Dissecting the Nuances of BIS’s New Affiliates Rule

The U.S. Department of Commerce’s Bureau of Industry and Security (BIS) recently implemented the long-anticipated 50% ownership standard (or Affiliates Rule) to extend the licensing requirements under the Export Administration Regulations (EAR) to non-listed parties that are 50% or more owned by certain listed parties. This replaces the previous “legally distinct” standard that BIS had applied, which did not directly extend these restrictions to non-listed affiliates.

The new BIS Affiliates Rule reflects essentially the same standard that has long been used by the Treasury Department’s Office of Foreign Assets Control (OFAC). As the basics of this rule are already widely known, this article focuses only on the lesser-known nuances.

To quickly review the basics: The Affiliates Rule subjects a foreign entity to a licensing requirement under the EAR if it is 50% or more owned — whether directly or indirectly, individually or in the aggregate — by one or more parties that are designated on the BIS Entity List or Military End User (MEU) List, or certain (not all) parties on OFAC’s Specially Designated Nationals (SDN) List.

We shine a light on the trickiest aspects of this rule below.

The Temporary General License (TGL): Very Narrow Scope and Short Duration

A new TGL overcomes the licensing requirement under the Affiliates Rule, but only until December 1, 2025, and only in two relatively rare scenarios — when the party in question is:

1) Located in a cooperating country (i.e., Country Group A:5 or A:6); or

2) A joint venture with entities headquartered in the U.S. or such a cooperating country that are not themselves subject to the Affiliates Rule, and only when located in a non-sanctioned country (i.e., outside Country Groups E:1 and E:2).

Furthermore, the TGL does not apply to entities 50% or more owned by covered SDNs — it only overcomes the Entity List and MEU List restrictions.

In short, the vast majority of companies will not be able to rely fully on the TGL.

Even Listed Entities Are Now Subject to EAR Licensing Requirements Globally (But Unlisted U.S. Affiliates Are Excluded)

The new Affiliates Rule only applies to unlisted “foreign affiliates” of the listed entities. So U.S. affiliates are not directly impacted by this rule.

As far as listed entities are concerned, the previous rule was that the listed entity was subject to the applicable restrictions at all of its locations in the country stated in the listing. BIS noted in the rulemaking that previously there were only three parties on the Entity List that were subject to a worldwide licensing requirement. BIS provided this example: “an entity listed on the Entity List under China has a sales office in Malaysia. Prior to this [rule], the sales office in Malaysia of the listed Chinese entity was not included within the scope of the Entity List license requirements, unless BIS listed that Chinese sales office in Malaysia also on the Entity List or there was information that the item was intended for the listed Chinese entity.”

Now, however, the licensing requirements for all listed entities on the Entity List or MEU List, or under the covered authorities of the SDN List, will “apply to all foreign countries.” This is a significant expansion of these pre-existing, list-based restrictions.

The Affiliates Rule Does Not Apply to Addresses on The Entity List

BIS has made clear that the Entity List restrictions do not apply to unlisted entities that are owned by entities operating at an address listed on the Entity List if the entities themselves are not specifically identified on the Entity List. The agency explained that “entities located at a different address with a parent company registered at a corporate services address on the Entity List may not present the same diversion risks.”

Many U.S. Restricted Party Lists Are Outside the Scope of This Rule

Affiliates of many types of SDNs are not impacted by this rule, which references an exclusive list of covered SDN list authorities. Similarly, an entity owned by covered SDNs and non-covered SDNs would not be covered by this rule, unless the covered SDN ownership is at least 50%.

Nor does this rule impact affiliates of parties that are only designated on other U.S. government lists, including the Department of Defense’s Chinese Military Companies (CMC or 1260H) list, OFAC’s Chinese Military-Industrial Complex Companies (CMIC) list, the BIS Unverified List (UVL) and Denied Persons List (DPL), and others. (The DPL, although not impacted by this rule, has long had a different scope of application to unlisted affiliates.)

Even BIS’s MEU restrictions are largely not affected by this rule, as the vast majority of MEUs under the EAR are not listed, but rather are treated as MEUs under the standard set forth in Section 744.21(g) of the EAR. BIS has stated explicitly that the licensing requirements under the Affiliates Rule “do not apply to unlisted foreign affiliates that are owned, directly or indirectly, individually or in the aggregate, solely by one or more unlisted `military end users,’ unless the unlisted foreign affiliate itself meets the definition of a `military end user.'”

In addition, entities owned only by parties covered by BIS’s Military-Intelligence End User (MIEU) restrictions in Section 744.22 of the EAR are not impacted by the Affiliates Rule, even if owned by listed MIEUs.

New Screening Tools May Be Required

In light of the aggressive statements by BIS about strict liability under this rule, companies should strongly consider whether their current screening tools are adequate. The U.S. government’s free and publicly available Consolidated Screening List (CSL), which many companies previously relied on for EAR compliance purposes, does not include ownership data and therefore will no longer reflect all entities subject to BIS licensing requirements.

Accordingly, it is important to check with your screening tool provider to confirm whether it includes this ownership data — many screening tools do not. With this in mind, many more companies going forward will need to pay for advanced screening tools with built-in ownership data, which previously only larger international companies tended to use.

No tool, however, has complete ownership data. So a key question going forward will be whether BIS will pursue strict liability enforcement actions against companies that exported to an entity that was not flagged by an advanced screening tool as having restricted party ownership under the Affiliates Rule. If so, there will be real questions about whether full compliance under the EAR is going to be feasible going forward.

Official Ownership Determinations From BIS Are Available

BIS has stated that it may be “able to make a determination during the license review process that the foreign entity is in fact not owned, directly or indirectly, individually or in aggregate, 50 percent or more by one or more” covered entities, in which case “the license application will be returned without action [RWA’d] to the applicant noting that a license is not required.”

This presents in effect an opportunity to obtain an official ownership determination from BIS via an RWA’d license application. However, given the currently very long licensing backlog at BIS, which is likely to continue to grow in the near-term, this may not be a practical option in many cases.

Entities Falling Below The 50% Threshold Are Still Impacted

Like OFAC’s guidance, BIS has stated that unlisted entities not meeting the 50% ownership threshold still call for enhanced due diligence:

. . .foreign parties with significant minority ownership by, or other significant ties to (e.g., overlapping board membership or other indicia of control), an Entity List entity, an MEU List entity, or an SDN subject to § 744.8(a)(1) present a Red Flag of potential diversion risk to the listed entity. In this type of situation, additional due diligence is necessary, especially given the opaque ownership structures and limited access to accurate ownership data in certain jurisdictions.

Also echoing OFAC’s warnings, BIS has advised of the risk of dealing with such entities, as they may be designated in the future.

Opportunities For Exclusion From These New Restrictions

Because of the automatic inclusion of affiliates under both pre-existing and new designations, and in light of the significant political pressure that BIS is likely to face to continue and even increase its pace of designations, it is reasonable to expect that the agency will overlook unintended consequences of the Affiliates Rule on a regular basis – it is hard to imagine BIS having the bandwidth to examine in detail the business of each entity in the complex corporate groups that they are targeting.

Accordingly, there will be opportunities for parties to seek a specific exclusion if they have a good case that it is not in the U.S. government’s interest to include them within the scope of these EAR restrictions. BIS has stated explicitly that it will review such requests on a case-by-case basis, pursuant to the procedures in Section 744.16(e) of the EAR, if it determines that an entity or group of entities “do not pose a significant risk of being or becoming involved in diversion to the listed entity.” A strong compliance program may be a ticket to exclusion from these restrictions.

Rule of Most Restrictiveness

As different restrictions may apply to different listed owners of an unlisted entity, BIS has set out the “rule of most restrictiveness” to guide these situations, which it has described as follows:

An entity owned 50 percent or more, directly or indirectly, by multiple entities subject to EAR license requirements pursuant to some combination of the Entity List, MEU List, or SDN List designated under programs listed in § 744.8(a)(1), is subject to the most restrictive license requirements, license exception eligibility, and license review policy applicable to one or more of its owners under the EAR.

This could result in odd outcomes in instances when an entity subject to stringent restrictions has a very small ownership interest and an entity subject to less stringent restrictions has the main ownership interest — in such cases, the restrictions applicable to the smaller shareholder, no matter how small its interest, would generally govern. BIS has said that “the breakdown of the percentages adding up to 50 percent or more does not matter.” These may be good cases to seek exclusions or modifications to the applicable restrictions.

This rule of most restrictiveness can be particularly significant when it comes to small ownership stakes held by entities subject to the Entity List Foreign Direct Product (FDP) rules, because in those cases the unlisted entity would be subjected not only to broad licensing requirements but also expanded jurisdictional exposure under the EAR.

Difficult License Application Requirements

While successful licensing in this context is increasingly rare, it is important to be aware of the new — and challenging — license application requirements that BIS has added for these cases, including an obligation to name the restricted party owners and explain “the due diligence conducted to determine the percentage of ownership, including providing an explanation for why percentage of ownership was not able to be determined.” Expect a high degree of scrutiny of these applications.

Cascading Effects Across Multiple Other Regulatory Regimes

The Entity List and MEU List are referenced in numerous other regulatory regimes, many of which do not incorporate the Affiliates Rule, at least not currently (or clearly enough). For example, an “Excepted Investor” under the regulations of the Committee on Foreign Investment in the United States (CFIUS) cannot be (and none of its parents or subsidiaries can be) “listed on” the Entity List. Similarly, Treasury’s Outbound Investment Security Program (OISP) defines “prohibited transactions” to include otherwise “notifiable transactions” with a “covered foreign person” that is “[i]ncluded on the Bureau of Industry and Security’s Entity List” or MEU List. It will be important to watch for any guidance or regulatory changes from other agencies incorporating the new BIS Affiliates Rule.

Conclusion

The backlash against this new rule has been swift and loud. It will, indeed, make compliance more costly and difficult for many companies, and, ultimately will result in less trade and technology cooperation with entities falling under the Affiliates Rule, as well as with entities not falling under this rule but with opaque ownership that prevents their partners from getting comfortable about them.

But less will change than many may expect. BIS’s press release said that, “[p]reviously, the Entity List and MEU List completely excluded all entities that were not specifically named on the Entity List/MEU List — even if there were extensive corporate and financial ties with listed entities.” That’s a highly misleading statement. BIS’s previous guidance provided stark warnings about the risk of dealing with unlisted affiliates of listed entities, including an expectation to conduct enhanced due diligence. Moreover, many companies (including the authors’ clients) have been subject to civil and criminal investigations for dealing with unlisted affiliates of listed entities. So to say that unlisted affiliates of listed entities were “completely excluded” from the scope of these restrictions prior to this rule does not fairly represent the previous state of play.

The promulgation of this rule — and the aggressive statements that BIS and others have made as part of its rollout — are indicative of the current administration’s focus on closing perceived “loopholes” in the EAR and similar regulatory programs. What remains to be seen is how aggressively these and other new restrictions will be enforced.