See the file for one of your buyers.
Bring a real counterparty, anonymized if you prefer. We will show you what we would check and what the file would say.
Buyer vetting you can defend.
A signed, checked, documented file on every buyer before you ship.
Buyer vetting file
CEU-2026-1024-0163
Sample
BuyerFjellvind AI AS NO
SiteGrønnli Datasenter, Hall B · Rjukan NO
OrderPO NK-2026-1107 · 32 × 8-GPU H100 system as declared by seller
DatesOpened 2026-10-13 · Released 2026-10-24
Checks
- Purchase-order declarationSigned
- Ownership and headquartersSee 5.3
- Transaction review1 flag · resolved
- Operator statementReceived direct
- Screening · 23 parties1 hit · see 4.4
- Site inspection pilotAfter delivery
Ownership and headquarters
Fjellvind AI AS · HQ NO
└ 55% Fjellvind Gründere AS · NO
└ 35% Tembusu Digital Holdings · SG
└ 100% Orchid Bay Ventures · BVI · owner in HK
└ 10% employees · NO
No owner at 50% or more. Headquarters test not met; position recorded for counsel.
Finding Proceed with conditions
Listed-party subscriber excluded from these systems. Re-screen on or after 10 Nov 2026.
Five steps. One file.
Step 1
You upload the purchase order, or any document for the deal.
We read it and fill in the buyer, the items and the parties for you to confirm. Five minutes.
Step 2
The buyer answers and signs.
A declaration on the order, an ownership and headquarters certification, and a questionnaire on the deal. A buyer who will not complete it has told you something.
Step 3
The data center confirms, directly to us.
Space and power exist. The operator is not the real end user. An inspector will be let in later. The statement never passes through the buyer.
Step 4
We screen, map and challenge.
- Every party screened against the BIS, OFAC and allied lists.
- Ownership traced through registries to the ultimate parent.
- Headquarters checked against the public record.
- Destination, facility, quantity and funding tested against the story. Gaps are queried in writing.
Step 5
You receive the file.
Anything that needs judgment is reviewed by a person first.
Every check, named.
The diligence the largest manufacturers run in-house. Here it is, line by line.
1
On every purchase order
A signed buyer declaration, tied to the PO, before you ship.
- Commercial, military or space.The buyer says which. Military triggers a follow-up on controlled technical data.
- A specific end use.In the buyer's own words. "For R&D" is not an answer.
- Weapons and proliferation.Missiles, drones, nuclear, chemical and biological: asked directly.
- Sanctioned destinations and restricted parties.Covers the buyer, its customers and consignees, including anyone owned 50 percent or more by listed parties.
- Named end user and installation country.On the record, for that order.
- Consent to inspection after delivery.In writing. Without it, a later visit depends on goodwill.
2
Ownership and headquarters
Where the buyer is headquartered can matter as much as where the hardware ships.
- The chain to the ultimate parent.Company, parent and ultimate parent, each with a headquarters address.
- Headquarters checked against the public record.Registries, filings and the buyer's own website. Any mismatch is explained in writing.
- The 50 percent test, in aggregate.Nobody in the chain is owned 50 percent or more by parties on the Entity List, the Military End-User List or the SDN List. The buyer certifies it; we test it.
- The percentage at every level, and how it was established.Each share recorded with the document that shows it. If a percentage cannot be determined, the file says so.
- The headquarters finding, stated.A clear yes or no: is the buyer, or its ultimate parent, headquartered in China or another arms-embargoed country?
- Date of incorporation.Companies formed after October 2022 get extra attention.
- No onward transfer without authorization.A signed undertaking covering export, re-export, resale and change of use.
- A duty to tell you when things change.Ownership, headquarters or a listing: the buyer must notify you.
3
GPU-ready systems sold without GPUs
A server without accelerators can become a controlled item once someone installs them.
- Will accelerators be added later, and which?Asked and signed on every GPU-capable order.
- Acknowledgment on the record.The buyer confirms that adding advanced chips can change the rules. Where that raises a license question, we say so and refer you to counsel. We do not make license determinations.
4
Does the deal make sense?
Most diversion cases look fine on paper. These questions test the story.
- Who is selling to whom.How the buyer found the end user, who will own the systems, and every other party involved.
- Where the hardware is really going.The full ship-to address, and whether it is a staging stop or the final destination.
- The facility behind the address.Owned or leased, the landlord, the lease term, and the megawatts contracted against the megawatts the order needs.
- Quantity against workload.The model, the count, the workloads, and whether the volume fits the business.
- Where the money comes from.Source of funds with documents. A bank statement alone is not enough.
- Who the hardware will serve.If the end user is a hosting provider, its subscribers and where they are headquartered.
- Who can reach the systems remotely.Who has remote access, how it is controlled, and whether any remote user is in, or owned from, China or another arms-embargoed country.
- The security of the site.Access control, visitor logging, and whether the hardware sits in a locked cage.
- A UAE party checked against the approved list.Since July 2026, only parties named in Supplement No. 8 to Part 740 receive these items license-free.
- The delivery schedule.Lot sizes that do not match how clusters are built are queried.
- Who signed, and why they can.Names, titles, and the basis of their authority.
5
A statement from the facility, not from the buyer
The one document in the file signed by someone with no stake in the sale.
- Signed by the data-center operator and sent to us directly.It never passes through the buyer or your sales team.
- Space and power confirmed.The end user is authorized to operate there and has reserved the capacity.
- Scale disclosed.The size of the end user's lease, so an unusually large deployment is visible early.
- The operator is not the hidden end user.No ownership interest in the equipment, and no use of it.
- Access for a later visit.An inspection during business hours, with notice.
6
On site
After delivery, an independent inspector confirms the hardware is where the buyer said, with serial numbers and photographs. Pilot program, limited capacity. See the on-site checks →
Every check goes in the file as a question, an answer, the evidence and the date. A refusal to answer goes in too.
What is in the file.
Everything a reviewer would ask for, where they expect it.
Request the sample file →- Scope and date of review
- The signed order declaration, with consent to inspection
- Ownership and headquarters, certified by the buyer and mapped by us
- GPU-ready system statement, where it applies
- Transaction review: each question, answer and the evidence
- The data-center operator's statement
- Screening record with list versions and timestamps
- Your license position, recorded as yours and tested against the facts
- Findings: proceed, proceed with conditions, or do not proceed
- Shipment record: serial numbers, export filing, delivery
- What to keep, and for how long
What it is not.
A record of diligence on a stated date against stated sources. Not a license determination, not a legal opinion, not a guarantee. Where a license may be needed, we say so and refer you to counsel.