The ITAR requires the exporter to determine the specific end user, end use and destination before applying or claiming an exemption, reviewing all readily available information, public and from other parties to the transaction, and requires the country of ultimate end use to be the destination named on the licence or EEI filing (123.9(a)). BIS's Know Your Customer guidance and red flags (Supplement No. 3 to Part 732) set the parallel EAR expectation: do not self-blind, assess red flags such as reluctance to give end-use information, capabilities that do not fit the buyer's business, unusual routing or payment, and resolve them before proceeding or refrain. Both feed licence conditions such as nontransfer and use certificates (123.10) and the BIS Statement by Ultimate Consignee and Purchaser for 600-series major defense equipment (748.11).
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.