A wide range of organizations, including technology companies, manufacturers and distributors, financial institutions, healthcare organizations, and universities, may soon face significantly expanded export control obligations. The reinstatement of the Bureau of Industry and Security’s (BIS) Affiliates Rule will require organizations to look beyond restricted-party lists and determine whether customers, suppliers, financing parties, and other counterparties are owned by listed entities. As a result, routine transactions involving companies that have never appeared on a restricted-party list could be subject to U.S. export controls.

What the Rule Does

On September 29, 2025, BIS published the Affiliates Rule (90 Fed. Reg. 47201), extending export licensing requirements to any foreign entity that is 50% or more owned, directly or indirectly, by a party on the BIS Entity List, the Military End-User (MEU) List, or certain entries in the Office of Foreign Assets Control’s Specially Designated Nationals and Blocked Persons List (OFAC SDN List). A subsidiary that never appeared on any list is now automatically subject to the same controls as its listed parent. The rule also creates an affirmative duty requiring exporters, freight forwarders, and financial institutions to trace beneficial ownership, not merely screen against existing lists. Ignorance of ownership is no longer a safe harbor.

The rule was suspended for one year effective November 10, 2025, as part of U.S.-China trade negotiations. The suspension expires November 9, 2026. The compliance window is now, not next year.

Who Is Directly in Scope

Technology and software companies face some of the sharpest exposure, precisely because they have operated at the lower-risk end of export controls and their compliance programs were never built for ownership-level analysis. Software licenses, cloud services, and SaaS agreements now require ownership tracing even for the most routine tier of classified transactions (EAR99) if the customer is an affiliate of a listed entity. No commercially available screening tool currently supports cross-list ownership aggregation. GDPR and China's Anti-Foreign Sanctions Law may also legally prohibit obtaining the ownership data BIS now requires, creating a compliance conflict to navigate before reinstatement in November 2026.

Semiconductor and electronics companies face compounding exposure because the Foreign Direct Product (FDP) Rules interact directly with the Affiliates Rule: a foreign chip made with U.S. equipment destined for a newly covered affiliate now requires a license. Companies that have screened against parent-level entity lists without tracing subsidiaries have a gap that IG auditors or regulatory enforcers would flag immediately. Non-U.S. chip suppliers face the same liability.

Aerospace and defense contractors already operate in the most heavily regulated export control environment, but the Affiliates Rule introduces new categories of risk. Foreign prime contractors with complex ownership structures involving government-adjacent entities are common in China, Russia, India, and the Middle East. Joint venture structures are historically where government investigations find the most significant compliance breakdowns.

Financial institutions were explicitly named in the rule's text, and I expect regulators (including FinCEN) to incorporate the Affiliates Rule into Bank Secrecy Act (BSA) and anti-money laundering (AML) examination frameworks. Transaction monitoring systems must be upgraded beyond OFAC list screening to identify counterparties that are affiliates owned 50% or more by listed entities. Red Flag 29 must be embedded into suspicious activity monitoring under General Prohibition 10. Trade finance instruments, loan agreements, and M&A financing documents all need updated representations and covenants. The standard export control representation in most credit agreements does not contemplate the Affiliates Rule's ownership-tracing obligation.

Logistics and freight forwarding companies are explicitly referenced in the rule's compliance obligations. All parties to every shipment, including shipper, consignee, end user, and intermediaries, must now be screened against the expanded affiliate universe. List-only screening is no longer sufficient.

Who Is Indirectly in Scope

The indirect exposure is broad. Automotive companies sourcing electric vehicle (EV) components, battery cells, or rare earth magnets from Chinese manufacturers need to map ownership structures in supplier onboarding now, as entities connected to Chinese-owned companies and affiliated state-owned enterprises may be covered affiliates.

Healthcare and medical device companies should evaluate whether foreign research partners or academic collaborators have indirect ownership ties to listed entities, particularly given the heavy presence of Chinese government-linked institutions on the BIS Entity List.

Energy and clean technology companies face supply chain exposure concentrated in solar, battery, and wind turbine components.

Agricultural exporters, previously operating with minimal export control infrastructure, now face basic ownership screening obligations even for EAR99 commodity transactions.

Universities and research institutions must account for the Affiliates Rule in deemed export and technology transfer reviews.

Retailers and consumer goods companies sourcing from China, Russia, or Belarus (among others) should treat supplier ownership mapping as a due diligence priority before November 2026.

What to Do Now

Every company in a directly or indirectly affected sector should take five steps before reinstatement:

• Audit the beneficial ownership of key counterparties against the BIS Entity List, MEU List, and SDN List.
   
• Assess whether your screening technology supports affiliate-level ownership tracing and document that effort now. In any enforcement proceeding, the contemporaneous compliance record matters as much as the substantive outcome.
   
• Revise key contracts, including export agreements, vendor contracts, loan documents, letters of credit, and M&A documents, to address Affiliates Rule obligations. The standard export control representation in most commercial agreements does not contemplate ownership-tracing.
   
• Train compliance, sales, and legal staff on what triggers an obligation to investigate or obtain a license.
   
• Consider engaging counsel now. The interaction of BIS and OFAC frameworks, the extraterritorial FDP Rules, and the legal conflicts created by GDPR and China's Anti-Foreign Sanctions Law make this a legal analysis problem, not merely an operations one.

BIS is experiencing the longest licensing backlog in over 30 years. Any surge in affiliate-related applications upon reinstatement will compound existing delays. The firms and institutions that build compliance infrastructure during this window will be materially better positioned than those that wait.

For more information, please contact me or your regular Parker Poe contact. Click here to subscribe to our latest alerts and insights.