Diligent Logo
Diligent Logo
Products
arrow_drop_down
Solutions
arrow_drop_down
Resources
arrow_drop_down
Diligent AI

BIS50 is coming: Where your organization may be exposed and how to prepare

October 28, 2026
•
4 min read
Husein Bektic

Husein Bektic

VP of Product Management

The next major change in export-control screening may not be about adding another name to a list. It may be about seeing the relationships behind the names already on it.

The U.S. Bureau of Industry and Security’s Affiliates Rule, commonly referred to as the BIS 50% Rule, is designed to extend certain BIS restrictions to foreign entities owned 50% or more, directly, indirectly, individually, or in aggregate, by listed entities or entities subject to ownership-based restrictions. The Federal Register provides the underlying rule and scope.

With relevant provisions currently scheduled to remain stayed through November 9, 2026, compliance teams have an important opportunity to understand what the change could mean for their customers, suppliers, distributors, and other third parties. Organizations should consult current BIS guidance for the latest status.

Why BIS50 matters

Traditional screening typically starts with a name match. But a third party may not appear on a restricted-party list while still presenting potential exposure through its parent company, shareholders, subsidiaries or affiliates.

That creates a gap between what a screening system shows and what a compliance team may need to understand.

The practical questions become:

  • Who owns this entity?
  • Are any ownership interests held indirectly or in aggregate?
  • Does a listed party’s ownership reach the relevant threshold?
  • Are there other relationships or risk signals that should trigger further review?
  • Can the analyst document the evidence behind the decision?

BIS has also identified significant minority ownership as a red flag that may require additional due diligence. BIS describes the Affiliates Rule and related red flags in its announcement.

Where organizations may be exposed

BIS50 exposure can arise across the third-party lifecycle, including:

  • *Customer onboarding:* A new customer passes name-based screening, but its ownership structure is unclear.
  • *Supplier and distributor reviews:* An indirect relationship creates questions that are not visible in the immediate counterparty record.
  • *Transaction approval:* Multiple listed parties may have ownership interests that need to be considered together.
  • *Ongoing monitoring:* A change in ownership or affiliation may alter the risk profile after onboarding.
  • *Manual investigations:* Analysts spend significant time assembling information from multiple sources before a decision can be made.

The challenge is not simply finding more names. It is connecting ownership information to the broader risk context already used by compliance teams—including sanctions, PEP, watchlist, state-owned enterprise, and ownership and affiliation data.

How Diligent is approaching BIS50

Diligent Risk Intelligence is introducing a BIS50 dataset to help organizations identify and investigate potential ownership-based exposure related to BIS-listed parties.

The dataset is designed to provide structured information on relevant BIS-listed entities and researched ownership relationships, including direct, indirect, and aggregated relationships where reliable information is available. Relationship evidence supports further review and helps analysts understand how a potential connection was identified.

BIS50 is not intended to replace an organization’s existing screening platform or make a definitive legal determination. It is designed to add ownership intelligence to the risk workflows and data environments teams already use.

Organizations can access the dataset through delivery methods including Snowflake and flexible feed formats such as XML, TXT, and CSV. This gives teams options for connecting BIS50 to their existing compliance, third-party risk, and screening processes.

The broader value comes from connecting BIS50 with other risk datasets. A potential BIS-related ownership connection can be reviewed alongside sanctions, PEP, watchlist, state-owned enterprise, and ownership and affiliation signals. This helps teams move from a standalone match to a more complete view of the relationship.

Preparing now for BIS50

Before BIS50 becomes part of your operating model, consider asking:

  • Does our current screening process identify indirect and aggregated ownership?
  • Where would an ownership red flag be escalated?
  • Can analysts access the relevant data in the systems they already use?
  • What evidence will support the final decision?
  • How will ownership changes be incorporated into ongoing reviews?

BIS50 is ultimately about more than another dataset. It is about helping compliance teams see the connections that traditional screening can miss, and giving them a practical way to bring that intelligence into the workflows they already rely on.

Learn more about BIS50 and Diligent Risk Intelligence.

This article is for general informational purposes only and does not constitute legal advice or a determination that any particular entity is subject to BIS restrictions. Coverage varies by jurisdiction and the availability of reliable information.

Explore More

Connectivity meeting image

Case Study

· 1 min read

TE Connectivity reduces third-party due diligence processing time by 25%

Our client leveraged Diligent's Third-Party Risk Management — Compliance solution to increase visibility, efficiency and accountability across their due diligence processes.

Close-up of a hand reaching toward a laptop keyboard, representing the hidden access pathways and third-party risks that can expose organisations to cyber threats.

Blog

· Oct 12, 2026

· 5 min read

The vendor you forgot to audit: Why your third-party risk programme has a blind spot

By Jay Cameron

Recent breach headlines show why vendor criticality alone can miss serious exposure. Learn how access-based oversight helps close third-party risk gaps.

Blog

· Sep 7, 2026

· 7 min read

4 popular TPRM approaches and the gaps each one leaves behind

By Jay Cameron

Discover 4 practical approaches to TPRM to bridge critical risk gaps beyond standard vendor assessments. Strengthen your third-party risk management today.