Understanding BIS's Affiliates Rule And Compliance Implications

Key Takeaways

• The U.S. Department of Commerce's Bureau of Industry and Security ("BIS") issued an interim final rule (the "IFR" or "Affiliates Rule") that applies Export Administration Regulations ("EAR") end user restrictions to any entity owned, directly or indirectly, individually or in the aggregate, 50 percent or more by one or more listed entities on the Entity List, Military End User ("MEU") List, or certain Specially Designated Nationals ("SDNs") covered by EAR § 744.8(a)(1).
• The IFR shares similarities with the Office of Foreign Assets Control's ("OFAC") 50 Percent Rule and closes a long-standing gap under the EAR's prior "legally distinct" standard, which had limited restrictions to the entity specifically listed (and its non-legally distinct branches). However, there are also important differences that must be taken into account when updating compliance policies and procedures.
• The Affiliates Rule reaches worldwide and applies a "most-restrictive owner" principle when multiple listed owners exist; exporters must resolve ownership questions related to proposed end users or apply for a BIS license if ownership cannot be determined (the new "Red Flag 29").
• BIS created a short-term Temporary General License ("TGL") to facilitate limited transactions with non-listed foreign affiliates in certain circumstances; the TGL expires on December 1, 2025.
• The IFR also expands the end user scope of the Entity List and Russia/Belarus MEU Foreign Direct Product ("FDP") rules to cover majority owned affiliates.
• The compliance and business implications of the Affiliates Rule are far reaching and it is not possible for U.S. exporters, financial institutions, freight forwarders, or non-U.S. persons that deal in items subject to the EAR to comply with the rule without obtaining beneficial ownership information from proposed non-U.S. end users up to the counterparty's ultimate beneficial owner(s).
• The IFR became effective immediately upon publication on September 29, 2025 and BIS is accepting comments on the rule through October 29, 2025.

On September 29, 2025, BIS published an IFR entitled "Expansion of End-User Controls to Cover Affiliates of Certain Listed Entities," which became effective immediately and applies EAR end user restrictions to any entity owned, directly or indirectly, individually or in the aggregate, 50 percent or more by one or more entities included on the Entity List, MEU List, or certain SDNs sanctioned pursuant to Russia, Belarus, and terrorism-related sanctions programs covered by EAR § 744.8(a)(1) (or that are owned by parties otherwise subject to Entity or MEU List restrictions due to their ownership). The Affiliates Rule is similar to OFAC's 50 Percent Rule and closes a long-standing gap under the EAR's prior "legally distinct" standard, which previously applied Entity List and MEU List restrictions only to persons specifically named in those lists (and any non-legally distinct branches unless such branches were acting as "an agent, a front, or a shell" in order to divert items to the listed entity in which case they were covered by the restrictions (See Entity List FAQ 23)). In addition, the Affiliates Rule applies to all foreign countries where branch or sales offices are located, whereas the Entity List's previous "legally distinct standard" only covered foreign branches or sales offices located in the same country as the Listed Entity. Similarly, the restrictions on EAR§ 744.8(a)(1) entities previously only applied to persons on the SDN List not to entities subject to OFAC's 50 Percent Rule. The Affiliates Rule aims to choke the diversion of dual-use goods and relieve BIS of the burden of having to constantly update the Entity List and MEU List to address circumvention techniques used by listed entities who used unlisted related entities to obtain goods they were otherwise prohibited from receiving.

I. Overview of the Affiliates Rule

Under the Affiliates Rule, if one or more beneficial owners of a non-U.S. entity are listed on the Entity List, MEU List, or SDNs covered by EAR § 744.8(a)(1) (a "Listed Entity"), and together own 50 percent or more (directly or indirectly) of the entity, that non-U.S. entity is subject to the same EAR license requirements, license exception eligibility limits and license review policies as its Listed Entity owner(s). If multiple owners are listed, the entity is subject to the most restrictive applicable license, license exception eligibility and license review policy requirements among its Listed Entity owners regardless of the size of the ownership interest of the most restricted owner (the "rule of most restrictiveness"). Thus, if an end user has two Listed Entities as beneficial owners and "only one such owner is eligible for a license exception, that license exception will not apply to transactions involving the unlisted entity [that is subject to the Affiliates Rule], because BIS will apply the most restrictive license requirements to the unlisted entity." Note that restrictions applicable to SDNs covered by EAR § 744.8(a)(1) would flow down to foreign affiliates even if OFAC's 50 Percent Rule would not be triggered (for example if the SDN had only a minority interest in the foreign affiliate). It is also possible that there could be a situation where an OFAC general license could permit more transactions with a foreign affiliate than would the Entity List, but under the "rule of most restrictiveness," the Entity List restrictions would trump the general license. The Affiliates Rule does not currently consider beneficial owners included in other restricted party lists such as the Unverified List, Military Intelligence End User List, or entities subject to Denial Orders, but BIS is seeking comments from the public as to whether the IFR should be expanded to include other such lists. In addition, the Affiliates Rule does not currently extend to U.S. entities owned by Listed Entities.

The Affiliates Rule has worldwide reach, meaning coverage is not limited to the country of the Listed Entity's address, but restrictions now extend globally to all non-U.S. affiliates owned percent or more by the Listed Entity(ies). Affiliates are not automatically covered merely because an owner operates at an address-only entry on the Entity List that includes only a non-U.S. address and not the name of a specific entity(ies) operating at such an address; the owner must itself be identified as a Listed Entity. Beneficial owners who constitute "military end users," but are not actually listed on the MEU List, which currently has a very limited number of entries, are not considered for purposes of ownership calculations under the Affiliates Rule.

Additionally, under the new "Red Flag 29" contained in Supplement No. 3 to Part 732 of the EAR, if an exporter, reexporter, or transferor has "knowledge,"¹which under the EAR includes having a "reason to know," that a foreign counterparty is owned in part by one or more Listed Entities or by an entity subject to the Affiliates Rule, they must determine the ownership percentage before proceeding with the transaction or seek a license from BIS. If the exporter cannot determine aggregate ownership sufficient to assess whether the 50 percent threshold under the Affiliates Rule has been triggered, they must obtain a BIS license or rely on an available license exception consistent with the most-restrictive owner rule, in order to proceed with the transaction. BIS noted that the obligations under Red Flag 29 can extend to freight forwarders and financial institutions involved in transactions continuing a pattern of imposing export compliance responsibilities on such entities not previously used to being EAR compliance gatekeepers. In addition, the IFR makes clear that even if Listed Entities own less than 50 percent of a foreign entity, BIS expects exporters to engage in heightened due diligence in cases of "significant minority ownership by" or "significant ties to" a Listed Entity(ies) in order to assess the risk of diversion to the Listed Entity. The Affiliates Rule also adds Supplement No. 8 to Part 744 to the EAR providing guidance on the Affiliates Rule including that an exporter, reexporter, or transferor should "act with caution" in cases where a foreign entity is partially owned by a Listed Entity that "has significant direct or indirect ownership interest that is less than 50 percent" or is a parent entity of a Listed Entity, as such foreign entities could be the subject of future designations. Along with the IFR, BIS also published updated Entity List FAQs including new FAQs 41 through 53.

FDP Rules Expansion

The scope of the Entity List FDP (§ 734.9(e)) and Russia/Belarus MEU/Procurement FDP (§ 734.9(g)) rules also now includes covered affiliates. If any owner meets the end user criteria under the Entity List (Footnotes 1, 4, and 5) or Russia/Belarus MEU/Procurement FDP rules, and the Affiliates Rule applies to the foreign entity, the FDP rule also applies to the foreign affiliate regardless of the ownership interest of the owner subject to the Entity List or Russia/Belarus MEU/Procurement FDP rules. When multiple owners apply different FDP footnotes or criteria, all applicable criteria must be used and the most restrictive outcome applied.

TGL: Non-Listed Foreign Affiliates of Listed Entities

A TGL has also been established, with authorization expiring on December 1, 2025. The TGL allows transactions to or within Country Group A:5 or A:6, which includes many U.S. allies, when a party is a covered non-listed foreign affiliate. It also permits transactions to or within destinations, other than jurisdictions listed in Country Group E:1 or E:2 (Cuba, Iran, North Korea and Syria), when the covered party is a joint venture with a non-listed entity headquartered in the U.S. or in Country Group A:5 or A:6, provided that the joint venture partner is not 50 percent or more owned by listed parties. The TGL only overcomes license requirements in §§ 744.11 and 744.21 for the covered affiliate; all other EAR requirements still apply, including recordkeeping requirements under Part 762.

Savings Clause

The IFR authorizes exports, reexports, or in-country transfers for shipments in transit from September 29, 2025, as long as they are delivered no later than October 29, 2025.

Licenses

For license applications under the Affiliates Rule (Supplement No. 2 to Part 748, paragraph (cc); § 748.8(aa)), applicants must mark "Affiliates Rule" in Block 9 (Special Purpose) of the BIS-748P form. They must also identify listed owners, ownership percentages, the methodology for determining ownership and the due diligence performed, including an explanation if the ownership percentage could not be determined.

Delisting Procedures

Non-listed foreign affiliates captured by ownership may seek exclusion by requesting modification of the owner's listing under § 744.16(e) for the Entity List or § 744.21(b)(2) for the MEU List. The End User Review Committee ("ERC") may exclude specific affiliates or classes of affiliates on a case-by-case basis and may still list sub-50 percent affiliates based on articulated national security concerns. Supplement No. 8 to Part 744 provides EAR-specific guidelines for applying the 50 percent ownership analysis and due diligence expectations for sub-50 percent ownership or parent-of-listed scenarios.

II. Compliance Implications

The new IFR affects exporters, reexporters, transferors and intermediary parties such as distributors, freight forwarders, and financial institutions that have dealings involving entities with known ties to Entity List parties, MEU List parties, or SDNs covered by § 744.8. It is particularly relevant for those dealing with counterparties that have complex or opaque ownership chains, private holdings, trusts, layered funds, nominee arrangements, or jurisdictions with limited ownership disclosure. Companies must now augment their screening with robust ownership due diligence capable of identifying direct and indirect ownership, calculating aggregate ownership and identifying co-owners across relevant EAR and OFAC lists.

In promulgating the Affiliates Rule, BIS argued that it would not materially increase the burden on industry because companies were already conducting the same type of diligence in order to comply with OFAC's 50 Percent Rule. In fact, there are meaningful differences between the Affiliates Rule and OFAC's 50 Percent Rule as illustrated in the chart below. As a result, compliance with the 50 Percent Rule is insufficient to ensure compliance with the Affiliates Rule and vice versa.

Comparison of Affiliates Rules to OFAC's 50 Percent Rule

1. Update Data Collection and Restricted Party Screening Program

The Affiliates Rule imposes an "affirmative duty to determine the percentage of ownership" in a potential end user held by Listed Entities. As a result, companies should expand onboarding and Know-Your-Customer ("KYC") questionnaires to capture full upstream ownership information (direct, indirect and aggregate). Companies should implement "most-restrictive owner" logic in their controls, updating go/no-go matrices and license triggers for Entity List, MEU List and § 744.8 intersections.

Screening programs that rely solely on the Department of Commerce's Consolidated Screening List ("CSL"), administered by the International Trade Administration, are no longer sufficient. BIS has made clear that companies can no longer rely only on screening counterparties using the CSL, which does not include entities subject to restrictions based on their beneficial ownership and that, going forward, will not include a comprehensive list of all parties subject to Entity List restrictions. See BIS FAQ 46. Many companies previously relied on the CSL as their only restricted party screening tool. It may be advisable for companies to consider using a reputable corporate intelligence provider that includes beneficial ownership information and has 50 percent analysis capabilities.

However, there is no service available that provides complete beneficial ownership information for every private company worldwide and it seems safe to say that such a comprehensive tool will likely never exist. As a result, a manual effort must be made to identify the beneficial owners of proposed end users, which can be very challenging in the case of privately-owned end users. In many countries around the world, including the United States, such information is not publicly available and requesting such information is likely to run into strong opposition on privacy grounds and resistance to perceived U.S. government overreach. In any event, companies should adopt policies and procedures to document due diligence methodologies used to address Affiliates Rule requirements and should consider alternative means of compliance, tailored to the company's business and circumstances surrounding the potential transaction, to the extent possible in situations where end users refuse to provide the names of all beneficial owners.

2. Risk Assessment/Audit of Existing Counterparties

Companies should conduct a risk assessment to determine whether any existing counterparties (customers, suppliers, distributors, etc.) require refreshed due diligence to ensure compliance with the Affiliates Rule. U.S. entities can be excluded as they are not covered by the Affiliates Rule. A targeted audit is advisable to assess whether any existing non-U.S. counterparties have any ownership links to Entity List parties, MEU List parties, or SDNs covered by § 744.8, with particular attention to opaque ownership structures and high-risk geographies. For flagged entities, companies must determine aggregate direct and indirect listed ownership; if this cannot be resolved, they should pause transactions, seek a license, or confirm applicability of the TGL.

3. Update Contractual Language

Companies should expand contractual provisions related to export controls compliance (including in deal documents) to ensure that compliance obligations and counterparty representations account for the Affiliates Rule.

4. Update Internal Policies and Procedures

Impacted companies should update internal export controls policies and procedures to address Affiliates Rule requirements. This should include new due diligence protocols, such as screening methodology and updates to documents used to collect information from non-U.S. third parties. Exporters should also adjust audit and transaction monitoring to test for ownership gaps, especially in high-risk jurisdictions and sectors. Internal approval workflows and FDP analyses should also be updated as necessary.

5. Training

Personnel performing several functions should be immediately trained on the Affiliates Rule and its implications on their activities. Internally, at a minimum, those responsible for international trade compliance, sales activities outside of the U.S. and sourcing activities outside the U.S. should be trained. In addition, companies should train third party distributors, sales agents and suppliers who are responsible for territories outside the U.S. and/or who rely on non-U.S. parties.

6. Remedial Licensing and Delisting Petitions

When a company identifies an impacted counterparty, it should assess whether the TGL can be used in the near term (i.e., before December 1, 2025). Where the TGL is not available or is insufficient, companies should compile ownership due diligence and submit Affiliates Rule license applications to BIS as outlined in Supplement No. 2 to Part 748.

If facts support minimal diversion risk, companies should consider advising counterparties to seek a modification of the Entity List or MEU List to exclude specific affiliates who would otherwise be covered by the Affiliates Rule.

III. Conclusion

There is no doubt that the Affiliates Rule shifts due diligence obligations from BIS to industry even though the IFR makes clear that BIS views the due diligence required as steps those engaged in cross-border transactions should already have been taking to meet previous BIS and OFAC requirements. Violations of the Affiliates Rule are subject to strict liability, so proceeding without resolving ownership exposes parties to potentially significant liability under the EAR even in the absence of intent.

Foley Hoag will continue to monitor BIS's implementation, related ERC actions and any additional guidance or exclusions. Companies with questions about the IFR, ownership due diligence, licensing strategies, FDP implications, or how to align sanctions and export control compliance should contact a member of Foley Hoag's International Trade & National Securitypractice.

Footnote

1 Knowledge is defined in Part 772 of the EAR as "Knowledge of a circumstance (the term may be a variant, such as "know," "reason to know," or "reason to believe") includes not only positive knowledge that the circumstance exists or is substantially certain to occur, but also an awareness of a high probability of its existence or future occurrence. Such awareness is inferred from evidence of the conscious disregard of facts known to a person and is also inferred from a person's willful avoidance of facts."

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.