Checklist · International Trade

Export Control and Sanctions Compliance: A Practical Checklist

50 U.S.C. §§ 1701

Type: Checklist
Jurisdiction: National
Date: 2024-07-17
Topic: International Trade

Export control and sanctions law reaches far beyond shipping crates: it governs who may read your source code, who may join a video call, and which laptop crosses which border. This checklist walks a compliance program from first principles to operating discipline — determining whether an item is subject to the EAR, the ITAR, or neither; classifying every product, software build, and technology into an ECCN, a USML category, or EAR99; screening every counterparty against live restricted-party lists; running the Country Chart and license-exception analysis; managing deemed exports to foreign-national employees and contractors; locking down cloud repositories, email, and travel laptops; recognizing diversion red flags and the duty to inquire; and handling the blocking, rejecting, 50 Percent Rule, and facilitation questions that OFAC poses. It closes with contract clauses, training, recordkeeping, audit, and the voluntary self-disclosure decision that follows almost every discovered violation. Screening lists and license requirements change constantly — treat every figure here as a framework, not a current answer, and verify against the live rule before you act.

Export Control and Sanctions Compliance: A Practical Checklist

International Trade > Export Controls and Sanctions | Published 17 July 2024 - Updated 8 December 2025 | UpLaw - uplaw.us

Most companies discover export control law the same way: someone gives a foreign-national engineer access to a repository, and a year later a lawyer explains that this was an export. No crate. No customs form. No border. Just a permission bit — and a potential violation of federal law carrying criminal exposure.

Keywords: export controls, EAR, ITAR, OFAC, sanctions compliance, ECCN, EAR99, deemed export, restricted party screening, SDN list, Entity List, license exception, facilitation, voluntary self-disclosure

How to use this checklist

Export controls and sanctions are two distinct regimes that most companies experience as one problem. Export controls (the Export Administration Regulations, 15 C.F.R. Parts 730–774, administered by the Bureau of Industry and Security; and the International Traffic in Arms Regulations, 22 C.F.R. Parts 120–130, administered by the Directorate of Defense Trade Controls) ask what is moving, where it is going, who will use it, and for what. Sanctions (administered by the Treasury Department's Office of Foreign Assets Control under 31 C.F.R. Chapter V and the International Emergency Economic Powers Act, 50 U.S.C. §§ 1701–1708) ask a blunter question: is this person, or this country, off-limits entirely?

The thirteen phases below build a working program in the order a real company should build one. Doctrine lives in the companion Export Controls and Economic Sanctions: A Comprehensive Guide to the EAR, ITAR, and OFAC; the wider trade landscape — customs, tariffs, antidumping — lives in International Trade Law: A Comprehensive Guide to Customs, Tariffs, and Trade Remedies. This document is the operational layer.

A word on agency guidance. Much of the working knowledge in this field lives in BIS FAQs, OFAC FAQs, OFAC's Framework for OFAC Compliance Commitments, and enforcement releases. Treat these as what they are: the agency's stated view, not binding law. They tell you how the regulator will behave, which is enormously useful operationally, and they are the yardstick against which your program will be judged in a penalty analysis. But they do not bind a court. Since Loper Bright Enterprises v. Raimondo, 603 U.S. 369 (2024), which overruled Chevron, courts interpret the governing statutes and regulations independently rather than deferring to an agency's reasonable construction; agency interpretations carry only the persuasive weight their reasoning earns, in the Skidmore sense. The practical upshot for a compliance officer is unchanged — follow the guidance, because the agency writes the first draft of your enforcement outcome — but do not mistake an FAQ for the regulation, and read the regulation.

Our running example. Thistledown Systems is a ninety-person Colorado company that writes radar signal-processing and sensor-fusion software. It sells to commercial drone makers, to a European defense integrator, and to a university lab. Its engineering team includes an H-1B machine-learning engineer who is a citizen of the PRC, and it has just onboarded an independent contractor in Chennai and given her write access to the main GitHub repository. Thistledown has never thought about export controls. It is about to.

Phase 1 — Determine jurisdiction: EAR, ITAR, or neither

[ ] Inventory every product, software build, technical drawing, test dataset, and body of know-how the company possesses or produces.
[ ] For each item, ask whether it is described on the United States Munitions List (22 C.F.R. Part 121). If yes, it is ITAR-controlled and BIS jurisdiction never arises.
[ ] Confirm whether the company is a "manufacturer," "exporter," or "broker" of defense articles — if so, registration with DDTC is mandatory before any export, under 22 C.F.R. Part 122 (and Part 129 for brokering).
[ ] For items not on the USML, determine whether they are "subject to the EAR" under 15 C.F.R. § 734.3 — U.S.-origin items anywhere in the world, items located in the U.S., and certain foreign-made items with U.S. content or produced from U.S. technology.
[ ] Screen out what is genuinely outside both regimes: published information (15 C.F.R. § 734.7), the results of fundamental research (§ 734.8), educational information, and patent applications.
[ ] Where jurisdiction is genuinely ambiguous — the classic dual-use hardware or the defense-adjacent algorithm — file a Commodity Jurisdiction request with DDTC rather than guessing.
[ ] Document the jurisdictional conclusion for every item, with the reasoning and the date.

Why it matters, and the traps

Jurisdiction is the fork in the road, and taking the wrong branch invalidates everything downstream. A company that assumes it is "just EAR" when its product is USML-controlled will apply a license exception that does not exist in its regime, ship under a self-classification that has no legal force, and accumulate ITAR violations at a rate of one per shipment.

Two traps are chronic. First, the ITAR has no de minimis rule. Under the EAR, a foreign-made item with a small enough percentage of controlled U.S. content can escape U.S. jurisdiction (15 C.F.R. § 734.4). Under the ITAR, a U.S.-origin defense article "sees through" the foreign product forever: one ITAR-controlled component makes the whole assembly ITAR-controlled, regardless of proportion. Second, the fundamental research exclusion is narrower than universities believe. It applies to research where the results are ordinarily published and shared broadly; the moment a sponsor imposes publication restrictions or access controls on results, the exclusion evaporates — and the exclusion never covered the underlying equipment used to do the research, only the resulting information.

Thistledown's signal-processing library is dual-use: it processes radar returns, but it was not developed for a military platform and is not described on the USML. It lands under the EAR. That answer would flip if a defense customer funded a variant specifically designed for a fire-control application.

Phase 2 — Classify every item, technology, and software

[ ] Walk the ten categories of the Commerce Control List (Supplement No. 1 to 15 C.F.R. Part 774), matching each item to an Export Control Classification Number (ECCN) — or concluding it is EAR99.
[ ] Classify separately the hardware (product group A), the test/production equipment (B), the materials (C), the software (D), and the technology (E). These are different ECCNs with different rules.
[ ] Record the reasons for control on each ECCN (NS, MT, NP, CB, RS, AT, EI, and so forth) — you will need them in Phase 5.
[ ] Handle encryption on its own track: items with cryptographic functionality are governed by 15 C.F.R. § 742.15 and License Exception ENC (§ 740.17), which have their own classification, self-classification reporting, and notification mechanics.
[ ] Where a classification is close, request a formal commodity classification (CCATS) from BIS rather than living with a defensible-but-untested guess.
[ ] Maintain a classification register: item, ECCN or EAR99, reasons for control, who classified it, when, and on what basis.
[ ] Re-classify on every material product change. A new feature can move an ECCN.

Why it matters, and the traps

"EAR99" is not a synonym for "unregulated." An EAR99 item still cannot go to an embargoed destination, to a party on the Entity List or the SDN List, or to a prohibited end use. Companies that classify everything EAR99 and then stop thinking have not built a program; they have built a defense that collapses at the first Entity List hit.

The subtler trap is the software/technology split. Engineers think of "the product" as the binary they ship. The EAR treats the binary (a "D" ECCN), the source code (usually also "D"), and the technology required for development, production, or use (an "E" ECCN) as three different controlled things, often with different license requirements. A company can be perfectly compliant on the shipped executable and wildly non-compliant on the design documentation sitting in a shared drive.

Thistledown's team classifies the compiled library, the source repository, and the algorithm design notes. Two land in a controlled ECCN; the customer-facing documentation is EAR99. The register now has thirty-one rows and an owner.

Phase 3 — Map destinations, end users, and end uses

[ ] Build a live map of every country you ship to, license into, host data in, or employ people from.
[ ] Identify Country Group E:1/E:2 destinations (comprehensively embargoed or terrorist-supporting) and treat them as hard stops absent a specific license.
[ ] Flag "military end use" and "military end user" destinations and applications under 15 C.F.R. § 744.21 — a control that applies to EAR99 and low-level items and catches companies that assumed classification alone protected them.
[ ] Capture end-use controls for weapons of mass destruction (§ 744.2 nuclear, § 744.3 missile, §§ 744.4–744.6 chemical/biological and U.S.-person activities).
[ ] Distinguish the ultimate consignee from the intermediate consignee, the freight forwarder, and the purchaser. All four must be screened; only one of them will actually use the item.
[ ] Ask, in writing, what the item will be used for — and keep the answer.

Why it matters, and the traps

End-use and end-user controls are where "my item isn't controlled" stops being a defense. Part 744 imposes license requirements based on who is receiving and what they will do, irrespective of ECCN. An EAR99 laptop can require a license if you know it is destined for a nuclear-enrichment program.

The recurring failure is treating the distributor as the customer. A U.S. company sells to a Singapore reseller, ships, and considers the transaction closed. The reseller's actual end user is a listed entity in a third country. The knowledge standard in 15 C.F.R. § 772.1 does not require actual knowledge — awareness of a high probability suffices, and it can be inferred from conscious disregard or willful avoidance. Not asking is not a defense; sometimes it is the violation.

Phase 4 — Restricted-party screening

[ ] Screen against the live consolidated lists — OFAC's Specially Designated Nationals and Blocked Persons (SDN) List and its non-SDN lists; BIS's Entity List (Supplement No. 4 to Part 744), Denied Persons List, Unverified List, and Military End User List; State's Debarred List; and the government-wide exclusions list.
[ ] Screen every party: customer, ultimate consignee, intermediate consignee, freight forwarder, bank, distributor, agent, supplier, contractor, job applicant, investor, and board member.
[ ] Screen at defined trigger points — onboarding, quote, order acceptance, before shipment, before payment, and on any change to the parties.
[ ] Re-screen the entire counterparty database on a schedule (many programs run nightly or weekly) because designations happen without warning and retroactively spoil in-flight transactions.
[ ] Configure fuzzy matching, transliteration variants, and aliases; a pure exact-match screen is a screen designed to pass.
[ ] Write a documented hit-resolution procedure: who reviews a possible match, what evidence clears it, who escalates, and where the record lives.
[ ] Log every screen — party, list version, date, result, resolver. A screen you cannot prove you ran did not happen.

Why it matters, and the traps

Screening is the single highest-yield control in the program and the one most often implemented as theater. Three traps recur.

Cached lists. The lists change constantly. A vendor feed refreshed monthly means up to thirty days of exposure to designations that already exist. Screen against live data.

Screening once. OFAC liability under IEEPA is, in the civil enforcement posture, effectively strict liability — the government need not prove you knew. A customer you cleared in March and shipped to in June may have been designated in May. The re-screen is not paranoia; it is the control.

Screening only the name on the invoice. Ownership is invisible to a name screen. That is what Phase 9's 50 Percent Rule is for.

Thistledown wires screening into its CRM and its contractor-onboarding flow, so the Chennai contractor is screened before an account is provisioned — not after.

Phase 5 — Apply the Country Chart and identify licenses and exceptions

[ ] Follow the structured decision path in 15 C.F.R. Part 732 ("Steps for using the EAR"). It exists precisely so that no one has to invent an analysis.
[ ] Cross the ECCN's reasons for control against the destination row on the Commerce Country Chart (Supplement No. 1 to Part 738). An "X" in the intersecting cell means license required.
[ ] Check the ten General Prohibitions in 15 C.F.R. § 736.2 — including General Prohibition Ten, which forbids proceeding with a transaction when you know a violation has occurred or is about to.
[ ] If a license is required, work Part 740 for an available license exception — for example LVS (limited value shipments), GBS, TMP (temporary exports and tools of trade), RPL (servicing and replacement), TSU, GOV, BAG, ENC, or STA.
[ ] Confirm the exception's conditions and destination eligibility before relying on it, and record the specific paragraph you relied on.
[ ] Where no exception fits, file for a license and build the lead time into the commercial commitment — not after signature.
[ ] Separately evaluate the de minimis rules (§ 734.4) and the Foreign Direct Product rules (§ 734.9) if any manufacturing happens abroad. Both change frequently and have been expanded aggressively for advanced computing, semiconductors, and specific listed entities — verify the current text every time.

Why it matters, and the traps

The Country Chart looks mechanical and is, right up to the point where someone reads the wrong reason-for-control column. The two failure modes are opposite and equally expensive: assuming a license is required when an exception was plainly available (and losing the deal), or claiming an exception whose conditions you never satisfied (and committing a violation while feeling compliant).

License exceptions are not entitlements. They are conditional permissions with eligibility restrictions, recordkeeping requirements, and, in some cases, notification obligations. "We used TMP" is not a record. "We relied on § 740.9(a)(1) tools-of-trade, for a thirty-day trip, with the laptop under effective control, returning to the U.S., with the following encryption configuration" is a record.

Phase 6 — Deemed exports: foreign nationals in your U.S. workforce

[ ] Understand the rule: releasing controlled technology or source code to a foreign person inside the United States is deemed an export to that person's home country (15 C.F.R. § 734.13(a)(2)). The ITAR's definition of "export" (22 C.F.R. § 120.50) reaches releases of technical data to foreign persons wherever located.
[ ] Identify who is a "U.S. person" for these purposes — citizens, lawful permanent residents, and protected individuals (asylees and refugees). Visa holders, including H-1B and O-1 employees, are foreign persons.
[ ] Determine, for each foreign-person employee and contractor, the country of most recent citizenship or permanent residency — that is the destination the EAR deems the release to reach.
[ ] Run Phase 5's analysis for that person's country and the ECCN of the technology they will touch. If a license is required, apply for a deemed export license before access.
[ ] Build a Technology Control Plan that segregates controlled technology, restricts access by role, and documents who may see what.
[ ] Coordinate with HR and immigration counsel — export control questions surface on immigration forms, and the answers must be true and consistent with your actual controls. See Employment-Based Immigration: A Comprehensive Guide to H-1B, O-1, and EB Visas.
[ ] Do not solve this with a citizenship requirement. Blanket "U.S. citizens only" hiring rules violate the anti-discrimination provision of the Immigration and Nationality Act, 8 U.S.C. § 1324b, which protects lawful permanent residents, asylees, and refugees. DOJ has repeatedly penalized employers who cited export controls as cover for over-broad citizenship screens.

Why it matters, and the traps

This is the phase that catches software companies, and it is the phase our example exists to illustrate. Thistledown's Chennai contractor was granted write access to a repository containing controlled source code. The grant of access was the export — completed the instant the permission took effect, with no shipment, no license, and no record. The PRC-national H-1B engineer in Boulder presents the same problem with a different destination row on the Country Chart and, for some ECCNs, a materially worse answer.

The trap that follows is the overcorrection. Panicked companies write "U.S. persons only" into job postings and then, misunderstanding the term, screen out green-card holders. That is a straightforward § 1324b violation, and it converts an export problem into an employment problem without solving the export problem. The correct instrument is a Technology Control Plan and, where needed, a deemed export license — not a hiring bar. Reflect the actual policy in your handbook rather than an improvised one; see Building a Legally Sound Employee Handbook.

Phase 7 — Control technology and source code: cloud, repositories, email, and travel

[ ] Map where controlled technology actually lives: repositories, ticketing systems, wikis, shared drives, CI/CD pipelines, model weights and training data, backups, and personal laptops.
[ ] Apply access controls at the repository and branch level, not at the org level. "Everyone in engineering" is not a control.
[ ] Evaluate cloud and collaboration tools for foreign-national administrator access and data residency; support engineers at a SaaS vendor can be foreign persons with root.
[ ] Consider end-to-end encryption safe harbors for storage and transmission (15 C.F.R. § 734.18 addresses activities that are not exports, including transmission of properly end-to-end encrypted technology) — but read the conditions precisely; the protection is narrow and key-management-dependent.
[ ] Write a travel policy: clean loaner laptops, no controlled technology in checked bags, encryption compliance in the destination country, and a documented license-exception basis (typically TMP, § 740.9, or BAG, § 740.14).
[ ] Train engineers that pasting a controlled algorithm into a third-party AI assistant, a public forum, or a personal cloud account is a release. Coordinate with the controls in Deploying an AI System: An AI Governance and Risk Checklist.
[ ] Align these controls with your confidentiality program — the same access architecture serves both. See Standing Up a Trade Secret Protection Program: A Practical Checklist and Guarding Trade Secrets Without a Perimeter: Remote Work and the Cloud.

Why it matters, and the traps

The perimeter is gone, and export control law never assumed one. Every SaaS tool, every offshore support contract, every open repository is a potential release channel. The single most common technical violation in the software sector is a repository permission granted by an engineering manager who has never heard the phrase "deemed export."

A distinct trap sits at the intersection with open source. Publicly available, published software is generally outside the EAR under § 734.7 — but publishing controlled encryption source code carries its own notification requirements under § 742.15(b), and the fact that a project is on GitHub does not retroactively decontrol the proprietary code sitting next to it in a private repo. See Open Source Software Compliance: A Practical Checklist.

Phase 8 — Red flags and the duty to inquire

[ ] Post the BIS "Know Your Customer" red flags (Supplement No. 3 to 15 C.F.R. Part 732) where sales staff will see them.
[ ] Treat as red flags: reluctance to identify the end use; a customer whose business is unrelated to the item; delivery to a freight forwarder as final destination; requests to route through a third country adjacent to an embargoed one; abnormal payment terms or cash; a declined installation or service package; packaging inconsistent with the stated destination; a new customer with no web presence.
[ ] Adopt an inquiry protocol: a red flag triggers a documented question, a documented answer, and a documented decision to proceed or stop.
[ ] Never proceed while a red flag is unresolved — General Prohibition Ten (§ 736.2(b)(10)) makes proceeding with knowledge of a probable violation an independent offense.
[ ] Preserve the diligence file. It is the difference between a mistake and willful blindness.

Why it matters, and the traps

The knowledge standard is the hinge of every export enforcement case. Because "knowledge" in 15 C.F.R. § 772.1 includes awareness of a high probability, and because that awareness may be inferred from conscious disregard, the company that sees a red flag and chooses not to ask is in a materially worse position than the company that never saw it. Willful blindness is not a shield; in criminal cases it is the theory of the prosecution. The parallels to corporate criminal exposure generally are direct — see White-Collar Crime and Corporate Criminal Liability: A Comprehensive Guide.

Thistledown gets an order from a "commercial agricultural drone" buyer in a third country whose website went live six weeks ago, who wants no training and no support, and who asks for delivery to a freight forwarder. Every one of those is on the BIS list. Sales wants to ship. Compliance asks — and the deal ends.

Phase 9 — Sanctions: blocking vs. rejecting, the 50 Percent Rule, and facilitation

[ ] Distinguish a blocked transaction (property of an SDN or otherwise blocked person: freeze it, do not return it, and report it to OFAC) from a rejected transaction (prohibited but not involving blockable property: decline it and report it). See 31 C.F.R. §§ 501.603–501.604.
[ ] Apply OFAC's 50 Percent Rule: an entity owned 50 percent or more, directly or indirectly, individually or in the aggregate, by one or more blocked persons is itself blocked — even though its name appears on no list.
[ ] Trace ownership on material counterparties. A name screen cannot find an unnamed subsidiary.
[ ] Understand the difference between comprehensive country programs and list-based programs, and between sectoral and blocking sanctions.
[ ] Check for an applicable general license before assuming a transaction is impossible; apply for a specific license where one is not available.
[ ] Map facilitation risk: a U.S. person may not approve, finance, guarantee, or otherwise facilitate a transaction by a foreign person that the U.S. person could not lawfully do directly (see, e.g., 31 C.F.R. § 560.208 in the Iran program). This catches U.S. executives, U.S. parents, and U.S.-person employees of foreign subsidiaries.
[ ] Instruct U.S.-person employees abroad on recusal mechanics — and confirm that recusal actually removes them from the decision, rather than putting the approval on a different email thread.
[ ] Calendar blocked-property reporting: initial reports to OFAC are due within ten business days of blocking, with periodic reports thereafter.

Why it matters, and the traps

Sanctions punish structure, not intent. The 50 Percent Rule is the classic ambush: a counterparty passes every name screen because the blocked owner sits two layers up and holds 30 percent through one vehicle and 25 percent through another — aggregating to 55 percent and blocking the target. And because civil liability under IEEPA does not require knowledge, "we screened and it was clean" is a mitigation argument, not a defense.

Facilitation is the second ambush, and it is a people problem rather than a product problem. A U.S.-citizen CFO of a foreign subsidiary who signs off on the subsidiary's sale into a sanctioned market has violated U.S. law personally, even though the goods never touched the United States and the subsidiary is foreign. Penalties under 50 U.S.C. § 1705 include substantial civil penalties (a statutory maximum that is inflation-adjusted annually, and which may be measured as twice the value of the transaction) and, for willful violations, criminal fines and imprisonment. Do not quote a dollar figure from memory; look up the current adjusted maximum.

Phase 10 — Contract clauses

[ ] Include an export/sanctions representation and warranty: the counterparty is not a restricted party, is not owned or controlled by one, and will not re-export in violation of U.S. law.
[ ] Require an end-use/end-user certification identifying the ultimate consignee and the actual application, signed by someone with authority.
[ ] Add a no-diversion covenant and a flow-down obligation to the counterparty's own resellers and subcontractors.
[ ] Take audit and information rights sufficient to verify end use — and a termination right triggered by designation, red flag, or breach, exercisable immediately and without penalty.
[ ] Draft a compliance-with-law condition precedent to delivery: no license, no shipment, no breach.
[ ] Allocate license risk explicitly — who bears the cost and delay if BIS denies or sits on the application? Silence defaults badly.
[ ] Sanity-check indemnities and limitation-of-liability caps against regulatory penalty exposure. See The Commercial Contracts Toolkit: Drafting, Reviewing, and Enforcing Business Agreements.
[ ] In NDAs with foreign counterparties, address technical-data release directly — see Building an Enforceable NDA Clause by Clause: A Practical Checklist.

Why it matters, and the traps

Contract clauses do not create compliance; they create evidence of compliance and exits from non-compliance. Their real value is asymmetric: the representation gives you a clean termination right the day a customer is designated, and the end-use certification converts a later diversion from "your failure to inquire" into "their fraud on you." That distinction is worth an enormous amount in a BIS or OFAC penalty analysis.

The trap is the boilerplate export clause — three lines, no certification, no audit right, no termination trigger — pasted into every agreement and relied on by no one. It will not survive the first enforcement conversation.

Phase 11 — Training, written policy, and the empowered official

[ ] Adopt a written export control and sanctions policy approved at the board or senior-executive level. OFAC's Framework for OFAC Compliance Commitments organizes an effective program around five pillars: management commitment, risk assessment, internal controls, testing and auditing, and training.
[ ] Designate an empowered official with real authority to stop a shipment, and a reporting line that does not run through the person whose bonus depends on the shipment.
[ ] Train by role: sales (red flags, end-use questions), engineering (deemed exports, repositories, travel), HR (onboarding screens, § 1324b limits), finance (payment screening, blocked funds), logistics (destination control statements, documentation).
[ ] Train new hires within thirty days; refresh annually; retrain immediately after any incident or regulatory change.
[ ] Keep attendance records and the training deck itself — regulators ask what you taught, not just whether you trained.
[ ] Fold export controls into the broader program described in The Corporate Compliance Toolkit.

Why it matters, and the traps

Every published enforcement resolution in this space says the same thing in different words: the violation happened because a person without training made a decision without escalation. A program's maturity is measured by whether the twenty-six-year-old account executive on a Friday afternoon knows to stop.

The trap is the compliance officer without authority. An empowered official who can be overruled by the VP of Sales is not an empowered official; the title is a document, not a control.

Phase 12 — Recordkeeping and internal audit

[ ] Retain export records for the periods the regulations require: the EAR requires five years from the date of export, reexport, transfer, or the triggering event (15 C.F.R. Part 762); the ITAR requires five years (22 C.F.R. § 122.5).
[ ] Confirm the current OFAC period before setting a retention schedule. Congress extended the statute of limitations for IEEPA-based sanctions violations from five to ten years in 2024, and OFAC moved its recordkeeping requirement to match. Retention that was compliant in 2023 may not be compliant now.
[ ] Retain the whole file: classification analyses, screening logs, license applications and their attachments, license exception justifications, end-use certificates, red-flag inquiries and resolutions, shipping documents, and training records.
[ ] Keep electronic records retrievable — a record you cannot produce on request is functionally a record you do not have.
[ ] Run an annual internal audit against a written scope: sample transactions, re-perform classifications, test the screening tool with known-bad names, verify license-exception conditions were actually met, and check deemed-export access lists against HR data.
[ ] Route audit findings to a remediation tracker with owners and dates, and privilege the sensitive parts of the audit deliberately, with counsel, from the outset.
[ ] Test screening against seeded names. An untested screening tool is an assumption.

Why it matters, and the traps

Recordkeeping is where good programs quietly fail. Retention rules run from the transaction, not the calendar year, and the record set is far broader than the shipping file — the classification memo and the screening log are the records that decide whether an enforcement matter is a technical violation or an egregious one.

The audit trap is scope. An audit that reviews only completed shipments will never find the deemed-export problem, because the deemed export left no shipping document. Audit the access lists.

Phase 13 — When you find a violation: the voluntary self-disclosure decision

[ ] Stop the conduct immediately. Revoke access, halt the shipment, freeze the account. Ongoing violations are aggravating and can convert negligence into knowledge.
[ ] Engage counsel and scope a privileged internal investigation: what happened, how many times, over what period, who knew.
[ ] Preserve documents and issue a litigation hold before anyone "tidies up."
[ ] Quantify: how many transactions, what value, which ECCNs or programs, which countries, which parties.
[ ] Evaluate the voluntary self-disclosure. BIS's procedures are at 15 C.F.R. § 764.5 (initial notification, then a full narrative account, with a defined window to complete the review). DDTC's are at 22 C.F.R. § 127.12. OFAC's Economic Sanctions Enforcement Guidelines (Appendix A to 31 C.F.R. Part 501) treat a qualifying VSD as a substantial mitigating factor that can cut the base civil penalty by half. DOJ's National Security Division maintains a voluntary self-disclosure policy for criminal export and sanctions violations offering a presumption of favorable resolution absent aggravating factors.
[ ] Understand the timing constraint: a disclosure is only "voluntary" if it precedes the government learning of the conduct from another source. Deliberation has a shelf life.
[ ] Weigh non-disclosure honestly. BIS has stated that deliberately choosing not to disclose a significant violation is itself an aggravating factor, and that it will pursue tips about competitors' violations. The calculus that once favored silence has shifted.
[ ] Remediate visibly and describe the remediation in the disclosure — the fix is part of the argument.
[ ] Prepare for the government's follow-on requests. See Responding to a Government Subpoena or Investigation: A Practical Checklist and, where employee conduct is implicated, Conducting a Workplace Investigation: A Practical Checklist.

Why it matters, and the traps

Thistledown's counsel scopes the contractor's repository access: seven months, forty-one commits, full read access to two controlled ECCNs. That is not one export; it is a course of exports. The company terminates access, files an initial notification with BIS, completes the narrative account, hires a compliance manager, deploys a Technology Control Plan, and rebuilds repository permissions from scratch. The eventual resolution is a warning letter rather than a penalty — an outcome that was available only because the disclosure came first.

The traps are three. Delay, which forfeits voluntariness the moment a customs officer, a bank, or a disgruntled ex-employee gets there first. Under-scoping, which produces a disclosure that turns out to be incomplete — the worst possible posture, because it looks like concealment. And fixing nothing, which invites the enforcement agency to write the remediation for you, under a consent agreement, with a monitor.

Common mistakes to avoid

Treating export controls as a shipping problem. The most expensive violations in the software economy involve no physical goods at all — just an access grant.
"We're EAR99, so we're fine." EAR99 items are still barred from embargoed destinations, listed parties, and prohibited end uses.
Classifying the product but not the technology or source code. Three different ECCNs, three different answers.
Screening once, at onboarding. Designations are retroactive to your in-flight orders, not to the day you screened.
Screening only the named counterparty. The 50 Percent Rule blocks entities no list will ever name.
Confusing "U.S. person" with "U.S. citizen." Green-card holders, asylees, and refugees are U.S. persons; excluding them violates 8 U.S.C. § 1324b.
Relying on a license exception without meeting its conditions. The exception is the condition.
Ignoring facilitation. A U.S.-person executive at a foreign subsidiary carries U.S. sanctions law with them.
Missing the red flag on purpose. Willful blindness is the prosecutor's theory, not your defense.
Buying a company without diligencing its trade compliance. Successor liability is real; see Conducting Merger and Acquisition Due Diligence: A Practical Checklist.
Quoting stale penalty figures and stale rules. Civil penalty maxima are inflation-adjusted annually; the Foreign Direct Product and entity-based rules change several times a year.
Deciding not to disclose because disclosure is embarrassing. That is now an aggravating factor.

The consolidated export/sanctions compliance checklist

Foundations

[ ] Jurisdiction determined for every item (ITAR / EAR / neither), in writing
[ ] DDTC registration filed if the company manufactures, exports, or brokers defense articles
[ ] Classification register complete: ECCN or EAR99 for hardware, software, source code, and technology
[ ] Encryption items separately analyzed under § 742.15 and License Exception ENC

Transactions

[ ] Destination, end-user, and end-use captured for every order
[ ] Live restricted-party screening at onboarding, order, shipment, and payment; periodic re-screen
[ ] Hit-resolution procedure written, staffed, and logged
[ ] Country Chart run; license requirement or exception identified and documented by paragraph
[ ] Red-flag inquiry protocol in force; no shipment while a flag is open

People and technology

[ ] Foreign-person roster maintained; deemed-export analysis run for each
[ ] Technology Control Plan implemented; repository and cloud access restricted by role
[ ] Travel policy: loaner laptops, documented exception basis, encryption compliance
[ ] No citizenship-only hiring bar; § 1324b reviewed with employment counsel

Sanctions

[ ] Ownership traced for material counterparties (50 Percent Rule)
[ ] Blocking vs. rejecting procedure written; OFAC reporting calendared
[ ] Facilitation risk mapped for U.S. persons at foreign affiliates

Program

[ ] Board-approved written policy; empowered official with stop authority
[ ] Role-based training delivered and documented
[ ] Export/sanctions reps, end-use certifications, audit and termination rights in every relevant contract
[ ] Retention schedule confirmed against current EAR, ITAR, and OFAC periods
[ ] Annual audit performed; findings tracked to closure
[ ] Escalation and voluntary self-disclosure playbook ready before it is needed

Primary authority

Export Administration Regulations (Bureau of Industry and Security), 15 C.F.R. Parts 730–774

Part 732 — Steps for using the EAR
§ 734.3 — Items subject to the EAR; § 734.4 — de minimis; § 734.7 — published information; § 734.8 — fundamental research; § 734.9 — Foreign Direct Product rules; § 734.13 — definition of "export," including deemed exports; § 734.18 — activities that are not exports
§ 736.2 — the ten General Prohibitions (including General Prohibition Ten)
Part 738 and Supplement No. 1 — the Commerce Country Chart
§ 742.15 — encryption items
Part 740 — license exceptions (including § 740.9 TMP, § 740.14 BAG, § 740.17 ENC, § 740.20 STA)
Part 744 — end-use and end-user controls; § 744.21 military end use/end user; Supplement No. 4 — the Entity List
Supplement No. 3 to Part 732 — BIS "Know Your Customer" guidance and red flags
§ 772.1 — definitions, including "knowledge"
Part 762 — recordkeeping; Part 764 — violations, penalties, and § 764.5 voluntary self-disclosure
Part 774, Supplement No. 1 — the Commerce Control List

Export Control Reform Act of 2018, 50 U.S.C. §§ 4801–4852 (statutory authority for the EAR; penalties at 50 U.S.C. § 4819).

International Traffic in Arms Regulations (Directorate of Defense Trade Controls), 22 C.F.R. Parts 120–130

Part 120 — definitions and commodity jurisdiction; § 120.50 — "export"
Part 121 — the United States Munitions List
Part 122 — registration; § 122.5 — recordkeeping
Part 124 — agreements (TAAs and MLAs); Part 129 — brokering
§ 127.12 — voluntary disclosures

Arms Export Control Act, 22 U.S.C. § 2778 (statutory authority for the ITAR).

Office of Foreign Assets Control, 31 C.F.R. Chapter V

Part 501 — Reporting, Procedures and Penalties Regulations; §§ 501.601–501.604 (recordkeeping, blocked property reports, rejected transaction reports); Appendix A — Economic Sanctions Enforcement Guidelines
Program-specific parts (e.g., 31 C.F.R. Part 560, Iranian Transactions and Sanctions Regulations, including § 560.208 on facilitation)
OFAC, A Framework for OFAC Compliance Commitments (five pillars)
OFAC's 50 Percent Rule guidance on entities owned by blocked persons

International Emergency Economic Powers Act, 50 U.S.C. §§ 1701–1708 (civil and criminal penalties at § 1705; civil maxima are inflation-adjusted annually — verify the current figure).

Immigration and Nationality Act anti-discrimination provision, 8 U.S.C. § 1324b (citizenship-status and national-origin discrimination — the limit on "U.S. citizens only" export screens).

Secondary sources and guidance (persuasive, not binding)

OFAC FAQs and enforcement releases; BIS FAQs, guidance documents, and Don't Let This Happen to You!
DOJ National Security Division voluntary self-disclosure policy for criminal export control and sanctions violations
Note that under Loper Bright Enterprises v. Raimondo, 603 U.S. 369 (2024), courts do not defer to an agency's construction of an ambiguous statute; agency guidance persuades only to the extent of its reasoning. Follow it operationally; do not treat it as the rule of decision.

A standing accuracy warning: the Entity List, the SDN List, the Foreign Direct Product rules, license-exception availability, de minimis thresholds, tariff rates and duty classifications, transaction-reporting and merger-notification thresholds (including HSR), and civil penalty maxima all change frequently — sometimes several times a year, and sometimes on a single day's notice. Every figure, every threshold, and every list reference in this checklist is a framework, not a current answer. Screen against live lists and read the current regulatory text before you act.

Related UpLaw Resources

Related Guides & Articles

Related Checklists

Related Toolkits

This checklist is general legal information from UpLaw (uplaw.us), not legal advice, and does not create an attorney-client relationship. Export control and sanctions rules change frequently — lists, thresholds, and penalty amounts are moving targets — and the analysis is fact-specific. Verify current requirements against the live regulations and lists, and consult qualified trade counsel before acting.