The Entity List and the Power to Name
The most direct instrument in the entire control system is also the simplest to understand: a list of names. The Entity List is a published roster of organizations that the United States has determined pose a risk to its security or foreign-policy interests. Once a company appears on it, doing business with that company changes overnight. Transactions that were routine now require a license, and those licenses are frequently reviewed under a presumption of denial, meaning the default answer is no. Naming an organization is, in practice, a way of severing it from the supply of controlled American technology.
The power of the list comes from its specificity. Broad country-level controls are blunt; they treat every actor in a nation the same. The Entity List is a scalpel. It lets regulators target a particular firm, research institute, or procurement network without restricting an entire country, which is politically and economically valuable. It also lets the government respond quickly. Adding a name is administratively lighter than rewriting a technical threshold, so the list can react to new intelligence, a newly discovered front company, a firm caught diverting goods, faster than the rest of the system can move.
This speed makes the list a living instrument. It grows as new actors are identified, and its entries are often deliberately expansive, covering not just a company but its subsidiaries, aliases, and known addresses, because sophisticated targets restructure to escape. A firm placed on the list may spin up a differently named entity to keep buying, so regulators chase the network, not just the name. This cat-and-mouse dynamic is a permanent feature. The list is never finished, because the actors it targets are always adapting.
For companies doing business, the list creates an absolute obligation: screen every customer against it. This sounds simple and is operationally demanding. A large distributor may have thousands of customers, and those customers have owners, affiliates, and end users. Effective screening means checking not just the immediate buyer but the ownership chain behind it, because a listed entity can hide behind a majority stake in an unlisted one. Rules addressing exactly this, where ownership by listed parties above a threshold extends the restrictions to the owned company, exist precisely because evasion through ownership is the obvious move. Compliance teams now maintain continuous screening systems that re-check customers as the list updates, because a customer who was clean last month may not be clean today.
The list also interacts with the anti-evasion rules discussed earlier. It is not enough to avoid selling directly to a listed party. Knowingly selling to an intermediary who will pass goods to a listed party is itself a violation. This is where knowledge and willful blindness become legal concepts. A seller who ignores obvious red flags, an order wildly inconsistent with a customer's business, a shipping route that makes no sense, a buyer who refuses to identify the end user, cannot hide behind claimed ignorance. The law expects diligence proportional to the risk, and the risk around advanced compute is now understood to be high.
Beyond the Entity List sit other rosters with related functions, targeting different categories of concern, and the specifics of which list governs which restriction are the domain of specialists. The durable lesson for a practitioner is structural: the United States reserves the power to name specific actors and cut them off, it exercises that power frequently and expansively, and the obligation to screen against these names falls on everyone in the supply chain, not just the party at the border.
Faraday's read: the named-list approach is durable precisely because it is flexible and fast, and its use in the compute domain will only expand. Item thresholds age badly as hardware improves, but a name does not expire. Expect the lists to grow more granular and more networked, targeting procurement webs rather than single firms, and expect ownership and control rules to tighten so that hiding behind a corporate structure becomes harder. For companies, the strategic implication is that customer due diligence is no longer a back-office compliance chore. It is a core operational capability, and firms that treat it as such, investing in real intelligence about who they are dealing with, will avoid the catastrophic surprise of discovering that a major customer was a front the entire time.