BIS Significantly Expands Application of Export Control Restricted Party Lists with New “Affiliates Rule”
October 1, 2025
On September 29, 2025, the U.S. Department of Commerce, Bureau of Industry and Security (BIS) issued a new interim final rule, Expansion of End-User Controls to Cover Affiliates of Certain Listed Entities (the IFR) that, effective immediately, significantly expands the application of the Entity List and Military End-User List (MEU List) restrictions under the Export Administration Regulations (EAR) to foreign entities that are 50 percent or more owned by such listed entities (the Affiliates Rule).
The IFR sets forth – through strict liability under the Affiliates Rule, new Red Flags, and corresponding guidance – an “affirmative responsibility” for parties engaged in activities subject to the EAR to determine the ownership of foreign entities involved in such activities. The Affiliates Rule is intended to address concerns regarding potential diversion of controlled items to restricted end-users and to reduce the administrative burden on BIS to identify and add individual affiliates to the Entity List. Although the Affiliates Rule effectively aligns treatment of restricted end-users with the so-called “50 Percent Rule” imposed by the U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC), it also includes certain novel elements that diverge from OFAC practice in important ways. This client alert summarizes the key provisions of the IFR and Affiliates Rule and outlines important compliance considerations for parties engaged in activities subject to the EAR.
Application of the Affiliates Rule
Under the Affiliates Rule, any foreign entity that is 50 percent or more owned, directly or indirectly, individually or in the aggregate, by one or more entities on the Entity List, MEU List, or (in some cases) the List of Specially Designated Nationals and Blocked Persons (SDN List) maintained by OFAC as set forth in 15 C.F.R. 744.8(a)(1)[1] will be subject to the same restrictions under the EAR as those listed entities. Guidance contained in the IFR implies that BIS will rely on a similar “light switch” principle as the OFAC 50 Percent Rule, such that restrictions will flow down not only from listed entities directly owning 50 percent or more of a foreign entity, but also from any unlisted entities that are themselves “subject to Entity List or MEU license requirements or other Entity List or MEU restrictions based upon their ownership” pursuant to the Affiliates Rule. As a result, screening for indirect owners may be required to ensure compliance with the Affiliates Rule.
The Affiliates Rule does not apply to other restricted parties, such as parties on the Unverified List or subject to Denial Orders.
BIS may issue exceptions excluding certain affiliates or listed parties from application of the Affiliates Rule on a case-by-case basis, and the IFR introduces a process for impacted entities to apply for such exception. As of the date of the IFR, no entities have yet been excluded from application of the Affiliates Rule.
Aggregation: Rule of Most Restrictiveness
Where an entity is owned by one or more entities designated across multiple lists, the IFR also adds a new “rule of most restrictiveness” to the EAR. Under the rule, an entity owned 50 percent or more, directly or indirectly, by multiple entities subject to license requirements “pursuant to some combination of the Entity List, MEU List, or [the specified entities on the] SDN List,” will be subject to the “most restrictive license requirements, license exception eligibility, and license review policy applicable to one or more of its owners under the EAR.”
In this sense, the Affiliates Rule is more restrictive than the OFAC 50 Percent Rule (which generally only aggregates sanctions of the same type) and in some cases may require complex technical analysis. For example, a foreign entity in which an Entity List entity holds even a minority ownership interest (e.g., 45% owned by an MEU and 10% owned by an Entity List entity) would be subject to the broadest Entity List restrictions applicable to the 10% owner. Depending on whether the 10% Entity List owner is designated with a footnote on the Entity List, under the IFR transactions with the counterparty also could be subject to the restrictions under the Entity List foreign-produced direct product rules (FDP Rules) at 15 C.F.R. 734.9. This would mean, for instance, that if a counterparty surpasses the 50 percent threshold under the Affiliates Rule, then any ownership – however negligible the interest – by Huawei entities designated with footnote 1 on the Entity List, could result in a foreign-produced item being “subject to the EAR” and requiring a license to that counterparty, even if the Huawei entity is one of multiple minority owners of the counterparty.
New Red Flag Warranting Heightened Due Diligence
Separately under the IFR, BIS also introduced a new “Red Flag” setting forth additional compliance expectations on exporters when dealing with foreign parties owned—even under 50 percent—by entities on the Entity List, MEU List, or SDN List.
Specifically, BIS added a Red Flag to supplement no. 3 to part 732 of the EAR indicating that “if an exporter, reexporter, or transferor cannot determine the ownership percentage of a foreign entity that is an entity owned by one or more listed entities on the Entity List or the MEU List, it must resolve the Red Flag prior to proceeding…submit a license application to BIS, or identify an available license exception” that may apply to the listed party. As context for the new Red Flag, the he IFR states that “foreign parties with significant minority ownership by, or other significant ties to (e.g., overlapping board membership or other indicia of control)” an Entity List entity, an MEU List entity, or a covered SDN, are considered to present a “Red Flag” of potential diversion risk, and warrant heightened due diligence, for example, to confirm that ownership does not exceed 50 percent and that any such exports would not raise a diversion risk.
The IFR also includes specific guidance, included as Annex 1 to this Alert Memo, describing the application of the Affiliates Rule based on the type of entity. The guidance states that a license is required if a Red Flag exists that cannot be (or is not) resolved by the exporter before proceeding with the transaction. Notably, for companies that historically may have performed screening on counterparties that resulted in identification of ownership or other ties to entities on the MEU List, Entity List, or SDN List (even if a minority interest and therefore previously not prohibited under the EAR), prior screening records could conceivably give rise to the relevant “knowledge” warranting further enhanced due diligence prior to proceeding with a new transaction involving the same counterparty. Failure to do so could result in a violation of the EAR.
Temporary General License
BIS also issued a Temporary General License (TGL) that authorizes, for a period of 60 days (expiring December 1, 2025), limited exports, reexports, or transfers to non-listed foreign affiliates that are owned 50 percent or more by entities on the Entity List or MEU List.
The TGL authorizes two types of transactions with a non-listed foreign entity directly or indirectly owned 50 percent or more by listed entities: (1) exports, reexports, or transfers to or within Country Group A:5 or A:6[2]; and (2) exports, reexports, or transfers to or within any country (other than Cuba, Iran, North Korea, or Syria) to a joint venture with a non-listed entity headquartered in the United States or a country in Country Group A:5 or A:6 (that is also not owned 50 percent or more by listed entities or unlisted entities covered by the Affiliates Rule).
Recommended Actions
To ensure compliance with the Affiliates Rule and other provisions of the IFR, parties may consider the following:
- Review Pending Transactions: Assess whether any pending transactions may be affected by the Affiliates Rule and, if so, determine whether they would qualify for the TGL or any license exceptions under the EAR.
- Re-screen Existing Customers: Review existing customer databases to identify any entities that may be directly or indirectly owned by any combination of parties on the Entity List, MEU List, or relevant SDNs. Parties also should consider any other ties to such parties (such as shared leadership).
- Update Compliance Procedures: Revise export compliance procedures to incorporate the Affiliates Rule and Red Flag indicators, and enhance risk-based due diligence procedures as appropriate for transactions involving entities with any ownership or ties to restricted parties.
- Consider Effectiveness of Screening Solutions: Evaluate whether current screening tools can adequately identify ownership relationships or if additional resources are needed.
- Record Retention: Maintain all records related to screening and transactions involving such entities for a period of at least five years, pursuant to 15 C.F.R. Part 762 of the EAR.
Parties seeking to provide comments to BIS concerning the IFR must ensure that they are received by BIS no later than October 29, 2025.
Conclusion
The IFR and Affiliates Rule represents a significant expansion of export controls for companies engaged in the international trade of items subject to the EAR.
In addition to re-screening existing customers or counterparties that will receive items subject to the EAR, companies should consider the appropriateness of updated compliance policies and due diligence on a risk-based and going-forward basis. Given the potential, in some situations, for certain foreign-produced items to become subject to new license requirements, companies should also consider due diligence surrounding ownership of customers and counterparties for transactions involving certain sensitive foreign-produced items that would not ordinarily be “subject to the EAR.” For more information or assistance with compliance with these new requirements, please contact Cleary Gottlieb’s Foreign Investment and National Security team.
[1] Specifically, the restrictions will apply to SDNs designated on the SDN List with any of the following identifiers under 15 C.F.R. 744.8: (i) Related to Russia’s invasion of Ukraine: [BELARUS-EO14038], [BELARUS], [RUSSIA-EO14024], [UKRAINE-EO13660], [UKRAINE-EO13661], [UKRAINE-EO13662], or [UKRAINE-EO13685]; (ii) Terrorism-related: [FTO], or [SDGT]; (iii) WMD-related: [NPWMD]; (iv) Related to narcotics trafficking or other criminal networks: [ILLICIT DRUGS-EO14059], [SDNT], [SDNTK], or [TCO].
[2] See Annex 2 to this Alert Memo.