Key Takeaways
- EAR99 does not mean uncontrolled. Companies cannot assume that commercially available or EAR99 software can be provided to any customer without a license.
- Restricted-party screening should continue throughout the customer relationship. Violations arose when software updates continued to be made available to an existing customer after the customer was added to the Entity List.
- Sales through a distributor do not protect against violations. Violations involved transactions conducted through distributors in Japan and China where transaction documents identified the ultimate customer.
- Informal attempts to understand export restrictions are not a substitute for an export compliance program. Penalties were aggravated based on the company’s lack of written export compliance procedures, trained personnel, designated compliance responsibility, and timely legal guidance.
On October 2, the U.S. Department of Commerce’s Bureau of Industry and Security (BIS) announced an administrative enforcement settlement with Lambda Research Corporation (Lambda) resolving 66 alleged violations of the Export Administration Regulations (EAR) involving software exports, maintenance services, and automatic software updates provided to parties on the Entity List and Unverified List.
The enforcement action provides several important reminders for companies engaged in international software sales and other exports subject to the EAR. In particular, the settlement demonstrates that export control obligations continue after an initial sale, including through automatic software updates, maintenance agreements, and other post-sale services. The matter also underscores that companies need to treat restricted-party screening as an ongoing compliance obligation rather than a one-time review performed when a customer relationship begins.
Lambda’s Software Transactions with Huawei Japan
Lambda, a U.S. company, provides optical and illumination design software and engineering services. According to BIS, between April 2021 and August 2025, Lambda sold, exported, transmitted, or serviced software subject to the EAR for customers that included Huawei Technologies Japan K.K. (Huawei Japan) and Shenzhen SiCarrier Technologies Co., Ltd. (SiCarrier).
Both companies were on the Entity List during relevant portions of the transactions, and a BIS license was required to export, re-export, or transfer any item subject to the EAR to both companies. BIS alleged that Lambda, without obtaining the required license, exported CodeMeter USB dongles containing TracePro, OSLO, IGES, and STEP software to Huawei Japan through a Japanese distributor. The software was designated or believed to be EAR99. BIS treated the transfer of the dongles as a transfer of “access information” because the dongles enabled the release of the underlying software to Huawei Japan.
As discussed in earlier articles on EAR99 in-country transfers to an Entity List party and unlicensed exports of research equipment to an Entity List institution, even items classified as EAR99 may require BIS authorization based on the recipient. This applies to exports, re-exports, and transfers (in-country) when the relevant Entity List entry imposes a license requirement for all items subject to the EAR.
Lambda also sold Huawei Japan annual maintenance and support subscriptions. Those subscriptions allowed Huawei Japan to access Lambda’s technical support and download resources, including new software releases, documentation, libraries, utilities, examples, tutorials, and automatic software updates. BIS alleged that Lambda knew or had reason to know that these services related to software had been exported without the required authorization.
BIS charged Lambda with 11 violations – five dongle exports and six annual maintenance and support subscriptions – of EAR Section 764.2(e) for acting with knowledge of a violation.
Automatic Software Updates Result in Dozens of Separate Violations
Perhaps the most interesting aspect of this enforcement action is BIS’s treatment of automatic software updates.
Between April 2021 and August 2025, 42 automatic updates of TracePro and five automatic updates of OSLO were transmitted to Huawei Japan. BIS asserted that each automatic update constituted an export under the EAR, and thus each update resulted in a separate violation.
BIS took the same approach with SiCarrier, which was added to the Entity List in December 2024. Although the underlying software licenses were provided to SiCarrier prior to the designation, Lambda continued to transmit automatic TracePro updates under the existing licenses after SiCarrier became listed. BIS treated each of those seven automatic updates as unauthorized exports, resulting in seven additional violations.
This aspect of the settlement is particularly notable because the initial transaction itself does not establish immunity for subsequent, related activity. A customer that was unrestricted when software was initially licensed may subsequently become subject to licensing requirements. Continuing to provide downloads, cloud access, patches, updates, maintenance, or other services creates new export-control exposure.
BIS Focused on Lambda’s Compliance Program and Knowledge of Huawei Restrictions
The charging documents provide insight into the types of facts BIS may consider when determining whether a company acted with knowledge of an export control violation.
After submitting its initial notification to BIS in July 2025, Lambda submitted its full voluntary self-disclosure to BIS in October 2025. According to the settlement, Lambda acknowledged that its CEO and other senior management and sales personnel had been aware of media reports regarding Huawei Japan’s addition to the Entity List and had investigated the legal implications of the designation.
BIS alleged, however, that the investigation consisted primarily of reviewing news reports and press releases and determining whether competitors continued doing business with Huawei Japan. Lambda also stated that a former employee emailed BIS in 2019 seeking clarification about continuing sales to Huawei Japan, but BIS noted that Lambda had not produced documentation supporting the communication and that no one apparently followed up with the agency after that employee departed.
BIS further alleged that Lambda learned in September 2024 that a competitor had stopped selling to Huawei Japan after the 2019 Entity List designation, but Lambda did not terminate its own business with Huawei Japan. BIS also emphasized that Lambda did not seek legal guidance regarding the restrictions applicable to Huawei Japan until April 2025.
According to BIS, Lambda’s broader export compliance infrastructure was also inadequate. The company allegedly had no written export compliance procedures, and no employees had been trained or specifically assigned responsibility for export compliance.
Unverified List Transaction Creates an Additional Violation
The settlement also involved a separate transaction with Southern Marine Science and Engineering Laboratory, Sun Yat-Sen University (SMSEL), which was listed on BIS’s Unverified List (UVL). Under the EAR, before proceeding with certain transactions involving a UVL-listed party, exporters are required to obtain a UVL statement from the listed person.
BIS alleged that Lambda exported TracePro and RayViz software through a China-based distributor to SMSEL in November 2023 without first obtaining the required UVL statement. Transaction documents identified an SMSEL associate professor as the licensee and provided an address at Sun Yat-Sen University’s Zhuhai campus. BIS charged Lambda with one additional violation based on that transaction.
The clear lesson here is that exporters must screen against all applicable restricted-party lists while recognizing that different lists trigger different compliance requirements.
BIS Imposes $2 Million Suspended Penalty and Mandatory Compliance Measures
Under the settlement, Lambda was assessed a $2 million civil penalty, though payment is suspended for one year and will be waived if Lambda complies with the settlement and commits no additional EAR violations. If Lambda fails to comply with the agreement, the suspended penalty may become immediately due.
Lambda must designate at least two employees or officers to handle export compliance and require those individuals to complete export control training within three months. The company also must complete an internal audit of its export compliance program within nine months, covering the six-month period following the order. Any actual or potential violations identified through the audit must be promptly disclosed to BIS.
Importantly, completion of the required training and audit are express conditions of the granting, restoration, or continued validity of Lambda’s export licenses, license exceptions, permissions, and other export privileges.
What Companies Should Consider Going Forward
The Lambda settlement demonstrates how routine commercial activities can create export control exposure even when the underlying software is EAR99 and the transactions involve software licenses, license dongles, or automatic software updates.
More generally, as we discussed in our recent article on EAR99 exports to Russia and third-country transactions, an EAR99 classification does not itself resolve the licensing analysis. Exporters must separately consider the destination, end user, end use, and any transaction-specific restrictions.
Software companies and other businesses providing ongoing services to international customers should consider whether their restricted-party screening processes extend beyond the initial sale. Screening controls should account for changes in customer status and should be capable of addressing continuing activities such as software updates, downloads, technical support, cloud access, maintenance, and subscription renewals.
Companies also should evaluate whether distributors, resellers, and intermediaries provide sufficient information to identify ultimate end users. The Lambda enforcement action demonstrates that conducting a sale through a third-party distributor does not necessarily insulate the U.S. exporter when transaction records identify, or otherwise provide reason to know, who ultimately will receive the software.
Finally, the settlement reinforces the importance of a documented export compliance program. Written policies, designated compliance personnel, employee training, escalation procedures, ongoing restricted-party screening, and documented legal or compliance review can be particularly important when a company learns that an existing customer may be subject to new export restrictions.
Please contact the authors if you have any questions.
Recent Comments