Regulations on Export Control of Dual-Use Items

Exporting a dual-use item requires an individual licence, a general licence or a registration-based export voucher. An individual licence application is made to MOFCOM in writing or by electronic message, with a truthful application form and the prescribed materials; MOFCOM grants or refuses within 45 working days of acceptance. The exporter must export within the scope, conditions and validity stated on the licence and report the actual shipment, arrival, installation and use. The licence must be presented to Customs on export, and without it Customs will not release the goods.

Applies when

Companies exporting listed dual-use items. The 45-working-day review must be built into delivery schedules, and Art. 39 expressly treats circumvention by modifying or splitting items into parts or components as unlawful, so shipping in pieces or de-rating to dodge licensing is treated as a violation outright.

Deadline: MOFCOM decides within 45 working days of acceptance; each round of temporary controls lasts no more than two years.

Evidence to retain

• · Archived dual-use export application form and the complete submission pack
• · Register of licences with their scope, conditions and validity periods
• · Reports on actual shipment, arrival, installation and use
• · Customs presentation records and release documentation
• · Per-shipment reconciliation between the licence scope and what actually shipped

Estimated first-time effort: 15–40 person-days (estimate, not a commitment)

An application for a dual-use export licence must include an end-user and end-use certificate issued by the end user, and MOFCOM may additionally require a certificate issued or authenticated by a government body in the end user’s jurisdiction. MOFCOM operates a risk-management regime for end users and end uses, assessing and verifying them; where an importer or end user fails to cooperate with verification or provide supporting materials within the prescribed period, so that verification is impossible, MOFCOM may place it on the watch list.

Applies when

Every exporter of dual-use items, and especially those selling through distributors: the certificate must come from the end user rather than the distributor, so multi-tier distribution chains must be traced through to the real end user.

Evidence to retain

• · Original end-user and end-use certificate from the end user, with translation
• · Certificate issued or authenticated by a government body in the end user’s jurisdiction, where required
• · End-user penetration checks covering ownership, ultimate controller, nature of business and compliance history
• · Distributor contract clauses requiring end-user declaration and restricting onward transfer
• · Correspondence evidencing cooperation with MOFCOM verification

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

An exporter or importer that discovers any of the situations listed in Art. 25 must stop the export immediately, report to MOFCOM and cooperate with verification. An exporter that discovers, or is notified by MOFCOM of, a situation under Art. 14 §3, Art. 18 §4 or Art. 25 must report promptly, take the required measures to eliminate or mitigate the harm, and cooperate with the investigation. In addition, operators providing agency, freight, delivery, customs-clearance, third-party e-commerce platform or financial services that discover a suspected export-control violation must report it promptly to MOFCOM (Art. 36).

Applies when

Exporters and their service providers. “Stop the export” must be designed as an action that can be executed immediately — order freeze, shipment interception, remote feature disablement — rather than as after-the-fact remediation.

Evidence to retain

• · Documented procedure for identifying risk situations and stopping shipments, including a freeze and interception runbook
• · Execution records for stopping exports, with timestamp, order number and operator
• · Text of the report to MOFCOM and the receipt
• · Materials submitted in cooperation with verification and the outcome
• · Records of notifying and training service providers on their reporting duty

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

Properly retain end-user and end-use certificates together with contracts, invoices, ledgers, documents and business correspondence relating to dual-use exports for at least five years, unless another law or administrative regulation provides otherwise. Separately, MOFCOM issues a dual-use export-control compliance guideline and encourages exporters, and the freight, third-party e-commerce and financial service providers serving them, to build sound internal export-control compliance programmes (Art. 6). Such a programme is in practice the precondition for facilitation measures such as general licences and registration-based export vouchers.

Applies when

Every exporter of dual-use items. The five-year period exceeds most companies’ default document-retention policies and needs a dedicated retention rule in the ERP and contract-management systems.

Deadline: Records retained for at least five years.

Evidence to retain

• · Internal export-control compliance programme covering governance, classification, list screening, licence management, audit, training and whistleblowing
• · Appointment of the compliance officer and training records
• · Archive index for export records and screenshots of the five-year retention configuration
• · Internal compliance audit reports and remediation records
• · Compliance-programme evidence submitted when applying for a general licence or registration-based export voucher

Estimated first-time effort: 15–40 person-days (estimate, not a commitment)

PRC citizens, legal persons and unincorporated organisations that receive a foreign-government request for an export-control-related visit or on-site inspection must report it immediately to MOFCOM, and must not accept or undertake to accept such a visit or inspection without MOFCOM’s consent. Together with the data-blocking rule in Art. 36 of the Data Security Law this forms a pair of blocking duties and should be handled through a single “foreign authority request” procedure.

Applies when

Chinese companies with export-control compliance clauses in US or EU customer or supplier contracts; PRC subsidiaries asked by an offshore group to submit to an export-control audit; and manufacturing and R&D entities taking offshore orders that require customer-side compliance verification.

Deadline: Report “immediately” on receipt; do not accept or undertake to accept without consent.

Evidence to retain

• · Intake register for foreign-government and offshore-institution requests, recording date, requester, subject and scope
• · Text of the report to MOFCOM and the receipt
• · Archived MOFCOM decision granting or refusing consent
• · The combined foreign-request handling procedure designed jointly with Art. 36 of the Data Security Law
• · Negotiation records and reservations logged against export-control audit clauses in customer contracts

Estimated first-time effort: 3–10 person-days (estimate, not a commitment)