New BIS “Affiliates Rule”: What Exporters Need to Know About Ownership, Due Diligence, and Red Flags

New BIS “Affiliates Rule”: What Exporters Need to Know About Ownership, Due Diligence, and Red Flags

By Hdeel Abdelhady | MassPoint PLLC | October 29, 2025 | PDF

On September 29, 2025, the U.S. Department of Commerce’s Bureau of Industry and Security (BIS) issued the long-anticipated “Affiliates Rule,” a significant expansion of the Export Administration Regulations (EAR). The rule extends export restrictions to entities owned 50% or more by parties on the Entity List, Military End-User (MEU) List, or certain Specially Designated Nationals (SDNs), even if those affiliates are not themselves listed. It also introduces a new diversion-risk Red Flag, imposes strict-liability exposure, and creates enhanced due diligence obligations for exporters, reexporters, and in-country transferors. Companies should promptly review the Affiliates Rule, assess ownership and control risks in their transactions, and update compliance programs and screening tools accordingly.

Introduction

The Department of Commerce’s Bureau of Industry and Security (BIS) has issued its long-anticipated “Affiliates Rule,” the dual-use export controls version of the OFAC 50% Rule. The Affiliates Rule significantly expands export restrictions and compliance obligations for U.S. and foreign parties engaged in exports, reexports, and in-country transfers subject to the Export Administration Regulations (EAR). The rule extends export restrictions applicable to Entity List, Military End-User List, and certain 15 C.F.R. § 744.8 SDNs (Specially Designated Nationals) to entities owned 50% or more by one or more of those listed entities, even if those owned entities are not themselves listed.

The Affiliates Rule also adds a new diversion risk Red Flag and imposes corresponding compliance obligations for transactions involving entities with significant minority ownership or other ties to listed and unlisted entities to whom the Affiliates Rule applies. Separately, the rule requires additional due diligence even in circumstances in which an Entity List entity or other party of concern may exercise control, but does not hold a 50% or more ownership interest.

The Affiliates Rule, issued as an interim final rule, became effective on September 29, 2025.

Key Features of the Affiliates Rule

Ownership-Based Extension of Export Restrictions

The BIS has long contemplated adopting a version of the OFAC 50% Rule, applicable in the U.S. sanctions space. Under the OFAC 50% Rule, non-U.S. entities directly or indirectly owned 50% or more by one or more sanctioned persons are subject to the same sanctions as their owners. The Affiliates Rule likewise applies a 50% threshold, applicable to entities directly or indirectly owned 50% or more by one or more of:

  • Entities listed on the Entity List at supplement 4 to part 744 of the EAR; and/or
  • Entities listed on the MEU List at supplement 7 to part 744 of the EAR; and/or
  • Entities identified as SDNs at 15 C.F.R. § 744.8 and designated pursuant to specified Russia, terrorism, WMD, and narcotics trafficking sanctions programs; and/or,
  • Unlisted entities directly or indirectly owned 50% or more by one or more of the above three categories of entities.

Where one or more listed or unlisted entities own 50% or more of a non-U.S. entity that is a party to an export, reexport, or in-country transfer transaction, the restrictions applicable to the owner(s) apply to the owned entity. A “party to the transaction” is as set forth at 15 C.F.R. § 748.5.

In cases in which more than one listed or unlisted entities together own 50% or more, but are subject to different restrictions or licensing policies, the most restrictive conditions apply.

New Diversion “Red Flag” and Corresponding Compliance Obligations

In addition to the above ownership-based restrictions, the Affiliates Rule adds new anti-diversion Red Flag number 29 at Supplement No. 3 to Part 732, “BIS’s ‘Know Your Customer’ Guidance and Red Flags.” The new Red Flag provides as follows:

When an exporter, reexporter, or transferor has ‘knowledge’ that a foreign entity that is a party to the transaction has one or more owners that are listed on the Entity List or the MEU List, or that are unlisted entities that are subject to license requirements or other restrictions based on their ownership, it has an affirmative duty to determine the percentage of ownership by those entities and if that is not possible, to obtain a license from BIS if required under the Entity List or MEU List based on the requirements for the owner or owners of that foreign entity, unless a license exception is available.

Diversion Risk Due Diligence in the Absence of 50% or More Ownership

Notably, BIS has given notice in the Affiliates Rule that exporters, reexporters, and in-country transferors have due diligence obligations even in the absence of 50% or more ownership by a relevant listed or unlisted entity.  Where facts suggest that an Entity List, MEU List, 15 C.F.R. § 744.8 SDN, or an unlisted entity has or may have control over a customer/party to the transaction, the Affiliates Rule requires “additional due diligence” to resolve the diversion risk posed by such control. “Indicia of control” include, but are not limited to, “significant minority ownership” by a listed or unlisted entity or “overlapping” membership on the boards of, e.g., an Entity List entity and the customer/party to the transaction.

Strict Liability

BIS indicated that violations of the Affiliates Rule may be subject to strict liability, meaning exporters can be held responsible even without “knowledge” of a violation. “Knowledge,” as defined at 15 C.F.R. § 772.1, will be relevant only for penalty determination purposes, and not for establishing liability.

Practical Compliance Considerations

Compliance with the Affiliates Rule – on a transaction-by-transaction basis—will require an exporter, reexporter, or in-country transferor to, at minimum:

  • Consult the Entity List, MEU List, and OFAC SDN List to identify listed entities within the scope of the Affiliates Rule;
  • Determine whether the party to the transaction is owned 50% or more by one or more Entity List, MEU List, or relevant 15 C.F.R. § 744.8 SDN entities, or unlisted entities owned 50% or more by them; and,
  • Identify and comply with the most restrictive export restrictions (including licensing policies) applicable to listed or unlisted owners.
  • If less than 50% ownership cannot be determined with certainty, submit a license application to the BIS in accordance with the most restrictive licensing condition(s) applicable to the owner(s), and do not proceed with the export, reexport, or in-country transfer before a license or other authorization is secured.

In addition, exporters, reexporters, and in-country transferors may consider these additional operational and transactional compliance steps.

  • Compliance Programs. Update compliance programs to include the Affiliates Rule.
  • Software for Affiliates Rule Compliance. Confirm whether your screening provider includes or will add ownership/affiliate data relevant to the new rule. Some vendors have begun marketing their software for Affiliates Rule Compliance, but the scope and limitations of such software should be understood by the user as ownership information is often inaccessible. The Consolidated Screening List maintained by the International Trade Administration does not currently include entities that are not listed on the Entity List, MEU List, or the SDN list maintained by OFAC.
  • Due Diligence & KYC. Update customer and other export questionnaires and end-user certifications to collect ownership information and address new diversion risks. This may include requesting the date and jurisdiction of formation of the customer/party to the export, reexport, or in-country transfer transaction, and a link or other direction to the corporate registry or equivalent information where that information may be found.

The BIS has expressed concern that that entities may create “new foreign companies” to evade Entity List restrictions. Where a customer indicates that it was only recently formed, this information may require additional inquiry by the exporter, reexporter, or in-country transferor.

  • Red Flag Identification and Resolution. Utilize co-location, common board membership or management, minority ownership, and other information to identify and resolve potential diversion red flags, particularly where such information suggests a link between a customer/party to the transaction and a listed or unlisted entity of concern.
  • End-Use and End-User Statements. Update end-use and end-user statements to include certifications that the customer/party to the transaction is not owned (50% or more or at all) by an entity listed on the Entity List or MEU List, an entity relevantly identified as an SDN under 15 C.F.R. § 744.8, or an unlisted entity that is owned 50% or more by such entities and is above the customer/party to the transaction in the ownership chain.
  • Prepare for Financial Institution Inquiries. Companies should also anticipate Affiliates Rule-related questions from their banks or other financial institutions. In 2024, BIS issued guidance to financial institutions on compliance with General Prohibition Ten (GP10) — prohibiting U.S. persons from facilitating prohibited exports, reexports, or transfers. That guidance effectively placed financial institutions on notice that they must monitor export-related risks. Given that background, banks and trade finance providers are likely to request additional certifications or assurances confirming compliance with the Affiliates Rule. Exporters should be prepared to respond to such inquiries promptly and coordinate with their financial partners to ensure consistent messaging and documentation.
  • Efficiency & Communication: To the extent practicable, and appropriately for the size and nature of the exporter’s business, tailor KYC, end-user and end-use statements, and other compliance steps to achieve compliance while minimizing the compliance burden. Efficiency steps might include prioritizing the order and scope of compliance steps based on the nature of the business and customers, ensuring that the right number of employees are trained on the Affiliates Rule, and utilizing software and other technology but with appropriate human oversight.

Conclusion

The Affiliates Rule is a consequential expansion of BIS-administered dual-use export controls, and the increasing alignment of export controls with U.S. sanctions. Exporters, reexporters, and in-country transferors should promptly review the Affiliates Rule, update compliance protocols and programs, and ensure screening and due diligence tools are capable of identifying indirect ownership and affiliation risks.

For additional information, please contact the author, Hdeel Abdelhady.

Back To Top