What Changed and Why It Matters
For years, compliance professionals relied on the "exact match" principle for screening against the Bureau of Industry and Security (BIS) Entity List. If a company wasn't explicitly named on the list, many assumed it was safe to do business with.
That assumption is on borrowed time. Following the lead of the Treasury Department's Office of Foreign Assets Control (OFAC), BIS adopted an ownership extension in September 2025. The "BIS 50 Rule" (formally the Affiliates Rule) provides that restrictions applying to a listed entity also apply to any entity owned 50% or more by that listed party.
BIS stayed that rule before it took hold; the status panel above says where it stands today. So treat this page as a deadline to prepare for rather than a requirement in force today, with the important caveat that OFAC's own 50% Rule is enforced right now, and the EAR's Know Your Customer duties never went anywhere.
What Changes If the Rule Takes Effect
Once the rule takes effect, screening the published text of the Entity List will no longer be enough: you will need to screen the ownership graph of every counterparty to detect hidden links to restricted entities. Two reasons to build that capability before the date: OFAC's 50% Rule already requires ownership resolution today, and the EAR's Know Your Customer red-flag duties already apply to affiliate relationships.
How the BIS 50 Rule Works Once It Takes Effect
The rule is mathematical and ruthless. The mechanics below describe how it would operate once in effect; they are not a description of what the EAR requires while the rule is stayed. It accounts for three types of ownership structures that can trigger a block:
1. Direct Ownership
This is the simplest scenario. If Entity List Party A owns 51% of Company B, then Company B is treated exactly as if it were on the Entity List itself. No license exceptions apply, and license requirements are identical.
2. Indirect Ownership
Restrictions flow down through corporate chains on a threshold basis. If Entity List Party A owns 100% of Intermediate Corp, Intermediate Corp is itself restricted, and its full 50% of Target Company is attributed. Target is covered. Do not multiply 100% × 50% as if the rule were a scaled economic interest. OFAC FAQ 401 is the verified worked example of this method; BIS hop arithmetic should be confirmed with counsel independently.
3. Aggregate Ownership (The "50% Rule")
This is the most common trap. You must sum the ownership stakes of all restricted parties.
Example: Aggregate Ownership Calculation
Ownership Aggregation: Worked Scenarios
You cannot view restricted owners in isolation. You have to view them as a coalition. The scenarios below show how BIS aggregation would operate if and when the Affiliates Rule takes effect; the rule status at the top of this page says where it stands. The same aggregation math already governs OFAC's 50% Rule, which is in force today, so the calculations are worth running now either way.
Scenario A: Simple Direct Aggregation
- Owner 1 (Entity List) 25%
- Owner 2 (MEU List) 25%
- Total Restricted 50%Result: covered if and when the rule takes effect
Scenario B: Indirect Chains (The "Waterfall")
If a restricted party owns 50% or more of an Intermediate Company, that Intermediate Company is treated as if it were the restricted party itself.
→ Intermediate Corp is itself restricted.
2. Intermediate Corp owns 40% of Target Company.
→ Treated as if Restricted Party A owns 40% of Target Company. Do not multiply 51% × 40%.
3. Restricted Party B (a separate listed entity) owns 10% of Target Company.
4. Total Aggregation: 40% (via Intermediate) + 10% (Direct) = 50%.
→ Target Company is covered.
Scenario C: Minority Limits
If a restricted party owns less than 50% of an Intermediate Company, the restrictions usually do not flow down automatically to the next level (unless the aggregate of multiple restricted parties at the top level is 50% or more).
→ Intermediate Corp is NOT restricted by ownership (though a red flag exists).
2. Intermediate Corp owns 100% of Target Company.
→ Because Intermediate Corp is not restricted, Target Company is NOT covered through this path.
Warning: Due diligence still required to rule out control or diversion.
Minority Ownership: The "Red Flag"
What if the ownership sum is only 40%? Is the entity safe?
Not necessarily. BIS guidance explicitly identifies "significant minority ownership" by a restricted party as a "Red Flag." While a license may not be legally required solely based on ownership, proceeding without caution is dangerous.
If a restricted party owns 25% or more of an entity (or holds a board seat or veto power), you face the risk that the restricted party could:
- Divert controlled items to themselves.
- Use the non-listed entity as a procurement front.
- Access technical data in violation of deemed export rules.
SecurePoint USA recommends treating 25% or more aggregate restricted ownership as a red flag that goes to a reviewer. That 25% figure is SecurePoint USA's recommended review threshold, not a BIS rule: it leaves a buffer below 50% so significant minority stakes reach a reviewer.
Resolving the Red Flag
A red flag does not necessarily mean you have to block the deal, but you cannot auto-approve it. Resolve it with enhanced due diligence before proceeding.
Get a signed statement certifying items won't be transferred to the restricted owner.
Verify who actually appoints management and controls daily operations.
Operationalizing Compliance
Building a defensible compliance program requires more than just checking names. You need an audit trail that proves you checked for ownership.
1. Verify Beneficial Ownership
Ask your counterparties for their beneficial ownership structure. Who owns them? Are there any parent companies?
2. Map Against Sanctions Lists
Cross-reference every owner (and owner's owner) against the BIS Entity List, MEU List, and OFAC SDN List.
3. Document the Math
If you find matches, perform the aggregation calculation. Store this calculation in your transaction logs. This is your "shield" during an audit: proof that you did the math.
Common Misconceptions
“If the name is not on a list, we are safe.”
Name screening is necessary but not sufficient. Ownership and control can create hidden exposure.
“One-time screening is enough.”
Ownership changes. Policies and list content update. Controls must include periodic rescreening.
“Only procurement needs this analysis.”
Visitor access, vendor visits, and facility tours can all introduce the same compliance risk.
“A spreadsheet gives us auditability.”
Spreadsheets track data, but often fail to prove decision timing, versioning, and approver integrity.
How Ownership Risk Affects Visitor Management
Visitor compliance is increasingly tied to entity compliance. If a visiting representative is tied to an organization with unresolved ownership exposure, the safest default is controlled escalation: additional review, access limits, and documented sponsor approval before entry to sensitive areas.
This is where integrated workflows matter. Screening, ownership intelligence, adjudication, and front-desk controls should be connected. Otherwise, one team sees the risk while another grants access without context.
SecurePoint escalates BIS affiliate ownership signals to documented human review on every date, and does not start blocking them automatically when a scheduled date arrives. OFAC 50% ownership results run in shadow mode by default: the result is recorded without changing the screening decision.
Practical rule: if an entity appears to be 50% or more controlled by restricted parties, or if control is uncertain, do not treat the visitor as a standard clear pass.
Simplify Your Screening
Don't rely on spreadsheets to track complex ownership graphs. SecurePoint USA calculates aggregate restricted ownership from the ownership records it holds and sends BIS affiliate signals to documented human review.
Frequently Asked Questions
Does the 50% rule apply to the Unverified List?▼
Not legally in the same automatic way as the Entity List, but BIS recommends treating affiliates of unverified parties with extreme caution. It is considered a strong red flag.
What if firm ownership is exactly 50%?▼
The rule applies to ownership of 50% or more, so an exactly 50% stake will trigger the blockage if and when the rule takes effect. A 49.9% stake will not trigger an automatic block but is a major red flag. Under OFAC's separate 50% Rule, which is enforced today, an exactly 50% aggregate stake already blocks.
How often should I re-screen ownership?▼
Ownership structures change. We recommend re-screening at least annually, or prior to any new major transaction or contract renewal. Continuous monitoring solutions are best.
Do I need to sum ownership from different lists?▼
Generally, BIS and OFAC ownership rules operate independently, though exceptions apply. Best practice is to aggregate every listed party relevant to the specific regulation: for the EAR, sum Entity List and MEU List owners if and when the Affiliates Rule takes effect; for OFAC's 50% Rule, which is in force today, sum blocked persons.
How do I handle indirect ownership chains?▼
If a restricted party owns 50% or more of an intermediate entity, that intermediate entity is treated as restricted, and you count its full stake in the target rather than multiplying percentages along the chain. OFAC FAQ 401 is the verified worked example of this method for OFAC's 50% Rule; confirm BIS hop arithmetic with counsel.