White Papers

Eight Steps for Export Compliance

DS_LemonBrokerThere are many criminal prosecutions against exporters for violations of export controls.  In a recent case, the defendant argued that he was not responsible for failing to comply with export controls because these laws are too complex to understand.  The court disagreed and affirmed the conviction.  But it recognized that “putting together the pieces of this regulatory puzzle is not easy.”[1]

Faced with the daunting complexity of export controls, some companies limit the availability of their products abroad or decide to forgo international opportunities entirely.  At their own peril, other companies enter foreign markets without knowledge or any care of export controls.

Eliminating market access without a full understanding of the law is hasty and unwise.  Similarly, failing to assess applicable laws before entering foreign markets risks heavy fines, lengthy terms of imprisonment, and other penalties. While export controls are indeed complex, assessing eight preliminary steps to compliance is the proper approach.

Summary of U.S. Export Controls

Export controls promote U.S. national security interests and foreign policy, often at the cost of private enterprise.  They restrict exports from the U.S. and re-exports from one foreign location to another of U.S. origin commodities, software, and technology (collectively referred to as “items”).  Export controls also restrict the provision of certain services to foreign persons and to foreign destinations.  They require licenses and other forms of advance approval, the submission of certain applications, forms of agreements, reports on activities, and the maintenance of these and other types of records related to exporting and related activities.

The scope of items and services restricted by export controls is very broad, complex, and constantly changing.  Some of the controls come as no surprise.  For example, the implementing regulations restrict exports of military items, temporary imports of military items, exports of nuclear materials and technology, and activities by U.S. persons related to the proliferation of nuclear, chemical, and biological weapons, missile technology, and maritime nuclear propulsion systems.  They also restrict activities of U.S. and foreign persons involved in brokering military items and services related to military items.

In perhaps their clearest restrictions, export controls require adherence to various U.S. Government lists of prohibited parties.  These are blacklists with names and addresses of narcotics traffickers, weapons proliferators, known and suspected terrorists, members of oppressive regimes, known and suspected violators of export control regulations, and other bad guys with whom dealings are severely restricted and, in most cases, altogether prohibited.

Nevertheless, many of the regulations are surprising because they restrict exports of not just military items, but also restrict exports of a broad scope of commercial items, to include certain off-the-shelf valves, gauges, electronics, computers, optics, sensors, software, and other items of a seemingly commercial nature.  Items do not have to be solely of U.S. origin to be subject to control.  In fact, among their most surprising aspects, export controls apply not only to exports of items from the U.S., but they also apply to exports from foreign countries that involve foreign-produced items containing more than a de minimis amount of U.S. origin content; and they can apply to foreign produced items that incorporate U.S. technology or software.

Definitions for what constitute “exports” and other key terms under the regulations are very broad.  An export means sending an export-controlled item (or items) outside the U.S., shipping or electronically transmitting export-controlled information to a foreign location, or disclosing export-controlled information inside or outside the U.S. to a foreign national in any manner.  Accordingly, there are many actions that are considered exports.

Disclosures of export-controlled information to foreign nationals can occur visually, orally, or through the application of personal knowledge or technical experience.  For instance, showing blueprints to a foreign national or allowing a foreign national to simply see a production line at a manufacturing plant in the U.S. would be considered an export to the foreign national’s country of nationality if the viewing reveals technical information.  Similarly, disclosures of this information by electronic mail, in-person at meetings, or on the telephone also constitute exports regardless of whether the foreign national was in the U.S. or in a foreign country when they receive the information.  In one of the definition’s broadest applications, an export can be found by merely making controlled information available to a foreign person on a computer network.

The Regulations and Agencies

Many statutes and regulations address export controls.  These include those safeguarding national security and the various trade sanctions that form an integral part of U.S. foreign policy.  Of all these, the three primary U.S. export control regulations most commonly encountered in everyday trade are the International Traffic in Arms Regulations (“ITAR”), administered by the Department of State Directorate of Defense Trade Controls; the Export Administration Regulations (“EAR”), administered by the Department of Commerce Bureau of Industry and Security; and the Foreign Assets Control Regulations administered by the Department of Treasury Office of Financial Assets Control.  Other regulations may apply to a particular export or service.  These include the regulations administered by the Department of Energy, the Nuclear Regulatory Commission, the Food and Drug Administration, and the U.S. Patent and Trademark Office.

At times, the agencies share overlapping jurisdiction and a license may be required from more than one agency for the same export, service, or other activity.  Also, each agency’s regulations set forth their own prohibitions, requirements, and processes.  At times, this maze of regulatory red tape seems unfair to companies looking to conduct legitimate business abroad.  However, fair or not, Article I Section 8 of the Constitution provides Congress with the power to regulate trade with other countries.  Sanctions for failures to abide by this power are significant.

Violators face seizures of their products by U.S. Customs agents, the loss of export privileges, fines that can skyrocket into millions of dollars, lengthy terms of imprisonment, and other penalties.

These official sanctions, as well as the threat of bad publicity, the loss of clients, and the duty of being a good corporate citizen, are all reasons why an exporter must learn the regulations and comply with them.


ONE:  Learn the Rules

TWO:  Determine Jurisdiction and Classification

THREE:  Register as Required

FOUR:  Screen Each Transaction

SIX:  Make and Keep Records and Reports

SEVEN: Implement a Written Compliance Program

EIGHT:  Monitor Compliance


Learn the Rules

Step One is to learn the rules.  Same as for any other aspect of your business, you must learn and understand the scope of government regulations applicable to your international activities.  Of course, in conducting international trade, this will involve more than just U.S. export control regulations.  Other U.S. laws, such as antiboycott laws, restrictions on financial transactions with prohibited parties, asset blocking statutes, the Foreign Corrupt Practices Act, trade agreements, conventions, and various industry customs and usages will apply to your international trade operations.  In addition, U.S. exporters must ensure that they comply with laws of the foreign country into which they are sending their exports.  These foreign laws often include laws on competition, labeling, taxes, and tariffs of the destination country.


Determine Jurisdiction and Classification

Determining which U.S. Government agency or agencies controls the item or service at issue is critically important.  It is only by following this step that you can confidently assess any licensing and reporting responsibilities.

The items controlled by the Department of Commerce under the EAR are described in the EAR Commerce Control List (“CCL”) – a categorical listing of commodities, technology, and software subject to control.  Most items on the CCL are referred to as “dual use” items because they have both civilian and military applications.  Depending on the items being issued, end destination, end use, and parties involved in a particular transaction, the EAR may require a license for export unless there is an “exception” permitting an unlicensed export.  EAR exceptions come with very specific conditions for their use.

Among other things, the EAR Commerce Control List and other EAR parts also include special restrictions on exports and services involving encryption.  Additional restrictions are found in other parts of the EAR, to include those that apply to the export of surreptitious listening devices, items subject to short supply controls, exports intended for certain military end uses, and prohibited exports and services that support the proliferation of chemical, biological, and nuclear weapons, and the means of their delivery (i.e., missile systems).

If requested, the Department of Commerce will provide written advisement on how something is classified under the EAR.  However, the Department only controls exports not subject to the exclusive control of another agency.  So, before assessing whether your item or service is controlled by the Department of Commerce under the EAR, you must first determine whether it is controlled by the Department of State under the ITAR or subject to exclusive control by regulations administered by another agency.  The complexity of export controls regulations and individual agency practices often make this a gut-wrenching process that is full of potential pitfalls.

The Department of State’s ITAR contains the United States Munitions List (“USML”).  The USML contains a categorical listing of items controlled by the ITAR, known as “defense articles.”  The ITAR also controls certain types of services related to defense articles, known as “defense services.”  It controls the provision of proposals to sell defense articles and defense services to certain prohibited destinations and end users, and it controls the brokering of defense articles and defense services.  The ITAR requires a license or other form of written Department of State authorization as may be stated in the regulations for these exports and activities unless an ITAR license “exemption” applies.  Similar to the EAR license exceptions, each ITAR exemption comes with its own set of very specific conditions for use.

If there is any doubt on which agency exercises control over an item or service, the best approach is to obtain a binding decision in writing from government agencies.  Generally speaking, an agency can only be bound by its own written determination in a form expressly provided by it for that purpose.  For instance, the Department of State is the only U.S. Government agency that can provide a binding written determination on whether something is subject to the ITAR.  The Department does not consider opinions provided by its employees over the telephone or in emails to constitute binding agency determinations.  Instead, it provides a structured mechanism, known as a “Commodity Jurisdiction Procedure,” to use in obtaining a binding written determination on whether ITAR jurisdiction applies.

It is also important to keep in mind the many U.S. trade sanctions programs administered by the Department of Treasury’s Office of Foreign Assets Control (“OFAC”).  Under these regulations, which include comprehensive embargos and limited sanctions programs that are in part incorporated into export controls, U.S. trade sanctions prohibit dealings between U.S. companies and sanction targets.  The sanctions programs can even prohibit dealings between foreign subsidiaries with a sanctions target.  As such, irrespective of an item’s classification, if a prospective export or service will be provided to a person, entity, or country subject to one of the trade sanctions programs administered by OFAC, a license from the Department of Treasury may be required in lieu of or in addition to a license from another agency.


Register as Required

Step Three is to make all requisite registrations.  With very few and narrow exceptions, the Department of State requires all persons and entities involved in the manufacture of defense articles, the export of defense articles, the provision of defense services, or the brokering of defense articles and defense services to register with the Department of State Directorate of Defense Trade Controls.  Similarly, although its registration requirement is more limited in scope, the Department of Commerce requires that persons and entities involved in exports and technical assistance to foreign persons related to certain encryption technology register with the Department of Commerce Bureau of Industry and Security.

Registration with the online license application systems maintained by the agencies is also required to submit license applications and various other requests to the respective agencies.   In addition, registration with the U.S. Census Bureau’s Automated Export System is required to file Electronic Export Information reports.  Such reports must be filed for all physical shipments from the U.S. unless an exception to the Census Bureau filing requirement applies.


Screen Each Transaction

Once you know which set of regulations applies and how your item or service is classified under them, you must screen each transaction to determine whether any licensed or other pre-approval requirements or prohibitions apply.   This is a very fact-specific process that must be completed separately for each and every transaction.

You must answer questions on the who, what, where, and how of each transaction before you begin the screens.  These questions include:

  • What is the precise commodity, technology, software or service being provided?
  • Are all aspects of the item encompassed in the particular classification relied upon?
  • What is the country of final destination and who is the prospective end user of the item?
  • In what countries will the item transit on its way to the final destination?
  • Will the item be offloaded from any vessel prior to reaching its final destination?
  • Who will possess the item while it is in transit?
  • What will be done with the item after it is received?
  • How will the item be used by the final end user?
  • Will there be any reexports of the item?

This information, along with valid names and addresses for all the parties involved, is necessary to screen the transaction against the agency control lists, prohibited end uses, prohibited party lists, and to ensure that no risks of diversion or other situations requiring a license are present.

As part of this process, you must screen the country of final destination, countries of transshipment, and countries of any offloading.  While exports to countries subject to U.S. trade sanctions programs are generally prohibited without a license, exports of many items to other destinations also require a license.  Many items, particularly military and dual use items, often require a license to export to countries that are friendly with the U.S. because of the particular government interest attached to the item or technology.

As noted above, the prohibited end uses include end use in the proliferation of chemical, biological, nuclear weapons, and missile systems anywhere in the world.  End use controls also apply to certain commercial items when exported to specific destinations for a military end use.

You must further screen end users and other parties to the transaction, such as any brokers, shippers, insurers, involved financial institutions, and parties in your supply chain generally, to include suppliers and vendors, to ensure that they are not on any U.S. Government prohibited party lists.  The largest of these is the list of Specially Designated Nationals maintained by the Department of Treasury.  You must screen against this list as well as others depending on the scope of the transaction, to include those maintained by the Department of Commerce, Department of State, and other agencies, such as the Food and Drug Administration, and the General Services Administration.  Depending on the scope of the transaction, the necessary lists may also include those maintained by other countries and international organizations.

If your transaction involves ITAR defense articles or defense services, you must also screen for unlicensed defense article brokers and ensure that all parties to the transaction are properly registered with the Directorate of Defense Trade Controls as required.

Finally, you must screen for risks of diversion to prohibited destinations, diversion to prohibited end users, and diversion for prohibited end uses.  Here, the Department of Commerce provides particularly helpful guidance on how to spot diversion risks.  It refers to this as its “Know Your Customer Guidance,” which is available on its website at http://www.bis.doc.gov.   This guidance contains a list of non-inclusive indicators of diversion such as:

  • The customer is reluctant to offer information about the end use of the item.
  • The capabilities of the item do not fit the buyer’s line of business.
  • The shipping route is not normal for the item or destination.

Many other indicators are also listed.  You may not proceed with an export with knowledge that a violation is about to occur.  So the presence of any of these indicators of diversion (referred to by the Department of Commerce as “red flags”) or similar suspicious circumstances establishes knowledge of a possible diversion risk that must be resolved prior to any export.

You must further watch for changes to the transaction at issue.  The appearance of new parties will require additional screening.  Also, existing parties should be rescreened on a regular basis to keep up with changes to the names contained in the prohibited party lists.


Obtain All Necessary Authorizations

If a license or other form of advance approval is required and the export or service does not qualify for an applicable EAR exception (if the transaction is subject to the EAR) or ITAR exemption (if the transaction is subject to ITAR), you must obtain a license.  Other forms of required advance approval may consist of Department of State approved technical assistance or manufacturing license agreements for defense services, warehousing and distribution agreements, and offshore procurement agreements.


Make and Keep Records and Reports

Step Six requires you to make and keep records and reports of exports.  Written records of an export normally include a collection of documents, such as the air waybill, bill of lading, and others that evidence the items exported, date and mode of transport, and parties to a particular export transaction.

The regulations may also require the completion of other documents such as non-disclosure agreements, non-transfer and use certificates, end use assurances, the provision of specific language on shipping documents (known as a “destination control statement” for the EAR and “retransfer statement” for the ITAR), reports to comply with multilateral treaties and regimes, and completion of Electronic Export Information report filings on the Department of Census Automated Export System.

Once all the paperwork is completed, you must keep copies of all export records for no less than five years from the date of export, reexport, transshipment, termination of the transaction, license expiration, expiration of technical assistance agreement or manufacturing license agreement, or other export related activity that is the last in time.  Regardless of whether stored in electronic or paper format, these records must be accessible, legible, and accurate.

Types of records that must be retained include books of account, export licenses, emails of export-controlled information, Electronic Export Information reports, correspondence with government agencies on international activities, and any other records, to include the those noted above, that relate in any way to exports and services provided to foreign persons and foreign destinations.  You should also maintain records of all due diligence performed relating to transactions.

Keep in mind that you must always maintain and must not destroy records of any matter, regardless of the last date of export activity, which relates to a violation, government investigation, or other official inquiry.  It is also a good practice to retain all records related to international trade for as long as possible in case the need to refute an alleged violation arises.


Implement a Written Compliance Program

Step Seven requires implementation of a written export compliance program.  An export compliance program, carried out in written policies and procedures and supported by regular employee training, is the best way to identify risks, minimize the chance of inadvertent violations, and, when properly implemented and followed, operates as a mitigating factor in agency enforcement actions.

Many of the agencies offer guidance on how to develop compliance policies and procedures.  In fact, the current Department of Commerce compliance program guidelines are over one hundred pages long and quite detailed.  Additional guidance is provided by other sources, to include the U.S. Sentencing Guidelines and a report known as the “Nunn-Wolfowitz Task Force Report on Industry Best Practices Regarding Export Compliance Programs.”  These establish some of the core requirements for any effective export compliance program.  Consistent with them, export compliance programs must be in writing, require performance of all the eight steps described in this article, and further include:

  • A policy, to include a written statement from senior management, establishing a corporate commitment to compliance, backed by policies and procedures that foster a corporate culture of compliance;
  • A means by which employees can report suspected violations to management and a clear statement that employees can report violations without fear of reprisal;
  • A clear delegation of responsibilities for carrying out export compliance functions within the company;
  • A procedure for handling gaps in compliance measures when identified in employee reports, internal assessments, and in regular audits; and
  • Requirements for regular employee training on the program and general procedures utilizing daily checklists, memoranda, announcements, or other means to maintain employee awareness of the regulations, the program, and the need to ensure compliance.

The policies and procedures should contain a sufficient level of detail and be written in plain language that is understood by rank and file employees.  Otherwise, the program is unlikely to serve as a useful tool for compliance.  In the same vain, the program must be something that actually works and sufficient resources must be committed to carry out its requirements.

Keep in mind that these are only some of the minimum requirements and are not offered as an exhaustive list.  There is no one size fits all and you must review the standards and map the approach to compliance best suited to the actual way your company operates and the trade compliance risks it faces.

You must also regularly review and adapt your compliance program to changes in the scope of your company’s international operations and to changes in company technologies; and you will need to update it to timely reflect any changes in the law relevant to your operations.

The prohibited party listings, export control lists and other parts of the regulations are the subject of frequent revisions.  These are necessary to reflect changes in U.S. foreign policy, national security concerns, and other government interests.  At the time of this article, the regulations are also the subject of extensive reform efforts.  These dynamics are important because exporters must work with up-to-date copies of the regulations and prohibited party lists in making license determinations. Accordingly, much like the regulations they address, your company compliance program and any supplemental internal forms should be treated as living documents that are subject to change.


Monitor Compliance

Just having written policies and procedures is a good start, but it is definitely not enough.  Stating the obvious, your company and its employees must follow the written compliance program and document compliance with it.  You should accomplish this through comprehensive record making and recordkeeping, regular internal audits, and audits performed by outside professionals.  Preferably, licensed legal counsel should perform the audits and communicate their findings to your company under the attorney-client privilege.

Regardless of who performs them, the audits should identify any and all compliance gaps.  These must be corrected, and written documentation should create a record of all corrective actions.  Where actual violations of the regulations are discovered, immediate notification should be provided to your company general counsel or in-house legal department and company senior management, to include company board of directors as needed.   Swift action must be taken and proper determinations made as to whether notification to the relevant U.S. Government agencies is appropriate.


In many respects, export controls are just another cost of doing business in today’s global marketplace.  They cannot be ignored.  Responsible exporters must dedicate themselves and fully commit their company to compliance.  They must stay informed of changes to the export control regulations, follow other laws applicable to their international operations, and adjust each compliance step as needed.  While this may all seem very complex, the eight steps described in this article present an organized approach to export controls that can minimize risks and help keep your company’s foreign markets open.


* The above is not intended as an exhaustive list of restrictions that may apply to a particular transaction nor advice for a specific transaction because the specifics of an individual case may implicate application of other U.S. laws as well as foreign laws that carry added or different requirements.  In addition, U.S. export control and sanctions laws are frequently subject to change.  Such changes can affect the continued validity of the information above, which is based on U.S. law existing as of June 3, 2013.  For these reasons, assistance from a qualified attorney competent to advise on such matters is highly recommended.

Matthew A. Goldstein is an International Trade Attorney in Washington D.C. licensed to practice in the District of Columbia and the State of Arizona.  He can be reached at (202) 550-0040 and Matthew@GoldsteinPLLC.com.

[1] U.S. v. ZHI YONG GUO, 634 F.3d 1119, 1122 (Ninth Cir. 2011).