US BIS "Affiliates Rule" Closes Entity List Loophole, Effective September 29, 2025

The US Bureau of Industry and Security adopted a rule, effective September 29, 2025, that fundamentally changes who counts as a restricted party under US export control law. Until this rule took effect, the Entity List and the Military End-User List restricted specific, named companies and organizations. A buyer that shared an owner, a parent company, or a corporate structure with a listed party, but was not itself named on the list, fell outside those restrictions. BIS has now closed that gap. Any entity owned 50 percent or more, whether directly, indirectly, individually, or in aggregate by one or more parties already on the Entity List or the Military End-User List, is now itself subject to the same licensing restrictions as the listed party, regardless of whether that owned entity appears anywhere on the published list by name.

The rule carried a comment period running through October 29, 2025, and BIS built in a limited grace period for certain in-transit or already-contracted exports through December 1, 2025. Those transition windows have now closed, and the rule is in full effect. For a Thailand-based exporter or importer handling any US-origin goods, technology, or software, or any product with dual-use relevance, this is not a peripheral compliance update. It changes what "screening a counterparty" actually means in practice.

What the rule actually does

Before this rule, BIS export control jurisdiction attached to a transaction based on whether the named counterparty, its subsidiaries under certain narrower older tests, or the item itself, triggered a licensing requirement. The Entity List and Military End-User List worked as name-based blacklists: BIS added a specific company by name, and anyone transacting with that named company needed a license or an exception to proceed. A restricted party's separately incorporated subsidiary, joint venture, or affiliate, if not independently named on the list, was in a legal gray zone that many companies treated as clear.

The Affiliates Rule eliminates that gray zone by applying an ownership test rather than a name test. If a listed party owns 50 percent or more of another entity, whether that ownership is direct, indirect, held individually by one listed party, or aggregated across multiple listed parties acting together, the owned entity is automatically subject to the same restrictions as if it had been separately listed. According to law firm analyses from Skadden, Paul, Weiss, and Latham & Watkins, all of which reviewed the same BIS rule text and reached consistent readings, this test applies without BIS needing to take any further listing action against the affiliate itself. The restriction attaches automatically the moment the ownership threshold is met.

Why this closes a real loophole, not a theoretical one

The ownership-based workaround this rule targets was a known and, in some cases, actively used structure. A restricted party facing Entity List sanctions could route procurement through a subsidiary or joint venture that had never itself been individually reviewed and named by BIS, effectively using corporate structure to route around a restriction that was, in substance, meant to apply to the whole enterprise. Because the prior test was name-based, a counterparty due-diligence check that only searched a buyer's own registered name against the Entity List would return a clean result even where that buyer was wholly or majority owned by a listed party.

This is precisely the kind of gap that made restricted-party screening programs built purely on name-matching software insufficient even before this rule, and it is now formally insufficient as a matter of US export control law. A name-only screening check no longer reflects the actual scope of who is restricted.

What this means for a Thailand-based exporter or importer

Thailand sits at the center of significant US trade flows, and DeeMED's own client base, spanning pharmaceutical ingredients, medical devices, cosmetics formulations, and hazardous substances, regularly transacts with counterparties whose corporate ownership is not always transparent on the surface. Under the Affiliates Rule, the compliance question a Thai exporter must now answer before shipping any US-origin or dual-use-relevant good is no longer just "is this buyer's name on a restricted list." It is "who owns 50 percent or more of this buyer, and is any of those owners themselves restricted."

That is a materially harder question to answer from a standing start. It requires either the exporter or the counterparty to disclose beneficial ownership information, something many buyers will not volunteer without being asked directly, and it requires the exporter's screening process to check not just the buyer's registered name but any parent company, joint venture partner, or aggregated ownership structure sitting above it. For higher-risk transactions, particularly those involving buyers in jurisdictions or industries where Entity List or Military End-User List exposure is more common, requesting ownership disclosure directly from the buyer as a condition of the sale is now a defensible and increasingly necessary step, not an excessive one.

The practical effect is that any Thai exporter relying on a screening process built only for the pre-September 2025 name-based test now has an outdated compliance program. A transaction that would have cleared screening in August 2025 can fail the same check today if the buyer's ownership structure includes a restricted party, even where nothing else about the transaction has changed.

Interaction with Thailand's own dual-use export control regime

This US rule change lands on top of, rather than replaces, Thailand's own dual-use export licensing regime administered by the Committee on the Control of Goods Related to Weapons of Mass Destruction. A Thai exporter of dual-use-adjacent goods already has an obligation under Thai law to screen end users and end uses as part of the domestic licensing process. The Affiliates Rule adds a second, independent layer: even where a transaction clears Thailand's own licensing review, it can still trigger US jurisdiction if the item contains US-origin content and the buyer's ownership structure includes an Entity List or Military End-User List party. Neither regime substitutes for the other, and a shipment now needs to clear both.

Where the burden of proof now sits

One practical consequence of the ownership test worth spelling out: BIS did not build in a requirement that the exporter somehow have known about a hidden ownership structure before liability attaches. The rule's mechanics attach the restriction based on the ownership fact itself, not on whether the exporter was aware of it at the time of the transaction. That places the practical burden on the exporter or reseller to actively investigate ownership before shipping, rather than allowing a "we didn't know" position to substitute for having checked. For a Thai company selling into a buyer with an opaque or multi-layered corporate structure, particularly one involving holding companies in third countries, this means the absence of an obvious red flag is not the same as having verified there is no restricted ownership sitting above the counterparty.

What to do now

Any company that built a restricted-party screening process before September 29, 2025, should treat that process as due for review, not as still current. The rule's comment period and grace period have both closed, and enforcement exposure now runs from the effective date forward. A defensible screening program in this environment checks the counterparty's registered name against the relevant lists, and separately investigates or requests disclosure of the counterparty's ownership structure wherever the transaction involves US-origin content, dual-use classification, or a buyer in a higher-risk jurisdiction or sector. Documenting that ownership check, not just the name-match result, is what will distinguish a program that holds up under scrutiny from one that does not.

DeeMED's Global Trade compliance services build restricted-party and ownership-structure screening into the same review as Thai dual-use export licensing and HS classification, so a Thailand-based exporter or importer can confirm a counterparty clears both the US ownership-based test and Thailand's own licensing requirements before a shipment leaves, not after a bank or foreign customs authority raises a flag.