Export Control Transfer Risk — Acquisition Recon

Control DNA — Classification integrity

Classification is where compliance begins. If it drifts here, it propagates everywhere.

Every controlled product has a current export classification (ECCN/USML) assigned in the product master — not in a spreadsheet.

Engineering change orders affecting controlled technology trigger a classification impact assessment before closing.

Classification is reviewed when the regulatory list changes — not only when someone remembers to check.

The jurisdiction (EAR vs ITAR vs both) is explicitly documented for every controlled item.

Enforcement gates — Architecture vs discretion

Compliance built on discretion breaks under operational pressure. Architecture does not.

Restricted party screening runs automatically on every transaction — not as a periodic manual check.

The system can stop a shipment automatically pending compliance authorization — without human override.

License conditions and expiration dates are tracked in the transaction system — not in a compliance officer's spreadsheet.

Beneficial ownership analysis covers every active customer to the ultimate beneficial owner.

Evidence fabric — Audit readiness

The buyer inherits 10 years of statute of limitations. Evidence that cannot be retrieved is evidence that does not exist.

Compliance decisions are recorded automatically at the moment they occur — not reconstructed after the fact.

An auditor can retrieve the full compliance record for any transaction without requiring manual reconstruction.

Every structural change to a compliance record creates a new version — no silent overwrites are possible.

Supply chain — Third-party exposure

Every active supplier has a documented export classification for each component in active BOMs.

Supplier ownership changes are monitored continuously — not reviewed annually.

Every compliance-relevant procurement event generates an automatic entry in a Supply Chain Compliance Register.

License transfer risk

Licenses do not transfer automatically at close. DDTC and BIS approval is required. This determines whether the deal can close on schedule.

Active ITAR licenses (DSP-5, DSP-73, etc.) 3

Active EAR licenses (BIS) 2

Agreements requiring DDTC consent to transfer (MLA, TAA) 1

Estimated months for license transfer approval 6 mo

Inherited violation exposure

Statute of limitations: 10 years for most US sanctions violations. The buyer inherits what has not yet surfaced.

Known violations in past 5 years 0

Years since last external export control audit 2 yrs

% of revenue from ITAR/EAR controlled products 40%

Regulatory regimes — select all that apply

What export control obligations are you inheriting?