What credit professionals need to know about the BIS Affiliates Rule

In credit management, proper risk management begins with knowing your customer—from their legal name to their industry and risk tolerance. In global trade, it means digging deeper to understand who truly owns, controls and benefits from the customer. 

Why it matters: International trade brings forth additional risks, driven by complex ownership structures, geopolitical tensions and regulatory scrutiny. A recent regulation from the Bureau of Industry and Security (BIS) introduces new layers of compliance, reshaping risk management and Know Your Customer (KYC) practices for global transactions. 

Standard regulations: An overview 

For international B2B transactions, credit professionals are required to comply with regulations from the Office of Foreign Assets Control (OFAC) and Export Administration Regulations (EAR). At the same time, they are also required to follow directives issued by the United Nations and the European Union. In addition, they are obliged by law to consult restricted or denied party screening lists, which identify parties with whom companies are prohibited or restricted from doing business, including the Entity List in the EAR. 

These parties include individuals, groups or countries involved in activities such as terrorism, narcotics trafficking or the proliferation of weapons of mass destruction, which pose a threat to U.S. interests. OFAC’s enforcement activities include freezing assets and restricting trade to pressure targets into changing their behavior. Violating such regulations can result in severe penalties, including fines, loss of export privileges, uncollectible receivables, reputational damage and even criminal charges. 

The Affiliates Rule 

On Sept. 29, 2025, the BIS issued the Affiliates Rule or 50% Rule, which imposes restrictions on entities that are 50% or more owned, directly or indirectly, by one or more parties listed on the Entity List, Military End-User (MEU) List or certain Specially Designated Nationals (SDN) and Blocked Persons List. It requires businesses to conduct more extensive due diligence to map out complex ownership structures, including indirect ownership, to avoid violations. 

The rule applies globally, restricting license eligibility and review policies, with most restrictive rules across lists prevailing. Under the new “Red Flag 29” duty, established through the Affiliates Rule, companies must resolve unclear ownership percentages by obtaining BIS licenses before proceeding. Additionally, exclusions from being captured as an affiliate and therefore subject to restrictions require BIS End User Review Committee approval, highlighting importance of proactive compliance and ownership analysis.  

“Part of the rationale for publishing the Affiliates Rule was to address any gaps that BIS saw in the regulation and the ability in those gaps for exporters to be able to divert technology that the U.S. protects,” said Ola Craft, senior trade advisor from Lowenstein Sandler LLP (Washington, D.C.), during FCIB’s October Global Expert Briefing. “If a purchase order was placed before Sept. 29 and is pending fulfillment, the rule does apply. If it was placed after Sept. 29, it would be subject to the rule. The applicability of the rule hinges on the date of export.” Items that were already en route on Sept. 29, 2025, may proceed provided delivery is completed by Oct. 29, 2025. 

Violating the EAR can trigger severe consequences, including criminal penalties for willful misconduct of up to 20 years’ imprisonment and $1,000,000 in fines per violation, as well as civil penalties that can reach the greater of a statutory maximum per count (adjusted annually; commonly in the hundreds of thousands of dollars) or twice the value of the transaction.  

Civil liability does not require willfulness and can be paired with powerful administrative measures such as denial of export privileges (temporary or permanent), Temporary Denial Orders, license suspension or revocation, placement on restricted party lists (e.g., Entity or Unverified Lists) and seizure or forfeiture of unlawfully exported items. Penalty determinations consider aggravating factors (willful/reckless conduct, concealment, patterns, restricted parties/embargoes, national security harm) and mitigating factors (effective compliance programs, cooperation, remediation and timely voluntary self-disclosures, which can substantially reduce penalties). Beyond fines and prison, collateral impacts include supply chain disruption, banking and insurance friction, reputational damage and long-term operational constraints. 

Steps for compliance: A creditor’s guide 

#1: Ownership mapping and due diligence: By mapping ownership chains and conducting due diligence, credit professionals can identify direct and indirect ownership exceeding 50%. “There may be processes and ownership mapping already in place due to compliance with OFAC regulations, but those can be adapted in accordance with new regulations,” Craft said. 

#2: Enhanced KYC and escalation: Improve KYC workflows to include “Red Flag 29” and define clear escalation for unverifiable ownership. “If all the documentation and diligence efforts aren’t able to determine ownership, resource planning and trade compliance costs associated should be updated in order to account for these additional workflows and processes,” said Craft. Companies should consult and escalate to their compliance departments or trade counsel to undertake risk analysis.

#3: Compliance rules and transaction review: Update compliance rules and review transactions to identify affiliates and licensing needs. “Make sure that the most restrictive standard (across applicable lists including the OFAC, Entity List and Military End User List) is applied to any pending transactions and that they capture the Affiliates Rule,” Craft said. “Also, determine whether the temporary general license for that 60-day period is available or whether a license may be required to conduct that transaction.” 

#4: Training and vendor management: Provide training across departments and update vendor processes for ownership screening compliance. For example, inform the sales, logistics, procurement and finance departments amongst others, and bring any potential impacted transactions for review. “Companies should also have the option of pursuing an exclusion request if there is a need to transact with an affiliate that is subject to the 50% rule and the option to prepare an application to BIS to request an exclusion from this rule for that particular affiliate,” said Craft. 

Advisory services 

Outside of your company’s compliance processes, there are outside advisors that may be able to help who are experienced in compliance, strategic license management and regulatory adherence support and risk minimization continuity. 

• Expertise in compliance: Specialized advisory services help navigate the complex Affiliates’ Rule with expert ownership diligence and risk assessments. 
• Strategic license management: Advisory services support license strategy development, including scoping and use of the Temporary General License (TGL). 
• Regulatory adherence support: Experienced professionals assist in preparing exclusion requests and updating compliance programs to meet evolving regulations. 
• Risk minimization and continuity: Partnering with advisory services minimizes risk and ensures operational continuity amid changing export control rules. 

“Screening services have already been adapted to cover this rule,” said Craft. “Screenings can be done on an ad hoc basis as transactions occur, or you can purchase a service and do those screenings in-house.” 

The bottom line: For credit professionals, BIS’s new law underscores the importance of going beyond surface-level vetting. Knowing who ultimately owns or controls your customer is essential to protecting your company from financial loss, legal penalties and reputational harm.