Trade-controls counsel for companies that move goods, technology, software, and money across borders, with EAR and ITAR classification, OFAC sanctions screening, licensing, and disclosures mapped before the transaction closes.
A product built in Germany can still answer to Washington. If more than 25 percent of its value is controlled US content, or 10 percent for the most restricted destinations, the Export Administration Regulations follow it when it is reexported. The Treasury's Office of Foreign Assets Control now has ten years to bring a civil case, requires records kept for ten, and does not ask what the company knew.
Three regimes do the work. The EAR, run by the Bureau of Industry and Security, classify commercial and dual-use items. The International Traffic in Arms Regulations cover the Munitions List and require registration before a license can be sought. OFAC blocks dealings with listed persons and with any entity they own 50 percent or more.
We classify, screen and license before closing. When a shipment has already crossed a line, we investigate under privilege and advise on the voluntary self-disclosure, which halves the base penalty at OFAC and carries great weight in mitigation at BIS. The UK, the EU and the UAE run parallel regimes that do not always agree with Washington; we map them together with locally admitted counsel.
Determining which regime an item falls under, the EAR or the ITAR, identifying the correct ECCN or US Munitions List category, and analyzing how destination, end user, and end use drive the licensing question. Every other decision rests on this foundation.
Counsel on the OFAC programs that reach a given transaction, including country-based and list-based sanctions, the Specially Designated Nationals list, and the 50-percent rule, so a company understands which dealings are prohibited before money or goods move.
Preparing and supporting license and authorization requests, commodity jurisdiction and classification requests, and license exceptions, and structuring transactions to fit within an available authorization where one exists.
Building and refining export-control and sanctions compliance programs, with written policies, restricted-party screening, recordkeeping, and the internal controls that turn a regulatory obligation into a repeatable operating process.
Trade-controls diligence on counterparties, suppliers, and acquisition targets, screening parties and supply chains and assessing inherited exposure, so a deal does not import a sanctions or export-control problem at closing.
Investigating potential violations under privilege, assessing regulatory exposure, advising on whether and how to make a voluntary self-disclosure to BIS, DDTC, or OFAC, and representing clients in matters before those agencies.
An item that fits no entry on the Commerce Control List is EAR99, and most exports of it need no license. It still needs one to an embargoed country, a listed party or a prohibited end use. When classification is contested, BIS rules on request and DDTC decides jurisdiction between the two lists.
Many OFAC violations require no intent. A company can breach a sanctions program without knowing it existed, which is why screening before the transaction is far cheaper than explaining it after.
Sharing technical data with a foreign national, even inside the United States, can be a controlled export. So can email, source code, and a conversation. The rules reach information as well as cargo.
A voluntary self-disclosure counts at OFAC only if it arrives before the agency hears of the conduct from anyone else, and it halves the base penalty. At BIS the initial notice can be short, but the full narrative is due within 180 days, and a late one loses some or all of the credit.
US controls and OFAC programs can apply to conduct abroad, to US-origin goods, and in some cases to dollar-denominated dealings between non-US parties. Geography is not a safe harbor.
The EU Blocking Statute forbids a company in the Union from complying with listed US sanctions on Cuba and Iran, so a group can be ordered by Brussels to do what Washington forbids. UK sanctions breaches have carried civil penalties on a strict-liability basis since 2022. The regimes are mapped together or not at all.
Every matter opens with the same question, EAR or ITAR. We fix the item's ECCN or Munitions List category, filing a commodity jurisdiction or classification request where the classification is contested, because every downstream decision inherits this one.
Counterparties, end users, and ownership chains are run against the SDN and restricted-party lists, with OFAC's Fifty Percent Rule applied to the entities behind the entities. Where a license is required, we prepare the BIS, DDTC, or OFAC application, or we structure the deal to fit an existing exception.
Authorization in hand, the analysis becomes an operating system: written policies, screening at the point of quote and shipment, technology-release controls for foreign-national employees, and recordkeeping that will stand up when an agency asks to see it.
When a shipment, payment, or email has already crossed a line, we investigate under privilege, size the exposure, and advise on whether and how to self-disclose to BIS, DDTC, or OFAC. Timing, scope and content are decided once the facts are known, not before.
In this practice, the border is every email, every wire, and every conversation with a foreign national.
Export controls are the rules that govern what goods, technology, software, or technical data a US company may send to a foreign party. They are administered chiefly through the Export Administration Regulations (EAR) for commercial and dual-use items and the International Traffic in Arms Regulations (ITAR) for defense articles. Economic sanctions, administered by the Treasury's Office of Foreign Assets Control (OFAC), restrict transactions and dealings with sanctioned countries, entities, and individuals. Together they decide what a company can ship, share, and pay, and to whom.
Start with jurisdiction. If the item was specially designed or modified for a military application it is likely on the United States Munitions List and governed by the ITAR; if not, it is subject to the EAR and either matches an Export Control Classification Number on the Commerce Control List or defaults to EAR99. The ECCN, read against the Commerce Country Chart for the destination, says whether a license is required, and the end-user and end-use rules can require one even when the chart does not. Where the answer is unclear, a classification request to BIS or a commodity jurisdiction request to DDTC produces a ruling the company can rely on. Encryption items, source code and technical data follow their own entries and are the ones most often misread.
OFAC is the Office of Foreign Assets Control within the US Department of the Treasury, and it administers economic and trade sanctions against targeted countries, regimes, entities, and individuals on the Specially Designated Nationals list and other restricted-party lists. Sanctions are strict-liability in many respects, so a company can violate them without intent, and the rules reach US persons, US-origin goods, and in some programs non-US parties dealing in US dollars. Screening counterparties and understanding which programs apply is essential before money or goods move.
Stop the conduct, preserve the records, and put the investigation under privilege before anyone writes a summary. The next question is whether to disclose, and it turns on numbers the agencies have published. At OFAC a voluntary self-disclosure halves the base penalty, but only if it reaches the agency before anyone else tells it. At BIS a short initial notice protects the company's place in line and buys up to 180 days to deliver the full narrative. A disclosure to one agency is often read by the others, so the decision is made once, for all three, with the facts established first.
Yes. We advise on and represent clients in matters before the Bureau of Industry and Security (BIS), the Directorate of Defense Trade Controls (DDTC), and the Office of Foreign Assets Control (OFAC), including license and authorization requests, commodity jurisdiction and classification requests, voluntary disclosures, and responses to administrative inquiries. We act for the company in front of those agencies, and where a matter requires a particular registration or local-law admission abroad, we coordinate with the appropriate counsel.
Trade controls rarely stop at one country's rules. US export controls and OFAC sanctions can reach conduct outside the United States, and the UK, EU, and UAE maintain their own sanctions and export-licensing regimes that may apply to the same transaction. Working from Chicago, London, and Dubai, we help companies map the overlapping regimes a deal touches and coordinate with locally admitted counsel where foreign law governs, so the structure holds up in every jurisdiction the transaction reaches.
CFIUS and inbound-investment review, assessing national-security exposure, filings, and mitigation for cross-border deals that touch sensitive technology, data, or infrastructure.
Explore →Board structure, fiduciary duty, disclosure, and federal and state securities compliance for companies whose financial instruments are subject to evolving SEC rules.
Explore →Counsel for technology ventures from formation through growth, covering IP strategy, financing, data and operational compliance, and the regulatory questions that arrive with scale.
Explore →Reviewed by Jonathan D. Herpy, Sr., Senior Partner · Last updated October 2026 · Educational overview · Not legal advice
One partner is accountable for the whole matter, and you have that partner's direct line. Chicago, London, and Dubai work to the same standard.