Red Flags Rising - Episode 33 - Back to Basics
===

[00:00:00] 

Mike Huneke: The views expressed in this podcast are solely our own. This information is provided for your convenience. It does not constitute legal advice, nor does it create an attorney-client relationship. Prior results do not guarantee similar outcomes. This is attorney advertising. Enjoy!



Mike Huneke: Hi, welcome again to Red Flags Rising. My name is Mike Huneke. I'm a partner at Morgan, Lewis and Bockius LLP in the International Trade and National Security Practice. With me, as always, is my good friend, Brent Carlson of Red Flags Rising Solutions, LLC. Today is Monday, November 24th, 2025, just after 3:00 PM US Eastern Time. Brent, how are you doing today?

Brent Carlson: Excellent. Thanks Mike. Glad to be here as always.

Mike Huneke: So Brent, you and I have been exchanging emails over the past couple days about a few recent [00:01:00] events, including a new hearing before Congress, which is a topic we've covered a few times. As we've expected, the congressional attention on the issues we discuss has continued. We've seen a lot of, let's say, aftershocks still from the suspension of the Affiliates Rule. In our last episode, in addition to commenting on the Broadway play Waiting for Godot, we also tried to offer people a path forward and a way of thinking. A lot of people, Brent, are still searching for some foundational principles to guide them in these times that are, to say the least, dynamic. We thought it would be worth going back to first principles, which is a concept you hear over and over again from chief executives, founders, people who've started new companies, when they describe a problem that they've seen and their approach to finding the solution.

Brent Carlson: Yeah, Mike, we've seen that with the rollercoaster over the affiliates rule, it's rollout and immediate effect and then it's suspension. It's on the back burner for now. But depending on the ebbs and flows in the US China relations, it could snap back anytime. There's a year suspension on it. A lot of [00:02:00] folks are wondering, okay, what's next? Where do things go from here? One of the things that I think that we noted in all the discussions over the affiliates rule, and quite honestly the exasperation during and after is that the affiliates rule didn't have any impact on preexisting anti diversion provisions in the export administration regulations. That's an important thing to look at. Also in some of the discussions, there seemed to be an overemphasis on that 50% cutoff. That's worth exploring a bit because yes, the affiliates rule is on pause. Yes, companies still need to think about getting ready for it. Now, they have at least a little bit more time , than scrambling to get caught up.

But at the same time, the real risk for compliance and enforcement lay just outside of it. That's really where those preexisting anti diversion provisions really come into play and where companies really need to be thinking about how they continue to evolve their compliance programs in order to read the signals from the government and to get ready for the next issue, the next crisis that's gonna come, [00:03:00] because we never know when that next shoe is gonna drop.

Mike Huneke: That's right Brent. We're going back to basics here, really. Right? When you talk about the anti diversion aspects of the US Export administration regulations, what are you talking about? Well, you're talking about General Prohibition 10, which turns on awareness, it turns on knowledge. So the full definition of knowledge, including an awareness of a high probability related to a past, current or future violation of the EAR through any type of activity including financing, servicing, transporting, et cetera. That's a very potent provision that the government has started to point to a bit more and more, that really brings in a lot of people beyond just your stereotypical or maybe your traditional exporters. There are what we've been calling the inchoate, or not yet fully formed provisions of the EAR that also perform an important anti-diversion, anti evasion function. These are things that will be familiar to traditional white collar corporate defense lawyers, such as causing aiding abetting solicitation or attempt [00:04:00] conspiracy acting with knowledge of a violation. Misrepresentation, concealment of facts, intent to evade, failure to comply with record keeping requirements. If you think about it, fundamentally, Brent, it's provisions like this that you see over and over again in many different American regulatory regimes.

Why do you see them over and over again? It's because Congress knows, or in the case of administrative regulations, the agencies involved know that they aren't ever going to be able to predict every potential factual scenario that might present a national security risk or might present something that they need to legislate or regulate.

These provisions, Brent, are why there are no gaps to begin with. These fill the gaps. They existed before the affiliates rule, during the affiliates rule and during the suspension of the affiliates rule. They've been there the whole time. If you look back at the enforcement actions, including against corporations brought by the Bureau of Industry and Security, BIS, just in the last 12 months, those [00:05:00] are full of examples of various of these being used. So, when we talk about enforcement activity in the background, this is very much what's going on. 

Brent Carlson: There's some important signals there. That's why it's helpful for us to refresh some of these key anti diversion provisions in the EAR to go and help people think about, okay, how are we making sure that we're capturing these effectively and efficiently within our compliance programs?

Dovetailing that a little bit is some great listener feedback from our last episode and the previous couple of ones talking about the affiliates rule from an in-house compliance perspective. The feedback pointed out that although it was anticipated, the affiliates rule was a sea change because it removed a degree of discretion in evaluating entity ownership and the real diversion risk, in the sense that ownership and diversion risk are not the same thing for export compliance, but the rule made it so.

We agree with these points. From our perspective, the affiliates rule really was unnecessary because of the existing anti diversion [00:06:00] provisions in the export administration regulations. Whether or not that's gonna come back, when it's gonna come back, the key point is to understand these existing anti-diversion provisions and to make sure that they are again, addressed in the compliance program and not being lost in all the storm and fury over the affiliates rule. 

Mike Huneke: I was really grateful for this feedback. It illustrated to me that there were different perspectives about in which direction the rule was pushing choices and options. To me, when I first read the Affiliates Rule and the way I would typically think about really even the Entity List, I think from the government's perspective, they say, look, first principle is that there are catchall provisions. Those turn on your knowledge. We know you will not always be able to know when there is that diversion or evasion, especially if we're talking about state backed or state acquiesced smuggling and things like that. The entity list, essentially from that perspective, in thinking of that as the first step, removes [00:07:00] the burden of having to do due diligence on the listed entities. Expanding that was essentially from the government's view, to their mind, helping industry by removing still further entities from the bucket of things where it's gray, where you have to do due diligence.

But this listener's feedback was very interesting, Brent, because from their experience working in house, they actually saw it as the restriction of discretion where they were setting risk maybe a bit differently than the government does. We've always talked about the value of the high probability standard from a company perspective being that the compliance high probability playbook means you decide where your highest risks are. That is the answer to the enforcement playbook, where the government doesn't have to prove up actual knowledge and they can bring more cases more quickly.

But to this person, the Affiliates Rule so shrank the amount of discretion that they had that then they lost that ability to really have those types of communications together and just had to start saying no all the [00:08:00] time. You can also see the government saying, well, we need to say no all the time to the affiliates, but other people might say, well, you could have put them on the entity list then. Brent, this was valuable feedback. We don't take live callers during these, but it's nice to know we're having a bit of a dialogue back and forth with people out there in the trenches. 

Brent Carlson: Also helpful in this feedback is that for a lot of places out there that 50% cutoff can also set a false sense of security for some, thinking that below the line might be a viable loophole, but rather it could be a potential liability pitfall, again, based on these existing anti diversion provisions in the EAR. 

This is where our approach of developing and implementing a high probability protocol comes into play. Even the 50% rule, okay, if you have 49%, the issue is not ownership, it's control and diversion risk. How are you going to set where that risk level is, where that risk tolerance is and how red flags are going to be addressed and mitigated?

Wherever you're gonna set that, that high probability protocol is gonna be based upon each [00:09:00] company's individual risk profile and tolerance tailored to its specific businesses.

Brent Carlson: But at the same time, it creates a consistent and defensible approach. So when the government does come and they say, okay, how are you evaluating these end users? You can show, well, this is our approach. Here's how we're applying the full definition of knowledge under the expert administration regulations, making sure that is addressed.

Now, obviously, like we've talked before, mistakes can and will be made. But at least you're making this best effort to bring this full definition of knowledge under the EAR into the compliance program and recognize it as such, because again, the signals from the government are that that's what they're increasingly looking at. 

Mike Huneke: Brent, you've been monitoring a few pieces of proposed legislation that are out there. What's the update with those? 

Brent Carlson: Right. So, what's passing around now is the Gain AI Act, which essentially creates a right of first refusal or first dibs for US companies on buying advanced GPU chips. There's recent [00:10:00] reporting calling into question whether or not that's gonna go forward or not. If that doesn't, then what may be coming on its heels is the secure and feasible export act of 2025, which is reportedly under discussion. It would codify the requirement for the Commerce Department to deny all applications for any sales to China of AI chips that are more powerful than what the US currently allows. Again, that's still under discussion. There's been another proposed act, the Export Controls Reform Act penalty Increase Act, which was just introduced this month basically raising the maximum penalty amounts for export controls violations, from twice to four times the value of the transactions.

The key point in all this is that Congress is still looking for solutions to address these export control issues for national security reasons, while at the same time balancing those commercial concerns. But there seems to be an increasing sense that if effective solutions are not found, then increasingly restrictive legislation is [00:11:00] gonna be brought to the fore. More restrictive, more blanket type of bans, which then takes that flexibility out, let's say just even using the existing enforcement and compliance tools that are already there, that BIS has, that DOJ has and what companies have, in terms of leveraging that full definition of knowledge under the EAR.

Other recent activity is the House Select Committee on the CCP issued its report on semiconductor manufacturing equipment to China. The report was called Selling the Forges of the Future.

Last week, the House Foreign Affairs Committee, in their Central and South Asia subcommittee, took up the baton in looking at export controls with a hearing that was titled Export Control Loopholes, colon Chip Making Tools and Their Sub Components. What was interesting on that one was that there's a recognition that there are at least perceived loopholes out there. We went through the hearing and the witness statements and the high probability standard or leveraging the full definition of knowledge wasn't mentioned. And I think It's only a matter of time before it does, especially [00:12:00] as that committee looks at what else has been going around with the other committees in Congress and look at what has already been done. Like, for example, the Senate Permanent Subcommittee on Investigations report from December 18th, 2024, talking about export controls enforcement, and addressing what are perceived loopholes, which in many of these situations are not really loopholes, but can be liability pitfalls depending on the particular facts and circumstances. If a company's compliance program is not leveraging that full definition of knowledge, you can walk into these liability pitfalls quite easily. The bottom line in all this is that these issues are not going away. The frustration of lawmakers will increase until effective solutions will be found. The risk is that this process results in more restrictive measures. That's something to think about. But there is a way to thread the needle between the national security and commercial priorities, which is what we've been discussing for some time now, leveraging the full definition of knowledge under the EAR. 

Mike Huneke: You're absolutely right, Brent, that there is this [00:13:00] sense, I'd say a growing sense, of frustration that it's not working, that things aren't working. This is a dangerous time. Throwing a bunch of potential solutions at the wall and seeing if anything sticks can be very counterproductive. Just ask any trade professional who was scrambling for the last two months to try to comply with the affiliates rule.

I get the sense of frustration, I know you do too, Brent. You can see it, right, and all these bills. It's all wrapped around the axle of a highly dynamic and challenging geopolitical environment. Every week, every day there's new news about what is agreed or not agreed.

Really the only way to stay grounded is coming back to first principles about why are we here? Why do we have export controls? What are we trying to accomplish with those export controls? As a company, why do we have compliance programs? What are we trying to accomplish with that? 

Mike Huneke: Brent, the House Foreign Affairs subcommittee , they're looking for loopholes. But based on all the reasons we described about the inchoate provisions and General P rohibition 10, and the definition of knowledge, it's not an issue of [00:14:00] loopholes. It may seem that way, especially if you've been spending decades starting this analysis from item-based classifications. There's a lot of very well-meaning people who've worked countless hours, nights, weekends, trying to get through these things and are just searching for some kind of solution or guiding principles.

There are, as of January 1st in 2025, 1,467 pages in the US Export Administration regulations. A lot of it is going to feel like and may even well be legalese, but there are certain nuggets in there, certain guideposts that really can be the first principles around which you build or rebuild or enhance your export controls compliance program, especially the definition of knowledge. We've talked about this repeatedly, Brent, because considering both of our backgrounds really in the anti-corruption world for decades, that was what drove compliance in that space when combined with effective enforcement.

When knowledge is not just actual knowledge, but [00:15:00] it's other degrees of knowledge, including in the case of the export administration regulations, reason to know, and an awareness of a high probability that is not legalese, that is not just noise. The whole point of knowledge being defined that way is to provide everybody a way out, to provide the government an effective way to bring more cases more quickly, but on the other hand, it invites industry, for companies who are willing to embrace this mindset and lean into it, with a path forward, where they can leverage the same high probability standard to right size and rationalize where they are devoting compliance time, effort, and money.

That is exactly what happened over 20 years of Foreign Corrupt Practices Act enforcement, where you ended up with essentially the government and industry reaching a sort of deante about the impossibility of perfect performance, the finite nature of time and space and compliance resources, and an expectation that companies make those decisions in the first instance about where are their highest risks and how are they gonna mitigate [00:16:00] them?

Brent Carlson: It was very interesting on some of the discussions on that House Foreign Affairs Committee subcommittee. A subcommittee member was giving an example of a workaround , of a loophole, which would be a customer goes on the entity list and then the business gets shifted to an affiliate or a subsidiary.

This is exactly what we're talking about where that is actually not really a loophole, but can be a liability pitfall. That was key in the July corporate resolution with the DOJ plea agreement and the BIS settlement, which resulted in a nine figure penalty. It was exactly the fact pattern. You had a US exporter. A customer in China went on the entity list. Then the business went to an affiliate. That affiliate then went on the entity list, and then it went to another third party. It's important to go back to the basics and refresh them because the answers can be lying in plain sight. 

So why don't we just refresh a little bit? What is General Prohibition 10? What does it say? It refers back to knowledge, which is a defined term. Let's go back to that, what that says, then talk about some of the other inchoate [00:17:00] provisions ' cause this goes back to the key part again for the US government leveraging these for enforcement. We can talk about the signals, how they're doing that. This is also critically important for companies to protect themselves.

General Prohibition 10, Part 736.2 in the export administration regulations, says proceeding with transactions with knowledge that a violation has occurred or is about to occur, parentheses, knowledge violation to occur. Here's the text. You may not sell, transfer, export, re-export, finance, order, buy, remove, conceal, store, use, loan, dispose of, transport, forward, or otherwise service in whole or in part, any item subject to the EAR and exported, re-exported, or transferred in country parentheses or to be exported, re-exported, or transferred parentheses, in-country with knowledge that a violation of the Export Administration Regulations, the Export Control Reform Act of 2018, [00:18:00] or any order license, license exception, or other authorization issued there under has occurred, is about to occur, or is intended to occur in connection with the item.

Mike Huneke: I want to unpack a few of these sentences to illustrate how broad this is. First, this includes financing, it includes storing, using. It includes transporting. So even if something has already been purchased, if you're using it or if you're storing it, this could apply to you. If you are in any way providing finance for the transaction, this could apply to you. If you're transferring it, this could apply to you. It applies to any item subject to the EAR, and that's important because it is not limited to items that have an ECCN number. It is any item subject to the EAR. This could be a paperclip, EAR 99 items. 

Finally, Brent repeated throughout this prohibition in the title, in the body of the text is the word knowledge, or variations thereof. As we've said, knowledge is highly important. [00:19:00] Since 1996, this has been the definition of knowledge. Knowledge of a circumstance, parenthetically noting the term may be a variant, such as know, reason to know, or reason to believe end parens, includes not only positive knowledge the circumstance exists or is substantially certain to occur, but also an awareness of a high probability of its that is the circumstance's, existence or future occurrence. Such awareness is inferred from evidence of the conscious disregard of facts known to a person, and is also inferred from a person's willful avoidance of facts.

Now, t Now, hese words are not randomly chosen. We know from talking to people who wrote these amendments in 1996, Brent, that this was very intentionally taken from the 1988 amendments to the Foreign Corrupt Practices Act, in which payments through third parties turned on knowledge, and knowledge was defined exactly this way. In those amendments in 88, there's a callback [00:20:00] to a prior early 1980s effort to incorporate into the US Federal Code, the Model Penal Code. The Model Penal Code was a project of law professors and others dating back to, I think the late 1950s, certainly to the 1960s, with the foundational concept being that criminal law needed to be more clearly articulated and written. The framework for having a consistent nomenclature for how crimes were defined under the Model Penal Code was conduct circumstances and results, that various laws, regardless of what is prohibited, should be written in terms of what conduct is prohibited in which circumstances and with which result.

So there is a family tree of sorts in legal terminology, from this definition of knowledge, to the Foreign Corrupt Practices Act, to the Model Penal Code. It is meant to address what others might call a loophole if it were only defined as actual knowledge, [00:21:00] because then we all, if left your own imaginations facing an actual knowledge requirement can find a lot of creative ways where we wouldn't actually know anything. But this is meant to get exactly at that.

Brent Carlson: Good points, Mike, in terms of the origin of where this came from, I think that's important to keep in mind as well, 'cause there's a certain taxonomy to this and there's a history to it. Going back to that earlier comment you made about the definition of knowledge in the EAR, it's not just legalese or some ambiguity to be glossed over. It's actually quite clear when one can look at it from its origins and understand it, where it has been applied in other white collar enforcement and compliance situations, i.e., the Foreign Corrupt Practices Act.

Mike Huneke: Exactly Brent. And look, we know from the Senate PSI report that you mentioned from December of 2024, that at least as of May of 2024 BIS had told the Senate that it had never brought a case solely on that high probability awareness component of the definition before. That said, we know from the last 20 years of Foreign [00:22:00] Corrupt Practices Act enforcement that that term was applied there in numerous cases.

It was in fact litigated. You have several court decisions about the jury instructions for how juries are meant to interpret that phrase. You even have an appeal in the federal system up to the Second Circuit Court of Appeals, where that term was really discussed in detail in the case of Frederick Bourke and Victor Kozeny. So, there are adjacent areas of law where these terms have been litigated, have been disputed. There are court decisions providing guidance as to what they mean. 

Brent Carlson: And why don't we talk about some of the recent enforcement movement in the backfield, because I think there's a little bit of perception that BIS has been quiet on the enforcement side, we haven't seen a whole lot of big headlines hit the news except for that nine figure penalty case that came through in July.

Mike Huneke: That's exactly right, Brent. There was the big case at the end of July, which you and I have already spoken about. You wrote a very nice summary of it for the NYU program on corporate compliance and enforcement blog, which we'll link again in the show notes. That [00:23:00] was the first case that we've seen that really contained factual allegations based on that broader definition of knowledge.

As recently as last week, the Department of Justice issued a press release regarding the indictment of four individuals related to the alleged diversion of GPUs to China. Most interesting to me from the press release, Brent, and also from the publicly available docket, was that at some level, someone was selling these GPUs to a real estate company in Florida. There's no indication or allegation that the design company involved, let alone the manufacturer was shipping directly to this real estate company. There appears to have been a middle company in Alabama that looked and sounded like a technology company. What due diligence was done at some point on this entity like that raises questions.

Mike Huneke: What is the government trying to tell us in this case, Brent? It's to look for that low hanging fruit. You don't have to embark upon a multi-month, super expensive, externally supported review to just look at the names of your customers. If your customer list includes names that are not companies that would be [00:24:00] using GPUs, certainly not at the level being ordered, then that is something the government would look at you and say, come on, you know, how could you have not taken steps to at least do additional due diligence in those cases?

Brent Carlson: A similar case that was a few months ago in Southern California also involved a small company exporting advanced GPUs to China via Southeast Asia. From one perspective, one may think, well, I'm selling this domestically so it's not an export, so I don't have to worry about who the end user may be. Be careful because then we get into General Prohibition 10 and that full definition of knowledge, which really means if you're selling products, even through a distributor, that really don't seem to match that end user' s or that company's business, that's a red flag that needs to be addressed.

Mike Huneke: Brent, let's take, for example, a case that was almost a year ago, on December 23rd, 2024. In that case, we're talking about an American company that makes soldering preforms wires and ribbon for industrial purposes. The particular [00:25:00] provisions of the export administration regulations applicable to those specific exports were strict liability offenses. The government put into the settlement agreement, this company encountered, but failed to appropriately address red flags throughout the transactions. Then BIS points to its own KYC guidelines, which are often misreported and misunderstood as excusing exporters of any obligation to look behind representations made by their customers. It also points to the several guidance documents that the Department of Commerce and other departments issued jointly over the past two years related to Russia. Why do we care what that says? Why do we care about that? It's because that is what the government is looking at and thinking about when they decide whether there's a potential high probability awareness of a violation of a provision that does include knowledge that they need to do something about. It wasn't really germane to the particular provision of the EAR that was at issue there, but they were signaling to industry that that is important to them.

Brent, we talked about the [00:26:00] inchoate provisions, the anti diversion provisions. In October of 2025, regarding a manufacturer of equipment used for industrial water testing, there is an acting with knowledge count 764.2(e) because here the manufacturer even offered the Iranian purchaser a price discount because of the difficulties imposed by sanctions. And there's a 764.2(g) misrepresentation and concealment count because of the false information provided. What was the false information there? In the electronic export information provided to the United States government, it was falsely stated that the freight forwarder in Dubai was the quote, ultimate consignee end quote, when the exporter quote knew that the ultimate consignee and end user of the item was in Iran.

Brent Carlson: Like we've talked about, that full definition of knowledge comes down to developing and implementing that high probability protocol. One of the low hanging fruit areas for companies to look at are information and data provided in those outreach visits and in [00:27:00] those administrative subpoenas from the perspective of the high probability standard because then you can really be on guard and understand where you may have vulnerabilities in the compliance program, where mistakes may have been made, and then you can defend them and address them.

Mike Huneke: Well, Brent, I think that brings us to managing up. What is your managing up for this episode?

Brent Carlson: Yeah, you bet Mike. You know, whenever faced with change, uncertainty, and stress, which I think all of us are facing these days, go back to the basics. In this episode, we talked about the full definition of knowledge, General Prohibition 10, and the in Leverage these to bring clarity to confusion and help build a strong compliance culture because I think in one sense, we are all waiting for the next crisis to hit, you know, the next affiliates rule type issue.

I think what we're gonna see is we're gonna see enforcement issues coming down the pike that have been simmering for some time. Don't get caught flatfooted by these, I mean, the signals are there in terms of preparing for them and shoring up defenses for the company.

Just [00:28:00] go back to the basics. Don't get lost in the weeds of the over 1400 pages of the EAR. Look at where those enforcement cases that you mentioned, Mike, provide some real signals.

Well said Brent. That concludes this episode of Red Flags Rising. As always, be well.

Brent Carlson: Thanks Mike. Be well. And to everyone else out there. Be well.