BIS Affiliates Rule 2026: Why CSL Screening Won't Be Enough

On November 10, 2026, a quiet change in U.S. export controls reshapes who exporters can legally sell to. The rule is called the BIS Affiliates Rule, and it extends existing export restrictions to the subsidiaries of already-restricted companies, not just the parents named on U.S. government lists. If you export products that contain any U.S.-origin parts, software, or technology, this reaches you, whether or not you are based in the United States.

Until now, checking a buyer's name against U.S. restricted-party lists was usually enough. After snapback, that check alone misses a whole category of restricted companies: subsidiaries that are not themselves listed. The U.S. government's main screening list will not display them. They exist only in ownership data. This article walks through who the rule applies to, what changes, when it takes effect, why today's screening falls short, what new duty it creates, which lists trigger it, and what to do in the days before snapback.

What is the BIS Affiliates Rule?

The BIS Affiliates Rule is an interim final rule published by the U.S. Department of Commerce's Bureau of Industry and Security on September 29, 2025. It extends Export Administration Regulations (EAR) license requirements to foreign entities that are at least 50% owned, directly or indirectly, individually or in aggregate, by one or more parties on the Entity List, Military End-User (MEU) List, or the subset of the SDN List identified in 15 CFR §744.8. The affiliate does not need to be separately listed.

The rule is modeled on the OFAC 50 Percent Rule, which has governed U.S. sanctions compliance since 2014, extending that ownership standard into dual-use export controls.

Before this rule, BIS applied a "legally distinct" standard. If a subsidiary of an Entity List parent was not itself named on the list, it generally fell outside Entity List restrictions. According to BIS, diversion schemes exploited this structure by routing U.S.-controlled goods through non-listed affiliates. The Affiliates Rule removes that workaround by attaching the parent's restrictions to any 50%-owned downstream entity automatically.

Who does the Affiliates Rule apply to?

The Affiliates Rule applies to anyone who exports, reexports, or transfers items subject to U.S. export controls, regardless of where the exporter is based. Three groups are typically captured.

U.S. exporters shipping items out of the United States.

Non-U.S. companies reexporting items that contain U.S.-origin content. If a product is manufactured in Korea, Germany, or Japan but contains more than the de minimis threshold of U.S.-origin parts or software (generally 25%, or 10% for certain controlled destinations), a reexport falls within U.S. jurisdiction under the EAR.

Non-U.S. companies handling foreign-made items captured by the Foreign Direct Product (FDP) Rule. Certain items produced outside the United States using U.S. technology or software can still be subject to the EAR, particularly in semiconductors and for destinations like China or Russia.

The rule reaches transactions even when they take place entirely outside the United States with no U.S. person involvement. An exporter in Seoul shipping a product with meaningful U.S. content to a 50%-owned affiliate of an Entity List parent in Shanghai is within scope, even if no goods cross U.S. borders.

One carve-out: U.S. subsidiaries of foreign listed parents are not currently within the rule's scope. If your supply chain has no U.S.-origin content and does not touch the FDP Rule, the rule does not reach you — though that is narrow for most complex manufactured goods.

When does the Affiliates Rule snap back?

The Affiliates Rule is scheduled to take effect again on November 10, 2026. It was originally effective September 29, 2025, but BIS suspended implementation on November 10, 2025 for one year. According to a White House fact sheet issued November 3, 2025, the suspension was tied to a trade understanding with China involving rare earth export licensing.

The Federal Register notice of November 12, 2025 sets the suspension window precisely. The amendments are stayed from November 10, 2025 until November 9, 2026. The rule text specifies that the license requirements and related provisions removed during the suspension are reimposed on November 10, 2026 unless BIS takes further action before then.

Suspended does not mean repealed. According to the Federal Register notice, BIS will continue to evaluate national security and foreign policy interests related to non-listed affiliates during the suspension, and the amendatory instructions for snapback are already written into the regulatory text.

Why won't the Consolidated Screening List be enough?

Because non-listed affiliates don't appear on the Consolidated Screening List. BIS stated in the rule preamble that the CSL "will no longer comprise an exhaustive listing of foreign entities subject to Entity List license requirements."

The CSL is a U.S. government database that aggregates the major restricted-party lists, including the Entity List, MEU List, SDN List, and others, into a single searchable source. It shows entities that U.S. agencies have individually designated. What it does not do is trace ownership chains. Under the Affiliates Rule, a foreign entity with no independent listing can still be restricted by operation of law if one or more listed parties own 50% or more of it. That ownership can be direct or flow through intermediate holding companies. It can be held by a single listed owner or aggregated across several.

In practical terms, a clean CSL hit on your counterparty no longer confirms compliance. You also need ownership data on that counterparty: who the shareholders are, what percentages they hold, and whether any of them trace back to a listed party.

Name screening matches strings. Ownership screening requires beneficial-ownership data, which is often incomplete or scattered across corporate registries in different jurisdictions.

What is Red Flag 29 and what does it require?

Red Flag 29, added by the Affiliates Rule to BIS's "Know Your Customer" Guidance in Supplement No. 3 to Part 732, imposes an affirmative duty on exporters, reexporters, and in-country transferors to determine ownership percentages. According to the rule, if you know, or have reason to know, that one or more listed parties own a foreign counterparty, you must determine what share they hold. If you cannot determine the percentage, you must either obtain a BIS license or rely on a license exception before proceeding.

The phrase "reason to know" is important. It is an objective standard. Publicly available information, past correspondence, news reports, or a counterparty's own disclosures can all trigger the duty. Willful blindness is not a defense.

Significant minority ownership is also flagged. Even below the 50% threshold, a material stake combined with other indicia of control — such as overlapping board membership or shared management — presents a diversion risk that requires additional due diligence.

Functionally, Red Flag 29 shifts the compliance question from "Is this party listed?" to "Who actually owns this party, and can I document that I tried to find out?"

Which lists trigger the Affiliates Rule?

Three sources of restrictions flow down to 50%-owned affiliates.

The Entity List, at Supplement No. 4 to Part 744 of the EAR, identifies foreign parties the U.S. government has determined are acting contrary to national security or foreign policy interests. According to BIS, as of September 2025 the list included more than 3,000 entries, with the largest concentration in China across industries like telecommunications, AI, biotechnology, and semiconductors.

The Military End-User List, at Supplement No. 7 to Part 744, identifies military end-users subject to restrictions on specified items. The list was established in 2020.

The subset of the SDN List referenced in 15 CFR §744.8 covers persons sanctioned under specific OFAC programs: those related to Russia's invasion of Ukraine, terrorism, weapons of mass destruction, and narcotics trafficking. Other sanctions programs, such as those targeting Iran or Venezuela, are governed by separate restrictions and are not incorporated.

If a foreign entity is majority-owned by parties from more than one of these lists, the Rule of Most Restrictiveness applies. The affiliate inherits the most restrictive license requirements, license exception eligibility, and review policy among its owners.

Not every BIS list is covered. The Unverified List and the Denied Persons List are not currently subject to the rule. Address-only Entity List entries also do not automatically bring entities at those addresses within scope.

What should exporters do before November 10, 2026?

Four practical steps to close the gap.

First, map existing counterparties to ownership data. Run current buyers, distributors, end users, and freight intermediaries through a beneficial-ownership source, not just the CSL. Corporate registries, third-party ownership databases, and direct questionnaires all contribute. The goal is a documented record of who owns each counterparty, at least to the level where aggregated listed ownership falls below 50%.

Second, update export questionnaires and end-user certifications. Ask for ownership disclosures, jurisdiction and date of formation, and references to corporate registry filings. Include representations about restricted-party ownership and a duty to notify of material changes.

Third, review screening vendors. Ask whether their tool aggregates ownership across multiple listed parties. Not all do. Confirm whether the tool sources beneficial-ownership data and how frequently it updates.

Fourth, document ownership determinations. Red Flag 29 is about demonstrating affirmative effort. Contemporaneous records of what was checked, what sources were used, and how conclusions were reached are the evidence that you met the duty.

If you discover exposure, BIS allows covered affiliates to petition for exclusion from a listed parent's entry if they can demonstrate low diversion risk. These petitions are reviewed by the End-User Review Committee. The process is formal, but it exists.

Key takeaways

The BIS Affiliates Rule returns November 10, 2026, after a one-year suspension.
The rule reaches any exporter handling U.S.-origin goods, software, or technology — U.S. or non-U.S. based.
Foreign entities 50% or more owned by Entity List, MEU List, or §744.8 SDN parties are automatically restricted, directly or indirectly, individually or in aggregate.
The Consolidated Screening List is no longer exhaustive. It shows named parties only.
Red Flag 29 creates an affirmative duty to determine ownership percentages. Failure to resolve it requires a license.
Integrate ownership-tracing into screening, update counterparty questionnaires, confirm your vendor's aggregation capability, and document your determinations.