International Trade & Regulatory – Export Controls & Sanctions

International Trade & Regulatory – Export Controls & Sanctions

Being compliant with export control and sanctions legislation is of great importance for companies engaged in international trade as violation of this legislation can lead to severe penalties as well as reputational damage. Companies should therefore be well aware of the risks related to export control and sanctions and take measures to mitigate these risks.

Please find set out below some interesting recent developments concerning EU and U.S. export controls and sanctions.

EU - Internal Compliance Program (ICP)

The European Commission recently issued a draft "best practices" guidance on the core elements that companies should include in their internal compliance programs (ICPs) for trade in dual-use goods, software and technology. The focus is on export of dual-use items, however, the guidance is also very useful for sanctions compliance purposes. The EU guidance provides for the following seven ‘core elements’ for an ICP:

  1. Top-level management commitment to compliance
  2. Organization structure, responsibilities and resources
  3. Training and awareness raising
  4. Transaction screening process and procedures
  5. Performance review, audits, reporting and corrective actions
  6. Recordkeeping and documentation
  7. Physical and information security

The EU Dual-Use Regulation (Reg (EC) no 428/2009) does not explicitly require companies to put in place an ICP, but provides for general consideration in the authorization context of whether exporters have "proportionate and adequate" means and procedures to ensure compliance. As a result, Member States may require ICP implementation for simplified procedures or otherwise take it into account in their enforcement activities. In addition, draft EU legislation aiming to modernize dual-use controls currently provides for ICP implementation as a prerequisite for certain authorizations (please see the following link:

The draft EU legislation states: “the requirement for companies to implement an effective Internal Compliance Program (ICP) – a set of formal measures and procedures ensuring compliance with export controls – mainly applies in relation to global licences, while small companies that cannot afford to develop a formal ICP can export under most general authorisations and/or individual licences.”. Some EU export controls authorities, for example in the Netherlands, already apply this requirement.

The objective of the ICP guidance is to provide a non-binding instrument identifying the core elements for an effective ICP under the EU Dual-Use Regulation. The draft guidance emphasizes that an ICP should be tailored to the size, structure and scope of a company's business, and recommends that the ICP development process should start with a risk assessment to identify the company's individual dual-use trade risk profile.

While many EU exporters of sensitive items will already have in place an ICP, it would be useful for them to review the above draft core elements and consider whether any changes to current company compliance procedures may be appropriate. It would also be important to monitor when the final ICP guidance is issued, and any related EU Member State activities and requirements that may develop as a result.

Our team has specialists dedicated to national and international export controls and sanctions, ensuring that we are well-placed to assist in developing and reviewing your company’s ICP.

Iran sanctions – INSTEX – Special Purpose Vehicle (SPV)

In our last year’s November Iran Sanctions Special, we reported that EU is committed to the Joint Comprehensive Plan of Action (JCPOA) and was considering to set up a so-called Special Purpose Vehicle (SPV) to facilitate trade with Iran (please see: On 31 January 2019 the Foreign Ministers of France, Germany and the United Kingdom have announced the creation of INSTEX SAS (Instrument for supporting Trade Exchanges), “a Special Purpose Vehicle aimed at facilitating legitimate trade between European economic operators and Iran.

A joint statement mentions that INSTEX will support legitimate European trade with Iran, focusing on the sectors most essential to the Iranian population – such as pharmaceutical, medical devices and agri-food goods.” Furthermore, INSTEX will function under the highest international standards with regards to anti-money laundering, combating the financing of terrorism (AML/CFT) and EU and UN sanctions compliance. In this respect, the E3 expect Iran to swiftly implement all elements of its FATF action plan.

Netherlands’ Guidance on Cloud Exports

Recently the Dutch Ministry of Foreign Affairs released an updated version of the guidance note on export of controlled technology via a cloud service (Guidance Note). The Guidance Note states that a cloud export occurs when controlled technology is uploaded to the cloud and subsequently is made available to persons (individuals and entities) located outside the Netherlands. An export license is then required, if a general export license is not applicable.

The Guidance Note provides for information at which moment a cloud export of controlled technology occurs, what is expected with regard to cloud security and focuses on matters like server location and nationality.

The Guidance Note is only available in Dutch:

EU Dual-Use List updated

On 10 October 2018, the European Commission adopted the annual Delegated Regulation that updates the EU dual-use export control list in Annex I to Regulation (EC) No 428/2009 (EU Dual-Use Regulation). The amendments are foreseen to regularly update the EU export control list and to bring it in line with the decisions taken within the framework of the international non-proliferation regimes and export control arrangements such as the Wassenaar Arrangement. The new Annex I consists of the decisions taken by the plenary chair on 2017 outcome of the Wassenaar Arrangement (WA) on export controls for conventional arms and dual-use goods and technologies.

Please see the updated regulation here:

Changes in Annex I

The new European dual-use list is set out in Annex I to the EU Dual-Use Regulation and updates the existing Annex I of the EU Dual-Use Regulation as of 14 December 2018. Annex I establishes the common list of dual-use items that are subject to controls in the EU. Decisions on the items subject to controls are taken within the framework of the Australia Group (AG), the Missile Technology Control Regime (MTCR), the Nuclear Suppliers Group (NSG), the WA and the Chemical Weapons Convention (CWC).

The majority of the changes in the new Annex I result from amendments that were agreed at the 2017 plenary of the WA, including:

  • Change of controls on measuring and inspection equipment (2B006) and now including angular measuring equipment
  • Deletion of control on robots with 3D image processing (2B007a)
  • Deletion of controls on technology for numerical control units (2E003b) and machine tool instruction generators (2E003d)
  • New control entry for electro-optic modulators (3A001i)
  • New entry for semiconductor manufacturing mask substrate blanks (3B001j)
  • New decontrols for ‘upgrade’ intrusion software (4D004)
  • New decontrol for technology for ‘vulnerability disclosure’ and ‘cyber incident response’ (4E001)
  • New control for Focal Plane Array (FPA) readout integrated circuits (ROIC) (6A002f)
  • Deletion of controls on high speed cinema film recording and mechanical cameras (6A003a)
  • New parameter for ‘corrected specific fuel consumption’ added to the control on marine gas turbine control (9A002)
  • Increase of controls for ground based spacecraft control equipment (9A004)
  • Change of software controls for testing aero gas turbines engines (9D004b)

For the changes that took place within the MTCR, the NSG and the AG, please see the press release of the European Commission:

These changes are necessary to ensure full compliance with international security obligations, to guarantee transparency, and to maintain the competitiveness of economic operators.

For companies who export dual-use items, in particular Annex I goods, it is mandatory to obtain a license from the respective export control authority in the Member State.

Brexit and Export Controls

On 29 March 2017, the UK submitted the notification of its intention to withdraw from the EU. The consequence of this notification is that by 30 March 2019 all primary and secondary EU law will cease to apply to the UK (worst case scenario). A ‘no deal’ scenario means that the UK will become a third country.

The Export Control Joint Unit (ECJU) is responsible for the UK’s system of export controls on military items, dual-use items (items with both civil and military uses), civilian firearms, and items usable for torture. These items are regulated through a system of export licensing. The export of many controlled items within the EU does not require a license. If the UK leaves the EU without a deal, licenses would be required for export of these items from the UK to EU countries. EU export licences issued by the ECJU up and until this date will be no longer valid. Vice versa, licenses would be required for export of these items from the remaining EU-27 countries to the UK.

Companies with indirect/direct business interests in the UK and EU should (also) carefully assess the possible impact of the Brexit from an export compliance point of view.


Tim Hesselink - Partner / International Trade & Regulatory