Export Controls and Sanctions: Screening a Transaction Before It Proceeds

Screening a cross-border transaction means answering four questions before anything moves: what is the item, where is it going, who is on the other side, and what will it be used for. Get those right and most exports need no license. Get one wrong and the exposure is federal — civil penalties that do not require intent, and criminal liability where there is knowledge. Export controls and sanctions are entirely federal. Separate state rules on public contracting and investment can apply as well, but they run on their own lists and never substitute for the federal check.

Which regime you are actually in

Three federal systems do most of the work, and they answer different questions.

The regimes overlap. A commercial component can be uncontrolled under export rules and still be unlawful to ship because the buyer is sanctioned. A perfectly acceptable buyer can still require a license because of what the item is. The Bureau of Industry and Security and the Office of Foreign Assets Control publish their own current rules and lists, and both change often enough that a cached copy is a liability — programs and designations were being added and amended through mid-2026.

Note: "Export" is broader than shipping. Under the export rules, releasing controlled technology or source code to a foreign national — including an employee, contractor or visiting researcher inside the United States — is generally treated as an export to that person's country. This is often called the deemed export rule, and it makes hiring and lab access a trade-control question.

Question one: what is the item?

Classification comes first because it decides which rules apply at all. Under the export regulations, items are identified by an Export Control Classification Number on the Commerce Control List; items subject to the regulations but not listed are designated EAR99, which is the bulk of ordinary commercial goods.

Classification is a technical exercise, not a guess. A company can determine the classification itself using the list and the regulations, ask the manufacturer, or request a formal ruling from Commerce. Software and technology have classifications too, which surprises firms that think of exports as physical.

• The item's technical specifications, in the terms the control list actually uses.
• Whether encryption is present, since encryption functionality carries its own rules.
• Whether the item is a defense article, which moves it into a different regime entirely.
• Whether the export includes technology, drawings, source code or training, not just hardware.
• Whether a foreign-made item incorporates enough controlled U.S. content to remain subject to U.S. rules.

Questions two and three: where and to whom

Destination and party screening run together in practice. The country chart in the export regulations pairs a classification with a destination to show whether a license is required. Sanctions work differently: they attach to named parties, to whole countries in comprehensive programs, and to sectors.

Party screening means checking every participant, not just the buyer — the consignee, the end user, the freight forwarder, the bank, the intermediate broker, and any individual signing. The International Trade Administration maintains a consolidated view of federal screening lists at trade.gov, which is the practical starting point for a small exporter.

Watch out: Sanctions can reach entities that are not themselves listed. Treasury applies an ownership rule under which entities owned in the aggregate above a stated threshold by blocked persons are themselves treated as blocked, even though they never appear on the list. Screening the name alone is not enough — the beneficial ownership behind it matters, and the threshold and its application are set out in OFAC's own guidance.

Question four: what will it be used for?

Even an unlisted item to an unlisted party can require a license if the end use is one the regulations restrict — certain military, nuclear, missile, chemical or biological applications, and certain military end users in specified countries. These are called catch-all or end-use controls, and they are triggered by knowledge, including knowledge a reasonable exporter should have had.

That last point drives the practical rule: you cannot solve a red flag by not asking. If something about the order does not fit, the obligation is to inquire and resolve it, and to keep the record of having done so.

• A buyer whose stated business has nothing to do with the item ordered.
• An order routed through an unrelated third country for no commercial reason.
• A customer who declines installation, training or routine after-sales service.
• Unusual packaging, labelling or shipping instructions requested by the buyer.
• Payment terms that do not match the customer's stated size or country.
• A refusal to sign an end-use statement or name the ultimate consignee.

Licenses, records and what to do after a mistake

If a license is required, it is applied for through the agency that administers the relevant regime, and shipping before it issues is not an option. Where no license is required, that conclusion still needs to be documented — the file, not the outcome, is what an audit examines.

1. Before quoting

   Classify the item and screen the enquiring party, so a bad transaction never reaches a contract.

2. Before contracting

   Confirm destination and end use, obtain an end-use statement, and add trade-control and re-export representations to the agreement.

3. Before shipping

   Re-screen all parties, because lists change between order and dispatch, and confirm any license is in hand.

4. For the retention period

   Keep the classification analysis, screening results, licenses and shipping documents — the export regulations require records to be kept for five years.

Where something has gone wrong, both Commerce and Treasury operate voluntary self-disclosure processes and treat a genuine, prompt disclosure as a significant mitigating factor. Penalty amounts and mitigation frameworks are set by regulation and adjusted, so the agencies' own current penalty guidance is the only reliable source for figures.

Contract terms carry a lot of this weight. Agreements with foreign distributors and agents should include compliance representations, audit rights and termination triggers — our explainer on independent sales representatives and commission statutes covers the other half of those relationships. Cross-border partnerships need the same screening applied to the partner itself, which our guide to joint venture agreements works through.

Common questions

Our product is ordinary commercial equipment. Do these rules still apply?

Yes. Most commercial goods fall under the export regulations even when no license is needed for a given destination, and sanctions apply to any U.S. person regardless of what is being sold. The classification may well be EAR99 and the shipment may go without authorization, but that is a conclusion you reach by screening, not an assumption you start from.

Does hiring a foreign national trigger export rules?

It can. Giving an employee, contractor or student access to controlled technology or source code is generally treated as an export to their country of nationality, without anything leaving the building. Firms handling controlled technology typically map which roles touch it, build access controls around those systems, and treat authorization as part of onboarding rather than an afterthought.

If we sell through a distributor, is compliance their problem?

Not entirely. The U.S. exporter remains responsible for its own export, and re-export controls can follow the item after it leaves the country. Distribution agreements that work include end-user restrictions, a prohibition on re-export to restricted destinations, screening obligations, record access and a termination right — plus real monitoring, because an unenforced clause carries little weight in an enforcement review.

How often do the sanctions lists actually change?

Frequently, and without warning. Designations, delistings and new programs are issued throughout the year, which is why screening at quotation is not enough on its own. Most exporters re-screen at contract and again immediately before shipment, and many rescreen their customer file on a schedule so that a newly designated long-standing customer is caught rather than discovered later.

Building a screen you can actually run

Write down the four questions and make them a gate in the order process rather than a memo. A screen that lives in someone's judgment will fail on the week they are on holiday.

Assign classification to someone technical and screening to someone in operations, then require both answers before an order is accepted. Keep the resulting file — classification reasoning, screening printouts with dates, end-use statement, license if any — under the export regulations' retention period.

Put trade-control clauses into standard terms rather than negotiating them deal by deal. Train the sales team on red flags, because they see them first and are the group most likely to explain them away.

Finally, keep the source list short and official: SBA for general exporting background, and the administering agencies for the rules themselves. Firms that also hold local operating permissions should confirm nothing in this area conflicts with them — our guide to finding every licensing layer explains how those stack, and companies selling to federal buyers should read our guide to federal contracting registration as well.