Global Trade Compliance Software: What Happens When a Screening Hit Reaches the Dock Instead of the Compliance Desk

Why a screening hit reaches the dock instead of the compliance desk

An order comes in through a distributor for a components package worth a moderate amount, destined for a freight forwarder's address in a third country. Customer service enters it, credit approves it, the warehouse picks it, and it ships on Thursday. On the following Tuesday the compliance team runs its weekly screening batch and finds that the ultimate consignee named in the shipping documents matches an entry on a restricted party list. The goods are already on a vessel. Now the company is drafting a voluntary disclosure and calling outside counsel, and the conversation with the board is about a control failure rather than about a near miss.

That timeline is the entire problem. Trade compliance is not fundamentally about having the right lists or the right classifications, because those are purchasable. It is about whether the control executes at the moment a decision is made, inside the systems where people work, in every entity, every time. A compliance function that reviews after the fact is producing evidence of violations rather than preventing them.

The obligations themselves are well defined and public. Products carry a tariff classification for duty and an export control classification under the Export Administration Regulations, or a category under the International Traffic in Arms Regulations if they are defence articles. Parties are screened against consolidated restricted party lists, and the ownership rules matter, since an entity owned fifty percent or more in aggregate by blocked persons is itself blocked even when its own name appears on no list. Licences and licence exceptions have conditions attached that someone has to actually check. Country of origin drives duty, and preferential origin under a trade agreement drives whether a claim is defensible when the customs authority audits it. Records must be retained for five years. None of this is ambiguous. What is hard is enforcement at speed across a real business.

Problem 1: classification is your engineering data, not a lookup table

Vendors sell classification content and it is genuinely useful, but content answers a general question and your question is specific. What is the classification of this assembly, given the bill of materials, given that the controlled component sits three levels down, given that a substitute part was approved by engineering last quarter, and given that the item ships with software that has its own control status?

This is why classification projects stall. The compliance team is asked to classify tens of thousands of part numbers, they lack the engineering context, engineering lacks the regulatory context, and the two groups meet in a spreadsheet. Then a design change alters the answer and nobody re examines it, so the classification decays quietly.

What a custom build does is anchor classification to your product structure. Classify at the level where the control actually attaches, propagate up the bill of materials with an explicit rule for how a controlled component affects the assembly, and trigger review automatically when engineering changes the structure. Store the reasoning, not just the code: which rule, which note, who decided, on what date, with what supporting document. When a regulator or an auditor asks why an item was treated as EAR99, the answer must be a record rather than a recollection.

Problem 2: screening has to be synchronous, everywhere, or it is theatre

Screening belongs at order entry, at customer master creation, at shipment release, at vendor onboarding and at any point where a new party enters your data. It has to run in seconds, because a control that adds two minutes to order entry will be routed around within a month. It has to handle the ownership rule, which means screening a name is not sufficient and you need beneficial ownership data for the entities that matter. And it has to produce a defensible record of what was checked against which list version at what time.

Descartes Visual Compliance is genuinely strong at screening as a service and many companies use it well. Where a build earns its place is the embedding: enforcing screening inside three different ERPs, a legacy order system and an e-commerce channel, with one escalation workflow and one audit trail, is integration work regardless of whose screening engine sits underneath. Sensibly designed, a custom platform often calls a commercial screening service rather than replicating list management, and spends its effort on the enforcement points and the exception handling. That is the honest architecture and we would recommend it over rebuilding list infrastructure.

The escalation design is where most implementations succeed or fail. A hit is not a violation. Most hits are false positives on common names. If every hit blocks an order and routes to a compliance analyst, order entry grinds to a halt and the business starts pressuring compliance to loosen thresholds, which is exactly the wrong dynamic. Good design means graded responses: automatic clearance for previously reviewed matches with a recorded decision, soft holds that allow order entry to continue but block release, and hard blocks reserved for high confidence matches on the most serious lists.

Problem 3: licences have conditions and nobody is watching the value

An export licence is not a permission slip, it is a set of conditions: specific commodities, a specific end user, a quantity or value ceiling, an expiry date, and often reporting obligations. Companies routinely track that a licence exists and fail to track consumption against it, so the ceiling is discovered at the point of breach.

The build treats a licence as a live balance. Each shipment decrements it, the system refuses to draw on an expired or exhausted licence, and it warns at a configurable threshold so renewal starts before the shipment is at the dock. The same logic applies to licence exceptions, where eligibility conditions must be checked per transaction rather than assumed once. Deemed export exposure, meaning technology released to a foreign national inside your own facility, belongs in the same system, because the technology transfer is a controlled event even though nothing crosses a border.

Where SAP GTS, Oracle GTM, ONESOURCE and e2open actually stop

SAP Global Trade Services is deeply integrated for an SAP shop, and if your entire business runs on one SAP instance it is the obvious answer. Oracle Global Trade Management is the equivalent statement for Oracle. Both weaken exactly where large manufacturers actually live, which is a mixed estate: an acquired division on a different ERP (Enterprise Resource Planning), a legacy system in one region, a direct to consumer channel that was never in scope. Thomson Reuters ONESOURCE Global Trade brings strong regulatory content, and content is a different thing from enforcement inside your order flow, which remains integration work. Descartes Visual Compliance is excellent at screening and is not a full classification and licensing engine tied to your bill of materials. e2open is broad and network oriented, with the configuration effort that comes with breadth.

The pattern in every one of these is the same. They are strongest at the compliance content and weakest at the last mile into your specific systems, and the last mile is where the violation happens.

What it costs, how long it takes, and what drives the number

Across the 2,000 plus projects Digital Heroes has delivered, this is the shape. A first release covering classification tied to product structure, synchronous screening at order entry and shipment release with a graded escalation workflow, and a complete audit trail runs $130,000 to $280,000 and ships in four to seven months. A full platform adding licence and exception management with balance tracking, preferential origin determination and supplier solicitation, denied party workflows across all entry points, duty and drawback support, and multi entity reporting runs $400,000 to $1,100,000 phased over 12 to 24 months.

What drives the cost up: the number of ERPs and order channels where controls must be enforced, which is the dominant factor. Preferential origin, because collecting and maintaining supplier declarations and running regional value content calculations is a programme rather than a feature. Defence articles, since the ITAR regime brings its own registration, licensing and technology control plan requirements. And the state of your product master data, because classification cannot be automated on top of part numbers that nobody can map to an engineering structure.

How to choose a developer for trade compliance software

Ask them how they would handle a screening hit on an entity whose name is not on any list but which is majority owned by a listed party. If they do not raise the ownership rule unprompted, they have read a product brochure rather than the regulations, and you will be funding their education while carrying the risk.

Ask how classification propagates through a bill of materials and what triggers reclassification. A team that treats classification as a field on a part record has not understood why these projects fail. Then ask what their escalation model looks like and how they prevent false positive fatigue, because that single design decision determines whether the business works with the control or around it.

Ask what they will build versus what they will buy. The right answer usually includes calling a commercial screening service and buying tariff content, while building the enforcement, workflow and audit layer that is specific to you. A team that proposes to rebuild list management from scratch is optimising for billable hours. Then get ownership in writing before kickoff: repository, infrastructure accounts and the right to appoint anyone else. At Digital Heroes the client owns the code from the first commit, and for a system whose records must be retained for five years and produced under audit, owning both the code and the data is the only defensible arrangement.