Regardless of whether companies are a one-person, small/medium-sized company or a multinational corporation, these companies all have in common that they have to face the applicable requirements of German, EU and possibly US export control and sanction laws within the framework of their respective export control “footprint”.
For example, the foreign and security policy interests of Germany and international agreements of the European Union and its Member States set limits to the basically free movement of foreign trade. The responsibility for compliance with these limits lies with the companies and within the companies primarily with the company management. It is the task of the company management to ensure legally compliant action of the company members by means of organizational measures in the form of an ICP. The legal environment of export control is complex and subject to constant change. Compliance with its provisions therefore cannot be treated as a “self-runner”.
All measures that a company implements to comply with the export control rules that affect them are called Internal Compliance Program (ICP). ICPs aim to prevent violations of export control law and at the same time serve to protect the company, its management and its employees from the legal consequences of “non-compliance”. These range from liability under criminal or administrative offence law and reputational damage to the loss of reliability from the point of view of the authorities and thus the basic prerequisite for the granting of export control permits.
In addition to German and European law on export control and sanctions (embargoes), the US export control and sanction law, which is extraterritorial from the US point of view, may also be applicable to exporters resident in Germany/the EU.
My recommended approach to determining your own export control footprint, the required ICP, its implementation and continuous review and optimization in the future, is the following in two possible scenarios:
Acc. to A. Defense/aftercare
Even the best ICP cannot guarantee 100% protection against compliance violations. If there have been detected violations of the rules of export control in the past, it is primarily a matter of “defending” the company concerned, the company management and the employees. Here, the existing and to be improved ICP already plays an important and decisive role in the outcome of such procedures. Uncovered gaps in the ICP must be closed specifically and permanently for the future. A successful ICP improvement as “aftercare” provides good arguments for the defense or for mitigating consequences of violations. This is also the case in the context of a voluntary disclosure.
Acc. to B. Prevention/precautionary measure
Without the pressure of investigative proceedings for clearly detected or possible violations of the rules of export control, it often makes more sense to preventively put the existing ICP through its paces calmly and comprehensively in order to avoid or mitigate violations and their consequences for the future from the outset – as part of a precautionary measure.
I recommend starting with the nine elements of an ICP for export control. Their ICP element requirements should then explained in more detail and by way of example in the form of a benchmark for best practice and checked on the basis of checklists. This benchmark for best practice is based on the ICP leaflet of the German Export Control Authority (Federal Office for Economic Affairs and Export Control, BAFA) and the Recommendation of the EU Commission (EU) 2019/1318 on ICP. As part of a checklist for risk analysis, the company’s footprint under export control law is determined, among other things. This benchmark test can be conducted as a self-assessment and/or external expert assessment. Necessary action points and recommendations for action determined from this can be implemented and supervised by the company management after information and decision. The ICP created in this way should then be checked regularly, as changes in the legal situation, the product range or processes can render the ICP ineffective.
The requirements for companies to establish, maintain and continuously improve an ICP for export control according to their respective footprint continue to increase – not least due to political developments and new types of threats to peace, freedom and human rights around the world. The new EU Dual-use Regulation (Regulation (EU) No. 2021/821), which came into force on 9.9.2021, reacts to such threats and focuses more strongly than before on the importance of ICPs.
If you have any questions about the contents of the ICP model as a whole, its implementation or even only about individual elements of the ICP and need support, please do not hesitate to contact me.