Earlier this month the United States government imposed some of its toughest trade restrictions yet on ZTE Corp, China’s second-largest smartphone and telecom equipment maker. These sanctions, authorities say, stem from evidence that ZTE violated U.S. controls on exporting American technology to Iran and other countries. According to a U.S. Commerce Department notice on March 8, 2016, ZTE allegedly set up several shell companies to illicitly re-export controlled items to Iran in violation of U.S. export control laws. U.S. authorities have since granted ZTE a three-month reprieve to attempt to undertake unspecified corrective action, before the sanctions formally kick in. The restrictions, when imposed, would immediately bar all U.S. companies from selling U.S.-made technology, software, equipment, and components (such as microprocessors and chips for smartphones) to ZTE. Such restrictions would undoubtedly impact ZTE’s $15.5 billion in U.S. sales, and have already led to the suspension of trading for ZTE’s stock on the Hong Kong Stock Exchange.

Why do companies – even large multinationals like ZTE – often overlook compliance with U.S. export control laws, despite the serious repercussions for noncompliance, including denial of export privileges as in this case? One of the possible reasons could be that in many instances, organizations are not completely familiar with the nuances of the U.S. export control regime. Regardless of the underlying reasons for non-compliance, the consequences of “getting it wrong” are invariably quite costly, involving both penalties and logistical restrictions. Additionally, a publicized failure to comply with export control rules can also indelibly tarnish a company’s reputation in a manner that can undo years of goodwill. It is therefore imperative for businesses to have a clear and nuanced understanding of their export control responsibilities, both domestically and in the international market. This article discusses some of the important issues that companies should take heed, to avoid potential compliance failures and hence minimize risk exposure:

  1. Understand and comply with U.S. export control laws

Before doing business with Iran, businesses should be aware of all applicable U.S. export control laws, to ensure that the underlying transaction is not prohibited, and does not require a special license from the U.S. government. U.S. export control laws encompass a comprehensive set of federal regulations that broadly prohibit commerce with certain countries, including Iran, for foreign policy and national security reasons. The three major U.S. regulations in place governing export control laws are the Export Administration Regulations (EARs) administered by the U.S. Department of Commerce; the International Traffic in Arms Regulations (ITARs) administered by the U.S. Department of State; and the Office of Foreign Asset Control (OFAC) regulations administered by the U.S. Department of Treasury.

The EARs restrict access to certain items by countries or persons that might apply them to uses inimical to U.S. interests. The ITAR regulations address export restrictions pertaining to defense articles and defense services. The EARs and ITARs also apply to civilian goods that could have unintended military applications. In addition to ITARs and EARs, OFAC also administers and enforces economic and trade sanctions against targeted countries, regimes, individuals and entities. The OFAC sanctions can be either comprehensive or selective, and include the blocking of assets or trade restrictions to accomplish U.S. national security goals. Businesses should be aware that certain international conventions to which the U.S. is a party, such as the United Nations Convention on Contracts for the International Sale of Goods (CISG), have the effect of U.S. federal law, and can concurrently govern or affect their transactions. Non-compliance with any of the operative export laws can carry heavy penalties, both civil and criminal. It is therefore incumbent upon businesses to learn how to recognize export control issues, in order to ensure compliance.

  1. Virtually every commercial product is subject to the export control laws

The EARs cover most commercial products and technologies created in the U.S. or by U.S. persons, as well as foreign products that 1) move in commerce through the U.S., or 2) are created using U.S. technology. The scope of products and technologies covered by the EAR is vast, and businesses must therefore remain vigilant to ensure that they comply with all provisions of the relevant sanctions.

The ITARs control items and technology specifically developed for military or space applications. The definition of what may constitute ITAR-controlled items appear narrow, but deceivingly so. For example, a software that has been modified specifically for use with a military item will be considered a military item for purposes of the ITARs, even if that was not the software’s original intended purpose. Another example is electric switches, which can also be deemed a prohibited product and be subject to export control regulations because of their potential use for military purposes. These types of prohibited products are known as “dual use” items, which are not dangerous in and of themselves, but can be used as devices or components for militiary products. Whether or not an item is legally considered “dual use” is rarely apparent.

  1. Apply for an export license

Businesses have the burden of determining whether the export of any item requires a license. When making that determination, companies must consider the following questions: 1) Which items are being exported? 2) Where are the items being exported to? 3) Who will receive the items? and 4) What will the items be used for?

An export license will be required for a shipment if the proposed export of an item is to an embargoed country, to an end-user of concern, or in support of a prohibited end-use. In that case, the company should expeditiously submit a license request with the appropriate U.S. government agency for the item that they wish to export. Such license requests typically go through an extensive review process, including review by interested U.S. government agencies such as the Department of Defense, Department of Energy, as well as the Department of State. If a license is not granted, companies must not engage in the transaction.

  1. Develop and implement a robust compliance program

The ZTE case has made clear that even large, multinational corporations with billions of dollars in revenue can have a lapse in their U.S. export control compliance, and be held accountable for violations. Implementing a strict and effective compliance program can go a long way toward cultivating credibility among U.S. regulators. This means ensuring employees are not only aware of their export control compliance responsibilities, but are also up-to-date with any changes to export control laws and regulations. Companies should also establish a holistic audit system to confirm that all policies and procedures are appropriately implemented. This can include a requirement that all senior representatives make a written statement of their commitment to export control compliance. Most critically, companies must institute robust procedures to identify red flags and manage suspected non-compliance with export control laws. Avoiding transactions with red flags would not insulate a company from liability, but would usually be considered a mitigating factor in an enforcement proceeding. In fact, detecting and reporting suspicious approaches can go a long way in showing a company’s commitment to export control compliance.

Conclusion

Despite a recent thaw in relations, the U.S. embargo on Iran remains largely in place, and any proposed transactions with Iran must be evaluated with both caution and appropriate due diligence. Businesses need to know with absolute clarity as to where they stand and what they should do, in order to minimize legal exposure when doing business with Iran. Penalties such as denial of export privileges, even on a temporary basis, can have long-term implications for the organization’s financial and reputational wellbeing. Further, individuals and corporations alike can incur severe civil and criminal penalties for failure to comply. For these reasons, companies must recognize the potential for choppy waters when doing business any sanctioned country or prohibited entity/individual, and allocate appropriate resources to focus on the need to strengthen their respective export control compliance programs.