Dual-Use Goods Export Controls and Sanctions Intersection

Dual-use export controls and sanctions law are two separate legal regimes, built for different purposes, run by different agencies, and grounded in different statutory authority. In practice, they've become an interlocking system, and anyone moving goods, software, or technology across a border needs to treat them as one problem with two rulebooks, not two problems that happen to sit next to each other.

Start with the definition, because it decides who this applies to. Dual-use items are goods, software, and technology capable of both civil and military or weapons-related use, and EU law extends that definition beyond the physical shipment of a crate to cover a range of activities including transit, brokering, and technical assistance. This isn't a niche category sitting at the edge of world trade. Semiconductors, AI systems, quantum computing hardware, biotech tools, telecom equipment: these are mainstream commercial sectors, and they sit squarely inside the dual-use definition, whether the companies making them think of themselves as defense contractors or not.

Classification is where a lot of exporters get into trouble, because it's not a simple lookup. Even an item that doesn't appear on any control list can still need a license if it contains a listed component, if it's headed toward a sensitive end use, or if it trips a catch-all provision, like the UK's catch-all provisions or the EU's end-use controls. UK and EU authorities examine whether controlled components amount to the essential functionality of the item in question. That's a judgment call, not a database query, and it's one exporters have to make themselves before they ship.

The separate legal regimes: who administers what, and under which authority

The United States runs two regimes side by side, through two agencies with different mandates and different lists. One US agency, sitting inside the Commerce Department, regulates commercial products and technology under a set of export control regulations, and its main tools are the Commerce Control List and the Entity List. §§ 730-774), and its main tools are the Commerce Control List and the Entity List. Another US agency, sitting inside Treasury, administers economic sanctions, and its main tool is a list of specially designated parties, an authority rooted in financial control rather than trade policy. These aren't redundant systems. A party can land on one list and not the other, and each agency applies its own legal test for who gets named and why.

The EU works from a single dual-use framework, Regulation (EU) 2021/821, which sets common rules, defines authorization types, and maintains the EU Dual-Use List in Annex I. Sanctions are a separate track entirely: Russia-related measures come from Council regulation, adopted at the EU level but enforced by individual member states. Criminal penalties for violations have been subject to ongoing harmonization efforts across the bloc, but member states still hold enforcement power on their own turf. The same violation can therefore produce very different prosecution outcomes depending on where it happens to land.

The UK split its own system after leaving the EU. Great Britain regulates dual-use items under the retained version of Council Regulation (EC) No. 428/2009, while Northern Ireland still applies Regulation (EU) 2021/821 under the terms of the Windsor Framework. The Export Control Joint Unit, part of the Department for Business and Trade, is the competent authority for dual-use matters. Military goods run on a separate track altogether, governed by dedicated military export control rules across the whole UK, Northern Ireland included.

The Wassenaar Arrangement, the Australia Group, the Nuclear Suppliers Group, and the Missile Technology Control Regime all emerge from a shared multilateral architecture. National control lists in the US, EU, and UK all derive from these frameworks, so a change agreed at the multilateral level appears in domestic law in each jurisdiction, though the timing and exact wording can differ.

Structural mechanisms linking export controls to sanctions

The clearest bridge between the two US regimes is EAR Section 744.8, which restricts the export of EAR-controlled items to anyone on the OFAC SDN List who's been designated over Russia's invasion of Ukraine, terrorism, WMD proliferation, or narcotics. That means an OFAC sanctions designation, a Treasury action, can directly trigger a BIS licensing requirement, a Commerce action. The two lists, built by two agencies under two different laws, now talk to each other.

The BIS Affiliates Rule pushed that logic further. It extended licensing restrictions to foreign subsidiaries of listed entities: any foreign company owned 50% or more, directly or indirectly, by one or more listed parties, faces the same license requirements as its listed parent. BIS built this rule explicitly on OFAC's own 50 Percent Rule, borrowing a sanctions concept and grafting it onto export control law, with the goal of closing off diversion through affiliates that aren't themselves named on any list. BIS suspended the Affiliates Rule effective November 10, 2025, for one year, as part of trade negotiations with China. Suspended is not the same as repealed: the legal architecture stays in place, ready to be reactivated.

The scale of the underlying Entity List gives a sense of how much is riding on these mechanisms. The list carried 3,163 entities, most of them in China, concentrated in telecommunications, AI, biotech, quantum information systems, and semiconductors. The list hasn't grown in a straight line; it's grown exponentially, and each addition widens the net that the Affiliates Rule and Section 744.8 both depend on.

Russia as the live stress-test: how the two regimes ran in parallel and began to merge

Nowhere has this convergence played out more visibly than in the EU's Russia sanctions program, which has expanded package by package since 2022. The 14th package brought anti-circumvention tools and LNG restrictions. The 15th focused on the shadow fleet of tankers moving Russian oil and expanded the list of sanctioned parties. The 16th added financial and trade restrictions, including measures targeting Russia's SPFS payment system. The 17th went after shadow fleet logistics and energy revenue, and tightened export controls further.

The 18th package, ambitious even by the standard set by its predecessors, lowered the crude oil price cap to a level notably below its prior mark with a mechanism to adjust it over time, expanded shadow fleet vessel listings to roughly 444 total, imposed a full transaction ban on both Nord Stream pipelines, hit 22 additional Russian banks with full transaction bans, and added about €2.5 billion in new export bans covering CNC machines and propellant chemicals. The 19th package banned Russian LNG imports outright, proposed 118 more shadow fleet vessels (pushing the total past 560), tightened the transaction ban on Rosneft and Gazprom Neft by removing prior energy import exemptions (leaving only narrow carve-outs), listed 45 more companies, and added restrictions on crypto platforms. A 20th package was slated for adoption by February 24, 2026, but got pushed to April 23, 2026, after Hungary and Slovakia dropped their opposition; it's expected to bring further export restrictions, tighter fertilizer import rules, and more asset-freeze designations.

Running alongside all of this, the same Commerce Department agency has been building its own track aimed at a specific country's end users through Military End-User designations. As of January 12, 2025, it had named over 500 Russian and Belarusian entities and individuals as MEUs on the Entity List, a designation that leaves almost no license exceptions available, aside from a limited government-use carve-out.

The clearest sign that these regimes are starting to merge operationally is the Common High Priority List, built jointly by the EU, Japan, UK, and US. It names 50 HS codes for items identified as high-priority dual-use goods of concern, and updated G7 industry guidance has been issued in connection with those codes. The designation of Nayara Energy, an Indian refinery partly owned by Rosneft, in July 2025 signals where this is headed next: the EU is now willing to reach into third countries that process Russian oil, and destination-based export restrictions targeting high-diversion-risk countries are expected sometime in 2026.

Anti-circumvention as the third layer: how evasion networks exploit the gap between regimes

EU law bans "knowingly and intentionally" helping to get around export restrictions, and that liability doesn't stop at the border. An EU exporter who ships goods lawfully to one country can still be held liable if those goods get re-exported to Russia through a third country, even if the original transaction looked clean on paper.

The mechanics of evasion tend to follow a familiar pattern: shell companies, transit through a third country, invoices that name the wrong end customer, and brokers based in places like the UAE inserted between the real buyer and the real seller. The Estonian case against Taras Potapov shows the pattern in practice: goods were routed through Kazakhstan, with invoices built to hide the fact that Russia was the actual destination. Some member states have responded with additional national measures covering dual-use goods that could end up supporting Russia or Belarus, stacked on top of whatever the EU already requires.

The EU has laid the legal groundwork to name specific high-risk destinations and impose export restrictions on them directly, but as of September 2025 it hadn't yet designated any countries under that authority. Officials describe 2026 designations as likely, which would mark the point where destination, not just end user, becomes a formal trigger for restriction.

What enforcement looks like: criminal convictions, seizures, and penalty settlements

The enforcement record across multiple jurisdictions shows this isn't a paperwork regime anymore; it's producing prison sentences and multimillion-dollar seizures. In Estonia, Taras Potapov was convicted of aiding and abetting the provision of a service tied to a prohibited strategic good (resonance testing machines) and of helping violate international sanctions covering dual-use and aerospace goods. A separate Estonian company and its director bought equipment from Switzerland and sold it to Russian customers, while Alus Grupp and its director moved goods through Kazakhstan, with a UAE intermediary used on other occasions.

Germany has produced some of the largest cases on record. A 56-year-old businessman got five years in prison for arranging the export of 71 high-value vehicles to Russia through third countries; authorities seized roughly €5 million in criminal proceeds along with three luxury cars. In a separate case, five men were arrested for delivering more than 16,000 shipments to at least 24 Russian arms companies since 2022, an operation prosecutors say ran for Russian intelligence through a network of shell companies, moving at least €30 million worth of restricted goods.

Spain is prosecuting a case involving the alleged export of military aircraft engines to Russia, with a network said to involve multiple companies coordinating the transfers. Authorities have made arrests and seizures in connection with the investigation, including of individuals alleged to have coordinated the transfers across multiple jurisdictions. Enforcement actions have also emerged in other EU member states, where authorities have intercepted dual-use goods moving through multi-country transit routes toward Russia.

US enforcement runs on the same logic. US authorities have prosecuted cases involving the illegal export of dual-use microelectronics to Russia, including through multi-country transshipment routes. In December 2024, BIS fined a US company $3.3 million for selling transistors and export-controlled items to Russian end users without authorization. The UK's HM Revenue and Customs handed down its own record in July 2025: a penalty of more than £1.16 million against a UK exporter, the largest compound settlement HMRC has reached for a Russia-related sanctions offense.

Criminal prosecution, not just a civil fine, is now the norm across these cases; proceeds seizure routinely follows conviction; and enforcement crosses borders as a matter of course, with German customs seizing engines in a Spanish prosecution and Polish police intercepting goods originally bought in Germany.

What a functioning dual-use and sanctions compliance programme requires

Classification comes first, and it has to be revisited, not done once and filed away. Exporters need to check whether an item is listed under any regime that applies to them (the EAR, the EU Dual-Use List, the UK's Strategic Export Control Lists), and apply the catch-all and principal element tests to anything unlisted. The EU's Dual-Use List update on September 8, 2025, means classification decisions made before that date may no longer hold for quantum technologies, semiconductor manufacturing equipment, or additive manufacturing tools, so those calls need a second look.

Screening has to run in parallel, not one list after another. The OFAC SDN List, the BIS Entity List, the EU consolidated list, the UK's financial sanctions list: a hit on any one of them can trigger obligations under a completely different regime, and EAR Section 744.8 makes that cross-list exposure explicit rather than incidental. Beneficial ownership tracing matters just as much. The BIS Affiliates Rule points at where the law is heading even while it's suspended, so compliance teams should already be mapping counterparties' ownership chains down to the 50% threshold, the same standard OFAC has used for years.

End-use and end-user documentation carries particular weight for anything on the Common High Priority List, given how directly those 50 HS codes tie back to items recovered from the battlefield or judged critical to Russian weapons production. None of this works as a one-time check. Between the pace of EU sanctions packages, the pending 2026 destination-based restrictions, and a suspended Affiliates Rule that could snap back into force, the only viable posture is treating classification, screening, and ownership tracing as a standing discipline that continues after a shipment goes out.