How to Manage Export‑control Risk in China M&A (2026): Due Diligence, Licensing & Deal‑structuring

Export control m&a china risk has moved from a specialist afterthought to a front-line transactional concern following the Ministry of Commerce (MOFCOM, 商务部) 2026 expansion of its export-control listings. For inbound acquirers, that expansion widens the universe of targets, technologies and counterparties that can trigger licensing obligations or transfer restrictions mid-deal. This guide sets out a lawyer-led, step-by-step workflow, from pre-deal screening through due diligence, classification, licensing, deal structuring and post-closing integration, designed for deal teams that need to operationalise compliance rather than read statutory summaries. Every recommendation here requires fact-specific counsel review; the material is general guidance, not legal advice.

Overview: Why export control m&a china risk matters in 2026

The legal architecture governing export control m&a china sits on three pillars. First, the Export Control Law of the People’s Republic of China, adopted by the Standing Committee of the National People’s Congress (全国人民代表大会常务委员会) and in force since 1 December 2020, provides the statutory basis for controls over dual-use items, military items and related technology and data. Second, MOFCOM administers the control lists, entity listings and licensing regime, issuing the notices that define which items and parties are restricted. Third, the General Administration of Customs (GACC, 海关总署) enforces export clearance and licensing at the border, while the Ministry of Industry and Information Technology (MIIT, 工业和信息化部) shapes the industrial-policy context that informs how many ICT and advanced-technology goods are classified.

For an acquirer, the practical significance is that a change of ownership can itself constitute or enable a controlled transfer, of goods, of technology, of source code, or of technical know-how carried by key personnel. Where a target manufactures dual-use goods, develops controlled algorithms, or transacts with a listed entity, the deal team must treat export-control analysis as a gating workstream, not a confirmatory footnote. MOFCOM’s 2026 listings sharpen this because they increased both the number of restricted parties and the categories of technology in scope, meaning targets that were “clean” under prior lists may now sit inside the control perimeter. The remainder of this guide translates that legal framework into a transactional playbook.

Eligibility, When China’s export-control rules apply to an inbound M&A

The threshold question in any export control m&a china analysis is whether the transaction touches controlled subject matter or controlled parties. The rules do not switch on for every deal; they engage where a defined trigger is present. Deal teams should run a structured trigger check at first-look stage.

Legal triggers

Three categories of event most commonly bring a transaction within scope:

• Ownership change conveying controlled items. Where acquiring the target transfers control over controlled goods, technology or data, the transfer itself may require authorisation.
• Technology transfer. Cross-border movement of controlled technology, technical data or source code, including through post-closing integration, secondment or shared repositories, can constitute a licensable export.
• Export of controlled items. Where the target’s ongoing business exports controlled goods, the acquirer inherits both the licensing footprint and any enforcement history.

Subject-matter scope

Controlled subject matter typically includes dual-use goods, advanced materials, certain software, and technical data and drawings. The Export Control Law and MOFCOM’s control lists define the specific categories; MIIT guidance helps map many ICT and advanced-manufacturing goods to those categories. Software and algorithms deserve particular attention, because control can attach to the underlying code or model rather than to a physical product.

Jurisdictional reach

Scope is determined not only by the nature of the item but by the origin of the goods, the destination, the ultimate end-use, and whether any counterparty appears on a control or entity list. A target’s downstream customer base and end-use statements are therefore central to the assessment.

As a first-pass decision tree, deal teams should ask: Who is the acquirer and its ultimate ownership? What does the target actually make or develop, and are those items or their subsystems controlled? Does the target, or any material counterparty, appear on a MOFCOM export control list or entity listing? A “yes” or “unclear” on any branch escalates the matter to export-control counsel.

Step-by-step process for export control m&a china due diligence

Export-control analysis should be integrated into the standard M&A workflow rather than bolted on late. The discipline is to screen early, request the right documents, classify rigorously, assess licensing before signing where possible, and build contractual protections in parallel. Escalate to dedicated export-control counsel the moment a red flag surfaces, do not wait for confirmatory diligence to close.

1) Pre-deal screening and prioritisation

Before committing diligence budget, run a red-flag check against the target’s product set, its jurisdictional footprint, and the current MOFCOM export control list and entity listings. This screening, led by external counsel with an internal legal and technical lead, determines whether the transaction needs a full export-control workstream and how much timeline to reserve.

2) Export-control due diligence (document list and requests)

Structured export-control due diligence in China turns on getting the right documents. Generic corporate diligence request lists rarely capture the specifications, bills of materials and code-level detail needed to classify items correctly. Frame requests specifically: ask for product lists with HS codes and BOMs, not product “descriptions”; ask for architecture diagrams and source-code access, not marketing summaries; and ask for the target’s full licence and enforcement history rather than a management assurance.

3) Classification and technical assessment

Classification is where legal and technical analysis converge. Technical experts working with export counsel determine whether goods, subsystems, software or technical data fall within controlled categories. Sub-component and subsystem review is essential, a finished product may be uncontrolled while an embedded module or algorithm is controlled. Where classification is genuinely uncertain, teams may seek clarification through the competent authority’s consultation channels, but sensitive interpretations must be verified by counsel.

4) Licensing assessment and pre-filing strategy

Once items are classified, assess whether the contemplated transfer requires a licence, and whether to file pre-closing or post-closing. Where a filing is likely, pre-application consultation with the relevant authority or a local agent can de-risk timing and surface conditions early.

5) Deal protections and holdbacks

In parallel with diligence, transaction counsel drafts the contractual architecture, representations, indemnities, escrows, holdbacks and conditions to closing, that allocates residual export-control risk. These provisions are drafted concurrently so that findings from classification and licensing flow directly into deal terms.

Export-control workflow: step, owner and duration

Required documents for export control due diligence in China

Practical drafting pointers help these requests land. In the diligence request list, use wording such as: “Provide complete bills of materials, HS classification codes and full technical specifications for each product line, including subsystems and embedded software.” For the red-flag memo, adopt tiered language, “HIGH RISK: target holds a prior licence refusal for [item]; transfer of this asset should be treated as conditional pending export-control counsel sign-off.” Vendor questionnaires should ask directly whether the target or any material counterparty appears on any control or entity list, and whether any transaction has previously been paused or blocked. The image alt text for the accompanying visual, “Lawyers reviewing export control due diligence checklist for China M&A”, reflects exactly this workstream.

Export licensing, triggers, strategy and timing

Licensing is the operational heart of export control m&a china risk management. Whether the acquirer needs an export licence after acquiring a Chinese target that makes dual-use goods or software depends on whether the transferred items or technology are on a MOFCOM control list or otherwise controlled, and on how and when the transfer actually occurs.

When an export licence is required, pre-closing versus post-closing

A licence obligation can crystallise either before or after completion. If controlled technology or goods will move cross-border, or into the acquirer’s group, as part of closing mechanics, licensing may need to be resolved pre-closing or made a condition to completion. If the transfer occurs only later, for example, during post-closing integration when repositories are consolidated or technical staff are seconded, licensing may be handled post-closing, provided the interim period is properly ring-fenced.

Typical licensing application process and timelines

Export licensing for acquisitions typically involves MOFCOM’s authorisation regime alongside GACC’s customs clearance and declaration processes. Statutory processing periods apply, but real-world timelines vary widely: routine administrative cases can resolve relatively quickly, while complex or sensitive technologies can run to several months, particularly where technical review or additional end-use assurances are required. Deal teams should model the longer end of the range and treat pre-consultation time as additive.

When to consult MOFCOM for pre-filing advice

Pre-filing consultation is worthwhile where classification is ambiguous, where a counterparty’s status is unclear, or where the transaction structure could be adapted to reduce licensing exposure. Early engagement surfaces likely conditions and processing expectations before commercial terms are locked.

Indicative cost ranges

The figures below are broad illustrations only; actual costs depend heavily on deal complexity, counsel location and the nature of any technical testing, and should be confirmed with providers.

The strategic choice between pre-closing and post-closing licensing is a trade-off. Pre-closing licensing gives certainty at completion but can stall the deal timetable and expose commercial terms to regulator conditions. Post-closing licensing preserves deal momentum but requires disciplined interim controls to ensure no controlled transfer occurs before authorisation, and carries the risk that a licence is refused after money has changed hands. Escrows and holdbacks are the usual bridge between the two.

Deal structuring and mitigation options for export control m&a china

Structuring is where a well-advised acquirer converts export-control findings into risk reduction. In some cases a deal can be structured to limit or avoid a licence requirement, through asset carve-outs, licence-backs, minority investments or post-closing partitions, though each option carries operational and commercial trade-offs. The right choice depends on how central the controlled technology is to the target’s value.

Structural options compared

Contractual risk allocation

Where residual risk remains, allocate it in the contract. Specific export-control representations should confirm classification status, licence history, absence of listed counterparties and compliance with the Export Control Law. Indemnities should cover pre-closing breaches and enforcement exposure. Escrows and holdbacks give the acquirer a funded remedy if a licence is refused or an enforcement issue emerges post-closing. Draft representations narrowly enough to be meaningful, a bare “the target complies with all applicable laws” is inadequate for controlled-technology risk.

Operational measures

Structural and contractual protections should be reinforced operationally. Technology partitions keep controlled data segregated from the acquirer’s systems until licensing is resolved; source-code escrow controls who can access repositories; and employee non-transfer covenants prevent inadvertent technology transfer through the movement of R&D personnel who carry controlled know-how.

Conditional and staggered closings

Where controlled assets cannot be cleared before signing, conditional closings, with licensing as a condition precedent, or staggered transfer of controlled assets allow the bulk of the deal to complete while sensitive elements move only once authorisation is in place. This preserves value without exposing the acquirer to an unlicensed transfer.

Post-closing integration and compliance

Closing is not the end of export-control obligations. Sustained export control compliance in M&A depends on embedding controls into the acquired business promptly and monitoring for change.

Compliance playbook

Immediately post-closing, register any licences obtained, update customs records with GACC to reflect the new ownership and applicant details, and implement access controls over controlled technology and repositories. Where a technology partition was used pre-closing, define the criteria and sign-off required before it is dismantled.

Ongoing monitoring and audits

Controlled status is not static. Reclassification can be triggered by product changes, new use cases, or, critically, additions to MOFCOM’s export control list and entity listings. Build periodic re-screening into the compliance calendar so that a newly listed customer or a newly controlled category is caught quickly rather than at the next enforcement event.

Remediation if a licence is required after closing

If diligence gaps or list changes reveal that a licence is required after completion, act immediately: stop the relevant transfers, notify regulators where appropriate, and apply for the licence. A prepared communication plan, identifying who contacts MOFCOM and customs, what is disclosed, and how counterparties are informed, reduces the risk that a remediable gap escalates into an enforcement matter. Sensitive regulatory positions in that plan should be verified by counsel before use.

What changed in 2026 and immediate actions for deals

MOFCOM’s 2026 notice expanded the set of listed entities and reinforced the measures applicable to controlled transactions, adding parties, including certain US entities, to its export-control listings. The practical effect is a materially larger risk universe: targets and counterparties that were outside the control perimeter under earlier lists may now sit inside it, and technology categories once treated as low-risk may warrant fresh classification.

For live deals, the immediate triage is to re-run screening against the current 2026 lists, re-confirm the classification of any borderline items, and re-test whether the current transaction structure still limits transfer risk. For deal pipelines, update template diligence request lists to capture the newly relevant categories, add current-list screening to first-look checklists, and reserve additional timeline for licensing where sensitive technology is in play. Acquirers who front-load this triage are better placed to avoid the most disruptive outcome, discovering a listing issue only after signing. Treat the MOFCOM 2026 notice as the primary authority for these determinations and verify each application against the original text and any subsequent updates.

Common pitfalls and how to avoid them

• Relying on seller representations alone. Warranties do not substitute for independent classification of the target’s products and subsystems.
• Failing to classify subsystems. A finished product can be uncontrolled while an embedded module, algorithm or dataset is controlled.
• Ignoring personnel transfers. Technology can move through R&D staff and secondments as readily as through documents or code.
• Underestimating the timeline. Licensing and classification can run for months; build this into the deal calendar from the outset.
• Overlooking the national-security review overlap. Export-control triggers frequently coincide with broader foreign-investment security review; assess both in parallel.

For a quick red-flag checklist, treat any of the following as reasons to pause and escalate: a counterparty on a MOFCOM list; a prior licence refusal; refusal to grant source-code access; vague downstream customer data; or a pending regulatory enforcement notice.

Conclusion

Managing export control m&a china risk in 2026 is a matter of sequencing and discipline: screen early against the current MOFCOM lists, run document-driven due diligence, classify items and subsystems rigorously, resolve licensing on a deliberate pre- or post-closing basis, and reinforce the outcome with contractual and operational protections. MOFCOM’s 2026 listings have widened the risk universe, so acquirers who integrate these steps into the standard deal workflow will move faster and with fewer surprises. For a tailored review of a specific transaction, consult the Foreign Investment practice area, China or find a Foreign Investment lawyer in China through the Global Law Experts directory. This article is general guidance and not legal advice; obtain fact-specific counsel before acting.

Sources

1. Ministry of Commerce of the PRC (MOFCOM), official portal and export-control notices
2. General Administration of Customs of the PRC (GACC)
3. Ministry of Industry and Information Technology (MIIT)
4. State Council of the PRC (official portal)
5. National People’s Congress (NPC), Export Control Law of the PRC