A licence is required, to the extent stated in the entry, to export, reexport or transfer any item subject to the EAR when an Entity List entity, or any entity using a listed high diversion risk address, is a party to the transaction (748.5(c) to (f)); licence exceptions are available only as the entry states, and applications are reviewed under the entry's policy. Entity List restrictions also extend to foreign entities owned 50 percent or more by listed entities (not merely by entities at listed addresses), the most restrictive owner's rules apply, and where ownership cannot be determined the red flag must be resolved or a licence obtained. Foreign-produced items subject to the EAR under the Entity List FDP rules need a licence for Footnote 1 entities (exceptions available within 740.2), Footnote 3 entities (per 746.8(a)(3)), Footnote 4 entities and Footnote 5 entities and advanced-node facilities (specified semiconductor equipment by headquarters and origin). Entities may be listed on specific and articulable facts of involvement or significant risk of activities contrary to U.S. national security or foreign policy (terrorism support, military capabilities of terrorism sponsors, conventional weapons, obstructing end-use checks, sustained host-government non-cooperation, conduct risking EAR violations), never U.S. persons; BIS may also inform persons of licence requirements for circumvention, fronts or shells. The 50 percent affiliates extension (90 FR 47201, 30 September 2025), which the eCFR text still carries, is stayed from 10 November 2025 to 9 November 2026 by 90 FR 50857 and returns on 10 November 2026 absent a further extension.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.