EAR99 Restrictions Most Exporters Miss

Haas Automation paid $2.5M in combined BIS and OFAC penalties in January 2025 for shipping $29,254 worth of CNC machine parts to Entity List parties in China and Russia (BIS.gov, 2025). Read that ratio again. The parts cost less than $30K. The penalty exceeded $2.5M. Every single item was classified EAR99, the designation most exporters treat as a free pass.

Key Takeaways

• EAR99 means "not on the Commerce Control List." It does not mean "no restrictions apply." Entity List, SDN List, end-use, and destination controls can all require a license for EAR99 items (15 CFR Part 744, BIS.gov).
• BIS civil penalties reached $374,474 per violation or twice the transaction value as of January 2025, with criminal penalties up to $1M per violation and 20 years imprisonment (BIS.gov, 2025).
• Since March 2022, hundreds of EAR99 items identified by HTS code require a license for export to Russia and Belarus under Part 746 industry sector sanctions (Federal Register, 87 FR 12856).
• At the March 2025 BIS Update Conference, a BIS official recommended collecting end-use/end-user statements even for EAR99 shipments (Davis Wright Tremaine, 2025).
• The September 2025 Affiliates Rule extends Entity List restrictions to entities 50% or more owned by listed parties, though BIS suspended implementation for one year effective November 10, 2025 (90 FR 47201; Federal Register, November 2025).

The "No License Required" Trap

EAR99 covers items subject to the Export Administration Regulations but not specifically listed on the Commerce Control List. Most companies correctly read the first-order implication: these items generally ship under a "No License Required" designation.

Where the understanding falls apart, and where fines start accumulating, sits in the second-order analysis. NLR status only holds when none of the 10 General Prohibitions in 15 CFR §736.2 are triggered. Several of those prohibitions have nothing to do with what you're shipping. They care about who receives it, what they do with it, and where it ends up.

Consider the Haas case. Gearboxes, magnetic encoder adapters, dual battery replacement kits. Consumer-grade parts for CNC machines already sold to customers in China and Russia. But the buyers had been added to the Entity List for supporting military programs (BIS.gov, 2025). Beihang University, Shandong Institute of Space Electronic Technology, CETC 14. Once a buyer lands on the Entity List under §744.11, even shipping them a replacement bolt requires BIS authorization.

The operational failure wasn't technical. Haas sold through authorized distributors who serviced machines already in the field. Nobody rescreened the end-users after initial sale. Two of the five Chinese transactions actually occurred after Haas knew BIS was investigating their practices.

That's the gap. Ongoing screening, not just at point of sale.

Destination Controls That Override EAR99

Before February 2022, most EAR99 items moved to Russia and Belarus without much regulatory friction. The rules got messier fast after Russia's invasion of Ukraine, when BIS rolled out layered controls under Part 746 targeting EAR99 goods specifically.

The Russian Industry Sector Sanctions (§746.5) added hundreds of HTS-6 codes to Supplement No. 4 to Part 746. Items classified EAR99 that suddenly required a license for any shipment to or within Russia. The initial March 2022 rule covered categories like industrial equipment and electronics. A May 2022 expansion added 205 more HTS codes. Subsequent rules in February 2023 and through 2024 kept widening the net, with BIS adding new supplements (No. 5, 6, and 7 to Part 746) to capture luxury goods, software categories, and additional industrial items.

Indium Corporation learned this the expensive way. Between April 2022 and March 2023, they exported solder preforms, wires, and ribbon to Russia without licenses on 11 occasions. Total value: $96,505. BIS fined them $180,000 in December 2024. The products fell under HTS codes listed in Supplement No. 5 to Part 746, which meant they required authorization despite EAR99 status (BIS.gov, 2024). Red flags in the transaction chain went unaddressed. The Polish freight forwarder even asked Indium to delete Russian phone numbers from shipping documents. All three intermediary parties wound up on OFAC's SDN List within months.

We see this pattern repeatedly across our research: you can't just check the ECCN anymore. For Russia, Belarus, and Iran shipments, you also need to cross-reference HTS codes against Parts 746.5, 746.7, and 746.8. That second lookup barely existed three years ago.

End-Use Controls and the 50% Ownership Question

Even without destination-specific sanctions, EAR99 items face license requirements under the end-use and end-user controls in Part 744. General Prohibition Seven (§736.2(b)(7)) prohibits the export of any item subject to the EAR if the exporter knows the item will support proliferation activities. Part 744 adds specific license requirements for military end uses (§744.21) and Entity List parties (§744.11).

For EAR99 items heading to military end users in China, Russia, Belarus, Burma, Cambodia, Nicaragua, or Venezuela, §744.21 requires a license. Applications get reviewed under a presumption of denial.

One area creating real confusion: the Affiliates Rule. BIS published it in September 2025 (90 FR 47201), establishing that any entity 50% or more owned by an Entity List party inherits the most restrictive license requirements applicable to its parent. This applies to EAR99 items. So a previously clean buyer in a neutral jurisdiction becomes restricted because of a corporate restructuring you may not have visibility into unless your screening catches the ownership chain.

Important caveat: BIS suspended the Affiliates Rule for one year effective November 10, 2025, as part of trade negotiations (Federal Register, November 2025). The rule will reimpose November 10, 2026, absent further extension. During the suspension, the EAR reverts to the prior "legally distinct" standard. But BIS has been explicit that exporters should use this window to build ownership screening procedures, not to ignore the requirement. When it comes back, enforcement will assume you had a year to prepare.

Running names against the SDN isn't enough anymore. You need beneficial ownership data that tracks corporate trees, and you need it refreshed more often than quarterly.

What BIS Said at the March 2025 Conference

At the March 2025 BIS Update Conference on Export Controls and Policy, a BIS official recommended that exporters collect end-use and end-user statements for all EAR-controlled exports, including EAR99 items (Davis Wright Tremaine analysis, April 2025). No rulemaking accompanied it. But anyone who's been through enough audits knows what an informal recommendation from an enforcement agency signals in practice.

The logic tracks with enforcement patterns over the past two years. BIS updated its penalty guidelines in September 2024, eliminating the $125K cap on base penalties for non-egregious violations disclosed voluntarily and tying penalties directly to transaction values. The January 2024 voluntary self-disclosure reforms signaled that BIS wants companies to police themselves.

Collecting end-use statements for EAR99 shipments adds friction. Some customers push back. But for exporters shipping industrial goods to distributors or end-users in sensitive regions like the Gulf, Southeast Asia, or Central Asia, those statements create a paper trail that proves you asked the right questions. If a customer refuses to sign, that refusal itself qualifies as a red flag under BIS Know Your Customer guidance.

Not every EAR99 exporter needs this. If you're shipping consumer packaged goods to Canada, the cost-benefit clearly doesn't justify it. But if your products have any dual-use potential and your customer base includes buyers in regions with diversion risk, the calculus shifts hard.

What Your Screening Program Probably Misses

Most SMB compliance programs built around EAR99 products have three structural gaps that we encounter over and over in our work.

First: rescreening frequency. An entity added to the Entity List today restricts a shipment tomorrow, but many programs only screen at customer onboarding. Haas's violations spanned five years because distributors kept servicing machines for customers who'd been listed mid-relationship. Weekly or event-driven rescreening would have caught at least some of those transactions.

Second: HTS-to-restriction mapping. If your compliance workflow stops at ECCN classification and your items come back EAR99, the analysis often ends there. But for Russia, Belarus, and Iran, the HTS code of that same EAR99 item might trigger a Part 746 license requirement. That lookup requires cross-referencing Supplements 2, 4, 5, 6, and 7 to Part 746. Most manual processes skip it entirely.

Third: ownership screening depth. The Affiliates Rule (once reimposed) means your Entity List check needs to go beyond name matching. Chasing down UBO chains on every transaction isn't realistic manually, but ignoring ownership structures means building risk into every sale. Platforms like Lenzo, Descartes, and SAP GTS can automate portions of this, screening against consolidated lists, mapping HTS codes to destination-specific restrictions, and flagging ownership structures. The question for most mid-market exporters isn't whether to automate but how much manual risk they're willing to carry in the meantime.

FAQ

Can EAR99 items ever require an export license?

Yes. EAR99 items require a license when exported to embargoed destinations (Cuba, North Korea, Iran, Syria, and partially Russia/Belarus), to parties on the Entity List or SDN List, for prohibited end uses like weapons proliferation, or for military end uses in countries specified in §744.21 including China. Specific EAR99 items identified by HTS code in Supplements to Part 746 also require a license when destined for Russia, Belarus, or Iran (15 CFR Parts 744 and 746, BIS.gov).

How often should we rescreen existing customers for EAR99 shipments?

BIS doesn't prescribe a specific frequency, but the Haas case shows what happens with infrequent screening. Entity List additions occur multiple times annually. BIS added entries on at least 12 occasions in 2024 alone. Any screening cadence longer than monthly creates structural exposure. Event-driven screening triggered by new list publications offers the strongest protection.

Does the Affiliates Rule apply to EAR99 items?

Yes, once reimposed. The September 2025 interim final rule (90 FR 47201) extended restrictions to 50%-owned affiliates of Entity List, MEU List, and certain SDN List parties for all items subject to the EAR, including EAR99. BIS suspended implementation in November 2025 for one year but has stated the rule will take effect November 10, 2026. Exporters should use the suspension window to build ownership screening procedures.

EAR99 earned its reputation as the simplest classification in export controls. The enforcement environment around it stopped being simple around February 2022. BIS has made clear through rulemaking, penalty increases, and public statements that "not on the CCL" no longer translates to "low compliance burden." Exporters still treating EAR99 as a shortcut through their screening process are building exactly the kind of gaps that show up in consent agreements and charging letters. Lenzo surfaces HTS-to-restriction mappings alongside Entity List and destination controls in a single view, connecting the dots that manual programs tend to miss.