Executive Summary

The new proposed export controls from the US Department of Commerce’s Bureau of Industry and Security would require deeper due diligence research to ensure products do not end up in the hands of militaries or governments adversarial to the United States. The proposed export controls expansion and categorization will impact a wider range of businesses, items, and restricted countries. US firms will need to exercise increased caution and conduct thorough KYC procedures when exporting goods that could have military, security, and intelligence applications.

Upcoming Export Control Changes

On September 27, 2024, the US Department of Commerce’s Bureau of Industry and Security (BIS) closed the public comment period for two proposals for changing military end use export controls. Though the implemented controls could differ from the proposals, the resulting restrictions will likely be similar. A proactive look at the proposals gives compliance programs an opportunity to prepare.

What is in the Proposals?

The proposals widen the restrictions on military end users (MEUs) export restrictions. The expansion covers exports to a broader range of entities providing  “military support, intelligence, and security.” These include government civilian and military intelligence, security, and reconnaissance customers in restricted countries.

The proposed restrictions increase MEU export restrictions and divide MEU into additional categories: Foreign-Security End User (FSEU) and Intelligence End User (IEU). For MEU, BIS proposes adding private military companies (PMCs) and mercenaries as restricted parties so that the definition would be “the national armed services (army, navy, marine, air force, or coast guard), the national guard, or any person or entity performing the functions of a ‘military end user,’ including mercenaries, paramilitary, or irregular forces.” and intelligence end users as restricted parties.

Similar to the expansion of MEU to PMCs, the IEU definition will cover both government and nongovernmental actors. The proposed restrictions widen the list of restricted countries for Intelligence End Users (IEUs) to more than 45 countries. This list is much longer than the list for MEUs, which only contains nine countries. The wide country scope will present a compliance challenge, particularly as intelligence groups will likely leverage their evasive nature to develop diversion tactics. Known tactics include routing products through unrestricted countries and through webs of affiliates, such as Pegasus spyware producer Intellexa.

FSEUs, included as MEUs in the current MEU definition, would be categorized separately and require a new type of license. FSEU activities include “arrest, detention, monitoring, or search,” and FSEUs “may include analytic and data centers (e.g., genomic data centers), forensic laboratories, jails, prisons, detention facilities, labor camps, and reeducation facilities.” While FSEUs were previously restricted as MEUs, BIS will process FSEU licenses case-by-case to determine whether the export could enable human rights violations, which will specialize control for entities such as public safety departments that include restricted categories but also medical and firefighting services.

The items subject to export controls for MEUs, FSEUs, and IEUs would expand to cover all items subject to the Export Administration Regulations (EAR), rather than just those listed in Supplement No. 2 to Part 744 of the EAR. Facial recognition systems would also be included as controlled items if used for mass surveillance, crowd scanning, or crime control. The specified restricted end use of facial recognition systems, which have unrestricted uses such as authentication, also makes a case for thorough KYC.

Private Sector Impacts

For the private sector, in-depth KYC research will be essential to meet BIS export restrictions on dual-use and military goods to “persons or entities at all levels of the government police and security services, from the national headquarters or the ministry level to all subordinate agencies/bureaus.” Essential to complying with these regulations is understanding customer political and employment connections, a task which becomes more complex when customers come from jurisdictions presenting linguistic challenges for research, such as China and Russia.

Since Russia launched its offensive in Ukraine in 2022, US regulators have shifted their priorities to enforce trade restrictions on exports to Russia. Countering Russia’s military activities could be part of what has led BIS to propose including PMCs as MEUs, as they are widely used to implement the Kremlin’s agenda. PMCs are also common in China, another country under BIS military end use restrictions. For Russia- and China-connected customers, examining a customer’s business activities or employment background will be necessary to ensure they are not connected with a PMC or mercenary group.

Regulators likely have China in mind for the proposed restrictions on facial recognition equipment, analytic data centers for reeducation centers, and prisons. These concerns likely stem from China’s genocide against the Uyghurs. China has a history of evading export controls targeting the genocide using cloud service providers (CSPs), technology rentals, and subsidiaries to access restricted technology. Entities selling goods and services in these categories will need to be cautious about engaging with entities with any China ties, even if the entity is not located in China.

Enforcement

Violations of BIS export controls are subject to monetary and criminal penalties, including possible jail time. Fines can reach up to $1 million per violation, and jail time up to 20 years. Previous cases of BIS enforcement show these penalties are enforced. In August 2024, BIS imposed a $5.8 million federal penalty on TE Connectivity Corporation. The company, based in Pennsylvania, was charged with sending restricted goods such as “wires, printed circuit-board connectors, and pressure and temperature scanners” to China-based companies with military ties. The companies in China obfuscated the identity of the end users by altering entity names and end-use descriptions. While evasion techniques pose a compliance challenge, BIS has demonstrated that it will prosecute export controls violations regardless of intent, placing the burden of end-use research on the private sector.

Screening a customer only by location is not sufficient to comply with BIS export controls. In April 2023, BIS charged Estonian company By Trade OU and a Latvian company for serving as front companies supporting the Russian military. The companies procured machinery, such as high precision jig grinder with dual-use restrictions, to support the manufacture of Russian military equipment. A US federal court ordered the companies to forfeit $826,000. Though no US companies outside of the procurement network were charged, their reputation is at risk, as their equipment with their branding could show up in the media as being used to support the Russian military, as a 2023 PBS report on another US firm showed. Although exports to Latvian and Estonian companies appear to carry much less risk than exports to Russian companies, this is not necessarily the case. Thorough end-use research looking for company ties to Russia can lower the risk of diversion.

Conclusion

The proposed BIS export controls expand end-use restrictions and the private sector’s responsibility to comply. US firms will need to be vigilant and thorough in determining end use before engaging with third parties. Companies selling dual-use goods will also need to gain a thorough understanding of who their end users are and evaluate the risk of product diversion. Past export controls enforcement demonstrates that US regulators place a steep cost on violations, and the proposed export controls increase the need for thorough third-party and end-user research conducted by regional and linguistic experts.