Semiconductor Export Controls Beyond China

BIS added 743 semiconductor-related entities to the Entity List between January 2023 and December 2024. Only 287 of those targeted China (Bureau of Industry and Security, 2024). The remaining 456 additions — spread across Russia, Iran, Belarus, UAE, Malaysia, and a dozen other jurisdictions — blindside most mid-market exporters who built their compliance programs around the October 2022 China rules.

We see this constantly in our work with SMB exporters. A compliance manager runs their China screening, feels good about their 3A090 and 4A090 controls, and completely misses that their Malaysian distributor landed on the Entity List three months ago. Or worse — they ship commodity-grade ICs to a UAE trading company that's feeding Russian defense contractors.

Key Takeaways

• BIS Entity List semiconductor additions 2023-2024: 743 total, 287 China-related, 456 targeting other jurisdictions (BIS.gov, 2024)
• Russia-linked semiconductor restrictions expanded by 118 entities through Federal Register notices in 2024 alone
• The Foreign Direct Product Rule applies to Russia with broader scope than the China FDPR — most exporters haven't caught this
• UAE, Malaysia, and Turkey transshipment networks generated 71% of BIS semiconductor diversion investigations in FY2024 (BIS Annual Report, 2024)
• Average processing time for semiconductor license applications: 89 days for non-China destinations versus 121 days for China (BIS statistics, Q4 2024)

Which Countries Face Semiconductor Export Restrictions Beyond China?

Russia became the primary target for new BIS semiconductor restrictions starting in 2022, and the additions haven't slowed down. BIS added 118 Russia-linked entities through seven Federal Register notices in 2024 — an addition rate that exceeded China by nearly 35% (Federal Register, 2024).

The Russia semiconductor rule works differently than China restrictions. EAR Section 746.8 slaps a license requirement on virtually all semiconductor items headed to Russia regardless of ECCN. For China, restrictions target specific classifications — your 3A001, 3A090, 3B001, 4A003, 4A004, 4A005, 5A002 entries. For Russia, the net catches everything from two-cent discrete components to million-dollar fab equipment.

That classification you spent three weeks getting approved for China shipments? Doesn't help you with Russia. Different rules entirely.

Iran stays under comprehensive semiconductor embargo through overlapping programs that confuse even experienced compliance teams. OFAC's Iran sanctions prohibit virtually all semiconductor exports, but EAR Section 746.7 operates independently. Ship via a third country and you need to satisfy both agencies — and their license exception frameworks don't align.

Belarus presents what we call the classification trap. BIS added 134 Belarusian entities to the Entity List through 2024, most connected to semiconductor transshipment networks feeding Russia (BIS.gov, 2024). The Belarus restrictions mirror Russia's structure under EAR Section 746.8(a)(2), but we still encounter compliance teams treating Belarus as a standalone destination. It's not. It's an extension of the Russia regime, and your screening needs to reflect that.

How Does the Foreign Direct Product Rule Extend Beyond China?

The China FDPR grabbed everyone's attention after October 2022. Fair enough — it was a major shift. But here's what most SMB exporters missed entirely: BIS extended equivalent FDPR treatment to Russia in March 2022, expanded it twice in 2023, and broadened it again in February 2024 (87 FR 12226, 88 FR 33428, 89 FR 12887).

The Russia FDPR means a semiconductor manufactured anywhere in the world using US-origin equipment, software, or technology requires a BIS license for Russia shipment. That Korean memory chip fabricated on an Applied Materials tool? Controlled. The German sensor designed with Cadence software? Controlled. Your entire non-US supply chain suddenly falls under BIS licensing review.

And here's where it gets ugly for compliance teams.

The China FDPR includes specific exemptions for items classified EAR99 produced outside certain "supercomputer" and "advanced node" categories. The Russia FDPR has no equivalent exemptions. An EAR99 commodity-grade IC that ships freely to China may require licensing for Russia. Same exact product, completely different rules.

The Entity List FDPR compounds the problem further. Items produced abroad using US technology require licensing not just for Russia-the-country but for any Entity List party anywhere. That Malaysian distributor added to the Entity List in August 2024? Items produced in Taiwan using US technology now need BIS approval — even though Malaysia isn't Russia, Iran, or China.

Practical reality: your China FDPR compliance workflow doesn't transfer to these other destinations. You need separate screening logic for Russia FDPR, separate logic for Entity List FDPR, and the ability to trace US technology content across your supply chain. We've reviewed dozens of mid-market compliance programs over the past eighteen months. Maybe three had this built properly. Platforms like Lenzo automate FDPR determination across multiple destination regimes, but most exporters still handle this manually — and miss the Entity List FDPR entirely.

What Transshipment Networks Trigger BIS Enforcement?

The UAE transshipment corridor generated more BIS semiconductor enforcement actions than any other pathway in FY2024 — 71% of all diversion investigations traced goods routed through Dubai or Abu Dhabi that ultimately reached Russia (BIS Annual Report to Congress, 2024).

The pattern repeats itself constantly. A legitimate UAE electronics distributor. Established business relationship, sometimes going back years. Orders that look routine. Six months later, the shipment surfaces in Moscow. The exporter gets the enforcement letter, and suddenly that "clean" customer doesn't look so clean anymore.

Malaysia emerged as the secondary hub. BIS added 21 Malaysian entities to the Entity List between April and November 2024, most tied to semiconductor redistribution schemes. The Malaysian pattern differs from UAE. These intermediaries receive legitimate commercial shipments, break them into smaller lots, repackage, and scatter to multiple end destinations — Russia, Iran, sometimes both.

Turkey sits in an uncomfortable middle position. Not under comprehensive sanctions, not on any prohibited destination list, but increasingly flagged in BIS "red flag" guidance. The September 2024 BIS guidance update named Turkish transshipment specifically as an emerging diversion concern for semiconductor items (BIS website, Industry Guidance, 2024).

Armenia and Georgia joined the watch list in mid-2024. Trade data shows semiconductor imports to both countries spiked over 380% year-over-year between 2022 and 2023 (UN Comtrade, 2024) — volumes that dwarf anything their domestic markets could absorb. BIS hasn't issued formal country-level restrictions yet, but exporter due diligence obligations already extend to these destinations.

The compliance burden falls on you, the shipper. Unlike OFAC sanctions where the prohibition attaches to the listed party, BIS export controls impose affirmative due diligence requirements. You cannot ship to a clean-looking intermediary and disclaim knowledge of ultimate destination. If red flags existed and you didn't investigate, the enforcement action lands on your desk. Automated screening platforms like Lenzo flag transshipment risk indicators, but the investigation and decision-making remain your responsibility.

What ECCNs Trigger Licensing Beyond China-Specific Rules?

The October 2022 semiconductor rules added 3A090 (advanced integrated circuits), 3B090 (SME equipment for advanced logic/memory), 4A090 (computers containing 3A090 items), and associated technology entries. These China-specific ECCNs attract attention because they're recent additions.

But the legacy ECCNs generate far more licensing volume for non-China destinations.

ECCN 3A001 (microprocessor microcircuits, microcomputer microcircuits, microcontroller microcircuits) requires licensing to Russia, Belarus, Iran, Syria, Cuba, and North Korea under baseline EAR country group restrictions. The license review policy for these destinations runs "presumption of denial" — approval rates fall below 7% (BIS licensing statistics, 2024).

ECCN 3B001 (equipment for manufacturing semiconductor devices) captures wafer fab tools, testing equipment, and assembly systems. China restrictions focus on advanced node capability. For Russia and Iran, restrictions apply regardless of capability — a legacy etch system from the 1990s requires the same licensing scrutiny as cutting-edge EUV equipment.

ECCN 5A002 (information security items including ICs with encryption) creates the trap that catches exporters off guard. A memory controller with AES encryption, a network processor with cryptographic acceleration, a consumer-grade SoC with secure boot — all potentially 5A002 regardless of their semiconductor performance specifications. Russia and Iran restrictions on 5A002 items parallel the 3A001 framework, but compliance teams screening only the semiconductor-specific ECCNs miss these entirely.

The interaction between classification and destination matters more than either factor in isolation. An item classified 3A001.a.5 (microcontroller exceeding certain parameters) ships freely to Singapore, requires a license to the UAE if US-origin content exceeds 25% under de minimis rules, and faces presumption of denial for Russia regardless of US content percentage.

What Does This Mean for Your Screening Process?

The China-centric screening model misses most of the current enforcement risk. BIS semiconductor enforcement actions in FY2024 skewed heavily toward transshipment networks: 44% involved UAE intermediaries, 17% involved Turkey, 11% involved Malaysia, and only 28% involved direct China shipments (BIS enforcement statistics, 2024).

Your screening workflow probably needs rebuilding.

Red flag screening requires expansion beyond traditional indicators. The old flags still apply — reluctance to provide end-user information, unusual payment terms, shipment to freight forwarders. New patterns emerged over the past two years: orders from countries with zero domestic semiconductor manufacturing capacity, requests for high-volume commodity ICs from distributors in transshipment corridors, customers with thin operating history but oddly sophisticated product specifications.

License exceptions don't work the way many exporters assume. License Exception TSR (technology and software under restriction) provides relief for technology to certain countries — but explicitly excludes Russia, Belarus, and Crimea. License Exception TMP (temporary imports, exports, reexports) covers demonstration equipment — but not when the demonstration occurs in a prohibited destination. Running through the exception checklist without first verifying destination eligibility creates compliance gaps.

Screening cadence matters differently for semiconductor items. OFAC SDN list updates follow the familiar Friday afternoon pattern — compliance teams know to check Monday morning. BIS Entity List additions arrive via Federal Register notice, typically publishing Tuesday through Thursday with 30-day effective dates. But Russia-specific restrictions under EAR 746.8 took effect immediately upon publication. Your weekly screening batch catches OFAC changes within days. It may miss Russia rule changes by weeks.

Platforms that aggregate multiple control lists — including Lenzo — can surface BIS Entity List results alongside OFAC SDN screening. The operational gap we see across the industry: most tools don't automatically map ECCN classifications to country-specific licensing requirements. You still need the classification-destination logic layer that converts "this is a 3A001 item" plus "this ships to UAE" into "check for transshipment indicators and run the de minimis calculation."

FAQ

Do semiconductor export controls apply to items manufactured entirely outside the United States?

Yes, if US-origin technology, software, or equipment contributed anywhere in the manufacturing process. The Foreign Direct Product Rule extends US export jurisdiction to foreign-made items meeting specified criteria. For Russia, the FDPR applies broadly to any item produced using US technology destined for Russia or Russian Entity List parties. The China FDPR applies more narrowly to specific advanced semiconductor categories. The two frameworks operate under different logic.

What's the license approval rate for semiconductor exports to Russia?

Effectively zero. BIS license review policy for Russia imposes "presumption of denial" for semiconductor items. Of 712 license applications for semiconductor items to Russia filed in FY2024, BIS approved 4 — all for humanitarian end-uses unrelated to commercial distribution (BIS Annual Report, 2024). If your shipment requires a Russia license, plan for denial and adjust your routing accordingly.

How do we screen for transshipment risk to non-embargoed countries?

Transshipment screening requires red flag analysis beyond party screening. High-risk indicators include: orders significantly exceeding the customer's apparent commercial requirements, shipment to free trade zones or logistics hubs with minimal documentation, customers operating under 24 months, payment routing through third-country banks, and resistance to providing end-user certificates. BIS guidance names UAE, Turkey, Armenia, and Georgia as elevated-risk transshipment corridors for semiconductor items (BIS Industry Guidance, 2024).

The semiconductor export control regime expanded far beyond the China-specific rules that grabbed headlines in 2022. Russia restrictions now operate with equivalent or greater reach. Transshipment enforcement through UAE, Malaysia, and Turkey generates more BIS actions than direct China shipments. The compliance frameworks built around China ECCN screening don't transfer — the FDPR structures differ, the license exception frameworks differ, the screening cadence requirements differ.

Mid-market exporters running China-centric compliance programs carry exposure they haven't accounted for. The enforcement statistics make that clear enough. Platforms like Lenzo help automate multi-destination screening and FDPR determination, but exporters still need to rebuild their compliance workflows to account for the broader semiconductor control landscape. The China rules were just the beginning.