Your first template is free — choose any document.
| If your situation is… | Use this template |
|---|---|
| Company primarily ships physical goods internationally | Trade Compliance Policy (Export Focus) |
| Technology company sharing software or technical data with foreign nationals | Export Control Policy (EAR/ITAR) |
| Importer needing customs classification and valuation procedures | Import Compliance Procedure Manual |
| Business operating in OFAC-sanctioned country risk environments | Sanctions Compliance Program |
| Company requiring a supplier-facing compliance code | Supplier Code of Conduct |
| Organization needing a broader ethics and regulatory compliance framework | Code of Business Conduct and Ethics |
| Business preparing for a Customs Trade Partnership Against Terrorism (CTPAT) application | Supply Chain Security Policy |
A Trade Compliance Policy is an internal governance document that defines how a company identifies, manages, and meets its legal obligations under export control, import, customs, and economic sanctions regulations. It assigns accountability to named roles, describes the procedures employees must follow when classifying goods, screening transaction parties, filing customs entries, and maintaining compliance records, and establishes how potential violations are escalated and resolved. Unlike a procedures manual, a trade compliance policy sets the governance framework — the regulatory scope, the accountable owner, the training standard, and the enforcement consequences — that all operational procedures must satisfy.
Operating across international borders without a written trade compliance policy exposes a company to regulatory penalties that can reach hundreds of thousands of dollars per transaction, reputational damage that affects banking and logistics relationships, and in severe cases, suspension of export privileges. Regulatory agencies including BIS, OFAC, and CBP do not require companies to violate the law knowingly — negligence is sufficient for civil liability. A written, implemented policy is the primary evidence agencies use to assess whether a company had adequate controls in place before a violation occurred, and it is the single most significant factor in determining whether penalties are mitigated or compounded. This template gives you a defensible, operational policy framework in hours rather than weeks, covering every core element regulators expect to find in a functioning trade compliance program.
Why it matters: EAR99 is a residual classification for items not specifically listed on the Commerce Control List — using it as a default rather than a verified conclusion exposes the company to unlicensed exports of controlled items.
Fix: Require a documented classification analysis for every product, software, and technology item. Retain the classification rationale in the compliance record for each SKU.
Why it matters: Denied-party lists are updated continuously — sometimes daily. An approved customer at onboarding can appear on the OFAC SDN list before their next order ships.
Fix: Screen all transaction parties at each order or shipment event, not just at account setup. Most compliance screening tools support automated transaction-level screening.
Why it matters: The importer of record is legally liable for the accuracy of every customs entry, regardless of who files it. Broker errors become the company's enforcement exposure.
Fix: Establish an internal review process for high-value or high-risk imports. Provide brokers with complete, verified documentation and conduct annual broker performance reviews.
Why it matters: Employees who encounter unusual transaction circumstances but have no clear guidance default to approving the shipment or passing it up the chain informally — both routes create liability.
Fix: Add a one-page red flag escalation flowchart to the policy appendix specifying who decides, within what timeframe, and what documentation is required to proceed or halt.
Why it matters: Sharing export-controlled technology or source code with a foreign national employee in the US counts as an export to their country of nationality and requires the same licensing analysis as a physical shipment.
Fix: Explicitly include deemed exports in the scope section and add a procedure for HR and IT to flag foreign national access to controlled technology systems for compliance review.
Why it matters: Trade regulations change frequently — new sanctions programs, revised CCL entries, updated HTS codes — and an outdated policy provides no protection and can itself evidence negligence.
Fix: Schedule a formal annual policy review and assign a designated owner to monitor regulatory updates from BIS, OFAC, CBP, and DDTC between reviews.
List every regulatory body that governs your import and export activity — BIS, OFAC, DDTC, CBP in the US, and any equivalent agencies in your destination or origin countries. This list drives the entire policy framework.
💡 If you ship to more than five countries, create a jurisdiction matrix mapping each destination to its applicable export control and sanctions regime before drafting.
Specify which legal entities, employees, contractors, and agents are subject to the policy. Include engineering and IT teams if they handle export-controlled technical data or software.
💡 A deemed export — sharing controlled technology with a foreign national on US soil — is one of the most frequently overlooked obligations. Name it explicitly in the scope section.
Designate a specific title (e.g., Export Compliance Officer) and a backup responsible for policy implementation, license management, and escalation decisions. Avoid assigning ownership to a committee.
💡 Include the compliance owner's contact details so employees know exactly who to call when a transaction raises a red flag.
Describe step-by-step how items are classified under EAR or ITAR, which screening tool or list you use for denied-party checks, and who is authorized to approve transactions with elevated risk.
💡 Reference a specific screening software or government list URL so employees know which version of the list applies — outdated lists are a common audit finding.
Enter the minimum retention period for each document type — export records (typically 5 years under EAR), import entries (5 years under CBP rules), and screening logs. Specify whether records are stored in a shared drive, ERP, or dedicated compliance system.
💡 Electronic records are fully acceptable, but ensure your storage system logs the date and user for any modifications — regulators look for evidence of tampering.
Specify which roles require training, how frequently, and how completion is tracked. Include both initial onboarding training and annual refresher requirements.
💡 Brief, role-specific training modules (15–20 minutes) have higher completion rates than annual all-hands sessions and are easier to document for audit purposes.
Write a clear escalation path: who an employee reports to, within what timeframe, and how the company will assess whether a voluntary self-disclosure is warranted. Include a no-retaliation statement for good-faith reporters.
💡 Agencies consistently credit companies with a functioning VSD process when calculating penalties — a defined protocol is one of the lowest-cost risk mitigants available.
Add a section specifying when the policy will be reviewed — at minimum annually, and also upon any significant regulatory change, acquisition, or new market entry.
💡 Calendar the annual review 60 days before your fiscal year-end so updates are complete before the new year's training cycle begins.
Short on time? Open it in Business in a Box and let AI fill in the blanks with you.
A trade compliance policy is an internal company document that defines the procedures and controls a business follows to meet its obligations under export control, import, customs, and economic sanctions laws. It names responsible parties, describes classification and screening procedures, sets recordkeeping requirements, and establishes how potential violations are reported and resolved. Regulators treat a written, implemented policy as evidence of good-faith compliance effort.
Any company that imports or exports goods, software, or technology across international borders needs some form of written trade compliance program. The level of detail scales with complexity — a company shipping standard commercial goods to low-risk destinations needs a leaner policy than a defense contractor or semiconductor manufacturer. US companies subject to EAR, ITAR, or OFAC jurisdiction have the greatest documentation obligation, but importers of any size face customs compliance requirements.
In the US, a trade compliance policy typically addresses the Export Administration Regulations (EAR) administered by BIS, ITAR administered by the State Department's DDTC, OFAC sanctions programs, and CBP import regulations. Companies operating internationally also reference EU dual-use export controls, UK export control regulations, and the export licensing regimes of their origin and destination countries.
A deemed export occurs when export-controlled technology or source code is shared with a foreign national in the US — it is treated as an export to that person's country of nationality and may require a license. This catches many technology companies off-guard because it applies to employees, interns, and contractors accessing controlled R&D systems. A trade compliance policy should explicitly address deemed exports and establish a screening process for foreign national access to controlled technology.
At minimum, a trade compliance policy should be formally reviewed annually to incorporate regulatory changes — updated sanctions lists, revised CCL entries, new HTS codes, or changes in export control enforcement priorities. It should also be reviewed after any company acquisition, new market entry, new product line involving controlled technology, or any enforcement action or audit finding. An outdated policy can be used as evidence of organizational negligence in an enforcement proceeding.
Penalties vary by statute and agency. EAR violations can carry civil penalties of up to $364,992 per violation (adjusted annually for inflation) or twice the value of the transaction, and criminal penalties of up to $1 million and 20 years imprisonment for willful violations. OFAC civil penalties can reach $364,992 per transaction or the value of the transaction, whichever is greater. Voluntarily self-disclosing violations and demonstrating a functioning compliance program typically results in significantly reduced penalties.
No specific law mandates that a company maintain a written trade compliance policy. However, agencies including BIS, OFAC, and CBP treat the existence and quality of a compliance program as a significant mitigating factor in enforcement actions. Companies with documented programs typically receive lower penalties, are eligible for settlement agreements, and may avoid suspension or debarment. For ITAR-registered companies, the State Department effectively expects a written compliance program as part of registration.
Voluntary self-disclosure (VSD) is a company's proactive report to a regulatory agency — BIS, OFAC, or DDTC — of a potential violation before the agency discovers it independently. Most agencies have formal VSD programs and consistently credit companies that self-disclose with penalty reductions of 50% or more. A trade compliance policy should define who has authority to approve a VSD, the timeframe for making the disclosure decision, and how the investigation and remediation process is documented.
Yes. A small or mid-size importer or exporter without a dedicated compliance team can use this template as the foundation of a proportionate compliance program, assigning responsibilities to existing roles such as the COO, logistics manager, or outside counsel. The key is that the policy reflects the company's actual procedures — not aspirational processes no one follows. For companies entering heavily regulated markets or handling ITAR-controlled items, an outside trade compliance consultant can help tailor the policy for approximately $1,500–$5,000.
A supplier code of conduct sets standards for third-party supplier behavior — labor practices, environmental standards, and ethics. A trade compliance policy is an internal governance document governing the company's own regulatory obligations on imports and exports. Both are needed for a complete compliance program, but they serve different audiences and different risk areas.
A code of business conduct covers broad ethical obligations — anti-bribery, conflicts of interest, and workplace conduct. A trade compliance policy is narrowly focused on the technical regulatory requirements of international trade law. Trade compliance is typically referenced in the broader ethics code but requires a separate, more detailed policy to be operationally useful.
An anti-bribery policy addresses FCPA, UK Bribery Act, and equivalent laws governing payments to foreign officials and third parties. A trade compliance policy addresses export controls, sanctions, and customs law. Both apply to international business operations but govern entirely distinct legal frameworks and require separate procedures, training, and compliance owners.
An import and export procedures manual is a step-by-step operational guide for shipping and receiving teams — freight documentation, broker instructions, and shipment routing. A trade compliance policy is a higher-level governance document that defines the regulatory framework, assigns accountability, and sets the standards that procedures must meet. The policy drives the procedures, not the reverse.
Dual-use goods classification under EAR, origin determination for country-of-origin marking, and supplier import documentation for customs entry accuracy.
Encryption classification under EAR (ECCN 5D002), deemed export controls for foreign national employees accessing source code, and cloud-based technology transfer considerations.
ITAR registration and compliance for defense articles on the USML, TAA and MLA license management, and State Department VSD procedures for technical data disclosures.
HTS classification for high-volume SKU imports, de minimis threshold management, Section 301 tariff tracking, and country-of-origin verification for supply chain diversification.
| Path | Best for | Cost | Time |
|---|---|---|---|
| Use the template | Small and mid-size importers and exporters with standard commercial goods and limited controlled-technology exposure | Included with Business in a Box | 3–6 hours to customize and finalize |
| Template + professional review | Companies with dual-use or ITAR-adjacent products, multiple jurisdictions, or a recent customs audit finding | $1,500–$5,000 for a trade compliance consultant review | 1–2 weeks |
| Custom drafted | Defense contractors, semiconductor exporters, or companies under BIS or OFAC enforcement review | $5,000–$20,000+ for outside counsel or specialized trade compliance firm | 4–8 weeks |
Your plan sets the direction. Business in a Box helps you organize the projects, priorities and tasks that move it forward.
Business in a Box gives you one workspace for documents, projects, tasks, team collaboration and AI assistance. Start with this template and explore more of the platform when you're ready.
From template to finished document — all in one Business in a Box workspace.
Access over 3,000+ business and legal templates for any business task, project or initiative.
Customize your ready-made business document template and save it in the cloud.
Share your files and folders with your team. Create a space of seamless collaboration.
"Fantastic value! I'm not sure how I'd do without it. It's worth its weight in gold and paid back for itself many times."
"I have been using Business in a Box for years. It has been the most useful source of templates I have encountered. I recommend it to anyone."
"It has been a life saver so many times I have lost count. Business in a Box has saved me so much time and as you know, time is money."
Business in a Box brings people, projects, tasks, documents, knowledge and team communication into one AI-powered workspace. Start with the template you need today.
Start free · No credit card required
