, not name-matching. Has your compliance programme made that step part of its standard process?

How do affiliate-level restrictions actually work under the EAR?

BIS administers affiliate-level restrictions through a combination of the Entity List and Denied Persons List mechanics, end-use and end-user controls, and – following a rule that is currently scheduled for implementation but has already been postponed once – a formalised ownership-extension standard. The pending rule would treat entities owned 50 percent or more, directly or indirectly and in the aggregate, by an Entity List party as themselves subject to Entity List restrictions, mirroring the structure that OFAC applies to its blocked-person analysis.

Until that rule takes effect, and as currently in force (verify the current position before relying on this), the analysis depends on a combination of factors. BIS has long maintained that the purpose of the Entity List is to prevent listed parties from using affiliates, subsidiaries, and front structures to obtain controlled items indirectly. Enforcement actions reflect that understanding. A transaction structured to route a controlled item through an affiliate of a listed entity, where the practical benefit flows to the listed party, falls within the prohibitions and is treated as facilitation.

Facilitation – a concept the EAR shares with the OFAC sanctions framework – is the mechanism that closes the affiliate gap in current law. A US person who knows or has reason to know that an item will be re-exported, transferred, or otherwise provided to a listed entity facilitates a prohibited transaction, regardless of the legal form of the intermediate step. The affiliate is not the end point of the analysis; the listed entity that ultimately benefits is.

End-use and end-user controls add a parallel layer. Military end-use and end-user restrictions (MEU controls) apply on a destination- and item-specific basis and can catch an affiliate that is itself a military or intelligence-affiliated entity, even where it is not named on any list. In our cross-border practice, MEU exposure is frequently underweighted in affiliate analysis because it requires knowledge of the affiliate's operations, not just its name.

The Foreign Direct Product rules (FDP rules) extend these obligations extraterritorially. Where an item is the direct product of US-controlled technology or software, the EAR can apply to its export or re-export even when the transaction involves no US parties and no US territory. An affiliate of a listed entity located entirely outside the United States can therefore be within scope of the EAR's restrictions on that basis alone, as currently in force.

How does the BIS affiliate analysis compare with OFSI and EU approaches?

The comparison is practically important for any business subject to more than one regime – which, in cross-border trade, is nearly every significant exporter. The regimes share a conceptual goal – preventing listed-party access through affiliated structures – but they reach it by different tests, and the differences change the answer in borderline cases.

Under OFAC's approach, the 50 percent rule is mechanical and ownership-focused. An entity owned 50 percent or more in the aggregate by blocked persons is itself treated as blocked, as a matter of structural rule, regardless of whether it is named. OFAC does not require evidence of control or operational direction; ownership percentage alone is the test. The pending BIS rule would align the Entity List analysis more closely with this model for the specific category of Entity List parties.

Under the UK approach, OFSI (the Office of Financial Sanctions Implementation) applies an ownership and control test that goes beyond a single percentage threshold. A non-listed entity may be caught where a designated person has the ability to exercise control over it, whether through shareholding, voting rights, contractual arrangements, or other means. UK case law has established that control must be actual rather than theoretical – the question is whether the designated person genuinely directs the entity's decisions, not merely whether they could in theory. This is a broader and more fact-intensive test than the OFAC or pending BIS model.

The EU approach follows a similar logic. The asset-freeze prohibitions under Council regulations extend to making funds or economic resources available, directly or indirectly, to or for the benefit of listed persons. The EU ownership criterion for asset-freeze purposes exceeds 50 percent, but the control analysis is broader and turns on objective and sufficiently weighty evidence of actual direction – a standard confirmed by EU court rulings. Critically, the EU also applies its control test to situations where a listed natural person can determine the commercial decisions of a company without necessarily holding a majority stake.

For a business exporting goods subject to both the EAR and EU dual-use controls, both analyses run in parallel. Under EU dual-use rules – currently the recast Dual-Use Regulation – export licensing requirements attach based on the classification of the item and the destination and end-user, and the end-user analysis includes the question of whether the stated end-user is the true end-user or a conduit for a restricted party. Where two regimes both apply, the stricter prohibition governs the conduct of a person subject to both.

For businesses operating across the UK, EU, and US simultaneously, the practical lesson is that the EAR's affiliate analysis does not replace the OFSI or EU ownership and control assessment – it adds to it. A compliance programme that handles only one regime's test while ignoring the others creates a structural gap. We regularly advise on the design of unified affiliate-analysis procedures that satisfy all three regimes within a single review process.

What are the main risk flags in affiliate-level screening under BIS and EAR?

Affiliate-level exposure rarely announces itself. In our experience, the transactions that present the highest risk are precisely those where the affiliate structure is non-obvious, the counterparty is locally branded, and the compliance team has no particular reason to look further. The risk flags set out below are the indicators that should prompt an affirmative ownership investigation rather than reliance on a name-match result.

The first flag is any ownership structure that is incomplete or recent. Where a counterparty's ultimate beneficial owner cannot be verified from public records, or where ownership appears to have changed recently, the omission itself is a signal. Diversion through newly incorporated affiliates is a documented pattern in export-control enforcement.

The second is a distribution arrangement in a jurisdiction that sits on a regularly updated diversion-risk watch list, particularly where the stated end-use is inconsistent with the counterparty's known business activities. A sharp change in trade flows to a transit jurisdiction is treated as a diversion red flag, and where an affiliate structure is part of that picture, the combination creates compounding risk.

Third: any counterparty that references, co-brands, or operationally co-locates with a known listed entity, even without formal ownership linkage, warrants enhanced scrutiny. Co-location and shared management are features of affiliate structures that are designed to obscure the connection; their presence is reason to escalate, not to proceed.

Fourth: re-export or third-party transfer clauses in distribution agreements that do not include an explicit end-user and re-export compliance obligation on the counterparty. Where a distributor is free to on-sell controlled items without restriction, the exporter retains facilitation exposure for any downstream diversion to a listed affiliate.

Fifth: the item's classification. Certain categories of controlled items – advanced computing technology, semiconductor manufacturing equipment, and certain other items on the Commerce Control List – attract heightened attention from BIS and are the subject of targeted enforcement. An affiliate-level control gap in a supply chain for these items is a materially higher-risk position than one involving EAR99-classified goods.

Sixth: the structure of the exporter's own compliance programme. Name screening alone is not a complete control. Sanctions screening obligations attach on a risk basis, and a programme that checks names but does not assess ownership chains, does not refresh ownership data at periodic intervals, and does not require counterparties to notify changes in beneficial ownership does not meet the standard that BIS expects of a diligent exporter. The AUDIENCE_MYTH that name screening alone is sufficient is one of the most persistent and consequential misunderstandings in export-control compliance. We have seen it contribute to apparent violations in situations where the counterparty's connection to a listed entity was, in hindsight, identifiable from publicly available corporate records.

When should you involve a specialist in affiliate-level EAR restrictions?

Specialist involvement is warranted at the point when a standard compliance review identifies a potential affiliate connection that the programme cannot resolve with confidence – and, critically, before a decision is made to proceed.

The scenarios that most frequently require external legal analysis are: (a) a counterparty review that surfaces a connection to a listed entity through an ownership chain of two or more steps; (b) a transaction in which the goods or technology are at the more sensitive end of the Commerce Control List, such that any error in the affiliate analysis carries elevated enforcement risk; (c) a counterparty in a jurisdiction where diversion risk is established and the distribution structure involves intermediate parties; (d) a joint venture with a partner whose full ownership structure cannot be independently verified; and (e) a situation in which the exporter has already shipped and is reassessing whether the affiliate connection that has subsequently come to light constitutes an apparent violation requiring a VSD (voluntary self-disclosure, a recognised mitigating factor in BIS enforcement proceedings).

The decision to make a VSD is not one to take without legal advice. The framing of a VSD, the completeness of the factual record, and the timing of the submission all affect the outcome of the BIS review. A poorly constructed VSD can provide regulators with a more complete account of the violation than they would otherwise have assembled, without securing the mitigation credit that the disclosure was intended to generate.

In a recent matter, a manufacturing group subject to the EAR identified, following an internal audit, that one of its established distributors had been acquired by a conglomerate with a listed affiliate. The group had not been notified of the change in ownership. We were instructed to assess the scope of the apparent violations, advise on the VSD decision, and redesign the group's counterparty-monitoring controls to include periodic ownership verification at defined intervals. The matter proceeded without a referral to criminal enforcement. No outcome is ever guaranteed, but the speed and completeness of the response are consistently material factors in how BIS views a self-reported matter.

How a screening gap surfaces only after a breach – and how to close it

The most damaging feature of affiliate-level exposure is its timing. The gap does not appear when the transaction is being approved; it appears when an audit, a third-party report, or a change in a counterparty's ownership brings the connection to light after the export has already taken place. By that point, the exporter is not managing risk – it is managing a potential violation.

Closing the gap requires a programme design that is affirmative rather than reactive. The elements of an effective affiliate-level control under the EAR are: first, an initial counterparty ownership review at the start of any commercial relationship, covering the full corporate chain to the ultimate beneficial owner; second, a contractual requirement that the counterparty notify the exporter of any change in its ownership or control within a defined period; third, periodic re-screening and re-verification of the ownership structure at intervals calibrated to the risk level of the relationship and the sensitivity of the items being exported; fourth, transaction-level end-user statements for controlled items, updated where the distribution structure changes; and fifth, internal escalation protocols that require legal review before a transaction proceeds where any affiliate connection to a listed entity is identified.

Records should be maintained for the period required under the EAR – five years, as currently in force – and the documentation of each ownership review should be sufficient to demonstrate, in the event of an enforcement inquiry, that the exporter exercised the diligence that the rules require.

The position above covers the standard case. Your facts – the counterparty, the items, the ownership structure, the jurisdictions involved, and any history of prior dealings with the group – change the analysis. If you have identified an affiliate connection and need to determine whether it constitutes an apparent violation, or if you want to redesign your programme before the next audit cycle, contact Calder & Vance at info@caldervance.com.

If a transaction has already proceeded and an affiliate connection has subsequently come to light, an early review is essential. The options available to an exporter narrow with time, and the VSD window – while not subject to a fixed deadline – is practically better used before BIS has opened its own inquiry. Contact us at info@caldervance.com.

Addressing the myth: why name screening alone does not meet the standard

A persistent view in export-control compliance is that running a counterparty's name through a recognised screening database before a transaction is sufficient to satisfy the EAR's due-diligence expectations. That view is incorrect, and acting on it is one of the more reliable ways to accumulate affiliate-level exposure silently.

Screening tools match names and addresses against published lists. They do not map ownership structures. They do not identify that a clean-named subsidiary shares a parent with a listed entity. They do not flag a distributor that was acquired by a restricted group six months after the initial screen was run. And they do not assess whether the beneficial outcome of a transaction flows, through an affiliate, to a listed party.

BIS's enforcement posture reflects this. The agency assesses compliance programmes on a multi-element standard: screening is one element, not a complete programme. The other elements – ownership research, end-user verification, contractual controls, transaction monitoring, and escalation protocols – are not optional additions for sophisticated exporters. They are the baseline for a programme that meets the standard of diligence that the EAR requires of a person who knows or has reason to know the end-use and end-user of their exports.

The practical implication: a compliance programme that cannot answer the question "who ultimately owns our counterparty, and does any part of that ownership chain include a listed party?" is not a programme that will defend an exporter in an enforcement context. Calder & Vance assists companies in building and testing that answer into their standard compliance process. We act for multinationals, financial institutions, and exporters on sanctions and export-control matters across the major regimes.

Related practices

• Aggregating holdings under Canada's sanctions regime – ownership analysis for the Canadian sanctions framework
• Aggregating holdings under EU sanctions – the EU control and ownership test applied to affiliate structures

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.