Export controls, sanctions and conflicting regulations

Can a shipment with no US touchpoint still trigger US export controls? Recent enforcement activity shows that it can. Against this backdrop, this digest examines how the US Export Administration Regulations (EAR) can apply beyond US borders and the practical implications for businesses operating across jurisdictions. It also highlights how export controls may intersect with sanctions and other regulatory regimes, creating additional compliance challenges.

Export controls and sanctions are often discussed together, but confusing them may result in businesses miscalculating their exposure:

• Export controls manage and restrict the transfer of sensitive goods, software, technology, and information from one country to foreign entities or foreign nationals. They determine whether an export licence may be required.
• Sanctions focus on whether you can do business with a particular country, organisation, individual, or vessel at all.

The EAR’s reach is not confined to goods physically exported from the US. Under 15 CFR § 734.3. An item may be subject to the EAR if it is located in the US, is of US origin, incorporates controlled US-origin content above the applicable threshold, or is a foreign-made item that falls within one of the EAR’s extraterritorial rules. The foreign-direct product rules can therefore bring certain foreign-made items within US export control jurisdiction even where no US person is involved in the transaction.

This extraterritorial reach means that the place of shipment does not, by itself, determine the applicable export-control obligations. Exporters must therefore assess not only the requirements of the jurisdiction from which the goods are shipped, but also whether the EAR applies. In some cases, a transaction may require authorisation from both the relevant export control authority in the country of export and the US Bureau of Industry and Security (BIS) before the shipment can proceed.

This multi-jurisdictional analysis is particularly relevant in Asia Pacific, where many jurisdictions, including Australia, China, Hong Kong SAR, India, Japan, Malaysia, New Zealand, the Philippines, Singapore, South Korea, Thailand, and Vietnam, have established or implemented operational strategic trade-control frameworks. This list is illustrative rather than exhaustive, and the scope, coverage, and maturity of these regimes vary. For businesses operating across the region, the compliance question is therefore not simply whether one regime applies, but how all potentially applicable regimes interact by jurisdiction.

Violating the EAR requirements, no matter where in the world, can result in significant financial, operational, and reputational consequences. As of 15 January 2025, BIS's maximum administrative penalty for an EAR violation under the Export Control Reform Act of 2018 is US$374,474 per violation or twice the transaction value, whichever is greater, adjusted annually for inflation. Criminal violations carry up to 20 years' imprisonment, up to US$1 million in fines per violation, or both.

The EAR primarily regulates dual-use items: products, software, and technology with legitimate civil applications, as well as terrorism, military, and weapons of mass destruction applications. Common examples include, (a) semiconductors and advanced microchips, (b) encryption and cybersecurity software, and (c) certain chemicals and materials.

The EAR also extends to:

• Any item warranting control that is not exclusively controlled for export, re-export, or transfer (in-country) by any US government agency or otherwise excluded from being subject to the EAR as set out in Part 734.3(b) of the EAR.
• Certain military-related items not controlled under the International Traffic in Arms Regulations (ITAR)
  _{Note: ITAR controls the import and export of defence-related technology, services, and articles.}

Step 1: Determine if your item is subject to the EAR. Refer to the considerations discussed in the previous section and assess whether your product:

• Is a US-origin product;
• Contains controlled US-origin content;
• Was produced using certain US-origin technology, software or equipment; or
• Is in, or being shipped through, the US.

Step 2: Classify the product. Export control classification is a key step in determining the controls that apply to a product and whether a licence may be required.

Every product subject to the EAR is either:

• Listed on the Commerce Control List (CCL) and assigned an Export Control Classification Number (ECCN) — its export control ‘category code’, which sets out whether a licence is needed and for which destinations.
  _{Note: The CCL is a database of goods, software, and technologies that need an export licence from the US government.}
• BIS sets out three ways businesses can determine whether a product is described in an ECCN on the CCL:
  1. Ask the manufacturer, developer, or producer of the product. They are usually the most familiar with the details of the product. However, companies should perform due diligence and verify that the classification provided is correct, or at least likely to be so.
  2. Determine the product’s classification internally. This requires a solid and holistic understanding of the product's technical specifications and how they map against the CCL.
  3. Seek an official classification from BIS. When in doubt, companies can submit an electronic classification request directly to the BIS via the Simplified Network Application Process Redesign (SNAP-R). This creates a documented record of due diligence if the authorities raise questions in the future.
• Not listed on the CCL and designated EAR99. EAR99 items are products that are subject to the EAR but are not specifically listed on the CCL. While many may be exported without a licence, restrictions may still apply.

Step 3: Check the destination, end user, and end use, regardless of classification (i.e., ECCN or EAR99). Consider the following three questions:

• Where is the item being shipped? (destination)
• Who is the target end user? (end-user)
• How will it be used? (end-use)

A licence may be required if the product is:

• Being shipped to a sanctioned or embargoed country
• Being supplied to a prohibited or restricted party
• Intended for military, weapons-related, or other prohibited end-use

Clearing the EAR does not mean clearing sanctions

This three-step EAR check answers one question: whether this product may move to its destination under the EAR. However, EAR compliance is only one part of the analysis. Businesses must also assess whether sanctions apply to the transaction. A shipment can pass every EAR check but still be unlawful if the counterparty is sanctioned, because sanctions generally focus on the parties involved in a transaction rather than on the product itself.

As a matter of good practice, businesses should routinely screen their counterparties against the US Office of Foreign Assets Control (OFAC)'s Specially Designated Nationals List and other applicable sanctions or restricted party lists as part of their broader trade compliance procedures, irrespective of the outcome of any EAR assessment.

As trade restrictions expand globally, compliance challenges increasingly arise from conflicting legal obligations rather than a single country's rules. While trade compliance is often viewed through a US lens, other countries have introduced measures designed to respond to foreign sanctions, export controls, and other restrictions that they consider having extraterritorial effects.

For example, China has introduced a range of countermeasure frameworks aimed at responding to the extraterritorial application of foreign laws and restrictions. In particular, regulations implementing China’s 2025 Anti-Foreign Sanctions Law (AFSL) strengthen asset-freeze and transaction restrictions and allow Chinese parties to seek cessation of infringement and compensation where foreign “discriminatory restrictive measures” are implemented or assisted. As a result, a company that ceases dealing with a Chinese counterparty to comply with foreign sanctions may face legal exposure in China.

As political and trade tensions rise globally, more governments are introducing regulations that restrict who companies can transact and do business with.

For businesses operating across borders, complying with one country's regulations may, in some circumstances, create risk under another's. Businesses should therefore consider the following actions. The actions below are not exhaustive, but they provide a practical starting point for strengthening export control and sanctions compliance.

Immediate priorities

Businesses should first seek to understand their risk exposure by reviewing their products, customers, suppliers, jurisdictions, operating models, and supply chains.

• Map your supply chain end-to-end. Understand how products move from the manufacturer to the ultimate end user and end destination. Assess whether the goods may become subject to the EAR or other export control requirements at any stage of the flow. Businesses should also review whether multiple jurisdictions impose overlapping or conflicting requirements, and consider whether supply chain structures, contractual arrangements, or operating models need to be adjusted to manage these risks effectively.
• A targeted risk assessment or compliance diagnostic can help identify areas where export control or sanctions risks may arise, uncover potential compliance gaps, and highlight activities that warrant closer monitoring. This enables organisations to focus their resources on higher-risk areas while improving awareness of compliance obligations across the business. Where business structures and supply chains are more complex, businesses may also consider engaging external specialists to conduct an independent review and provide additional technical expertise.

Build operational controls

Businesses should establish appropriate processes and controls to ensure compliance with export control requirements in day-to-day operations.

• Adopt the three-step EAR check above as your standard internal checklist for every product, not just new or unusual ones. Where an export control classification is uncertain, or where a manufacturer or producer supplies a classification, consider whether additional internal review or an official BIS classification request is appropriate, rather than relying solely on the classification provided.
• Treat sanctions screening as a separate, mandatory step; never infer sanctions clearance from an EAR classification outcome.

Building long-term resilience

While implementing appropriate export control procedures is an important first step, compliance alone may not resolve the broader challenges arising from today's increasingly complex geopolitical and regulatory landscape. Organisations should look beyond transaction-level compliance and consider whether their supply chains, operating models, governance frameworks, and contractual arrangements remain fit for purpose. Building long-term resilience requires structural changes, greater visibility across the supply chain, and a deeper understanding of regulatory risks across jurisdictions.

• Document and retain your export control assessments and classification decisions. Maintain records supporting your export control classifications, such as formal BIS rulings, manufacturer or supplier information, technical specifications, and internal assessments. A clear audit trail can help demonstrate the basis for your compliance decisions.
• Train the people closest to the paperwork. The case studies above illustrate that export control issues can arise at any stage of the business process, including at an operational level. It is crucial to allocate sufficient resources to export control classification and compliance training for employees involved in day-to-day documentation and shipping processes. It may also be helpful to implement a second-level review to provide additional oversight and reduce the risk of error.
• Review your risk exposure regularly. Compliance obligations can change as business activities, products and markets evolve. Export control and sanctions risks should be reassessed when entering new markets, onboarding new customers or suppliers, handling new products, or when product specifications change.
• Secure visible senior management sponsorship. Building a resilient export control regime requires active support from senior management. Leadership commitment helps foster a culture of compliance, ensures adequate resources are allocated to compliance activities, and raises awareness of export control obligations across the organisation. It also helps embed regulatory risk considerations into broader business strategy, operational decision-making, and supply chain planning.