Screen the entire transaction—not just the supplier’s name. A defensible first-pass review checks the item and its export classification, every relevant party, ownership and headquarters, official restricted-party lists, the actual end user and use, and the delivery site. A clean list search is only one part of that review; it does not establish that a transaction is unrestricted.
This workflow focuses on U.S. sanctions and the U.S. Export Administration Regulations (EAR), based on guidance from the Bureau of Industry and Security (BIS) and the Office of Foreign Assets Control (OFAC). Other countries’ sanctions and export controls may also apply, depending on the company, product, parties, and transaction. Use qualified trade-compliance or legal advice for transaction-specific decisions.
As an Amazon Associate I earn from qualifying purchases.
1. Define the transaction and identify the hardware
Start by documenting what is being acquired, supplied, exported, reexported, or transferred. Identify the exact hardware and any related software or technology. Ask the supplier or exporter for the applicable export classification—an Export Control Classification Number (ECCN), if applicable—or whether the item is EAR99, along with the basis for that determination.
Do not infer a classification from the phrase “AI hardware.” Classification depends on the particular product and its technical characteristics. BIS’s licensing guidance calls for determining whether an item is subject to the EAR and classifying it before assessing the country, end user, and end use.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Classification can be especially important for advanced-computing items. BIS’s May 2025 industry guidance identifies examples including items under ECCNs 3A090.a and 4A090.a, and certain “.z” items in Categories 3, 4, and 5, including some servers. These examples are not a classification decision for any specific product.
2. Map every party and role in the transaction
Collect each party’s legal name, aliases, address, registration details, and role. Include the supplier, purchaser, applicant, intermediate and ultimate consignees, end user, freight forwarders, and other intermediaries. Identify remote users where relevant—for example, parties that may access computing resources through an infrastructure-as-a-service (IaaS) arrangement.
Do not stop with the company placing the order or receiving delivery. BIS explains that restrictions can apply when a listed party is a transaction party, including an applicant, purchaser, or consignee; the restricted party need not be the end user. A complete party map is also essential when hardware will be resold, installed for another customer, or used to provide services to others.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteRank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
3. Check official lists and analyze what a potential match means
Use the U.S. government’s Consolidated Screening List (CSL) as a starting point for consolidated restricted-party screening. Then identify the underlying agency list and rule relevant to any potential match. BIS lists include the Entity List, Denied Persons List, Unverified List, and Military End-User List. These lists have distinct consequences, so a “hit” is not a single, uniform legal outcome. The Military End-User List is not exhaustive; absence from it does not replace your own diligence.
Check OFAC’s sanctions lists as well. OFAC maintains the Specially Designated Nationals (SDN) List and other lists that can impose different, including non-blocking, restrictions. Determine which program and restriction apply rather than assuming every OFAC entry has the same effect.
Investigate potential name matches using identifying information and your organization’s documented procedures. A similar name alone does not establish a match, and a search result alone does not resolve one. Keep a record of:
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- the list sources and search date;
- the names and aliases queried and the identifiers compared;
- potential matches, their disposition, and the reason for that disposition; and
- the reviewer and any escalation or approval.
Refresh checks when a party, ownership, destination, end use, or other transaction fact changes, and at relevant milestones under risk-based company procedures. Lists and restrictions can change, so a past search is not a permanent clearance.
Free tools Windows power users keep installed
One-click scans. No signup required.
4. Trace ownership and check headquarters
Request a current ownership chart or equivalent evidence that shows direct and indirect owners through to the ultimate parent. Record the headquarters of the supplier, ultimate parent, end user, and relevant counterparties. An entity may present a risk even when its own name does not appear on a list.
Apply OFAC’s 50 Percent Rule carefully
Under OFAC’s 50 Percent Rule, an entity is treated as blocked if one or more blocked persons own, in aggregate, at least 50 percent of it, directly or indirectly—even when the entity is not separately listed. Do not confuse that ownership test with control: a control relationship below the 50 percent ownership threshold requires careful, program-specific analysis, but should not automatically be treated as meeting the rule.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Check the advanced-computing headquarters rule
In guidance dated May 31, 2026, BIS said a license requirement continues for exports of covered advanced-computing items to entities headquartered in Country Group D:5 or Macau, or whose ultimate parent is headquartered there—even if the recipient itself is located elsewhere. BIS says exporters should continue seeking required licenses unless a specified license exception is available. Before applying this guidance, confirm the current EAR, destination group, item scope, and transaction facts. BIS distinguished this continuing requirement from portions of the AI Diffusion Rule whose new compliance requirements it said it would not enforce.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.5. Verify the end user, end use, and delivery path
Ask what the customer will actually do with the hardware. Will it use the equipment itself, hold it in stock, resell it, install it at a named location, or provide IaaS? If another party will ultimately use or access the hardware, identify that customer or remote user where known. Compare the intended use, ordered quantity, customer’s line of business, and the capabilities of the proposed site.
BIS’s May 2025 guidance recommends evaluating whether the customer’s business is consistent with the ordered items, identifying proposed transaction parties and intended end use, and determining delivery and installation locations. A useful end-user certification should therefore provide detailed information about the parties and intended use, rather than relying on a vague assurance such as “commercial use.”
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Check whether the installation site can plausibly support the order
For servers containing advanced computing integrated circuits (ICs), confirm the delivery and installation site and whether the data center has sufficient power, cooling, and space. BIS recommends written data-center attestation and flags an inability to affirm capacity as a reason for additional scrutiny. Its May 2025 guidance also says data centers with capacity to operate servers containing advanced ICs greater than 10 megawatts merit additional scrutiny because they may provide access to large quantities of advanced computing ICs. That figure is a screening recommendation in this guidance, not a universal legal threshold.
6. Investigate and resolve diversion indicators
A red flag is a reason to investigate and resolve the facts, not automatic proof of a violation. Escalate concerns such as:
- incomplete or inconsistent ownership information, or an unknown ultimate owner or user;
- a newly formed or opaque customer whose business does not fit the quantity or type of hardware ordered;
- unusual intermediaries, shipping routes, virtual or shared addresses, or unexplained changes to the delivery location;
- co-location with a restricted party or overlap between a new customer’s leadership and an Entity List party;
- weak evidence that the proposed site has the capacity to operate the equipment; or
- uncertain license history or an explanation of the transaction that does not fit the parties, product, route, or stated use.
BIS’s red-flag guidance says uncertainty about the ultimate owner or user, or about license history, must be resolved before proceeding in the circumstances it describes. Record the evidence that resolves each concern and who approved the disposition. If a material fact remains uncertain, pause the transaction and seek qualified export-control or sanctions counsel or guidance from the competent authority. A “no hit” on a list does not establish that the item, destination, end user, end use, ownership, or activity is unrestricted.
Recommended Free Tools
7. Determine authorization requirements and keep the file together
Make the authorization decision using the item’s classification and EAR status, destination, transaction parties, ownership, end use, and applicable restrictions. BIS notes that end-user and end-use controls can require a license even when the item classification or destination alone would not otherwise trigger one. The cited guidance cannot determine whether a particular company’s transaction needs authorization; that depends on its facts and the rules in force at the time.
Retain the classification basis, list checks, ownership evidence, end-user and end-use certifications, delivery and site evidence, license analysis, escalation records, approvals, and re-screening history together. For relevant advanced-computing transactions, BIS recommends detailed end-user certification and written data-center attestation where applicable.
Make screening repeatable without treating software as the decision-maker
For a small number of transactions, a documented manual process may be workable. Higher transaction volume, business sophistication, and risk may justify commercial sanctions-screening software. OFAC describes such software as a possible tool depending on an organization’s scale and risk profile, while emphasizing that no single compliance solution suits every circumstance. Software can support name screening and recordkeeping; it cannot replace ownership analysis, end-use diligence, license analysis, or a reviewer’s decision.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →
