Where EAR duties turn on knowledge of the end use, end user or destination, BIS expects firms to: look for red flags (abnormal circumstances suggesting an inappropriate end use, end user or destination); inquire when a red flag appears, since absent red flags there is no affirmative duty to go behind a customer's representations but a red flag creates a duty to check; not self-blind by cutting off information in the normal course of business (a policy of avoiding bad information is an aggravating factor); make sure employees know how to handle red flags, because an employee's knowledge is imputed to the firm and responsible senior officials must be able to evaluate it; reevaluate all the information after the inquiry and proceed only if the red flags are explained; and otherwise refrain from the transaction or put the facts to BIS in a licence application. The supplement lists 29 indicators, from the twelve classic diversion signs (reluctance about end use, a product unfit for the buyer's line of business, cash for an expensive financed item, declined installation, a freight forwarder as final destination, abnormal routing or packaging, evasive answers) to indicators for 9x515 and 600 series parts, advanced-node integrated circuits, supercomputers and semiconductor manufacturing equipment, uncertain licence history of an item being serviced, items altered after export, new customers sharing management with or taking over work for Entity List parties, Infrastructure-as-a-Service used to train models whose weights fall under ECCN 4E091, and the affirmative duty to determine the ownership percentage of Entity List or MEU List owners (or obtain a licence) when the firm knows such owners exist (indicator 29 belongs to the 50 percent affiliates extension of 30 September 2025, stayed from 10 November 2025 to 9 November 2026 by 90 FR 50857).
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.