Export controls catch many companies by surprise, because the question is not only “is this item sensitive?” It is also who is buying, where it is going, and what it will be used for. A common, low-tech item can need a license if the buyer is on a U.S. list. Here are the questions we hear most from exporters and from Chinese and U.S. companies that trade with each other.
Which rules apply?
Most commercial and dual-use items are governed by the Export Administration Regulations (EAR), 15 C.F.R. parts 730–774, administered by the Commerce Department’s Bureau of Industry and Security (BIS). Defense articles fall under the ITAR at the State Department. Sanctions on countries and listed persons are administered by Treasury’s Office of Foreign Assets Control (OFAC). One transaction can involve all three.
What is “subject to the EAR”?
Items in the United States, U.S.-origin items anywhere in the world, and some foreign-made items — for example, those with more than a minimum share of controlled U.S. content, or made with certain U.S. technology or equipment (the foreign direct product rules). Releasing controlled technology or source code to a foreign national inside the U.S. can count as an export to that person’s home country (a “deemed export”).
How do I know whether I need a license?
Work through four questions:
- What is it? Find the item’s Export Control Classification Number (ECCN) on the Commerce Control List, or confirm it is EAR99 (subject to the EAR but not listed).
- Where is it going? Check the ECCN’s reasons for control against the Country Chart for the destination.
- Who will receive it? Screen every party against the restricted-party lists.
- What will it be used for? Some end uses — military, weapons of mass destruction, certain advanced computing and semiconductor uses — require a license even for EAR99 items.
If a license is needed, check whether a license exception applies before applying.
Which lists should I screen against?
At a minimum: BIS’s Entity List, Unverified List, Military End-User List and Denied Persons List, and OFAC’s SDN List. The government’s Consolidated Screening List searches most of them at once. Keep a record of each screening.
What about companies owned by a listed party?
Under OFAC’s long-standing 50 percent rule, an entity owned 50% or more in aggregate by one or more blocked persons is itself blocked, even if it is not named. In September 2025, BIS issued a similar “Affiliates Rule” for the Entity List and Military End-User List. BIS suspended it on November 10, 2025, and in November 2026 extended the suspension through January 10, 2027. While it is suspended, the Entity List generally applies only to the parties actually named. The rule can come back, so check ownership now and watch for BIS announcements.
What are red flags?
BIS lists warning signs in Supplement No. 3 to part 732. Examples: a buyer reluctant to say how the item will be used, a shipping route that makes no commercial sense, an order that does not fit the buyer’s business, or an address that matches a listed party. A red flag creates a duty to investigate before you ship; ignoring it can be treated as knowledge.
What are the penalties?
Under the Export Control Reform Act, administrative penalties can reach the greater of $374,474 per violation (as adjusted for inflation; BIS updates this amount annually) or twice the value of the transaction. BIS can also deny export privileges. Willful violations are crimes punishable by up to $1 million per violation and 20 years in prison (50 U.S.C. §4819). OFAC has its own penalty scheme.
We found a mistake. Should we disclose it?
Often, yes. BIS treats a voluntary self-disclosure filed before it learns of the violation as a significant mitigating factor (15 C.F.R. §764.5), and OFAC has a similar policy. Before disclosing, stop the activity, preserve records, find the scope and the cause, and fix the process. The narrative and the timing matter, so get advice first.
What records must we keep?
Generally five years from the export or other triggering event: commercial invoices, classifications, screening results, licenses and export filings (15 C.F.R. part 762).
What does a reasonable compliance program look like for a small exporter?
- A written classification for each product, reviewed when designs change.
- Screening of every new customer, end user, freight forwarder and bank.
- An end-use statement for higher-risk sales.
- A clear stop-and-ask rule when a red flag appears.
- Training once a year and a short audit of a sample of shipments.
Does this apply to software, cloud services and technical data?
Yes. Sending controlled source code or technology by email, uploading it to a server abroad, or giving a foreign engineer access to a shared drive can be an export. Most mass-market software is lightly controlled, but encryption items have their own rules, and technology for advanced semiconductors and computing is tightly controlled for China and certain other destinations. Cloud providers generally are not the exporter of your data; you are.
What about our employees and visitors from abroad?
Releasing controlled technology to a foreign national in the United States is a “deemed export” to that person’s most recent country of citizenship or permanent residence. Engineering firms, universities and manufacturers with foreign staff should classify their technology, decide who may see what, and apply for licenses where needed before access is given. Green-card holders are treated as U.S. persons for this purpose.
How do OFAC sanctions differ from export controls?
Export controls focus on items and their destination and end use. Sanctions focus on people and places: U.S. persons generally may not deal with anyone on the SDN List or in comprehensively sanctioned regions, whether or not any goods move. A payment, a service or a contract can be a violation on its own. OFAC liability is strict for civil penalties, so even an unknowing violation can be penalized, although good-faith compliance programs reduce penalties.
What does a typical license application involve?
An application through BIS’s online system (SNAP-R) describing the item and its ECCN, all parties to the transaction, the end use, and supporting documents such as end-user statements. Processing times vary from weeks to months, and applications involving China and advanced technology face close review and may be denied. Build that time into delivery schedules.
We sell through distributors. Are we responsible for where the goods go next?
Often, yes. If you know or have reason to know that a distributor will re-export an item to a prohibited destination or end user, you can be liable. Put export-control clauses in distribution agreements, ask for end-user information on sensitive orders, and act on red flags such as unusual order patterns or requests to ship through third countries.
Sources: 15 C.F.R. parts 730–774, including §764.5, part 762 and Supplement No. 3 to part 732; 50 U.S.C. §4819; BIS penalty guidance; BIS final rules suspending the Affiliates Rule (90 Fed. Reg. 50857, Nov. 12, 2025) and extending the suspension (Nov. 2026). As of November 2026.
