Export Controls vs Sanctions: EAR, ITAR, Entity List

Two Regimes, One Strategic Toolkit

Export controls and sanctions are often conflated but operate under distinct statutory authorities, administering agencies, and jurisdictional logics. Sanctions, administered chiefly by the Treasury Department's Office of Foreign Assets Control (OFAC) under the International Emergency Economic Powers Act (IEEPA, 50 U.S.C. §§ 1701–1708) and the Trading with the Enemy Act (50 U.S.C. § 4301), block property and prohibit transactions with designated persons or jurisdictions. Export controls, by contrast, regulate the cross-border movement of specific commodities, software, and technology regardless of counterparty — though counterparty screening overlays the system.

The U.S. export control architecture rests on two principal regulations. The Export Administration Regulations (EAR, 15 C.F.R. Parts 730–774), administered by the Commerce Department's Bureau of Industry and Security (BIS), govern "dual-use" items — commercial goods with potential military application, such as semiconductors, advanced computing chips, and certain chemicals. The EAR derives statutory authority from the Export Control Reform Act of 2018 (ECRA, 50 U.S.C. § 4801 et seq.), which made permanent the regulatory regime previously authorized by the lapsed Export Administration Act.

The International Traffic in Arms Regulations (ITAR, 22 C.F.R. Parts 120–130), administered by the State Department's Directorate of Defense Trade Controls (DDTC), govern defense articles and services enumerated on the United States Munitions List (USML). ITAR derives from the Arms Export Control Act of 1976 (22 U.S.C. § 2778). ITAR controls are categorical: any USML-listed item — from F-35 components to certain encryption technology pre-2017 — requires a license for export, re-export, or even disclosure to a foreign national on U.S. soil (a "deemed export").

Classification and the CCL

Under the EAR, every controlled item receives an Export Control Classification Number (ECCN) drawn from the Commerce Control List (15 C.F.R. Part 774, Supplement No. 1). The ECCN, combined with the destination country's column on the Commerce Country Chart, dictates whether a license is required. Items not specifically listed default to EAR99, a residual category covering most low-technology commercial goods, which generally ship license-free except to embargoed destinations (Cuba, Iran, North Korea, Syria, and the Crimea, Donetsk, and Luhansk regions of Ukraine) or restricted end-users.

The jurisdictional reach of the EAR is notably extraterritorial. The Foreign Direct Product Rule (FDPR, 15 C.F.R. § 734.9), expanded dramatically on May 15, 2020 against Huawei and again on October 7, 2022 against China's semiconductor sector, captures foreign-made items produced using U.S.-origin technology or software. The October 7, 2022 controls — codified at 15 C.F.R. § 744.23 — restricted advanced computing chips (defined by performance thresholds in ECCN 3A090 and 4A090) and semiconductor manufacturing equipment to China. The October 17, 2023 update tightened thresholds and added new licensing requirements for additional countries.

De minimis rules (15 C.F.R. § 734.4) likewise extend EAR jurisdiction over foreign-made items containing more than 25% U.S.-origin controlled content by value (10% for items destined to Cuba, Iran, North Korea, or Syria). These extraterritorial mechanisms transform export controls into a global compliance burden far exceeding the narrow logic of border inspection.

The Entity List and Its Cousins

The Entity List (15 C.F.R. Part 744, Supplement No. 4) is BIS's principal restricted-party tool. Administered by the End-User Review Committee (ERC) — composed of Commerce, State, Defense, Energy, and (where appropriate) Treasury representatives — the Entity List imposes license requirements, often with a presumption of denial, on exports, re-exports, and in-country transfers to designated parties. Unlike OFAC's Specially Designated Nationals (SDN) List, Entity Listing does not block property or prohibit non-export transactions; a U.S. bank may still process payments to an Entity-Listed company absent other restrictions. The distinction matters for compliance triage.

Historically significant designations include the May 16, 2019 addition of Huawei Technologies and 68 affiliates; the December 18, 2020 listing of Semiconductor Manufacturing International Corporation (SMIC); and the October 7, 2022 additions of YMTC and 30 other Chinese entities. The Unverified List (15 C.F.R. Part 744, Supplement No. 6) is a precursor sanction: parties for whom BIS cannot complete end-use checks face heightened due diligence and risk Entity Listing if non-cooperation persists, as occurred when Pegatron and YMTC were moved from Unverified to Entity List status in October 2022.

The Military End User (MEU) List (15 C.F.R. Part 744, Supplement No. 7), established December 23, 2020, restricts exports of items enumerated in Supplement No. 2 to Part 744 to listed military end users in China, Russia, Venezuela, and Burma. The Military Intelligence End User (MIEU) controls (15 C.F.R. § 744.22) parallel these rules for intelligence services.

Penalties, Enforcement, and Convergence

Violations of the EAR carry administrative penalties up to the greater of $364,992 (as adjusted for 2024) or twice the value of the transaction per violation, plus criminal penalties up to $1 million and 20 years' imprisonment under 50 U.S.C. § 4819. ITAR violations carry civil penalties up to $1,272,251 per violation (2024 adjustment) under 22 U.S.C. § 2778(e) and criminal penalties matching the EAR. Landmark enforcement actions include the April 2018 ZTE settlement ($1.4 billion combined penalty and suspended denial order), the June 2019 United Technologies settlement ($13.9 million ITAR consent agreement covering F-35 software transfers to China), and the April 2023 Seagate Technology settlement ($300 million BIS penalty for sales to Huawei).

The operational line between sanctions and export controls has blurred. The October 7, 2022 China semiconductor package imposed extraterritorial controls functionally indistinguishable from secondary sanctions. The February 24, 2022 Russia sanctions package — coordinated among the G7 — paired OFAC SDN designations with sweeping BIS controls under the Russia/Belarus FDPR (15 C.F.R. § 746.8). Practitioners now routinely run combined SDN, Entity List, MEU, Denied Persons, and Debarred Parties screens as a single restricted-party check. Understanding which regime applies — and which agency holds licensing authority — remains essential because licensing standards, advisory opinion procedures, voluntary self-disclosure benefits, and statutes of limitations differ materially between OFAC (10 years under IEEPA following the April 24, 2024 amendment in the 21st Century Peace through Strength Act) and BIS (five years for EAR violations) and DDTC (five years for ITAR criminal violations).