In April 2023, Seagate Technology, a California-based company with an operating subsidiary in Singapore, agreed to pay $300 million to the Bureau of Industry and Security (BIS) for selling 7.4 million hard drives to Huawei without a license. The drives were not made in the U.S. They were made in China, Malaysia, Singapore and Thailand. But they were produced with U.S.-origin technology and equipment. That was enough for the law to apply.
In August 2024, TE Connectivity paid $5.8 million for shipping cables, printed circuit board connectors and pressure sensors (products classified as EAR99, meaning no special restriction) to Chinese entities linked to hypersonics, military drone and defense electronics programs. Seemingly harmless products. Seemingly commercial destinations. Real consequences.
These cases illustrate a principle that many companies outside the U.S. are unaware of: U.S. export controls do not stop at the country’s borders. They follow products, technology and technical data wherever they are. If your company manufactures, distributes, integrates or reexports products with U.S.-origin components, software or technology, these rules affect you. This guide explains how the two regulatory frameworks, the EAR and the ITAR, work, when they apply to non-U.S. companies and what happens when they are breached. If you first need to understand the other major U.S. regulatory pillar, see our guide to OFAC sanctions.
BOOK A FREE CONSULTATION WITH OUR U.S. EXPORT COMPLIANCE CONSULTANTS.
What are the EAR and the ITAR, and who administers them?
The United States controls exports of products, technology and services through two parallel regulatory frameworks. Both have extraterritorial reach and both impose obligations on companies operating outside the U.S.
The EAR (Export Administration Regulations) are administered by the Bureau of Industry and Security (BIS), part of the Department of Commerce. The ITAR (International Traffic in Arms Regulations) are administered by the Directorate of Defense Trade Controls (DDTC), part of the Department of State. They are separate regimes, with different control lists, different licensing procedures and different consequences. Confusing them is a common and costly mistake.
What does the EAR regulate?
The EAR regulates the export, reexport and transfer of dual-use items and technologies: those with both civilian and military applications. Semiconductors, encryption software, telecommunications equipment, certain chemicals and advanced manufacturing technologies are common examples.
The legal basis of the EAR is the Export Control Reform Act of 2018 (ECRA), codified at 50 U.S.C. § 4801 et seq. Controlled items are classified on the Commerce Control List (CCL) using an alphanumeric code called an ECCN (Export Control Classification Number). Items subject to the EAR that have no specific ECCN are classified as EAR99 and can, in principle, be exported without a license to most destinations. But even EAR99 items require a license if the destination, end user or end use is restricted.
The reach of the EAR is global. The Tri-Seal Compliance Note of March 2024, issued jointly by the Departments of the Treasury, Commerce and Justice, puts it plainly: the law follows the goods. Anyone involved in moving items subject to the EAR must comply with U.S. export controls, wherever they are located. For a detailed look at how the CCL and product classification work, see our article on what the EAR is and how the Commerce Control List works.
What does the ITAR regulate?
The ITAR regulates the export of defense articles, defense services and related technical data. These are items designed specifically for military applications: weapons systems, munitions, military vehicles, guidance systems, military surveillance technology and their components.
Items controlled by the ITAR are listed on the United States Munitions List (USML), organized into 21 categories. The ITAR is more restrictive than the EAR: the default presumption is denial, except for a small group of allies. Any export of a USML article requires prior authorization from the DDTC.
The ITAR does not only control physical items. Sharing technical data about a defense article with a foreign national, even inside the U.S., is a regulated export. This concept, known as a deemed export, has direct implications for companies that hire foreign staff or work with international partners on defense programs. For more on the ITAR and its impact on defense and industrial companies, see what the ITAR is and when it affects defense companies.
What is the practical difference between the EAR and the ITAR for a non-U.S. company?
The difference is not just technical. It determines which agency has jurisdiction over your products, which control list applies, what kind of license you need and what the consequences of non-compliance are.
| Criterion | EAR | ITAR |
|---|---|---|
| Regulator | BIS (Department of Commerce) | DDTC (Department of State) |
| Type of items | Dual-use (civilian + military) | Defense articles |
| Control list | Commerce Control List (CCL) | U.S. Munitions List (USML) |
| Classification | ECCN | USML categories (I-XXI) |
| Extraterritorial reach | Yes (reexports, de minimis, FDPR) | Yes (any USML article, no de minimis threshold) |
| Licensing presumption | Varies by destination and ECCN | Denial by default (except allies) |
| Maximum civil penalty per violation | $374,474 or twice the transaction value | $1,271,078 per violation or twice the transaction value |
| Maximum criminal penalty | 20 years and $1 million | 20 years and $1 million |
The first step for any company is to determine whether its products are subject to the EAR, the ITAR or neither. The procedure is known as the order of review: first check whether the item is on the USML; if it is not, check whether it appears on the CCL; if it is on neither, it is not controlled by these regimes (although other sector-specific controls may apply).
How do U.S. export controls reach companies outside the country?
Most countries limit their export controls to shipments leaving their territory. The U.S. does not. U.S. rules follow products, technology and technical data wherever they are. For a non-U.S. company, this means it can be subject to U.S. export controls without ever having exported from U.S. territory.
There are four main mechanisms through which the EAR reaches operations outside the U.S.
What is a reexport and why does it affect you?
A reexport is the shipment of an item subject to the EAR from one foreign country to another foreign country. A transfer within the same country (in-country transfer) is also regulated when the end user or end use of the item changes.
The principle is simple: a company cannot get around EAR restrictions by shipping a product to a third country so that someone else forwards it to the prohibited destination. The March 2024 Tri-Seal Compliance Note gives a concrete example: an exporter cannot evade the embargo on Iran by shipping an item to a distributor in the United Arab Emirates for onward delivery to an Iranian customer. Under U.S. rules, this is treated as a reexport to Iran, and both the original exporter and the UAE distributor would be liable.
Likewise, a company holding an item subject to the EAR in its inventory cannot ship it on to a third country without checking whether it needs a BIS license, even if the item never passed through the U.S.
What are the de minimis thresholds and when do they apply?
The EAR can apply to products made entirely outside the U.S. if they incorporate controlled U.S.-origin content above a certain percentage of the finished product’s total value.
The general threshold is 25%. If the value of controlled U.S. content exceeds 25% of the total value of the finished product, that product is subject to the EAR. For four destinations, Cuba, Iran, North Korea and Syria, the threshold drops to 10%. The regulatory reference is 15 C.F.R. § 734.4.
In practice, a European manufacturer that assembles electronic equipment with 30% controlled U.S.-origin components must treat that product as subject to the EAR for reexport purposes. It will need to screen destinations, end users and end uses before shipping the product to third countries, and obtain a BIS license if the combination of factors requires one.
What is the Foreign Direct Product Rule (FDPR)?
The Foreign Direct Product Rule (FDPR) is the EAR’s broadest extraterritorial mechanism. It allows products made entirely outside the U.S., with no U.S. components, to become subject to the EAR if they were produced using controlled U.S. technology, software or production equipment.
The Seagate case shows how. Its hard drives were made in plants outside the U.S., but those plants used inspection equipment classified under ECCN 3B992 and U.S.-origin technology classified under ECCN 3E991. BIS determined that this made the hard drives items subject to the EAR under the Huawei-specific FDPR (15 C.F.R. § 734.9). Seagate sold 7.4 million units to Huawei, worth approximately $1.1 billion. The penalty was $300 million, more than twice the estimated net profits from those sales.
The FDPR has expanded significantly since 2020. BIS has applied it to Chinese entities linked to advanced semiconductors, to Russian and Belarusian entities linked to defense, and to certain items destined for Iran. Given how widespread U.S. semiconductor manufacturing equipment is in fabs around the world, these restrictions mean that any semiconductor, wherever it is made, can be subject to the FDPR if it is destined for entities or countries covered by these rules. For a detailed analysis of the FDPR and its implications, see our article on how the FDPR and reexports work.
What is a “deemed export”?
A deemed export occurs when technology or source code controlled by the EAR is released to a foreign national inside the U.S. The rules treat that transfer of knowledge as an export to the person’s country of nationality. Similarly, a deemed reexport occurs when such a release takes place outside the U.S. to a national of a country other than the one where the release occurs.
This directly affects hiring decisions, facility access and the management of technical information. If a U.S. company hires an engineer of Iranian nationality and gives them access to software controlled under a specific ECCN, it needs a BIS license for that release, even if the engineer physically works in an office in Silicon Valley.
For non-U.S. companies, deemed exports matter when they send staff to U.S. subsidiaries or partners that handle controlled technology, or when they receive technical training on items subject to the EAR or the ITAR. Deemed reexports matter when technology is released to third-country nationals outside the U.S.
Which products need an export license and how are they classified?
Determining whether a product needs a license is a three-step process: classify the product, identify the destination, and screen the end user and end use. The combination of these three factors determines whether the export, reexport or transfer requires prior authorization.
How does ECCN classification on the Commerce Control List work?
Each item subject to the EAR may be assigned an ECCN on the Commerce Control List. The ECCN is a five-character alphanumeric code that identifies the product category, product group and reason for control. For example, ECCN 3A001 covers certain integrated circuits controlled for national security reasons.
The CCL is organized into 10 categories (from nuclear materials to electronics, including computers, telecommunications, information security and navigation) and 5 product groups (systems, equipment and components; test, inspection and production equipment; materials; software; and technology). Items that are subject to the EAR but have no ECCN are classified as EAR99. Most commercial products are EAR99 and can be exported freely to most destinations. But EAR99 does not mean exempt: if the end user is on the Entity List or the end use is military in a restricted country, a license is required.
For companies handling dual-use technology, ECCN classification is the first operational step. You can ask BIS for a commodity classification (CCATS) when the classification is not obvious. You will find a full guide to this process in our article on dual-use technology and ECCN classification.
When is a BIS or DDTC license mandatory?
Under the EAR, the need for a license depends on the combination of three elements: the item’s classification (ECCN or EAR99), the destination country and the end user and end use. BIS maintains several restricted party lists that must be checked before any transaction:
- Entity List: entities determined to be acting contrary to U.S. national security or foreign policy interests. In 2024, BIS added more than 340 entities from China, Russia, Iran and other countries. For the first time, it even listed 16 physical addresses in Hong Kong and Turkey that housed hundreds of shell companies.
- Denied Persons List: persons and entities whose export privileges have been denied or suspended.
- Unverified List: entities whose bona fides as export recipients could not be verified.
- Military End User List (MEU): entities linked to military activities in certain countries.
Under the ITAR, the presumption is more restrictive: any export of a USML article requires a DDTC license, unless a specific exemption applies. ITAR exemptions are narrower than EAR license exceptions and apply mainly to NATO allies and a small group of strategic partners.
In September 2025, BIS also published the 50% ownership rule (Affiliates Rule): Entity List and MEU restrictions, and certain SDN designations, automatically extend to any entity owned 50% or more, directly or indirectly, by a listed entity. The rule was suspended for one year shortly after publication, and it is expected to take effect again in November 2026. For details on the licensing process, see our article on BIS export licenses: when they are required.
What are the consequences of breaching U.S. export controls?
EAR and ITAR violations can lead to civil, criminal and administrative penalties. All three can apply at the same time, and they affect both companies and responsible individuals, wherever they are located.
What civil and criminal penalties does BIS impose?
Under the ECRA (Export Control Reform Act), penalties for EAR violations are:
- Civil penalties: up to $374,474 per violation (inflation-adjusted figure in effect since January 2025; there was no adjustment in 2026), or twice the value of the transaction, whichever is greater.
- Criminal penalties: up to 20 years in prison and $1 million per violation for willful violations under 50 U.S.C. § 4819(b).
- Temporary Denial Orders (TDOs): BIS can suspend a company’s export privileges, which means it is barred from exporting, receiving or taking part in any transaction subject to the EAR. A TDO can immediately halt a company’s international business.
Under the ITAR, civil fines can reach $1,271,078 per violation. Criminal penalties are the same as under the EAR: up to 20 years and $1 million.
A significant change since September 2024: BIS now treats a company’s deliberate decision not to file a voluntary self-disclosure (VSD) after discovering a significant violation as an aggravating factor. A VSD remains the main mitigating factor. But not disclosing what you know has become an additional risk.
Real enforcement cases against foreign companies
Export control enforcement has escalated significantly since 2022. The following cases show the extraterritorial reach of the rules and the scale of the consequences:
Seagate Technology (U.S./Singapore, $300 million, 2023). Seagate and its Singapore subsidiary sold 7.4 million hard drives made outside the U.S. to Huawei, an entity on the Entity List. BIS applied the FDPR: the drives were made with U.S.-origin technology and equipment. After learning of the restrictions, Seagate not only kept selling but also raised Huawei’s credit line above $1 billion and signed an agreement as a “strategic supplier”. The $300 million penalty was the largest in BIS history. It also includes mandatory audits over several years and a denial order suspended for five years.
TE Connectivity (U.S./Hong Kong, $5.8 million, 2024). TE Connectivity exported cables, connectors and sensors, all classified as EAR99, to Chinese entities on the Entity List linked to hypersonics, drone and military electronics programs. The exports were worth only $1.74 million. But the company’s representatives in China concealed the identity of the ultimate recipients, which included state-owned military corporations. The company filed a VSD, which significantly reduced the penalty but did not eliminate it.
Aratos Group (Netherlands/Greece, TDO, 2023). BIS issued a temporary denial order against Aratos Group, a network of defense companies based in the Netherlands and Greece, and its president, for acting as a procurement network for Russian intelligence services. The action is tied to a Department of Justice criminal indictment and was coordinated by the Disruptive Technology Strike Force.
Russian airlines (multiple TDOs, 2022-2024). After Russia’s invasion of Ukraine, BIS imposed sweeping controls on aviation items destined for Russia. Since 2022, it has issued TDOs against multiple airlines, including Nordwind Airlines, Siberian Airlines and Ural Airlines, for operating aircraft with more than 25% controlled U.S. content on flights to and from Russia. BIS has identified 184 aircraft that have violated these controls, including Airbus aircraft with U.S. content above the de minimis threshold.
What should a non-U.S. company do to comply with U.S. export controls?
The March 2024 Tri-Seal Compliance Note, issued jointly by the Departments of the Treasury, Commerce and Justice, contains specific recommendations for foreign companies. They are not generic suggestions. They are the U.S. government’s documented expectations of what diligent conduct looks like.
What does the U.S. government recommend to foreign companies?
The seven Tri-Seal Note recommendations, in operational terms:
- Risk-based compliance program. Develop, implement and regularly update a sanctions and export controls compliance program tailored to the company’s risk profile.
- Internal controls over payments and movement of goods. Put procedures in place to govern financial transactions and shipments involving affiliates, subsidiaries, agents or counterparties. These controls should detect links to sanctioned persons or jurisdictions that can be hidden in complex invoicing structures.
- Screening built into compliance protocols. Make sure that KYC (know-your-customer) information, such as passports, nationalities, countries of residence and registered addresses, and geolocation data feed into screening protocols and are kept up to date.
- Training for subsidiaries and affiliates. Ensure that foreign subsidiaries are trained on U.S. sanctions and export control requirements, can spot red flags and are empowered to escalate and report prohibited conduct to management.
- Immediate action on incidents. When a compliance issue is identified, put compensating controls in place immediately while the root cause is determined and remediated.
- Due diligence in mergers and acquisitions. Identify and implement risk mitigation measures before completing any M&A transaction, especially when the company is expanding quickly or integrating disparate information systems across multiple entities.
- Voluntary self-disclosure. If the company believes it may have violated the rules, file a voluntary self-disclosure with the relevant agency (BIS, OFAC or DDTC). A VSD is the single most powerful mitigating factor in determining penalties.
These recommendations are not a theoretical exercise. BIS assesses whether a compliance program exists, and how good it is, when determining penalties. And the OFAC Framework for Compliance Commitments sets out five essential components every organization should include: management commitment, risk assessment, internal controls, testing and auditing, and training. For a step-by-step guide to designing and implementing a full program, see our guide on how to design an OFAC, EAR and ITAR compliance program.
How do export controls relate to OFAC sanctions?
Export controls (EAR/ITAR) and economic sanctions (OFAC) are complementary but separate regimes. The EAR controls which items can leave (or be reexported or transferred) and where to. OFAC sanctions restrict who you can deal with and which financial transactions are prohibited.
The same item can be subject to both the EAR and OFAC sanctions at once. A company exporting semiconductors to a Russian entity could need a BIS license (because of the item’s ECCN and the destination) and at the same time be violating OFAC sanctions (if the entity is on the SDN List or the sector is embargoed).
The Tri-Seal Note confirms it: the three departments (Commerce, Treasury and Justice) act in coordination. In 2024, the Disruptive Technology Strike Force, co-led by the DOJ and BIS, brought 15 new criminal cases for sanctions and export control violations. Interagency coordination is not rhetoric; it is operational. To understand the sanctions framework, see what OFAC is.
Frequently asked questions about U.S. export controls
Do U.S. export controls apply if my company does not export from the United States?
Yes. The EAR follows the item, not the exporter. If your company reexports items subject to the EAR, makes products with controlled U.S. content above the de minimis thresholds, or uses U.S. technology or equipment in its production process (FDPR), it is subject to U.S. export controls.
What is the difference between the Entity List and OFAC’s SDN List?
The Entity List is a BIS list that imposes export restrictions: shipping items subject to the EAR to a listed entity requires a license (usually with a presumption of denial). OFAC’s SDN List imposes an asset freeze and a full ban on transactions with the designated person or entity. They are different lists, run by different agencies, with different consequences. A diligent company should check both. For more on the SDN List, see our article on the SDN List.
Can I be penalized for exporting a non-U.S. product that uses U.S. components?
Yes, if the value of controlled U.S.-origin content exceeds the applicable de minimis threshold (25% in general, 10% for Cuba, Iran, North Korea and Syria). And under the FDPR, even products with no U.S. components can be subject to the EAR if they were made with controlled U.S. technology or production equipment.
What should I do if I find that my company has violated the EAR or the ITAR?
File a voluntary self-disclosure (VSD) with BIS (for EAR violations) or with the DDTC (for ITAR violations). A VSD is the most important mitigating factor in determining penalties. Since September 2024, BIS treats a deliberate decision not to disclose a known significant violation as an aggravating factor.
Your company may be exposed without knowing it
U.S. export controls are not a distant set of rules that only affect American exporters. They reach any company in the world that manufactures, distributes, integrates or reexports products with U.S.-origin technology, components or software. Not knowing the rules is no excuse for not complying. And the consequences (multimillion-dollar fines, loss of export privileges, criminal liability) are real and documented.
The first step is to find out whether your company is exposed. If you make products with U.S. components, operate in technology or industrial sectors, have suppliers or customers with ties to sensitive jurisdictions, or are part of supply chains that include defense technology, you need to assess your position.
Download the free OFAC/EAR/ITAR risk checklist (in Spanish) to assess whether your company is exposed to U.S. export controls. In a few minutes you will identify the specific risk points in your operations.
If after the assessment you need specialist support, Burke Compliance works exclusively on U.S. sanctions and export control compliance for non-U.S. companies. Contact us for an initial assessment of your exposure.
