Regulatory Changes: When Low-Risk Becomes a Violation

BIS published the Affiliates Rule on September 29, 2025, effective immediately (BIS.gov). Any company 50% or more owned by an Entity List party became subject to the same license requirements as the parent—overnight. One rule change. No grace period. And suddenly, transactions that cleared screening last week now require licenses that take 45–90 days to process and face presumption of denial.

Key Takeaways

• The Entity List grew from ~200 entries in 1997 to 3,163 entries by September 2025 (BIS.gov)
• BIS issued 8 major export control rule changes in the first three quarters of 2025 alone
• Maximum civil penalty per violation: $374,474 or twice the transaction value, whichever is greater (15 CFR 764)

The ownership problem nobody screened for

Entity List screening before September 29, 2025 checked whether your counterparty appeared on the list. The party's subsidiaries, affiliates, shell companies? Not covered. A Chinese tech company could spin up a Singapore subsidiary, and that entity would clear every screening tool on the market. BIS called this a "significant loophole" when they closed it.

Here's what that meant operationally. Say you'd been shipping EAR99 items to a Singapore distributor for three years. Clean screening record. No red flags. Then September 29 arrives, and it turns out that distributor is 60% owned by a Beijing firm that landed on the Entity List in 2022 for military end-use concerns.

Your next shipment now requires a license with presumption of denial.

The contract date doesn't matter. The fact that you screened last month doesn't matter. The fact that you had no way of knowing the ownership structure doesn't matter—BIS expects exporters to conduct ownership due diligence going forward. Sixty days of transition via Temporary General License. Then it expired.

Why point-in-time screening fails

The standard compliance workflow runs screening at transaction initiation. Customer clears the list, shipment proceeds. The assumption baked into this process: regulatory status is stable between screening and export.

Wrong.

BIS added 340+ parties to the Entity List through enforcement referrals in 2024 alone (BIS Enforcement Recap). OFAC averaged 200 designation changes per quarter. The AI Diffusion Rule announced in January 2025 would have imposed new license requirements on May 15—then got rescinded entirely that same month. Secretary of Commerce Lutnick announced "dramatic" increases in enforcement at the March 2025 BIS Update Conference.

A $140 million penalty hit a US tech company for Entity List violations that accumulated over six years of transactions their screening missed.

Point-in-time screening captures none of this. A customer screened on Monday could face new restrictions by Thursday. The shipment that cleared Friday morning could violate rules published Friday afternoon. Teams running weekly batch screenings have a structural blind spot measured in days—sometimes weeks.

More list additions. More rule changes. More ownership-based restrictions. Same screening cadence. Growing gap.

What the \

Nothing useful.

BIS operates on strict liability for civil violations. You don't need to know your counterparty was restricted. You don't need intent. The violation occurred when you shipped without a license. Full stop. The $374,474 maximum penalty per violation doesn't care that your screening vendor hadn't updated their database yet.

Voluntary self-disclosure helps—BIS caps penalties at 50% of maximum for companies that come forward. But that assumes you caught the problem before BIS did. Most SMB compliance teams discover regulatory gaps when shipments hit customs holds or when the inquiry letter arrives.

Operational cost of compressed response windows

The real cost isn't the screening itself—it's the response window compression.

Most SMB exporters lack the internal bandwidth to run license determinations on 48-hour notice. When BIS drops a rule change on a Friday, compliance teams face a choice: stop all potentially affected shipments pending analysis, or continue shipping and hope for the best. The first option burns revenue. The second accumulates exposure at $374K a pop.

Neither works at scale.

Compliance monitoring that tracks regulatory changes across BIS, OFAC, and EU authorities—and surfaces which transactions in your pipeline are affected—compresses the analysis window. Lenzo consolidates rule-change alerts with transaction-level impact assessment, letting teams prioritize response rather than scramble to identify exposure.

The alternative is discovering your low-risk transaction became a license violation when the freight forwarder calls asking why customs flagged the shipment.

FAQ

What happens if I shipped to an Entity List affiliate before the Affiliates Rule took effect?

Shipments en route on September 29, 2025 and delivered by October 29 fall under the savings clause. Shipments initiated after September 29 to 50%+ owned affiliates require licenses. Historical transactions completed before September 29 are not retroactively affected.

How do I determine if a foreign company is 50% owned by an Entity List party?

BIS expects exporters to exercise "affirmative responsibility to know the ownership of the foreign companies that are parties to a transaction" (15 CFR 744). Minority ownership by a listed party is now a red flag requiring additional due diligence before proceeding.

Can I get a license for exports to Entity List affiliates?

You can apply, but the license review policy for Entity List parties—including their 50%+ owned affiliates—is presumption of denial for most controlled items. Processing time averages 45–90 days.