Export compliance for SMEs: rules of origin, sanctions and dual-use checks

Export compliance is often framed as a large-company problem, yet the structure of European trade says otherwise. Eurostat reports that small and medium-sized enterprises made up 98% of exporting enterprises in the EU in every year from 2017 to 2022. In Germany, according to the national statistics office, 258,000 of the 267,000 companies that exported goods in 2023 were SMEs. The legal duties attach to the exporter of record, not to its headcount.

Dependence on SMEs varies sharply by country. Eurostat finds SMEs generated 37% of EU export value in 2022, but 91% in Cyprus and 77% in Estonia, against 25% in France, 24% in Germany and 19% in Ireland. Where small firms dominate export value, as in the Baltic and Mediterranean economies, a single sanctions failure can matter to national trade flows as well as to the company concerned.

Large exporters hold the compliance staff, the licensing history and the legal budgets. Eurostat shows that large enterprises were 3.8% of extra-EU exporters yet accounted for 69.7% of the value. A mid-sized supplier selling into their chains will therefore be asked for assurances, declarations and end-use statements, often at short notice and in the buyer's format.

For a Head of Supply Chain the implication is plain: you will be judged against the same rules as a multinational, with a fraction of the resource. The practical response is to decide what must be controlled, put one person in charge, and make the control part of how orders are processed. Start by listing the markets, products and counterparties that carry real exposure.

There is also a customer-facing reason to act. Buyers, banks and insurers increasingly send due-diligence questionnaires to their suppliers and ask for named responsibility, screening practice and records. A supplier that can answer in a page, with a named owner and a dated test, wins the contract faster than one that has to commission a policy after the question arrives. Compliance maturity is becoming a sales qualification as well as a legal duty.

What to do this quarter: list the countries where you sell, mark those that attract sanctions or licensing attention, and ask your largest ten customers where the goods are used and who ultimately owns the buyer. Those two questions alone surface most of the exposure in a small export book, and the answers become the first entries in your counterparty file.

Dual-use goods are civilian items with potential military or surveillance use, and the category includes many industrial products: sensors, electronics, software, certain chemicals and machine tools. The European Commission reports that in 2024 Member States authorised dual-use exports of €77.6 billion, up from €71 billion the year before, equal to 3% of total extra-EU goods exports. That is a large controlled flow, and it is not confined to defence primes.

Authorisation is not automatic. The Commission records that 487 transactions involving dual-use items were denied by Member States on grounds of end-use security risk in 2024. Destination matters as well: China took 25% of authorised value, the United States 21%, the United Kingdom 7%, South Korea 7% and Ukraine 3%. Controls therefore sit alongside everyday commercial markets, not only distant or sanctioned ones.

The most common SME failure is not defiance but unawareness. A firm that has never classified its products cannot know whether a standard item needs a licence for a given destination, and a distributor that resells to an unfamiliar end user may not ask where the goods are going. Regulators do not treat ignorance as a defence where the item is plainly in a controlled category.

Make classification the first control. Assign a control-list code, or a documented determination that the item is not listed, to every product and every software or technical-data package you export. Record who decided and when, review it when the specification changes, and attach the result to the product master record so that it travels with every order rather than living in an email.

Many halted exports share a pattern: the item was ordinary, the buyer was new, and the end use was never asked about. The cases are rarely dramatic. A distributor resells to a party nobody knew, a software update crosses a border as an email attachment, or a spare part is shipped without anyone checking its code. Dual-use risk lives in routine transactions, which is why it needs routine controls rather than annual reviews.

What to do this quarter: run a simple classification sprint. Engineering supplies the technical specification of each product, the compliance owner checks it against the EU control list and the UK and US equivalents where relevant, and the result is stored on the product record. Aim to finish the top fifty products by value first, then the long tail as specifications change.

The legal baseline in the EU changed with Directive 2024/1226 on criminal offences for breaching restrictive measures. White & Case notes that Member States were required to implement it into national law by 20 May 2025. For companies, fines can range from 1% to 5% of total worldwide turnover, or fixed amounts from EUR 8 million up to EUR 40 million, depending on the offence.

The Directive also reaches individuals. Offences involving military or dual-use items require a maximum term of imprisonment of at least five years, and some offences are triggered where the value of the goods or services involved is a minimum of EUR 100,000. Serious negligence is punishable, at least where conduct relates to dual-use items. The risk is therefore not limited to knowing evasion; careless process can fall within scope.

The sanctions themselves keep widening. On 23 October 2025 the EU Council adopted its 19th package against Russia, adding further individual listings to an already dense regime. For an exporter, every package changes who can be sold to, what can be shipped and which intermediaries are acceptable, and the changes take effect at once, without a grace period for ongoing orders.

The implication for a supply chain leader is that screening can no longer be an occasional exercise by the finance team. Name an owner for sanctions updates, subscribe to the official notices, and agree with your bank and freight forwarder who screens what. Where your legal duties and theirs overlap, write down which party holds responsibility for each check.

Penalty exposure also depends on how a firm behaves once a problem is found. Regulators describe voluntary disclosure, cooperation and remediation as relevant factors in their assessments, and the OFSI case mix, with many warning letters against few penalties, is consistent with that. An exporter with a logged owner, a clear incident process and a history of testing is better placed to disclose early and to keep a breach small.

What to do this quarter: draw a one-page map of every party in your sanctions chain, from customer through freight forwarder and bank to insurer. Ask each what they screen and what they expect you to screen. Gaps and duplications show up immediately, and the map becomes the agreed division of responsibility if a question arises later.

Enforcement in the UK shows how this works in practice. The Office of Financial Sanctions Implementation brought 57 enforcement actions in 2024/25, closed 241 cases and had 240 active cases in April 2025, according to analysis of its annual review by Herbert Smith Freehills Kramer. Of the closed cases, two ended in a monetary penalty and 22 in a warning letter.

That distribution matters. Most cases do not end in a fine, because the regulator weighs self-disclosure, the quality of controls and the seriousness of the breach. Where penalties do follow they can be material: OFSI fined Markom Management Limited £300k in July 2025 over a transfer to a Russia-listed individual. Reported frozen assets also rose from about £24.4bn to £37bn, which shows how much more is now visible to the authorities.

For goods, HMRC publishes compound settlements. Duane Morris reports three settlements agreed in January and February 2025, totalling about £3.7 million, ranging from £10,900 to £3,231,762.40 for unlicensed exports of military goods. A separate settlement of just over £1.1 million was paid in May 2025 for breaches of the Russia sanctions regulations, as noted by Strong & Herd.

Exposure is not confined to Europe. The US Export Administration Regulations carry civil penalties of up to $374,474 or $377,700 per violation, according to DLA Piper, and criminal fines of up to $1 million with up to 20 years of imprisonment. Records must be kept for a minimum of five years. A European exporter shipping US-origin content must therefore design its files for the longest look-back.

Preferential origin also supports margin discipline. Where a trade agreement offers a lower duty, the exporter and its customer can share the gain, and that conversation is far stronger when the exporter can show a supplier declaration, a bill of materials and a rule of origin applied correctly. Make origin evidence part of the quotation pack for key accounts and track the claims made, accepted and queried each quarter.

What to do this quarter: choose one past incident or near miss and write it up in half a page. State what happened, which control would have stopped it and who owns that control now. A short internal record of lessons learned is exactly the kind of evidence regulators weigh when they assess whether a firm took reasonable care.

Scale, in these records, usually means value and duration, not the size of the exporter. A small company that ships one unlicensed consignment can face a settlement proportionate to the goods; a company that repeats the breach after a warning faces something far heavier. That is why the first disclosure decision matters. Agree in advance who may authorise a voluntary disclosure and how quickly legal advice can be obtained.

Rules of origin decide whether a product qualifies for a preferential tariff under a trade agreement, and the International Trade Centre notes that global trade is governed by more than 400 regional trade agreements and preferential arrangements. For an SME, the question is not academic. A correct origin claim can make a product cheaper at the border than a competitor's; an unsupported one can lead to retrospective duty demands and loss of the preference.

The same body reports that rules of origin are the most common source of constraints for micro, small and medium enterprises, based on its business surveys in more than 60 countries. The burden is usually evidence: bills of materials, supplier declarations, cumulation rules and processing records that must be assembled long after the goods have shipped. Firms without that evidence often pay full duty rather than risk a claim.

Origin and sanctions controls share inputs. The same bill of materials that proves a product's originating content also shows whether a component is sourced from a restricted jurisdiction or a listed supplier. A company that builds this file once, at product level, gets a preferential-tariff capability and a sanctions diligence trail from the same effort.

For the Head of Supply Chain, the action is to treat origin as a data problem. Ask suppliers for long-term origin declarations, keep a current bill of materials for each exported product, and note the rule you are relying on for each agreement. Review the top ten products by export value first; that usually captures most of the benefit and most of the risk.

A useful discipline is to separate policy from procedure. The policy is one page: who owns export compliance, what the firm will not ship, and when to stop an order. The procedure is the checklist and the system configuration. Review the policy annually with the board, and the procedure monthly with operations. This division keeps the document short enough to be read and the routine specific enough to be followed.

What to do this quarter: choose the three trade agreements that matter most to your sales and confirm the rule of origin applicable to your top products under each. Where a product fails the rule narrowly, ask procurement whether a change of supplier or process would qualify it. Small sourcing changes can unlock preferences worth more than the compliance effort.

Our reading of the enforcement record is that serious problems cluster around a handful of avoidable gaps: no product classification, no counterparty screening, weak end-use checks, poor origin evidence and no clear owner. Each can be closed with a modest routine. The exhibit below sets out the sequence we recommend for a growing exporter, from classification to retention of records, in the order a shipment actually moves.

The owner should be someone with authority over the order flow, such as the supply chain or operations lead, supported by legal advice when needed. Legal counsel should set policy and handle exceptions, but should not be the person who sees every order. Placing the control in operations means checks happen before dispatch rather than after a query arrives from a bank or a carrier.

Keep the routine proportionate. A company selling standard goods to a few established customers in low-risk markets needs a shorter version than one shipping electronics through distributors to emerging markets. Write down why the routine is sized as it is; a proportionate, documented approach is easier to defend than either an elaborate system nobody follows or no system at all.

Finally, test it. Once a quarter, pick five recent orders and trace each from quote to shipment, confirming that classification, screening, licence check and origin evidence exist and are retrievable. A control that cannot be shown to work in an hour is unlikely to survive a customs audit, a bank query or a customer's due-diligence questionnaire.

Finally, remember that compliance changes are cheapest before growth. A company with a handful of repeat customers can classify its catalogue, screen its accounts and organise its origin files in a few weeks. The same job after entering six new markets, adding distributors and acquiring a competitor is far more complex. Treat export compliance as part of the growth plan and fund it as an enabling investment rather than an overhead.

What to do this quarter: schedule the first trace test. Pick five orders, ask the owner to assemble the classification, screening, licence and origin records for each, and time how long it takes. Anything not found within an hour becomes a corrective action with a name and a date, and the results go to the managing director.

The strongest compliance programmes are invisible to sales teams because they are built into the systems that raise quotes and release orders. Add a mandatory field for product classification, a screening step on every new customer or consignee, and an order hold that only the compliance owner can clear. If a control depends on goodwill and memory, it will fail in the week of quarter-end shipments.

Evidence is the second half of control. Store screening results, licence decisions, end-use statements and origin declarations against the order, in a form that can be exported on request. The US rule requiring records for a minimum of five years is a useful default for exporters with American content, and the same discipline helps with customs audits in Europe and the UK.

Measure a few things monthly: orders held and why, new counterparties screened, licences applied for and refused, and origin claims made. Share the figures with the finance director and the managing director. A short monthly review turns compliance from a silent cost into a visible indicator of how safely the business is growing, and it gives the board a fair view of residual risk.

If you are expanding into new markets, run the routine before the first order, not after. Market-entry plans should include classification, licensing, sanctions diligence and origin analysis as workstreams alongside distribution and pricing. That sequencing avoids the common outcome in which a promising export lead stalls at the border for reasons that could have been identified in the first week.

What to do this quarter: add export compliance to the board agenda as a standing five-minute item. Report the monthly indicators, any refusals or holds, regulatory changes affecting your markets, and the status of corrective actions. A visible, short, regular report is the cheapest way to keep a small company honest about a risk that rarely announces itself in advance.

One more practical point is change control. Sanctions lists, control lists and trade agreements all change, often with immediate effect, so the routine needs a trigger for review. Subscribe the owner to official notices, record each change that affects your products or markets, and note what action was taken and when. A simple change log, reviewed monthly alongside held orders, shows a regulator or auditor that your controls keep pace with the rules.

Karter McKinley supports growing exporters with market-entry planning that builds classification, screening and origin work into the first order rather than the first problem. We help supply chain teams design a proportionate compliance routine, name an owner and connect it to distribution, pricing and partner selection. We are not a law firm, and licensing and legal determinations remain with qualified advisers.