BAFA Internal Compliance Programme (ICP) Germany: Export Control Requirements & Practical Steps

Export control ICP Germany obligations are a central concern for any business handling controlled goods, technology or software. The Federal Office for Economic Affairs and Export Control (BAFA) publishes an Information Leaflet on Internal Compliance Programmes that sets out how German companies are expected to document, govern and audit their trade-compliance controls. For in-house counsel, export control officers and compliance managers, the message is clear: a credible Internal Compliance Programme is not a paper exercise but a demonstrable, evidence-backed system that regulators expect to see working in practice.

This guidance translates BAFA’s expectations into a step-by-step implementation plan, covering governance, screening, IT controls, training and inspection readiness, so boards and operational teams can act in good time rather than scramble when an inspection notice arrives. Non-compliance carries real consequences under the Außenwirtschaftsgesetz (AWG) and Außenwirtschaftsverordnung (AWV) and the directly applicable EU Dual-Use Regulation (EU) 2021/821, making this a board-level priority.

Who this is for: in-house counsel, export control officers and compliance managers operating in Germany. What it delivers: actionable, BAFA-aligned steps to design, implement, evidence and audit an export control ICP, with governance structures, a staged roadmap and an inspection-readiness checklist.

Why BAFA’s ICP guidance matters

BAFA sits at the centre of Germany’s export control architecture. As the federal authority responsible for licensing dual-use and sensitive exports, it also shapes how companies are expected to manage their own compliance risk. The BAFA Information Leaflet on Internal Compliance Programmes re-states and sharpens the elements the authority looks for when it assesses whether an organisation can be trusted to handle controlled goods, technology and software responsibly. Companies should always work from the current version published on the BAFA website.

The commercial logic for acting is straightforward. An export control ICP Germany businesses can actually evidence reduces the risk of unauthorised exports, supports faster and smoother licensing decisions, and provides a defensible position if BAFA inspects or an enforcement question arises. Conversely, gaps in documentation, unclear responsibilities or weak screening expose the company, and its managers, to administrative and criminal liability under the AWG and AWV. Companies that keep their programmes current will be best placed to demonstrate good faith and operational maturity to the regulator.

What is a BAFA Internal Compliance Programme (ICP)?

An Internal Compliance Programme is a company-internal system of policies, procedures, responsibilities and controls designed to ensure that every export, transfer and brokering transaction complies with applicable export control law, and to demonstrate that compliance to the authorities. In the context of an export control ICP Germany framework, the ICP is the organisational machinery that turns legal obligations into repeatable, auditable business processes.

Crucially, an ICP is not a single document. It is an integrated set of controls spanning risk assessment, classification, counterparty screening, approval workflows, training and monitoring. BAFA’s leaflet describes what a “good” programme looks like, and companies are expected to tailor those elements to the size, structure and risk profile of their operations. A small engineering firm shipping occasional dual-use components will implement the same principles at a very different scale from a multinational with a global sales organisation.

Legal and regulatory context, AWG/AWV and the EU Dual-Use Regulation

The statutory foundation for German export controls rests on the Außenwirtschaftsgesetz (AWG) and its implementing Außenwirtschaftsverordnung (AWV), both available via the federal law portal. Together they define licensing obligations, prohibited exports, reporting duties and the penalty framework that applies when goods, technology or services leave Germany in breach of the rules. Formal amendments to these instruments are published in the Bundesgesetzblatt.

Layered over the national regime is the directly applicable EU Dual-Use Regulation (EU) 2021/821, which harmonises controls on dual-use items across the Union and governs licensing, re-export and transfer obligations. BAFA’s ICP guidance does not replace these instruments; rather, it explains how a company should organise itself internally to meet them reliably. The Federal Ministry for Economic Affairs and Climate Action (BMWK), available at bmwk.de, provides the broader policy context in which BAFA operates.

BAFA’s stated purpose for ICPs

BAFA presents the ICP as the mechanism through which a company systematically prevents violations of foreign trade and export control law. The regulator’s purpose is twofold: to help businesses avoid inadvertent breaches, and to give the authority confidence that controlled transactions are being handled under proper supervision. In practical terms, this means BAFA expects to see that risks have been identified, that responsibilities are allocated to named individuals, and that controls are documented and actually applied.

Translated into business benefit, an export control ICP Germany companies can stand behind delivers smoother licensing interactions, reduced enforcement exposure, and clearer internal accountability. It also protects individual managers, because a well-run programme evidences the due diligence expected of them under German corporate governance principles.

Is an export control ICP mandatory under BAFA?

This is the question compliance officers ask most often, and the answer needs nuance. BAFA’s leaflet sets out expectations and best practice rather than creating a freestanding statutory duty to maintain an ICP in a prescribed form. In that narrow sense, the leaflet itself is regulator guidance, not a statute.

However, that framing understates the practical reality. The underlying obligations, to obtain licences, to refrain from prohibited exports, to screen against sanctions measures and to keep records, flow directly from the AWG, the AWV and the EU Dual-Use Regulation, and those are binding. An effective ICP is the means by which a company meets those binding obligations consistently. Where a company applies for certain authorisations or general licences, BAFA may expect a functioning ICP as a condition or supporting factor. And if a breach occurs, the existence, quality and documentation of an ICP will be weighed when BAFA considers licensing decisions, mitigation and enforcement.

In other words, while no single provision says “every company must have an ICP”, the combined effect of statutory duties, licensing practice and enforcement discretion makes a robust programme effectively indispensable for any organisation handling controlled items. The sensible position is to treat the BAFA leaflet as the operational benchmark against which your programme will be judged.

Core elements of a BAFA-compliant export control ICP

The heart of any export control ICP Germany programme is a defined set of elements that BAFA expects to find in a mature compliance system. Each element should be documented, operational and capable of producing audit evidence. The sections below break the leaflet’s expectations into actionable components, with examples of the records inspectors typically want to see.

Risk assessment and classification process

Everything starts with risk. The company must identify where export control exposure arises across its products, technologies, software, customers, destinations and end-uses. The classification process determines whether items are listed on the EU dual-use control lists, subject to national controls, or caught by catch-all provisions tied to end-use. Document the methodology, the responsible owners and the decision outcomes for each product family.

Review the risk assessment on a defined cadence, at minimum annually and whenever the product portfolio, customer base, destinations or control lists change. Keep a dated classification register that records the rationale behind each determination, because BAFA inspectors frequently ask to trace how a specific item was classified.

Policies and procedures (the export control manual)

The export control manual is the written backbone of the programme. It should set out the company’s commitment to compliance, define prohibited activities, and provide step-by-step procedures for classification, licensing, screening and transaction approval. Include product classification flowcharts, an end-use and end-user documentation process, and a clearly worked list of red flags, unusual routing, reluctance to disclose end-use, mismatched technical sophistication and payment anomalies among them.

Procedures must be specific enough that a new employee can follow them. Vague aspirational statements are a common weakness; BAFA expects operational detail. Version-control the manual, record approval dates and ensure the current version is accessible to everyone who needs it.

Organisational responsibilities and governance

BAFA expects clear allocation of responsibility. Management-board accountability must be explicit, with a named export control officer holding day-to-day ownership and sufficient seniority and authority to stop a transaction. Define reporting lines, escalation routes and the interaction between the export control function, legal, compliance and operational units. Ambiguity about who decides is itself a finding inspectors flag.

Screening and due diligence on counterparties

Every customer, consignee, broker and end-user should be screened against applicable sanctions and denied-party lists before a transaction proceeds. Screening must be repeated when relationships change and re-run when lists are updated. Record each screening event, who was screened, against which lists, on what date, and the result, so the control can be evidenced. Because screening logs contain personal data, recordkeeping must be aligned with GDPR principles on retention, purpose limitation and access control.

Internal controls, IT systems and transactional controls

Controls need to be built into the transaction flow, not bolted on afterwards. Approval workflows should prevent a controlled shipment from leaving without the required sign-off and, where applicable, a valid licence. IT systems should log approvals, maintain system records and provide end-to-end traceability from order through classification and screening to dispatch.

Automated blocks, holds triggered by destination, item classification or a screening hit, significantly strengthen the programme and give BAFA confidence that controls do not depend solely on individual diligence. Ensure that system logs are tamper-resistant and retrievable, because they are among the first items inspectors request. Where multiple systems touch an order, map the data flow so there are no blind spots between order management, ERP and dispatch.

Training, reporting and whistleblowing

Training must reach everyone whose role touches controlled transactions, sales, engineering, logistics, finance and management, at a frequency proportionate to risk, typically at least annually with role-specific modules. Maintain training logs recording attendees, dates and content. Provide clear internal reporting channels, including a confidential whistleblowing route, so that concerns about a potential breach can be raised and documented without fear of reprisal. Employers in Germany should also bear in mind the separate obligations of the Hinweisgeberschutzgesetz (Whistleblower Protection Act) when designing internal reporting channels.

Monitoring, audits and corrective actions

Finally, the programme must monitor itself. Schedule periodic internal audits against the BAFA elements, record findings, and track corrective actions to closure. Retain the audit reports and remediation evidence, they demonstrate to BAFA that the ICP is a living system that identifies and fixes its own weaknesses.

Step-by-step implementation roadmap for an export control ICP Germany programme

Building or upgrading a programme to meet BAFA’s expectations is best managed as a staged project over roughly six to nine months. The phases below assign owners, milestones and deliverables so progress is measurable and board-reportable.

Phase 0, Executive sponsorship and scoping

Secure a management-board sponsor and mandate. Define the programme’s scope across business units, legal entities and jurisdictions, confirm the budget, and appoint the export control officer. Deliverable: a signed scoping document and governance charter establishing authority and reporting lines.

Phase 1, Risk assessment and policy drafting

Conduct the enterprise-wide export control risk assessment and classify the product and technology portfolio against the EU control lists and national controls. Draft the export control manual, classification procedures and red-flag guidance. Deliverables: a dated risk assessment, a classification register and a first-version manual approved by management. This phase typically takes eight to twelve weeks and sets the foundation for everything that follows, so resist the temptation to compress it.

Phase 2, Systems and controls deployment

Operationalise the controls. Configure approval workflows, integrate denied-party and sanctions screening, and build transaction holds and logging into the order-to-dispatch process. Confirm that IT systems produce retrievable, time-stamped records and that data flows are mapped across ERP, order management and logistics. Deliverables: documented workflows, live screening tooling, and a traceability map demonstrating end-to-end control.

Phase 3, Training, monitoring and documentation

Roll out role-based training with attendance logs, stand up the internal reporting and whistleblowing channels, and establish the monitoring framework. Confirm record-retention rules, aligned with both export control requirements and GDPR, are applied consistently. Deliverables: a training matrix, completed training records, published reporting procedures and a monitoring calendar.

Phase 4, Internal audit and BAFA inspection readiness

Run a first internal audit against the BAFA elements, remediate findings, and assemble an inspection pack: manual, classification records, screening logs, approval records and training logs, all retrievable at short notice. Deliverable: an audit report with a corrective-action log and an inspection-ready evidence index.

A practical minimum checklist for the roadmap includes: a dated risk assessment reviewed at least annually; a version-controlled export control manual; classification records traceable to each item; screening logs for every counterparty; transaction approval records; and training logs retained with defined retention periods. Keep records retrievable for the period required by the applicable statutory and licensing conditions.

Governance, roles and evidence, who does what?

BAFA’s expectations on accountability are explicit, and governance failures are among the most common inspection findings. A credible export control ICP Germany structure assigns ownership at every level and documents how the levels interact.

Board and executive

The management board carries ultimate accountability for export control compliance. Its role is to set the tone, approve the programme and its resourcing, receive regular compliance reporting, and ensure the export control officer has the authority and independence to halt non-compliant transactions. Board minutes approving the ICP and recording periodic oversight are valuable evidence of that accountability.

Export control officer and compliance officer

The export control officer owns the programme day-to-day: classification decisions, licence applications, screening oversight, training delivery and monitoring. Where the role sits alongside a broader compliance function, responsibilities should be mapped so that nothing falls between the two. This individual must have direct access to the board and the authority to say no, including the power to block a shipment pending resolution.

Legal, IT, HR and Sales interfaces

Export control is a cross-functional discipline. Legal supports interpretation, licensing strategy and privilege management; IT delivers the screening, logging and workflow controls; HR manages training records and the whistleblowing channel; and Sales operates at the front line where red flags first appear. Define these interfaces explicitly so that responsibility for each control is unambiguous and documented. Shared accountability without named owners is a recurring source of weakness.

How BAFA audits and enforcement work, what inspectors look for

When BAFA inspects, it tests whether the documented programme actually operates. Inspectors move quickly from policy to practice, asking for the evidence that a control was applied to a specific transaction. The items most commonly requested include:

• Export control manual. The current, version-controlled manual and the procedures it references.
• Classification records. The classification register and the rationale behind individual determinations.
• Screening logs. Dated records of sanctions and denied-party checks for named counterparties.
• Transaction approval records. Evidence that the required sign-offs occurred before dispatch and that licences, where needed, were in place.
• Training logs. Attendance and content records demonstrating that staff were trained.
• Internal audit reports. Findings, corrective actions and evidence of closure.

Preparation is everything. Maintain an inspection index so each category of evidence can be produced promptly, and nominate a response lead. Where legal advice or internal investigation materials are involved, engage counsel early to manage confidentiality and privilege appropriately. A calm, organised and cooperative response, supported by retrievable records, signals a mature programme and supports a constructive outcome.

Comparison, export control ICP Germany, EU Dual-Use Regulation and AWG/AWV obligations

Understanding how the BAFA ICP guidance relates to the binding legal instruments helps companies allocate effort correctly. The guidance tells you how to organise; the statutes and the EU Regulation tell you what you must achieve. The table below sets out the key differences companies must manage in parallel.

The practical takeaway is that the ICP is the operational layer that keeps the company compliant with the binding layers. Treating the three in isolation leads to fragmented controls; integrating them produces a programme that satisfies BAFA while meeting statutory and EU obligations at source.

Template resources and sample clauses

Converting the BAFA elements into usable documents accelerates implementation. The following resource types support a complete export control ICP Germany programme, aligned to BAFA’s leaflet:

• Export control policy skeleton. A structured template covering commitment, scope, prohibited activities, procedures and governance.
• Classification checklist. A step-by-step aid for determining control-list status and catch-all exposure.
• Training matrix. A role-based curriculum with tracking logs for attendance and content.
• Self-audit checklist. An inspection-readiness tool mapped to the leaflet’s elements.

Always calibrate any template to your own risk profile and cross-check against the current BAFA ICP leaflet before adoption; the regulator’s text remains the controlling reference.

Practical pitfalls and mitigation

Even well-intentioned programmes fail on predictable points. Recognising them early is the simplest route to a resilient export control ICP Germany framework.

• Poor recordkeeping. Controls that work but cannot be evidenced are treated as if they did not happen. Mitigation: standardise retrievable, dated records for classification, screening and approvals, with defined retention periods consistent with GDPR.
• Unclear responsibilities. Shared ownership without named individuals leads to gaps. Mitigation: assign every control to a named role and document escalation routes.
• Inadequate screening. One-off checks that are never refreshed miss sanctions-list updates. Mitigation: automate re-screening on list changes and log every event.
• Fragmented IT controls. Disconnected systems create blind spots between order and dispatch. Mitigation: map the data flow and build holds and logging into the end-to-end transaction process.

Conclusion and next steps

A credible, evidence-backed export control ICP Germany programme is a board-level priority rather than a back-office formality. The path forward is practical: secure executive sponsorship, complete a dated risk assessment and classification, document procedures in a version-controlled manual, embed screening and transactional controls in your systems, train the right people, and audit the programme against the BAFA elements. Companies that act in good time, and keep their evidence retrievable, will be best placed to satisfy inspectors, support smoother licensing and protect their managers. For ICP design, gap assessments or BAFA audit-readiness support, speak to a specialist compliance adviser.

Sources

1. BAFA, Information Leaflet about Internal Compliance Programmes (ICP)
2. BAFA, Federal Office for Economic Affairs and Export Control
3. EUR-Lex, Regulation (EU) 2021/821 (Dual-Use Regulation)
4. Gesetze im Internet, Federal Law Portal (AWG / AWV)
5. Bundesgesetzblatt (Federal Law Gazette)
6. BMWK, Federal Ministry for Economic Affairs and Climate Action
7. Bundesrechtsanwaltskammer (BRAK)