The bill of materials the sanctions desk will read
At preferred-bidder stage, the lender's compliance team sends the manufacturer a request. It is not adversarial in tone. It is, on the contrary, almost mundane — a list of documents the manufacturer is asked to provide before financial close. The list runs to about a page. It asks for the manufacturer's bill of materials with manufacturer attribution for each line item, the corporate structure to the level of beneficial ownership, the compliance certifications for export control, and the manufacturer's confirmation that none of the items in the bill of materials, and none of the sub-suppliers, manufacturing partners, software vendors or component suppliers behind them, appear on any of the sanctions lists the lender's home jurisdiction and the syndicate participants are bound by.
The manufacturer's commercial team forwards the request to procurement. Procurement forwards it to legal. Legal forwards it to engineering for the bill of materials. Engineering needs three weeks to compile the data — the bill of materials at the requested level of granularity exists internally but has not previously been shared at this depth with any single customer. The corporate structure document is held by the parent company in a different jurisdiction. The export control certifications cover the home market but have not been mapped against EU equivalents. The sanctions cross-check has never been performed at the line-item level.
This is the sanctions and provenance disclosure pack. It is the lender's compliance team's routine deliverable, and it is, for many non-EU manufacturers, the first encounter with the level of structured supply chain transparency that EU project finance now requires.
The principle behind the disclosure is straightforward. The lender, as an EU-regulated financial institution, cannot finance a project whose supply chain includes sanctioned entities or items subject to export control violations. The obligation is not delegable. The lender must satisfy themselves, with evidence, that the project as financed does not breach any of the sanctions regimes the lender or any syndicate participant is subject to. The evidence comes from the manufacturer, in structured form, before financial close. After financial close, the manufacturer's ongoing obligation is to maintain that disclosure as conditions change.
What sanctions regimes apply
Multiple regimes, often overlapping, frequently applied as a union rather than individually.
The European Union maintains its consolidated sanctions list under the Common Foreign and Security Policy, implemented through Council Regulations. The list is updated continuously, expanded in response to geopolitical events, and applies to all EU lenders, all EU-headquartered borrowers, and any entity operating within the EU's jurisdictional reach. The lender's compliance function refers to this list as a baseline; entities or items on the list cannot appear in the project supply chain without specific licensing exceptions that, for industrial projects, are rarely granted.
The United States maintains parallel regimes through the Office of Foreign Assets Control. The Specially Designated Nationals list, the sectoral sanctions identifications list, and the entity list maintained by the Department of Commerce all apply to US persons, dollar-denominated transactions, and through secondary sanctions to many transactions involving non-US parties. If any syndicate participant has dollar exposure, the OFAC framework reaches the project even if no other US connection exists.
The United Kingdom, post-Brexit, maintains its own sanctions framework through the Office of Financial Sanctions Implementation, generally aligned with EU positions but separately administered and not always identical in scope.
Norway, Switzerland and other non-EU European jurisdictions maintain national sanctions frameworks that typically align with EU positions but require separate cross-reference. United Nations Security Council resolutions impose sanctions that EU member states and most jurisdictions implement domestically.
The lender's compliance team typically applies the union of all relevant regimes — the most restrictive standard wins. A component acceptable under EU sanctions but flagged under OFAC will fail the lender's check if any syndicate participant has dollar exposure. A supplier acceptable under one regime but flagged under another fails on the regime where the flag exists. The manufacturer's disclosure must satisfy all of them simultaneously.
Three categories of sanctions matter for industrial supply chains. Asset freezes against specific named persons and entities — the consolidated lists. Sectoral sanctions against entire industries in specific jurisdictions, such as restrictions on advanced semiconductor exports to certain countries. And dual-use export controls, which cover items that can be used for both civilian and military purposes and which have their own regulatory framework alongside the sanctions lists.
What dual-use export control adds
Regulation (EU) 2021/821 — the EU dual-use regulation — covers items listed in its Annex I that require licences for export from the European Union. The list is extensive and includes many categories relevant to industrial control systems: certain semiconductors above defined performance thresholds, certain encryption technologies, certain communication equipment, certain test and measurement instruments, certain materials and metals.
Parallel frameworks exist outside the EU under different names. The United States operates the Export Administration Regulations with its Commerce Control List, administered by the Bureau of Industry and Security. The United Kingdom maintains the Strategic Export Control Lists. Most major manufacturing jurisdictions have their own equivalents, frequently aligned through the Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies.
For industrial equipment, the typical dual-use concerns include advanced semiconductors used in controllers and signal processing, encryption capabilities above certain key length or algorithm strength thresholds, communications equipment that could be repurposed for surveillance or military use, and certain categories of test and measurement equipment. The classifications are technical and granular; a specific semiconductor at one performance level may be uncontrolled while the same family at a higher performance level requires a licence.
The disclosure expectation is that the manufacturer can attest, with documentation, that any dual-use items in their bill of materials have been properly licensed for export to the project country, that no ongoing licensing constraints affect the project, and that no items in the supply chain are subject to recently-imposed restrictions that would prevent ongoing supply. The last point matters because dual-use restrictions can be tightened mid-project, with retroactive consequences for projects relying on continuous component supply.
The complexity arises when a manufacturer's product incorporates components originating in a jurisdiction with restrictive export controls, destined for use in a jurisdiction subject to those controls. A controller assembled in one country, using a semiconductor manufactured in a second, deployed in a third, sold by a manufacturer headquartered in a fourth, may need to satisfy export control requirements in all four jurisdictions simultaneously. Each jurisdiction has its own framework; the union is what the lender's compliance team applies.
What the disclosure pack contains
The minimum content at preferred-bidder stage is six structured artefacts.
A bill of materials with manufacturer attribution for every component, both hardware and software. The software bill of materials earlier in this series feeds directly into this pack; the hardware bill of materials follows the same discipline but at the component-supplier level rather than the library level. Every line item identifies the supplier; for each supplier, the legal entity name and jurisdiction of establishment are recorded.
A corporate structure document showing the manufacturer's parent company, sister companies, subsidiaries, joint ventures, and ultimate beneficial owners. Beneficial ownership is typically defined as any individual or entity owning more than 25 per cent directly or indirectly, though some jurisdictions apply lower thresholds. The EU's 2024 anti-money-laundering package — Regulation (EU) 2024/1624 and Directive (EU) 2024/1640, replacing the prior AMLD framework, with the Regulation applying in full from 10 July 2027 — and parallel frameworks across other jurisdictions require disclosure to the asset owner or lender on request, with the manufacturer's parent typically holding the most current version.
A sanctions cross-check confirmation. The manufacturer attests, with evidence of the screening process used, that none of the entities in the bill of materials or the corporate structure appears on the consolidated sanctions lists the lender applies. Most manufacturers run this screening through commercial compliance tools — Refinitiv World-Check, Dow Jones Risk and Compliance, LexisNexis WorldCompliance, Moody's Bureau van Dijk Compliance Catalyst, and others — that maintain current sanctions list data and provide an audit trail of the screening process.
Dual-use export control certification. Documentation confirming that any dual-use items in the bill of materials have been properly licensed for the project, including the licence numbers, the issuing authorities, and the validity periods. For items not requiring licences, a documented basis for that classification — typically a screening conducted by the manufacturer's export control function against the relevant control list.
Component provenance for high-risk categories. Specific declarations for semiconductors above defined performance thresholds, for encryption technology in the cryptographic chain, for communications equipment, and for any items subject to recently-imposed restrictions in any jurisdiction the lender considers material. Provenance is traced as deeply as the manufacturer's own visibility allows; gaps are flagged honestly.
The manufacturer's own beneficial ownership disclosure. The ultimate beneficial owners of the manufacturer's corporate structure, traced through holding companies and sister entities to the natural persons or sovereign entities with ultimate control. For privately held manufacturers, this may be straightforward. For listed entities with widely-held shares, the disclosure typically covers any owner above the threshold and the regulated shareholder reporting under the manufacturer's stock exchange rules.
Manufacturers who have submitted to EU project finance before have this pack pre-prepared and update it for each new transaction. Manufacturers new to EU project finance produce it for the first time, often discovering during preparation that some of the underlying data has not been compiled before and requires a discovery exercise of its own.
Maintaining the disclosure
Sanctions regimes change continuously. A supplier acceptable at financial close may be added to a sanctions list six months later. A jurisdiction's status may change as a result of geopolitical events. A new sectoral sanction may apply to an industry the manufacturer operates in. A previously-licensed dual-use item may have its licence revoked, suspended, or rescoped.
The manufacturer's ongoing obligation is to monitor sanctions list changes and notify the asset owner promptly when their supply chain is affected. This is typically a contractual obligation written into the supply agreement, with specific reporting timelines — frequently within 30 days of the change, sometimes faster if the change is material. The reporting obligation includes the change itself, the affected components or relationships, and the manufacturer's proposed remediation.
Remediation may be simple — substituting a component, switching to an alternative supplier, restructuring a sub-contract — or it may be substantial, requiring re-certification of the modified equipment under the manufacturer's quality system. The asset owner's contracts typically include step-in rights, hold-back provisions, or material adverse change clauses that activate if the manufacturer fails to remediate within agreed timelines.
Sanctions screening as an ongoing activity is well-supported by commercial tools, but the operational discipline of monitoring, assessing impact, and reporting requires a compliance function the manufacturer maintains continuously. Manufacturers without an established compliance function build one specifically for EU-financed business; this is one of the operational changes that EU project finance forces and that, once made, applies across the manufacturer's global business.
At proposal stage
A manufacturer's bid that includes — or proposes to provide on request, with a documented timeline — the full disclosure pack signals that the manufacturer has submitted to EU project finance before and has the supply chain transparency that the lender's compliance team requires. The conversation that follows is about specific items rather than about the existence of the pack: dual-use items requiring fresh licensing for the project country, borderline supplier relationships requiring clarification, beneficial ownership disclosures requiring drill-down, recent regulatory changes affecting the supply chain.
A manufacturer's bid that does not address sanctions and provenance, or that asserts compliance without producing the documentation, signals a gap that the lender's compliance team will surface immediately. The gap may be closeable through standard disclosure work — three to six weeks of compilation and screening for a manufacturer with reasonable internal records. It may surface specific items that require remediation, in which case the work expands. It may, in some cases, reveal supply chain relationships that prevent the manufacturer from being financed in the EU-financed project at all, in which case the bid is withdrawn or restructured.
The deeper observation is that sanctions and provenance disclosure is the topic where the lender's compliance team has the most direct authority. The cybersecurity conversations are mediated through technical advisers and the operational team; the data residency conversations are mediated through the data protection function. The sanctions check is conducted by the compliance team itself, against documented lists, with limited room for interpretation. An entity is on the list or it is not. A failed sanctions check is a hard fail; there is no negotiating around it, and no commercial discount that compensates for it.
The next article picks up the lifecycle question that sanctions and provenance partly address but do not fully resolve: the support period for the deployed equipment, which under the Cyber Resilience Act must be declared and matched to the asset's operational lifetime, and which under the long-term service agreement runs on a different cycle entirely.
This article reflects the sanctions and export control landscape at publication. The EU consolidated sanctions list, OFAC, UK OFSI and parallel jurisdictional frameworks are updated through their respective channels, often in response to geopolitical events; the dual-use control lists evolve alongside them. Specific transactions should be reviewed by qualified compliance counsel rather than against this article. If a citation has rotted or a clause has moved, LinkedIn is the way to flag it.