Sanctions Screening Requirements: Who Can I Actually Sell To?
My product is self-serve. Anyone with a credit card can sign up from anywhere, which was the whole point of building it that way.
I have never asked whether that includes people I am not allowed to sell to. US sanctions and export rules do not carry a startup exemption, and I do not know how far that obligation reaches past the name on the invoice.
Is Software Even an Export?
Yes, and more broadly than most teams assume. Under the Export Administration Regulations at 15 C.F.R. § 734.13, Export means an actual shipment or transmission out of the United States, in any manner. Transmission covers a download, an API call, and access to a hosted service.
The same section adds something founders almost never anticipate. Releasing or transferring technology or source code to a foreign person inside the United States is itself an export, known as a Deemed Export. The regulation treats such a release as an export to that person’s most recent country of citizenship or permanent residency.
The practical translation: giving a foreign national on your own engineering team access to controlled source code can be an export even though nothing left the building.
Who Are You Not Allowed to Deal With?
Sanctions administered by the Office of Foreign Assets Control operate on lists and on jurisdictions. The best known is the Specially Designated Nationals (SDN) List, alongside other consolidated lists, plus country and regional programs that restrict dealings with entire territories.
The reach extends past the listed name. Under what is commonly called the 50 Percent Rule, an entity owned 50 percent or more in the aggregate by one or more blocked persons is itself treated as blocked, whether or not it appears on any list.
One nuance is worth getting right, because it cuts both ways. OFAC guidance states that the rule speaks only to ownership and not to control. An entity controlled but not owned 50 percent or more by blocked persons is not automatically blocked, though OFAC urges caution with entities in which blocked persons hold a significant minority interest, and may designate such an entity separately.
What Does This Mean for a Self-Serve Product?
It means the screening question is an onboarding question, not a legal department question. If customers can sign up without a human involved, the control has to live in the sign-up flow.
Most companies address this with automated screening at account creation and at payment, geographic restrictions, and a process for what happens when something matches. The last part is the one teams skip, and an alert nobody is assigned to review is not a control.
Common Mistakes Founders Make
- Assuming a digital product is out of scope. Transmission out of the United States is an export. A download or hosted access can qualify.
- Screening only the entity name on the invoice. Ownership structures matter, and the 50 Percent Rule can block a company that never appears on a list.
- Buying screening software and stopping there. Screening generates alerts. Without a named owner, a documented review process, and a record of decisions, you have the cost of a control without the benefit of one.
A Quick Founder Check
- Can a customer sign up and use our product without any human on our side reviewing who they are?
- Do we screen customers against the SDN and consolidated lists at onboarding and at payment?
- Do we know the countries our current users are actually located in?
- Do we look past the contracting entity to who owns it?
- Has anyone assessed whether our product or source code is subject to export classification?
- Do foreign nationals on our team have access to source code that may be controlled?
- When a screening alert fires, who reviews it, and is that decision written down?
The Bottom Line
This area rewards early, modest effort and punishes discovery during diligence. Classifying your product once, wiring screening into onboarding, and naming an owner for alerts covers most of what a buyer or investor will ask about later.
Selling internationally through a self-serve product and unsure what screening you need?
Schedule a free 30-minute call with our team to discuss your needs and concerns.
Book here: https://calendly.com/primumlaw/30min