Export Controls

What export controls actually are

Export controls are laws restricting which goods, software, technology, and technical data can leave a country, and which foreign parties are permitted to receive them. They exist to prevent sensitive technology, particularly anything with military, intelligence, or weapons-proliferation application, from reaching countries, organisations, or individuals a government has determined shouldn’t have access to it. Unlike sanctions, which restrict dealings with a specific person or country broadly, export controls restrict specific categories of items and technology, regardless of who’s on the other end of the transaction, though the two regimes overlap constantly in practice.

The two parallel regimes: EAR vs ITAR

US export control law runs through two entirely separate legal frameworks, administered by different agencies, using different controlled-item lists, and carrying different penalties. The Export Administration Regulations, EAR, are administered by the Commerce Department’s Bureau of Industry and Security, BIS, and cover commercial and dual-use items, goods and technology with both civilian and potential military application. The International Traffic in Arms Regulations, ITAR, are administered by the State Department’s Directorate of Defense Trade Controls, DDTC, and cover defence-specific articles, services, and technical data listed on the US Munitions List, a category the EAR doesn’t touch at all.

How to tell which regime applies: the Order of Review

Determining whether a specific item falls under EAR or ITAR isn’t always obvious from the item alone, which is exactly why a formal classification process, referred to as the Order of Review, exists to resolve jurisdictional questions systematically. As a general rule, if an item appears on the US Munitions List, it’s ITAR-controlled, regardless of how simple or dual-purpose it might seem in isolation. If it doesn’t appear there but has genuine commercial or strategic use, it typically falls under EAR instead. Misclassifying an item, treating a genuinely ITAR-controlled item as if EAR’s lighter requirements applied, is one of the most consequential and common export control compliance failures.

The Commerce Control List and ECCN classification

Items subject to EAR are classified using Export Control Classification Numbers, ECCNs, five-character codes indicating an item’s category, its specific sensitivity, and the underlying policy reasons it’s controlled at all. Exporters cross-reference an item’s ECCN against BIS’s Commerce Country Chart to determine whether a licence is actually required for a specific destination country. This classification structure is genuinely more granular than most sanctions screening, since the same physical item can require a licence for one destination and none at all for another, depending entirely on that destination’s own ECCN-specific restrictions.

EAR99: the catch-all that still isn’t unrestricted

Items not specifically listed elsewhere on the Commerce Control List default to a classification called EAR99. Most EAR99 items don’t require a licence for most destinations, which leads many exporters to treat an EAR99 classification as effectively unrestricted. That’s an incomplete read. EAR99 items still require a licence when the destination is a comprehensively sanctioned or embargoed country, or when the transaction involves a party on one of BIS’s restricted party lists, regardless of how unremarkable the item itself might be.

The four BIS restricted party lists

Beyond item classification, BIS separately maintains four distinct restricted party lists that get confused constantly, including with each other: the Denied Persons List, covering parties whose export privileges have been fully revoked; the Entity List, imposing specific licence requirements on named parties without necessarily prohibiting all dealings with them; the Unverified List, a non-punitive list of parties BIS simply couldn’t verify during a post-shipment check; and the Military End-User List, covering parties BIS has determined support a foreign military’s operations. Each carries a genuinely different legal consequence, and treating “on a BIS list” as one uniform category, the same mistake that recurs across sanctions screening generally, misses which specific restriction actually applies.

Real penalties: EAR vs ITAR compared

The two regimes’ penalty structures differ meaningfully, which is itself a reason getting classification right matters beyond pure compliance principle. ITAR violations can carry penalties of up to $1 million per violation and up to 20 years’ imprisonment, reflecting the defence-sensitive nature of what ITAR covers. EAR violations carry civil penalties of up to $300,000 per violation, or twice the value of the underlying transaction, whichever is greater. Both regimes impose serious consequences, but ITAR’s exposure is substantially higher, another reason correctly determining which regime actually governs a given item isn’t a purely academic classification exercise.

Dual-use goods: the core EAR concept

Dual-use goods are items with both legitimate civilian application and potential military or weapons-proliferation use, GPS systems, high-performance computing hardware, certain chemicals, and advanced sensors are commonly cited examples. This dual character is precisely why EAR exists as a separate, more nuanced regime than a simple ban: the same GPS chip sold into a consumer navigation device and sold to a foreign military’s targeting system is the identical physical item, and export control law has to account for that ambiguity rather than treating every unit identically regardless of end use.

Where export controls intersect with sanctions

Export controls and sanctions screening overlap heavily but aren’t the same discipline, and a firm screening only against OFAC’s SDN List has a genuine gap. A transaction can clear standard sanctions screening entirely, no SDN match, no embargoed country involved, and still violate export control law because the specific item requires a licence for that destination or that end-user under EAR or ITAR independently. Comprehensive trade compliance requires checking both dimensions: who the counterparty is, and separately, what the item actually is and where it’s actually going.

Real consequence: misclassification risk

Misclassification, exporting an item as if it were EAR-controlled when it actually belongs under ITAR’s stricter regime, or failing to recognise that an EAR99 item still needs a licence for a specific restricted destination, is a recurring, genuinely costly failure pattern. It’s frequently not a deliberate evasion attempt at all, but a company genuinely misjudging where an item sits on a classification system with real technical nuance, which is exactly why export-heavy businesses typically maintain dedicated classification expertise rather than treating it as a routine administrative task.

Building export control screening into compliance

A trade compliance programme that properly accounts for export controls screens on two independent dimensions simultaneously: the counterparty, against sanctions lists and all four BIS restricted party lists, not just the SDN List, and the item itself, correctly classified under either EAR’s ECCN system or ITAR’s Munitions List categories, checked against the specific destination country’s own requirements. Firms handling genuinely dual-use or defence-adjacent products need classification expertise built into the process from the design stage, not applied retroactively once a shipment is already being prepared.

Frequently asked questions

Read more: our ultimate guides, whitepapers and templates

Related guides and resources to help you act on what you just read.