Regulatory Compliance: Where US, EU, and UK Export Rules Diverge

On September 29, 2025, BIS published the Affiliates Rule and instantly added thousands of unlisted entities to the US restricted party universe. Thirty-one days later, the EU updated its dual-use control list with unilateral entries that bypassed the Wassenaar Arrangement entirely. Seventeen days after that, the UK adopted equivalent controls under its own legislation. Regulatory compliance across US, EU, and UK export regimes now means tracking three systems that changed their own rules three times in under 90 days with zero coordination between them.

How US Export Controls Differ from EU and UK Frameworks

The US runs two parallel export control systems with no single European equivalent. BIS administers the EAR for dual-use items classified under ECCNs. DDTC administers ITAR for defense articles on the US Munitions List. Both reach outside US borders through Foreign Direct Product rules.

The EU operates one regulatory compliance framework under Regulation 2021/821: one control list in Annex I applied across 27 member states. That list changed in a way it never had before in 2025. The European Commission added items that Russia blocked at the Wassenaar Arrangement by exercising its veto. These "500-series" entries cover advanced chips, semiconductor manufacturing equipment, and cryogenic cooling technologies. First time the EU went unilateral on dual-use controls at this scale. Any exporter still checking only Wassenaar schedules is now missing items that the EU controls independently.

Post-Brexit UK sits between the two systems. Great Britain operates under the Export Control Order 2008 and retained EU regulations, while Northern Ireland remains subject to EU Regulation 2021/821. The ECJU adopted the Export Control (Amendment) (No. 2) Regulations 2025, effective December 16, 2025, mirroring the EU's November update. One-month delay. During that gap, an item controlled in Brussels but not yet in London trips up any multi-market exporter who assumed both lists moved together.

We've seen this assumption blow up repeatedly. The UK moved PL9013, PL9014, and PL9015 entries (semiconductors, quantum, additive manufacturing) from Schedule 3 of the Export Control Order into the assimilated Dual-Use Regulation. Structural change. No EU equivalent exists.

Sanctions List Architecture Across Three Jurisdictions

The US, EU as well as UK each maintain independent sanctions lists that do not synchronize on any fixed schedule and frequently contradict each other on timing. OFAC publishes the SDN List on no set calendar. The EU Consolidated List aggregates Council Regulation designations. UK OFSI's Consolidated List diverged from the EU's on January 1, 2021 and has been drifting further since.

A regulatory compliance management system screening against one list will miss entries on the others. We talk to export managers who assume "sanctions screening" means running names against the SDN. It doesn't. Hasn't for years.

The BIS Affiliates Rule, effective September 29, 2025, broke this open further. Before: the Entity List captured only named entities. Now any company 50% or more owned by a listed party falls under the same restrictions, even if that subsidiary appears nowhere on any published list. The Consolidated Screening List, the free BIS tool most SMBs rely on, carries no ownership data. A regulatory compliance platform that stops at name-matching will miss every one of these affiliates.

The EU has no equivalent affiliate rule for dual-use controls. Council Regulation 833/2014 includes beneficial ownership provisions for asset freezes, but those don't touch dual-use licensing. We've watched an EU exporter clear a dual-use license for a buyer in Q3 2025, then get flagged two weeks later because that same buyer triggered separate EU financial sanctions. Two legal bases, two separate checks, one shipment stuck at the port.

UK OFSI applies a 50% ownership threshold for financial sanctions under the Sanctions and Anti-Money Laundering Act 2018. Criminal penalties for export control breaches reach 10 years imprisonment and unlimited fines under the Customs and Excise Management Act 1979. OFSI fined Colorcon Limited £152,750 in September 2025 for payments to accounts at sanctioned Russian banks. Total amount transferred in breach: £128,277. The penalty exceeded the breach value.

Product Classification Rules That Trip Up Multi-Market Exporters

Regulatory compliance tools built for one jurisdiction break the moment you classify across borders. The US uses ECCNs under the Commerce Control List. The EU uses Wassenaar-derived numbering in Annex I but adds its own parameters plus the new 500-series entries. The UK duplicates most of this structure but maintains distinct national entries with different legal anchoring.

Here's where operations fall apart. An ECCN 3A001.a.1 semiconductor component maps to a similar entry in EU Annex I Category 3, but the US controls that item to more destinations under unilateral restrictions. A shipment cleared for export from Germany to the UAE under an EU General Export Authorisation might still need a BIS license if US-origin technology sits inside the product. EAR de minimis and foreign direct product rules override local EU classifications. We had a client discover this after the goods were already sitting at the freight forwarder. Thirty days of chasing BIS for an answer while the container racked up demurrage.

Timing gaps between jurisdictions create classification drift. For 30 days in November-December 2025, items controlled under the EU's updated Annex I sat uncontrolled under UK law. Same product, two warehouses, two different answers.

Applied Materials found this out the hard way. BIS rejected their argument that semiconductor lithography machines assembled in South Korea qualified as foreign-origin. The penalty: twice the transaction value, plus two mandatory internal audits.

Regulatory Compliance Management When Filing in All Three Regimes

Filing across three regimes multiplies the work roughly fivefold, because interaction effects between systems create obligations that don't exist in any single one.

A regulatory compliance service covering only classification and screening misses the procedural layer entirely. BIS license applications route through SNAP-R. EU applications go to national authorities (Germany's BAFA, France's DGA, the Netherlands' CDIU), each with different processing timelines and end-user certificate formats. The UK still runs on SPIRE, being replaced by LITE (in public beta for Standard Individual Export Licences only as of 2025). Three portals, three workflows, three approval timelines for the same product going to the same buyer.

OFAC's 14 enforcement actions in 2025 targeted "non-bank gatekeepers": private equity firms, real estate companies, attorneys. Eight of 14 involved Russia sanctions. The message: look past corporate formalities to economic reality. EU regulators are moving the same direction. October 2025 European Commission guidance stated that dual-use export bans apply "without prejudice" to licensing under Regulation 2021/821. Passing a sanctions check does not eliminate the dual-use filing. Two filings, not one.

UK enforcement is picking up speed. OFSI issued five penalties and two disclosure notices in the 12 months through January 2026. Markom Management Limited: £300,000 for a single £416,590 payment to a designated person. OFSI's proposed reforms would introduce fixed £5,000 or £10,000 penalties for late reporting. Parking tickets for license paperwork.

What does NOT work: running separate regulatory compliance software for each jurisdiction and reconciling manually at month-end. We've seen teams maintain three spreadsheets and discover conflicts when a shipment is already sitting at the dock. By then, the choices are absorb dead freight ($2,000-$5,000 per container) or ship and hope the screening gaps don't catch up. The second option is how $215 million penalties happen.

Building a Regulatory Compliance Platform Strategy for Cross-Border Operations

A multi-jurisdiction operation needs a single screening layer that checks all three sanctions architectures simultaneously, maps classifications across ECCN and EU/UK control entries, and flags when a license obligation in one regime touches a shipment cleared in another.

The BIS Affiliates Rule makes this non-negotiable. Regulatory compliance solutions relying on name-matching against published lists cannot detect 50% ownership thresholds. Corporate structures in the BVI, Cayman Islands, and certain UAE free zones are opaque by design. The screening system either pulls beneficial ownership data or it doesn't — and BIS treats "reason to know" as sufficient for enforcement.

The EU's unilateral 500-series controls mean multilateral consensus is no longer the ceiling for European restrictions. The Commission's 2024 White Paper on Export Controls called for mechanisms to add items blocked at Wassenaar. Companies planning regulatory compliance management around Wassenaar schedules alone are planning around a 2022 assumption.

UK OFSI's trajectory (240 active cases, maximum penalties set to double, voluntary disclosure discounts cut from 50% to 30%) tells exporters the UK is not the permissive jurisdiction some expected after Brexit.

Lenzo screens against all three sanctions architectures in a single query, mapping ownership structures and cross-referencing classification entries across all three control list regimes. For operations filing in multiple jurisdictions, Lenzo eliminates the manual reconciliation that turns three-regime obligations into daily friction at the operations desk.

FAQ

Do US export controls apply to products manufactured entirely outside the United States?

Yes. The EAR's Foreign Direct Product Rules extend US jurisdiction to items made abroad if they incorporate US-origin technology or were produced using US-origin equipment above certain thresholds. The BIS Affiliates Rule expanded this on September 29, 2025 by applying Entity List restrictions to subsidiaries 50% or more owned by listed parties, regardless of location.

Can a company screen against a single sanctions list for all three jurisdictions?

No. OFAC's SDN List, the EU Consolidated List, and the UK Consolidated List are independently maintained with different designees and different update cadences. The gap between EU and UK updates alone can stretch weeks. One list gives you one-third of the picture.

What happens when an item is controlled under EU dual-use rules but not yet under UK rules?

For 30 days in November-December 2025, that's exactly what happened. The EU's November 15 update took effect a month before the UK's December 16 adoption. Certain items required an export license from EU member states but not from Great Britain during that window. Same product, different answer depending on which warehouse it shipped from.

Does the BIS Affiliates Rule apply to entities not on the Consolidated Screening List?

Yes. That's the point. The CSL captures only named entities. The Affiliates Rule extends restrictions to any company 50% or more owned by listed parties, even if it appears on no published list. The free government screening tools don't carry ownership data, which means most SMBs running the CSL alone are now operating with a blind spot BIS considers their responsibility to close.

Are EU and US enforcement penalties comparable?

Not at all. OFAC collected $266 million in 2025 penalties. UK OFSI penalties ranged from £152,750 to £300,000 per case, though OFSI has proposed doubling its maximum to £2 million or 100% of breach value. EU penalties vary by member state, creating a patchwork across the bloc.

The three regimes will keep diverging. The US is pushing unilateral semiconductor controls. The EU is building autonomous control capacity outside Wassenaar. The UK aligns with both while maintaining post-Brexit structural independence. Any export operation still treating "regulatory compliance" as a single-jurisdiction exercise is filing paperwork for a world that stopped existing in 2022.