The time has come. The U.S. Bureau of Industry and Security’s (“BIS”) Affiliates Rule that was postponed last year is slated to take effect November 10, 2026, barring another extension. 

The Rule was initially set to start November 10, 2025 but was extended for a year, effectively giving exporters one-year notice to conduct due diligence within its customer base to ensure compliance with the Rule. 

So, what is it?

In technical terms, the Affiliates Rule extends export restrictions to non-listed “affiliates” owned by listed entities (on the Entity List, the Military End User List “MEU”, or the Specially Designated Nationals (“SDN” List) 50% or more alone or in the aggregate.

In simpler terms, the Affiliates Rule imposes export restrictions and requirements on a company if its owner(s) is/are already designated bad actors and have more than a 50% stake in the affiliate, alone or in the aggregate. 

In practice, this translates into a requirement to screen not only a transaction customer/end user, but its ownership too, which can be difficult to do without correct tools, a good relationship, or timing constraints. The era of screening transaction counterparties or end users against a consolidated screening list tool and stopping diligence efforts there is over. The general sentiment from BIS in recent years has been that this is no longer enough, as potential bad actors become more sophisticated at obfuscating company details, connections, or intentions of diversion. 

Why should you care?

The impetus for due diligence is placed on the exporter because Affiliates Rule uses a strict liability standard, meaning an exporting company cannot claim lack of knowledge as a complete defense to enforcement proceedings or penalties. Lack of knowledge may be considered a mitigating factor but, given the lead time on the imposition of the Rule, exporters should not take the risk. The idea is that with appropriate due diligence, “knowledge” or “suspicion based on the presence of red flags” should be recognized prior to a violation taking place. 

What can you do?

It is never too late to be compliant. 

1. Gather ownership structure information for end users and begin screening majority ownership. 
2. Initiate budget discussions for third party software to enhance ownership screening visibility. 
3. Familiarize yourself with the Entity List, the Military End User List, and the listed sanctions program identifiers. Run some of your biggest customers’ short names through the list and determine whether a relationship needs further diligence efforts. 
4. Update your Terms and Conditions and End User Certificates to include language speaking to the Affiliates Rule requirements. 
5. Put your end users of concern on notice and conduct internal meetings to determine whether you will seek a license or end the relationship. *Note: BIS may still deny your license application, so have a contingency plan for winding down operations. 
6. For pivotal long-standing relationships that could be implicated, start the license application process now. 
7. Monitor BIS for updates because another postponement could be on the horizon. 
8. Determine which markets are at higher risk than others and prioritize them, either by geographic location or product offering, and tackle higher risk areas first. 
9. Don’t assume anything. An unrelated sales office in a separate country from the listed entity under a separate name is still captured under the Affiliates Rule if it is owned 50% or more by the listed entity. 

Finally, document your efforts and be on the lookout for Red Flags. When in doubt, apply for a license prior to exporting. Taking at least one or two of these steps will set your future export transactions up for success in the current era of heightened enforcement.