News and Insights

Burke Compliance

Violations of the U.S. Export Controls’ Foreign Direct Product Rules for Selling to Huawei

Bosch–BIS Settlement: FDPR Violations for Sales to Huawei — Burke Compliance
Table of Contents

Bosch–BIS settlement: 109 FDPR violations for sales to Huawei

On June 17, the U.S. Department of Commerce’s Bureau of Industry and Security (“BIS”) announced a Settlement Agreement with Robert Bosch GmbH (“Bosch”), a German entity, under which Bosch must pay BIS USD 32,583,651 for 109 violations of the Foreign Direct Product Rules (“FDPRs”) of the U.S. Export Administration Regulations (“EAR”). Bosch’s subsidiary BST sold microelectronic sensor products to Huawei Technologies Co., Ltd. and its affiliates (“Huawei”) listed on the BIS Entity List. Bosch’s subsidiary ETAS sold software products to Huawei entities. (See the BIS press release in Document 1 and the Settlement Agreement in Document 2.)

Bosch did not just misread the EAR’s FDPRs. It compounded its misunderstanding by relying for years on flawed analysis by its compliance team. Bosch also ignored multiple red flags raised by counterparties, resulting in a large number of violations over time that could have been avoided had Bosch adopted effective compliance policies and procedures and followed up on the red flags to correct its mistakes.

This case highlights the serious risks of (1) misunderstanding U.S. rules and applying them incorrectly to products and software made outside the United States and (2) devoting insufficient resources to U.S. export control compliance policies and procedures. U.S. export controls can be very complex, especially concepts such as the FDPRs. Non-compliance can have very serious consequences. Access to experts with the experience and knowledge needed to ensure compliance is not optional.

Huawei and a large number of its affiliates were added to the BIS Entity List in May 2019, after the U.S. government determined that Huawei was engaged in activities contrary to U.S. foreign policy and national security interests. The EAR prohibit exports, reexports or transfers of “items subject to the EAR” without a BIS license or other authorization when Entity List parties are party to the transaction. Items subject to the EAR fall into several categories, including U.S.-origin items, items located in the United States, items made outside the United States that incorporate controlled U.S.-origin content above the “de minimis” level and, most relevant in the Bosch case, under several FDPRs, items or software made outside the United States using specified types of U.S.-origin technology or software, or made using equipment that was itself made using specified types of U.S.-origin technology or software.

In 2020, BIS introduced an FDPR specifically to apply a license requirement to items made outside the United States when there is knowledge that a Huawei entity on the Entity List is a party to the transaction, as purchaser, intermediate consignee, ultimate consignee or end user. Items covered by the rule include, among others, hardware and software produced outside the United States using equipment that is itself made with specified types of U.S.-origin technology or software. The FDPRs significantly expand the extraterritorial reach of U.S. export controls.

The FDPRs are complex rules that require deep knowledge and experience of various aspects of the EAR, the technical characteristics of all the items and technologies involved in the transfers, the technology, software and equipment used to make them, and the U.S.-origin technology and software used to make that equipment.

The electronic sensors Bosch sold to Huawei were made in Germany using equipment Bosch bought from various non-U.S. entities. The key point Bosch failed to grasp is that the equipment used to make the sensors sold to Huawei, although made outside the United States, was itself made with U.S.-origin technology or software classified for U.S. export control purposes under classifications (that is, Export Control Classification Numbers or ECCNs) identified in the Huawei FDPR. This made the sensors subject to the EAR and, consequently, subject to the need for a BIS license or other authorization before being shipped to Huawei. Bosch shipped the sensors to Huawei without the required licenses.

Likewise, the software items Bosch sold to Huawei were made using equipment that was itself made with U.S.-origin software or technology specified in the Huawei FDPR. The software was therefore also subject to the EAR and required a license or other authorization before being transferred to Huawei. Bosch did not obtain those licenses and therefore violated the EAR with respect to the software sales.

The documents accompanying the Settlement Agreement published by BIS identify Bosch’s analytical errors, its inadequate compliance procedures and its failure to pay attention to red flags.

  • According to BIS, “Bosch’s U.S. export compliance team did not have sufficient expertise or resources at the time to adequately address the August 2020 changes to the EAR, namely, the FDP Rule that expanded the restrictions for Huawei.” BIS added that Bosch’s failure to implement an effective U.S. export control compliance program for BST and ETAS at the time contributed directly to the violations charged.
  • BIS noted that Bosch’s compliance staff confused the EAR’s De Minimis Rule with the FDPRs. With respect to the BST sensors, a trade compliance employee in Germany advised that “provided your products contain less than 25% U.S. content and the U.S. content used is not classified under one of the following ECCNs…, there is no impact, and no licensing requirements apply.” BIS pointed out that this analysis corresponds to the De Minimis Rule, which is triggered by incorporated U.S.-origin content, and that the FDPRs, which depend on the software, technology and equipment used in production rather than on incorporated content, had not been considered.
  • BIS observed that “the BST Executive accepted this advice and continued to rely on it throughout the relevant period despite numerous subsequent indications that this advice was erroneous.”
  • BIS also explained how Bosch’s compliance staff got the analysis of the software sales to Huawei wrong: “Bosch trade compliance personnel reviewed ETAS’s sales to Huawei in an effort to ensure compliance with U.S. export controls, but they erroneously concluded that the FDP Rule applied only to physical goods and not to software.” This led to the violations relating to the sale of software to Huawei.
  • According to BIS, several of Bosch’s suppliers provided information about the equipment and services they supplied to Bosch that should have alerted Bosch that its FDPR analysis was wrong. However, Bosch ignored it and did not pay due attention to these red flags.
    • An outside semiconductor and testing services provider sent BST a letter explaining the FDPRs and advising that Bosch should assume the equipment used by this service provider triggered the FDPRs. The provider asked Bosch for a certification that no product processed by the provider would be supplied to Huawei. Bosch simply replied that its transactions with the provider complied with the EAR.
    • A Bosch compliance professional in the United States asked Bosch in Germany for information to verify whether the sales to Huawei complied with the EAR. The information was never provided. Had it been, Bosch might have identified the shortcomings under the FDPRs.
    • During supplier onboarding, a prospective supplier stated that no product it provided could be incorporated into the items Bosch sold to Huawei. Bosch decided not to onboard this supplier and continued its Huawei-related business using similar equipment and technologies.

 

On the positive side, according to BIS, once Bosch finally realized that its conduct violated the EAR, it immediately stopped the transactions, retained outside advisors to conduct a review and filed a voluntary self-disclosure with BIS. Bosch also cooperated fully with BIS throughout the investigation, and senior management committed significant resources to remedial measures to prevent future violations of U.S. export controls.

The U.S. Department of Justice (“DoJ”), which is responsible for criminal violations of U.S. export controls, was also involved in this matter. On June 15, it issued a letter summarizing the circumstances of the case and announcing its decision to decline criminal prosecution based on an assessment of the relevant factors, including Bosch’s voluntary self-disclosure to both the DoJ and BIS, Bosch’s cooperation and its remediation, including the addition of 66 employees to its trade compliance organization. This decision was conditional on the prior payment of USD 11,430,098, an amount reflecting Bosch’s pre-tax profits from its sales to Huawei. (See the DoJ letter in Document 3.)

This case is the latest in a long line of reminders that non-U.S. entities, especially those in complex technology sectors, ignore the complexities of U.S. export controls at their peril. U.S. export controls have extensive extraterritorial reach. Any investment in compliance is more than justified given the potentially severe consequences of non-compliance.

Referenced documents

Related service. If this issue affects your company, at Burke Compliance we analyze it as part of our EAR / ITAR export controls service.

If your company operates internationally, in sensitive sectors or markets, or has any nexus to the United States, specialist guidance on U.S. sanctions and export controls is not optional.

REQUEST A CONSULTATION