Dual-Use Export Controls: EAR, ITAR, Licenses, and Penalties

Dual-use export controls are the U.S. rules that regulate goods, software, and technology built for commercial purposes but capable of military or strategic use. Most items fall under the Export Administration Regulations (EAR), administered by the Commerce Department’s Bureau of Industry and Security, which catalogs controlled products on the Commerce Control List and requires licenses for many exports depending on the item, the destination, the end user, and the end use. Getting classification, screening, or licensing wrong can cost up to $300,000 per civil violation and, for willful conduct, up to 20 years in prison and a $1,000,000 criminal fine.

What Counts as a Dual-Use Item

An item is “dual-use” when the same technical capability that serves a commercial market can also serve a military or strategic one. A chemical used in fertilizer can also make explosives. High-performance chips run consumer electronics and guidance systems. High-strength composite fibers appear in sporting goods and in ballistic protection.

The Commerce Control List organizes these items into ten numbered categories:

Category 0: Nuclear materials, facilities, and equipment
Category 1: Materials, chemicals, microorganisms, and toxins
Category 2: Materials processing equipment
Category 3: Electronics
Category 4: Computers
Category 5: Telecommunications and information security
Category 6: Lasers and sensors
Category 7: Navigation and avionics
Category 8: Marine equipment
Category 9: Aerospace and propulsion systems

Each category covers finished products, key components, and the technical data needed to build or maintain the equipment.¹ Classification turns on performance thresholds, not on how the manufacturer markets the item. A milling machine falls under Category 2 once its accuracy crosses the line where it could fabricate weapon components. Encryption software lands in Category 5 because the same algorithms protect commercial data and military communications. If your product hits the specifications listed on the CCL, it is controlled, regardless of who you thought you were selling to.

EAR or ITAR: Figure Out Which Regime Applies First

Before anything else, an exporter needs to know which set of rules governs the item. Two separate regimes exist, run by two different agencies.

The International Traffic in Arms Regulations (ITAR), administered by the State Department’s Directorate of Defense Trade Controls, cover defense articles and services on the U.S. Munitions List. The EAR, administered by Commerce’s Bureau of Industry and Security, cover dual-use items on the Commerce Control List. ITAR takes precedence: if an item is on the Munitions List, State has jurisdiction even if the item also has commercial uses.²

If the answer isn’t obvious, submit a commodity jurisdiction request to the State Department using form DS-4076 through the Defense Export Control and Compliance System portal. A determination that the item isn’t on the Munitions List typically means it falls under the EAR framework described in the rest of this article.²

How the EAR Actually Works

The EAR is the primary legal structure governing dual-use trade, and the Commerce Control List is its centerpiece.³ Every controlled item on the list has an Export Control Classification Number (ECCN), a five-character alphanumeric code. The first digit maps to one of the ten CCL categories. The remaining characters describe the product group and the reason for control, such as national security, missile technology, or anti-terrorism.⁴

Items subject to the EAR but not specifically described on the CCL are designated EAR99. EAR99 items generally don’t need a license, but they can still trigger licensing based on the end user, end use, or destination.⁵

Whether a given ECCN requires a license for a given shipment depends on where it’s going. BIS maintains a Country Chart that cross-references each control reason against each destination. The same product may ship freely to one country and require full government review for another.

Deemed Exports: The Rule That Catches Employers

Export controls don’t only apply to physical shipments across borders. Under the EAR, releasing controlled technology or source code to a foreign person inside the United States counts as an export to that person’s home country. That’s a deemed export.⁶

In practice, hiring a foreign national engineer and giving them access to controlled technical data can require an export license before the employee starts work. Access to manufacturing floors, servers with technical drawings, meetings where controlled designs are discussed, and even printers producing controlled documents can all count. A “foreign person” here means anyone who isn’t a U.S. citizen, lawful permanent resident, or protected individual under federal immigration law.

Employers are expected to assess whether foreign national employees can be separated from controlled technology while still doing their jobs. When separation isn’t feasible, the employer needs a deemed export license from BIS (or from the State Department’s DDTC if the technology is ITAR-controlled). Universities and technology companies that employ international researchers miss this constantly.

When Foreign-Made Products Get Pulled In

U.S. export controls can reach beyond U.S. borders. A foreign-made product that incorporates controlled U.S.-origin components, software, or technology may itself become subject to the EAR if the U.S. content exceeds a threshold percentage of total value. This is the de minimis rule.

For most destinations, foreign-made items with 25% or less controlled U.S.-origin content by value are exempt. For countries in Country Groups E:1 and E:2 (state sponsors of terrorism and certain embargoed destinations), the threshold drops to 10%. Above the applicable threshold, the foreign product is treated as if it were shipping from the United States and needs the same licenses.⁷

Screening Buyers and Watching for Red Flags

Even an EAR99 item can become illegal to export if the buyer is on a restricted party list. The Consolidated Screening List, maintained by the International Trade Administration, combines the restricted party lists from Commerce, State, and Treasury into one searchable tool. On the Commerce side, this includes the Entity List, the Denied Persons List, the Unverified List, and the Military End User List.⁸

The Entity List is what most companies encounter. Entries carry specific licensing requirements, and many carry a policy of presumptive denial, meaning any license application will almost certainly be rejected. The Unverified List works differently: no license exceptions apply, and exporters must obtain a written statement from the buyer before shipping even items that would otherwise need no license.⁹

BIS also expects exporters to watch for behavior that signals illegal diversion. Its published red flag indicators include:

A mismatch between the product and the buyer, such as sophisticated computers ordered by a small bakery, or semiconductor equipment destined for a country with no electronics industry.
A buyer who avoids questions about end use, or is vague about whether the product is for domestic use, export, or re-export.
Willingness to pay cash for an expensive item that would normally involve financing.
A buyer who declines standard installation, training, or maintenance.
Abnormal shipping routes, vague delivery dates, out-of-the-way destinations, or a freight forwarder listed as the final destination.
A customer with little business history who is unfamiliar with the product’s performance characteristics.

A red flag doesn’t automatically kill the transaction. It has to be resolved before the shipment moves. Ignoring red flags and shipping anyway is what turns an inadvertent violation into a willful one.¹⁰

Getting a License or Using an Exception

Everything starts with accurate classification. The ECCN drives whether a license is required, which exceptions might apply, and which destinations are open. Exporters can classify their own items using BIS guidance or submit a formal commodity classification request through the SNAP-R portal.⁵ Classification requires detailed technical specifications: processing speeds, material compositions, operating frequencies, accuracy tolerances. Over-classifying wastes time and money on unnecessary licenses; under-classifying means shipping controlled items without authorization, which is a violation even if unintentional.

When a license is required, applications go through SNAP-R (Simplified Network Application Process Redesign). The application needs a full description of the item, the identity and address of the end user, the specific intended use, and supporting documentation. The application enters an interagency review, and historically processing has averaged around two to three months.¹¹

Not every controlled transaction needs a full license. Part 740 of the EAR defines license exceptions, which are pre-authorized permissions to export under stated conditions.¹² Each exception has specific eligibility criteria tied to the ECCN, the destination, and the end use. Some cover temporary exports or shipments to allied governments. Others require prior notification to BIS. Availability depends on the specific ECCN and the Country Chart, so assuming an exception applies without confirming every condition is a real compliance risk.

If You’ve Already Violated the Rules

Companies that discover a violation face a decision that shapes the outcome. BIS strongly encourages voluntary self-disclosure and treats it as a mitigating factor. A deliberate decision not to disclose a significant violation is treated as an aggravating factor.¹³

For minor or technical violations, companies submit an abbreviated narrative report by email to BIS’s intake address. For significant violations, initial notification should go out as soon as the violation is discovered, followed by an internal review. The full narrative account must reach BIS within 180 days of the initial notification, though extensions can be requested from the Director of the Office of Export Enforcement.¹³

Self-disclosure only mitigates if BIS hears it from you first. If the government has already learned the same information and opened an investigation, the disclosure loses its value.

Penalties for Export Control Violations

The Export Control Reform Act, codified at 50 U.S.C. Chapter 58, provides the penalty framework. The government can pursue civil and criminal cases at the same time.

Civil penalties for each violation include:

Fines up to $300,000 per violation or twice the value of the transaction, whichever is greater. The statutory baseline is periodically adjusted for inflation.
Revocation of any existing export license.
Denial of export privileges, which prohibits the violator from exporting, re-exporting, or transferring any items subject to the EAR.

Criminal penalties apply to willful violations. Individuals face up to 20 years in prison and fines up to $1,000,000 per violation. Corporate entities face the same $1,000,000 cap per incident.¹⁴

Denial of export privileges is often the penalty that actually ends a business. A denial order bars the named party from participating in any transaction involving items subject to the EAR, including applying for licenses, buying, selling, financing, transporting, or even benefiting from such transactions. The order also prohibits other parties from dealing with the denied person, which cuts the violator off from the U.S. supply chain.¹⁵

The line between civil and criminal enforcement usually comes down to intent. An honest classification mistake that leads to an unlicensed export typically draws civil enforcement. Knowingly shipping controlled technology to an embargoed destination or a party on the Entity List is the conduct that draws prosecution, a $1,000,000 fine, and years in federal prison.¹⁴

1
Bureau of Industry and Security. Part 738 – Commerce Control List Overview and the Country Chart
2
U.S. Department of State – Directorate of Defense Trade Controls. Commodity Jurisdictions
3
Bureau of Industry and Security. Export Administration Regulations
4
International Trade Administration. How Do I Determine My Export Control Classification Number (ECCN)
5
Bureau of Industry and Security. Classify Your Item
6
Bureau of Industry and Security. Deemed Exports
7
eCFR. 15 CFR 734.4 – De Minimis U.S. Content
8
International Trade Administration. Consolidated Screening List
9
Bureau of Industry and Security. Guidance on End-User and End-Use Controls and U.S. Person Controls
10
Cornell Law Institute. 15 CFR Appendix Supplement No. 3 to Part 732 – BIS “Know Your Customer” Guidance and Red Flags
11
Bureau of Industry and Security. SNAP-R
12
Bureau of Industry and Security. License Exceptions
13
eCFR. 15 CFR 764.5 – Voluntary Self-Disclosure
14
Office of the Law Revision Counsel. 50 USC 4819 – Penalties
15
eCFR. Supplement No. 1 to Part 764 – Standard Terms of Orders Denying Export Privileges