Malaysian companies engaged in cross-border trade may have to navigate several overlapping rulebooks – Malaysia’s own and, depending on the transaction, those of the United States (“US”), the European Union (“EU”) and China. Those systems increasingly overlap and may pull a business in different directions.

 

In a recent webinar hosted by Messrs Halim Hong & Quek (“HHQ”) titled “Sanctions, Export Controls, and Compliance in Cross-Border Trade”, Siva Kumar Kanagasabai of HHQ (Malaysia), Artie McConnell of BakerHostetler (United States), Dr. Maximilian Ohrloff of Noerr Partnerschaftsgesellschaft mbB (Germany) and Dai Menghao of King & Wood (China), moderated by Pavidren Sivananda Ratnam of HHQ, examined how the sanctions, export control and compliance regimes of Malaysia, US, EU and China reach, overlap and collide.

 

This is a summary of the key themes and practical strategies discussed during the session. It is a general overview only and whether any particular regime applies depends on the parties, payment route, goods, software and technology involved, destination, end-user, end-use, location of conduct, and the relevant corporate and contractual links.

 

A VERY BAD WEEK IN PENANG

 

Consider Pavitheus Systems & Resources Sdn Bhd – a fictional Penang electronics manufacturer (any resemblance to actual companies is coincidental). Its production lines use US-origin semiconductor equipment and software; it employs migrant workers; its customers sit in California, Munich, Shenzhen and Dubai; it invoices in US dollars; and it has a joint venture with a Chinese supplier of rare-earth-dependent components.

 

Cometh the week from hell: –

• • its bank suspends a US dollar payment from a Gulf distributor after discovering that two blocked persons each own 30% of the distributor;
• • a German customer strikes out a clause promising compliance with “all applicable sanctions, including those of the United States” and demands a map of Pavitheus’ labour supply chain;
• • an American customer asks Pavitheus to confirm whether products made using US technology or production equipment are subject to US export controls;
• • A consignment of high-performance AI servers transiting KLIA requires Malaysian strategic trade approval; and
• • the Chinese joint-venture partner warns that the rare-earth components now need Chinese export licences, that supply-chain investigations and information collection must comply with Chinese law, and that compliance with specified US sanctions could conflict with a Chinese blocking order or countermeasure.

 

The central problem is the distinction between local legality and foreign law compliance.

 

THE MALAYSIAN PARADOX: Lawful At Home, Exposed Abroad

 

Malaysia’s framework is anchored in United Nations sanctions and non-proliferation obligations. The Strategic Trade Act 2010 (“STA 2010”) regulates the export, transhipment, transit, brokering and other controlled activities involving strategic and dual-use items. As such, a party’s inclusion solely on a unilateral foreign sanctions list, such as the US Specially Designated Nationals and Blocked Persons List (“SDN List”), does not, without more, make dealings with that party an offence under Malaysian law.

 

However, that does not make the foreign exposure theoretical. The transaction may be rejected by banks, contracts may be terminated, and foreign export-control or secondary-sanctions consequences may cut off access to markets, technology and finance. Legality at home is no defence abroad.

 

Malaysia’s controls are also tightening. On 14 July 2025, the Ministry of Investment, Trade and Industry (“MITI”) announced that the export, transhipment and transit of high-performance AI chips of US origin would require a Strategic Trade Permit under the STA 2010. MITI’s accompanying industry guideline requires the prescribed Artificial Intelligence Chip Assessment (AICA) form to be submitted at least 30 days prior to export, transit and transhipment. The enforcement risk is real. In June 2026, Malaysian Customs intercepted 72 servers containing high-performance AI chips valued at approximately RM52.9 million in the KLIA free commercial zone. The goods were reportedly declared as “computer components” and intended for re-export without the required permit.

 

THE US: The Dollar, The Technology And The List

 

“We’re not American, so American rules don’t reach us” is a dangerous assumption for a Malaysian company to make. US exposure commonly arises in three ways: –

 

1. 1. The financial system: A wholly offshore transaction paid in US dollars may pass through a US correspondent bank, bringing it within reach of the Office of Foreign Assets Control (“OFAC”) and the Department of Justice (“DOJ”);

 

2. 2. The goods, software and technology: US export-control jurisdiction can follow abroad. A foreign-produced item may become subject to the Export Administration Regulations (“EAR”) under applicable de minimis rules or a Foreign Direct Product Rule (“FDPR”), depending on the specified US technology, software or plant involved, the product scope of the particular rule, and the destination, end-user and end-use; and

 

3. 3. Secondary sanctions: Certain US sanctions programmes may expose non-US persons to designation or other market-access consequences for specified conduct even without a conventional US territorial nexus.

 

Screening a name against the OFAC list is only the starting point. Under OFAC’s 50 Percent Rule, an entity is treated as blocked where one or more blocked persons directly or indirectly own 50% or more of it in the aggregate. Thus, if two blocked persons each own 30%, the entity is blocked even though it does not appear by name on the SDN List. Control without the required ownership threshold does not, by itself, automatically block the entity under that rule, although it remains a material due-diligence concern.

 

The Bureau of Industry and Security (“BIS”) Entity List is different from the SDN List. Entity List entries impose specified licensing requirements and licensing policies, frequently including a presumption of denial, depending on the entry. The Unverified List indicates that BIS has been unable to verify the bona fides of a foreign party and triggers additional procedural and due-diligence requirements. As at the writing of this article, BIS’s Affiliates Rule – which extends specified Entity List and Military End User restrictions and certain OFAC-sanctions-based restrictions to affiliates owned 50% or more, directly or indirectly, individually or in the aggregate, by one or more listed parties – remains suspended through 9 November 2026 and is scheduled to resume on 10 November 2026 unless further regulatory action is taken.

 

The practical objective is not merely to avoid ultimate liability. Even a peripheral role in an OFAC, BIS or DOJ investigation can drain management time, legal budget and commercial momentum.

 

EU: A Second Rulebook, Not A Mirror

 

US compliance does not equal EU compliance. The EU maintains a separate autonomous sanctions regime with different jurisdictional links, designation lists and ownership-and-control tests: –

 

1. 1. Jurisdiction: EU sanctions generally apply within EU territory; on board aircraft and vessels under the jurisdiction of a Member State; to nationals of Member States wherever located; to legal persons incorporated under the law of a Member State; and to business conducted in whole or in part within the Union. A Malaysian exporter selling into the single market or operating through an EU entity may therefore fall within scope.

 

2. 2. Lists: the EU consolidated list overlaps with, but is not identical to, the SDN list – a counterparty may be restricted in one jurisdiction but not the other.

 

3. 3. Ownership and Control: EU asset-freeze restrictions can extend to entities owned or controlled by a listed person. The control analysis may capture arrangements below 50% ownership, including rights to appoint management, exercise dominant influence or otherwise control the entity. A company calibrated only to OFAC’s quantitative ownership rule may therefore miss an EU risk.

 

Export controls add another layer. The EU Dual-Use Regulation, Regulation (EU) 2021/821, may apply alongside the EAR. The same shipment can therefore require separate EU and US classifications and licences, and the two authorities are not required to defer to one another.

 

Sharpest of all is the EU Blocking Statute, Council Regulation (EC) No 2271/96, which prohibits EU persons from complying with listed US extraterritorial sanctions, grants a right to recover resulting damages and requires member states to penalise breaches – in effect, penalties for obeying US law. A broad sanctions clause does not automatically breach the Blocking Statute. The risk depends on which sanctions the clause treats as applicable, whether it requires an EU person to comply with listed US measures, and the actual reason for suspending or terminating performance.

 

The safer approach is calibrated drafting: define the relevant regimes; make the clause subject to applicable blocking laws; use objective legal and commercial triggers; preserve appropriate suspension and exit rights; and consider whether authorisation is required. Any commercial rationale should be genuine and documented – not invented to disguise a decision made solely to comply with blocked foreign measures.

 

CHINA: The Countermeasures Era

 

China has developed an increasingly extensive toolkit in response to foreign sanctions and export controls. It includes the Anti-Foreign Sanctions Law, the Ministry of Commerce (“MOFCOM”) Blocking Rules, the Unreliable Entity List, the Export Control Law and product-specific export controls.

 

Rare earths illustrate the direction of travel. China first imposed controls on specified medium and heavy rare-earth-related items in April 2025. In October 2025, MOFCOM Announcement No 61 introduced licensing requirements for specified foreign-produced rare-earth-related items where prescribed Chinese-origin content reaches at least 0.1%, or where the items are produced using specified Chinese rare-earth technology. Implementation of these extraterritorial provisions has, however, been suspended by MOFCOM Announcement No 70 of 2025, until 10 November 2026, mirroring the suspension of the US Affiliates Rule, but the April 2025 controls on the underlying Chinese-origin rare-earth items remain in force. These are product-specific rules and should not be treated as a universal Chinese FDPR.

 

The countermeasures machinery is also active. On 2 May 2026, MOFCOM issued a formal blocking order prohibiting the recognition, enforcement of or compliance with specified US sanctions imposed on five Chinese refineries in connection with Iranian oil transactions.

 

China’s legal framework can also create reporting, civil-remedy and countermeasure risks. The relevant obligations depend on the specific instrument, designation or blocking order. Businesses should not assume that every foreign sanctions request is automatically prohibited in China, but neither should they treat US or EU sanctions clauses as universally enforceable without a Chinese-law review. China’s designation rules also turn on ownership or control without a bright-line 50% threshold: MOFCOM retains discretion, and even a sub-50% largest shareholder may bring an entity within scope.

 

China’s State Council Order No 834 establishes a national framework for industrial and supply-chain security. It does not prohibit ordinary provenance due diligence as such. However, investigations, data collection and information transfers conducted in China must comply with applicable Chinese laws, including those concerning data, confidentiality, export controls, state secrets and national security. A companion regulation, State Council Order No 835, separately addresses China’s response to foreign measures regarded as improperly extraterritorial.

 

China has also strengthened its outbound-investment framework. State Council Order No 837, effective from 1 July 2026, consolidates approval, filing, reporting and supervisory requirements and provides for security review where an outbound investment affects or may affect Chinese national security. It does not subject every Chinese outbound investment to an automatic national-security review, but Malaysian projects involving sensitive technologies, controlled items or strategic supply chains may attract closer scrutiny.

 

FORCED LABOUR: A Market-Access Issue

 

Of consequence is not just what is traded but how a product is made. US Customs and Border Protection (“CBP”) has issued Withhold Release Orders against Malaysian glove and palm-oil supply chains over forced-labour indicators, including recruitment-fee debt, passport retention and wage-related concerns. The subsequent modification of orders following remediation shows that labour compliance is now a condition of market access, not merely a human-resources issue.

 

Malaysia has strengthened obligations, policies and contractual requirements concerning foreign-worker recruitment, wages, accommodation, passport handling and repatriation. Nevertheless, the precise obligation depends on the applicable legislation, licence or approval conditions, standard employment contract, bilateral arrangement and category of worker.

 

Next comes the EU Forced Labour Regulation, namely Regulation (EU) 2024/3015, fully applicable from late 2027, which bars products made with forced labour from the EU market altogether. Operators must cooperate and provide relevant supply-chain information and a failure to do so may allow the authority to decide on whether forced labour was used based on other information available. Confirmed products may be prohibited, withdrawn and dealt with in accordance with the Regulation.

 

The preparation is traceability – credible, multi-tier evidence of recruitment practices, fee payments, wages, working conditions, grievance mechanisms and remediation, built before an investigation begins.

 

WHEN THE REGIMES COLLIDE

 

As evident from the above, the various regimes may impose inconsistent legal or commercial demands: a US-focused clause may create EU Blocking Statute risk; compliance with specified US sanctions may conflict with a Chinese blocking order; and foreign supply-chain tracing must be structured around Chinese information controls.

 

Early identification creates options. A business may restructure the payment route, change the goods or technology used, seek licences or authorisations, alter the counterparty or market, ring-fence parts of the business where legally effective, or decline the transaction before obligations are incurred. Trade compliance is therefore a management function: identify the legal conflict, quantify the commercial consequences, escalate it to the right level and record the decision honestly.

 

PRACTICAL ADVICE: THE CHECKLIST

 

1. 1. Map before you sign – for every cross-border transaction, identify which sanctions regimes have jurisdiction or create secondary-sanctions exposure; which export-control regimes classify the goods, software and technology; and whether any blocking or countermeasure law restricts compliance with another regime.

 

2. 2. Screen beyond the name – establish ultimate ownership and control under the applicable rules, including OFAC’s aggregated 50 Percent Rule, the EU ownership-and-control test and any transaction-specific Chinese extension or control provision. Rescreen at renewals, ownership changes and other trigger events.

 

3. 3. Classify under every regime – conduct a product-specific EAR analysis, including classification, de minimis content and every potentially applicable FDPR, and assess the EU Dual-Use Regulation and other relevant national controls. Do not assume that the presence or absence of US content or tooling alone determines the answer.

 

4. 4. Escalate early – route red-flag transactions (opaque end-users, unusual transit routes, mismatched declarations, restricted destinations, unexplained intermediaries or sensitive end-uses) to legal or compliance before shipment or payment. Train sales, logistics, procurement and finance teams to spot the flags.

 

5. 5. Draft for a multipolar world – use calibrated, jurisdiction-specific sanctions and export-control clauses; make them subject to applicable blocking and countermeasure laws; include end-use and end-user representations, information rights and proportionate suspension and exit mechanisms.

 

6. 6. Document the real rationale – record the genuine legal and commercial reasons for declining, suspending or restructuring risky business. Do not invent a commercial rationale to conceal a decision made solely to comply with a blocked foreign measure.

 

7. 7. Get the paperwork right at home – identify all applicable STA 2010 permits, notifications and declarations. For high-performance US-origin AI chips, comply with MITI’s permit and advance-assessment requirements, and maintain a verifiable end-user and end-use trail.

 

8. 8. Treat labour compliance as trade compliance – comply with all applicable recruitment-fee, wage, passport, accommodation and repatriation requirements, and build multi-tier supply-chain evidence before the EU Forced Labour Regulation becomes applicable on 14 December 2027.

 

CONCLUSION: Compliance As Strategy

 

Nothing in Pavitheus Systems & Resources’ bad week required a crystal ball – every hurdle was ascertainable before signature. The consensus among the panellists is that trade compliance has become strategic planning: companies must understand which markets, technologies and payment systems they depend on, map the rules before committing, escalate conflicts early and document decisions properly. Companies that do this well do more than avoid penalties. They demonstrate to banks, customers and regulators that they are the counterparty worth keeping.

 

Disclaimer: This article is for general information only and does not constitute legal advice or legal opinion. It should not be relied upon as a substitute for specific legal advice. No person should act (or refrain from acting) based on this article without obtaining advice on the specific facts and circumstances. Halim Hong & Quek does not accept responsibility or liability for any loss or damage arising from reliance on this article. Halim Hong & Quek reserves the right to update, amend or withdraw this article at any time. All rights reserved.

 

Subscribe to DISPUTES DECODED BY HHQ, our bi-monthly legal update, at https://mailchi.mp/hhq/2nofd6rjlt to receive our latest legal updates and articles. You may also visit the HHQ website at https://hhq.com.my/insights/ for further articles and insights from our team.

---

About the authors

Siva Kumar Kanagasabai
Senior Partner
Head of Dispute Resolution Practice Group
Halim Hong & Quek
kumar@hhq.com.my

○
Pavidren Sivananda Ratnam
Associate
Dispute Resolution
Halim Hong & Quek
pavidren@hhq.com.my

---