The Bureau of Industry and Security (BIS) issued new guidance for financial institutions on export control compliance on 9 October 2024. This represents the latest step in BIS’s intensifying focus on financial institutions and their responsibilities under the Export Administration Regulations General Prohibition 10 not to finance unlawful dual-use trade.
Export controls have laudable national security objectives. They are intended to protect defence and dual-use items – meaning goods, software and technology that can be used for both military and civilian purposes – from being acquired by adversaries. They are designed to protect the West’s technology advantage, recognising that it is critical in future warfare – and also on the battlefield of today. High-quality Western components and innovative and emerging technologies are high-priority targets for illicit procurement networks.
The latest requirements from BIS may have the opposite effect. While the document issued by BIS is entitled ‘guidance’, financial institutions know from prior experience with regulators that its recommendations are in reality not optional. A bank that decides not to implement the guidance, or to apply different controls, may find itself under scrutiny during regulatory examinations – and in an exposed position if it later faces enforcement action for processing a payment for an illegal export. To use a military expression, financial institutions are being ‘volun-told’ to implement these requirements, rather than the guidance being truly ‘volun-tary’.
Moreover, the controls specified in the guidance are extensive and complex to implement, particularly when banks rarely have access to the data on the underlying trades – such as the item, the end user and the end use – which are necessary to make decisions on what is being financed by wire transfers. ‘Extensive and complex’ ultimately means cost.
Unintended Consequences
The outcome may be ‘de-risking’. De-risking refers to financial institutions exiting clients or categories of clients because the cost of compliance is unsustainable. To put it another way, the compliance costs for these clients are higher than the revenue they generate. For banks, de-risking can be a commercially necessary and risk-prudent decision. However, the effect can be to exclude or restrict access to the financial system for those who need it most.
We’ve already seen de-risking in sectors such as non-profits and even whole countries, and its adverse effect on their ability to sustain operations and achieve economic growth.
Applying this to the defence sector, banks may find that primes – meaning the largest defence contractors – remain commercially viable clients. Banks may also have more confidence that larger defence contractors have the resources to maintain effective export control compliance programmes, reducing the risk that the bank will be exposed to financing export control violations. (Though even for defence primes, this may not always hold true, as the recent enforcement action against Raytheon demonstrates.)
However, the same does not apply to smaller companies contributing to the defence mission, including start-ups and those in their early growth phases. For example, these smaller companies comprise 73% of the US defence industrial base and provide ‘outsized, asymmetric, technological advantages that are critical towards maintaining our edge against near-peer competitors’, according to the US Department of Defense. Smaller companies make a critical contribution to the innovation and emerging technologies necessary to advance and maintain the West’s military technological advantage.
But for banks, these non-traditional and smaller defence-related businesses may represent lower revenues and higher risks. They may be rated as higher risk because smaller companies often do not have the resource or depth of experience to implement a fully effective compliance programme, given the complexity of export controls. Smaller companies may also be targeted by adversaries who perceive them as more vulnerable. Both risk factors – and these are just examples – increase the risk that a bank will be exposed via its clients to export control violations.
The outcome may be that these smaller firms, so critical to the defence mission, are ‘de-risked’ by banks, removing or limiting their access to financial services and hindering their operations and growth.
International Implications
It is not only US financial institutions that are subject to the new guidance on export controls. BIS’s jurisdiction is extensive and extra-territorial, meaning financial institutions globally may be subject to enforcement action too. Without entering the labyrinth of export controls requirements, at a high level, dual-use restrictions apply to items in the US – including those in transit, items originating in the US, and any subsequent re-exports. They also apply to foreign-made items that incorporate more than a threshold amount of controlled US-origin items, or which are made using US technology or software. This jurisdiction is extensive and significantly broader than equivalent requirements in other jurisdictions such as the UK or EU. The implication is that multi-national financial institutions servicing clients in aviation, electronics and other sectors may also find themselves subject to BIS’s requirements and jurisdiction.
Impact on US Defence
The adverse effect of US export controls on innovation by allies is already recognised. The US Defense Innovation Board identified that foreign technology companies are ‘frequently rebuffed’ due to US export control requirements and that ‘essential technological advances are going unnoticed as they occur outside the United States’. These constraints now extend beyond the goods and technologies themselves to the financial services that sustain and advance these innovative businesses.
The solution is not to impose more demands on financial institutions. Rather, it is coordinated joint action between the public and private sector. There is already a way mapped out: in more established areas of illicit finance, such as money laundering and terrorism financing, it is best practice to hold a consultation process on policy objectives and proposed expectations before imposing new requirements.
BIS should pause its new guidance on export controls for financial institutions until this can occur. Subsequently, it can engage with financial institutions to negotiate the most effective way to achieve policy objectives, while recognising banks’ strengths and limitations.
We are all committed to the same purpose of protecting our national and collective security, and through the public and private sector working together, we can achieve a united front.
© Catherine Woods, 2025, published by RUSI with permission of the author
The views expressed in this Commentary are the author’s, and do not represent those of RUSI or any other institution.
For terms of use, see Website Ts&Cs of Use.
Have an idea for a Commentary you’d like to write for us? Send a short pitch to [email protected] and we’ll get back to you if it fits into our research interests. Full guidelines for contributors can be found here.
This post was originally published on here
