Compliance Horror Stories

Halloween is the time of year for scary stories.

Haunted houses, binging all the horror flicks, and exchanging ghost stories.

For anyone working in trade compliance, some of the scariest stories don’t involve ghosts at all. They involve an export that left the building without the right authorization, a customer who turned out to be a restricted party, a classification that was never documented, or a license that expired months ago without anyone noticing.

These situations are not just another ghost story no one can validate, BIS and DDTC publish enforcement & violation actions that show what can happen when companies fail to follow export control requirements. Some of these cases involve deliberate misconduct. Others highlight what can happen when a company’s compliance processes fail to keep up with its business.

Here are a few real-life trade compliance nightmares that companies should avoid becoming part of their own Halloween story.

The Decision That Came Back to Haunt Them

Here’s a theoretical example- A company has been exporting the same product for years.

Everyone knows how it is classified. Or at least, everyone thinks they do.

The product changes. A component is replaced. The specifications are updated. A new version is introduced.

Somewhere along the way, the original classification gets carried forward without anyone going back to confirm that it is still correct.

This can become a problem when the classification determines whether a license is required, whether a license exception is available, or whether additional restrictions apply. Have you taken a look to see whether your ECCN is on Supplement No. 4 to Part 744 of the EAR? The Entity List can impose additional license requirements and restrict the availability of license exceptions.

The scary part is not that a classification was wrong once. The scary part is when no one can explain how the classification was originally determined or everyone just assumes it is correct.

A strong export compliance program should have a documented classification process.

That does not mean every classification needs a 20-page report and dissertation of how you got there. It means the company should be able to show what information was reviewed, how the classification was determined, and who made the decision.

If the product changes, the classification should be reconsidered.

And if a classification decision has not been reviewed in years, it may be time to take another look.

The Customer Who Wasn’t Who They Said They Were

The ZTE case: When export violations become much more than a screening problem

In 2017, ZTE Corporation and its affiliate ZTE Kangxun entered into a settlement with BIS involving exports of U.S.-origin items to Iran and North Korea in violation of the Export Administration Regulations. The government’s enforcement record described an elaborate scheme to conceal the unlicensed transactions, including deleting, destroying, removing, or sanitizing materials and information.

The original BIS settlement imposed a $661 million civil penalty, with $300 million suspended subject to probationary conditions. After BIS determined that ZTE had made false statements about disciplinary actions involving employees connected to the violations, it activated the suspended denial order in 2018. The subsequent resolution included a $1.761 billion BIS civil penalty, of which $400 million was placed in escrow and subject to suspension under the agreement.

The BIS penalties were part of a broader resolution involving approximately $1.19 billion in combined civil penalties, criminal fines, and forfeiture across the relevant U.S. government actions. The later BIS resolution increased the total amount imposed by BIS.

This was not simply a case of a company failing to clear a screening alert. It illustrates how serious the consequences can become when export restrictions are deliberately circumvented, and information is concealed from the government.

The lesson for companies is straightforward: screening cannot be treated as a box to check. A good screening program provides a consistent way to review potential matches, document the determination, and escalate a match when additional review is necessary.

It also needs to account for all relevant parties to a transaction, not just the customer placing the order.

The License Exception That Turned Into a Nightmare

First Call International: A missing document becomes a much bigger problem

Sometimes a company has a legitimate transaction, a product that can potentially qualify for a license exception, and a process that should have prevented a violation.

The problem is that the requirements still have to be met before you export.

In September 2024, BIS announced a $439,992 administrative settlement with First Call International Inc. involving a backdated document and exports of military aircraft parts without the required authorization.

The case involved a Prior Consignee Statement required before using License Exception Strategic Trade Authorization (STA). First Call had not obtained the required statement before an export. After BIS requested a copy, the company advised its overseas customer to backdate the document to make it appear that the transaction had complied with the EAR.

BIS also addressed exports of military aircraft parts classified under ECCN 9A610 to Malaysia and South Korea without the required licenses or authorizations. In the Malaysia transaction, First Call attempted to use STA to export the items first to Australia despite knowing that the items were ultimately destined for use by the Royal Malaysian Air Force. The transaction was not eligible for the exception.

The settlement required First Call to pay $75,000 of the $439,992 penalty, with the remaining $364,992 suspended based on the company’s financial condition and subject to compliance with the settlement requirements during a one-year probationary period. The company also agreed to provide export compliance training to relevant employees.

This case is a reminder that a license exception is not a shortcut around export authorization requirements. Every condition must be met, including documentation requirements, eligibility criteria, and restrictions related to the ultimate destination and end user.

If a required document is missing, stop. Get the document, then confirm you have all that is essential to satisfy export authorization requirements.

The End-Use Information That Should Never Have Been Left Out

MTS Systems Corporation: The details that matter most

An end-user statement is collected for a transaction. Everyone is satisfied. The shipment goes out.

Months later, another order comes in from the same customer. Someone within the company decides to pull out the old end-user statement and use it again for the new transaction.

Customer information changes. Ownership changes. Products change. End users change. The purpose of a transaction can change, even if the customer is purchasing the same item from you.

Documents that were accurate when they were signed should not be treated as blanket statements.

In reviewing BIS enforcement case involving MTS Systems Corporation, end-use matters. The end use/end user statement is not just a document that get filed away.

In 2008, BIS settled allegations involving two license applications for seismic testing equipment proposed for export to India. The equipment was classified under ECCN 9B990.

In the first transaction, valued at $525,000, BIS alleged that MTS omitted information from its license application indicating that the equipment could be used to test nuclear power plant components. Within 15 CFR 744.2 this specifically discusses restrictions on certain nuclear end uses and there’s a supplemental list of countries which are not subject to these restrictions. India is not currently on this list.

In the second transaction, valued at more than $3 million, BIS alleged that MTS omitted information that the Indian Department of Atomic Energy, an Entity List party at the time, had funded the transaction. BIS also alleged that MTS knew the equipment could be used for seismic testing on behalf of Indian nuclear facilities. The omitted information was also missing from subsequent materials submitted to the Department of Commerce.

BIS charged two violations under the then-applicable 15 CFR 764.2(g), concerning misrepresentation of material facts in connection with license applications. MTS agreed to a $400,000 civil penalty. Under the settlement agreement, MTS neither admitted nor denied the allegations.

This case illustrates why collecting an end-user statement is not enough on its own. Companies need to understand the actual end use, identify relevant funding and other parties to the transaction, and provide complete and accurate information in license applications.

Companies should establish procedures for determining when end-user or end-use information. The level of review should make sense for the company’s products, customers, countries, and risk profile.

The Decision That Was Easier to Hide Than to Fix

Lambda Research Corporation: When a compliance issue escalates

Sometimes the most frightening part of a compliance problem is not the original mistake. It is what happens after someone realizes there is a problem.

In October 2026, BIS announced an administrative enforcement settlement with Lambda Research Corporation. The matter involved charges under the EAR, including “acting with knowledge of a violation” which is listed under 15 CFR 764.2(e) and “engaging in prohibited conduct” which is under 15 CFR 764.2(a).

The settlement included a $2 million civil penalty, subject to suspension for one year and potential waiver if Lambda complied with the settlement requirements.

The important point for companies is that export compliance issues need to be addressed through a defined process, not handled informally or left for the enforcement officers to discover.

When an issue is identified, the company should determine what happened, preserve relevant records, assess whether additional transactions may be affected, and involve the appropriate compliance and legal personnel. Depending on the circumstances, a voluntary self-disclosure may also need to be considered.

A strong compliance program is designed to prevent violations before they occur by identifying potential risks, establishing clear procedures and enduring issues that are addressed before they result in noncompliance. The scariest part of a compliance program are the gaps and the worst time to figure out who is responsible for an export compliance investigation is after the government comes knocking.

The “We’ve Always Done It This Way” Nightmare

This is something heard very often in many companies and something I’ve seen in previous roles, and it may be one of the most common of compliance nightmares that’s avoidable.

Someone asks why a particular screening step is performed.

The answer- “That’s how we’ve always done it.”

Someone asks why a license exception is being used – “That’s what we have always used.”

Someone asks where the procedure is documented.- “It isn’t. (insert your compliance person’s name here) knows how to do it.”

And then (insert your compliance person’s name here) leaves the company. Suddenly, years of institutional knowledge walk out the door.

A compliance program should not depend entirely on someone’s memory. Procedures should be documented well enough so that another qualified employee can understand what needs to happen, when it needs to happen, and where to find the information needed to complete the task.

A well implemented Export Compliance Management Program aids with Classification decisions, license determinations, restricted party screening, end-use reviews, recordkeeping, and escalation procedures and prevents complacency.

If a decision cannot be explained or supported with records, it may be time to audit your compliance program.

Don’t Let Your Compliance Program Become the Horror Story

Most trade compliance problems do not begin with someone deliberately trying to violate the regulations.

The real-life cases above show that the consequences can range from substantial civil penalties to the loss of export privileges and serious disruption to a company’s international business.

They also show why the facts matter. A missing document, an omitted end use, an unauthorized export, and deliberate concealment are different compliance problems that require different responses.

A practical export management compliance program gives employees a way to identify and address these issues before they become problems. It establishes who is responsible, what information needs to be reviewed, when additional review is required, and what should be documented.

You do not need a haunted house to create a compliance nightmare. Sometimes all it takes is an outdated spreadsheet and nobody assigned to check it.

This Halloween, I urge you to examine your export management compliance program. Find the areas where the process depends on assumptions, memory, or “the way we’ve always done it.” And if you find your export management compliance program keeping you up at night, reach out to Export Solutions. We can help assess your current program, identify potential gaps, and put the right processes in place to help you sleep a little easier.