On September 29, 2025, the US Commerce Department's Bureau of Industry and Security ("BIS") introduced a significant interim rule update for two export control lists: the Entity List and Military End-User ("MEU") List. Together, the two lists impose export restrictions covering over 3,500 companies, organizations and individuals (“covered entities”), including for dual-use technologies that have both civilian and military applications. The rule update automatically includes subsidiaries that are at least 50% owned, directly or indirectly, by covered entities. The update brings BIS in line with the Treasury Department's Specially Designated Nationals and Blocked Persons list ("SDN List"), which also imposes a 50% rule on subsidiaries.
The rule update poses several challenges for sanctions compliance that will require a more investigative-intensive approach.
First, this is a significant update to the number of covered entities. Factoring in majority owned subsidiaries of covered entities potentially sweeps in thousands of new additions.
Second, the new rule factors in ownership by covered entities that are in the aggregate. This means that the ownership stakes of parent companies that are covered entities are added up. If a subsidiary is 50% owned by multiple covered entities, even when these have only minority stakes, then the company becomes covered under the new rule. For example, Harbin Institute of Technology, one of China's top universities that was added to the Entity List in June 2020, has direct and indirect investments in over 1,500 active companies across multiple high-tech industries. Though most of its investments are minority stakes, when factoring in the aggregate rule along with other parent companies that are on the Entity List, dozens of these companies will become covered entities.
Third, the onus is now on affected companies to identify the corporate networks of covered entities. The new rule automatically adds majority-owned subsidiaries, meaning these subsidiaries do not have to be specifically named in the lists themselves. Rather than screening a list of company names against what is in the Entity List, compliance with the new rules will require investigating direct and indirect ownership links to covered entities.
Fourth, mapping corporate networks and identifying subsidiaries will be a challenge due to incomplete information on covered entities. Entity List designations typically include only English-language identifiers and lack official company names (for example, in Chinese or Russian) and identification numbers. Identifying subsidiaries requires first being able to accurately determine whether a parent company is in fact a covered entity. Additionally, without official identifiers, the risk of false positives grows, especially for covered companies with common names.
Lastly, this isn’t just about identifying subsidiaries, but also about identifying parent companies. Companies have used obfuscation in corporate filings to hide ownership links with covered entities by, for example, reporting different company names from what is published on the Entity List. When examining ownership structure, compliance efforts will have to factor in the myriad name variations used by covered entities to circumvent these rules. This requires linguistic expertise and deep familiarity with corporate record reporting requirements and practices, especially for countries with a track-record of sanctions evasion.
The bottom line is that compliance controls will have to become more investigative-intensive to determine exposure to covered entities. Gone are the days when compliance was simply a matter of uploading a list of company names for screening. Organizations must leverage in-house or seek outside investigative expertise with country-specific knowledge to identify and map the corporate networks and affiliations of covered entities, to mitigate the associated risks and exposures that these changes will bring.
The new rule goes into effect 60-days after publication in the Federal Register, which is scheduled for September 30, 2025.
Previously, the Entity List and MEU List completely excluded all entities that were not specifically named on the Entity List/MEU List
