INTERNATIONAL TRADE LAW
How to Build an Export Compliance Program (EMCP)
An Export Management and Compliance Program (EMCP) is the written system a company uses to make sure every shipment is classified, screened, licensed, and recorded correctly before it leaves. It is not a binder you write once and shelve; it is the set of policies, people, and checks that catch a problem before the goods do. The Bureau of Industry and Security (BIS) publishes guidance on what an effective program contains, and companies that follow it both prevent violations and earn credit if one ever occurs.
This guide breaks down the building blocks of an EMCP, the order to stand them up in, and the screening and recordkeeping steps that do the day-to-day work.
What an effective EMCP contains
BIS’s published compliance guidance organizes an effective program around a core set of elements. Each one closes a specific gap, and a program missing any of them tends to fail at exactly that point.
| Element | What it does |
|---|---|
| Management commitment | Senior leadership owns compliance, funds it, and sets the tone — the element regulators look for first |
| Risk assessment | Maps where the real exposure is: which products, destinations, customers, and end uses |
| Export authorization | Classifies items (ECCN/EAR99), screens parties, and obtains any required license before shipping |
| Recordkeeping | Retains the full transaction file for the required period |
| Training | Equips everyone who touches an export — sales, shipping, finance — to spot a red flag |
| Audits | Tests the program against actual shipments and finds gaps before the government does |
| Handling violations & corrective action | A defined process to stop, investigate, fix, and (where required) disclose a problem |
| Compliance manual | Writes all of the above down so the program survives staff turnover |
The thread running through every element is documentation. A program that exists only in employees’ heads is the same as no program when an auditor or investigator asks how a decision was made.
How to stand one up, in order
Building an EMCP is sequential — later steps depend on earlier ones.
- Secure management commitment. Name a responsible owner and give the function authority and budget. Without this, the rest stalls.
- Run a risk assessment. Inventory your products, destinations, customers, and end uses to find where controls actually apply. The program should be sized to the risk, not generic.
- Build the authorization workflow. Classify each product, screen every party, and determine licensing before the shipment moves. See solving common challenges in export classification.
- Write the policies and manual. Turn the workflow into clear, role-specific procedures people can actually follow.
- Train the people who touch exports. Tailor training by role and refresh it as regulations change.
- Set up recordkeeping. Centralize the transaction file so records are retrievable, not scattered.
- Audit and improve. Schedule self-audits, document findings, and fix what they surface. See how to manage export compliance audits.
Screening is the step that runs on every order
The most frequent point of failure is shipping to a prohibited party, so restricted-party screening belongs in the authorization workflow for every transaction, not just sensitive ones. Screen your customers, end users, and other parties against the U.S. government’s Consolidated Screening List, which merges the major restricted-party lists from the Departments of Commerce, State, and Treasury — including the Entity List, the Denied Persons List, the Unverified List, and OFAC’s Specially Designated Nationals list — into one searchable resource. A hit, or even an Unverified List match, is a red flag to resolve before the goods move, not after.
Keep the records for five years
The Export Administration Regulations require exporters to retain records of each transaction for five years (15 CFR Part 762). That covers classifications, screening results, license determinations, the EEI/ITN, and the shipping documents. Because the audit and the worst-case investigation both run on this file, recordkeeping is less an administrative chore than the evidence that your program worked. Pair it with the document set in export documentation requirements.
Why the program pays for itself
A working EMCP reduces the risk of a violation, and U.S. export penalties are large enough that prevention is the cheaper path — criminal violations under the Export Control Reform Act can reach up to 20 years in prison and $1 million per violation, and civil penalties, adjusted annually for inflation, exceed $370,000 per violation (or twice the transaction value) as of 2025. Beyond avoiding penalties, a documented program is what lets a company expand into new markets, win contracts that require it, and respond to a government inquiry from a position of strength rather than scramble.
Frequently asked questions
Is an EMCP legally required? There is no statute that mandates a formal EMCP for every exporter, but the controls it implements — classification, screening, licensing, recordkeeping — are required. An EMCP is how you meet those obligations consistently, and BIS gives credit for an effective program when assessing any violation.
How big does our program need to be? It should match your risk. A company shipping EAR99 consumer goods to low-risk destinations needs far less than one exporting controlled technology, but every exporter needs classification, screening, and recordkeeping.
What is the single most important element? Management commitment. Without ownership and resources at the top, the other elements are not maintained and the program drifts out of date.
Who has to be trained? Everyone whose work touches an export — sales, order entry, shipping, and finance, not just a designated compliance officer. Red flags often appear first at the sales or shipping desk.
Standing up or tightening an export compliance program? Reidel Law Firm delivers a flat-fee Import/Export Compliance Memo that maps your classification, screening, and licensing obligations into a workable program — with direct attorney access. Get a flat-fee compliance memo →
