TaxTMI 
TaxTMI 
Inputs on Draft Internal Compliance Programme Document for adoption by Industry for export of dual use(SCOMET) items
X X X X Extracts X X X X
X X X X Extracts X X X X
....ubmit an ICP Checklist. In order to further standardize the elements of effective ICP, a draft document has been prepared in consultation with Bureau of Indian Standards (BIS). 2. In line with Para 1.07A of FTP 2023, which provides for consultation with stakeholders during the formulation or amendment of Foreign Trade Policy, Draft Management System Requirements for Internal Compliance Programme (ICP) for Dual-use items have been formulated and are enclosed as an Annexure to this Trade Notice. This Directorate invites views, suggestions, comments, and feedback from relevant stakeholders, including exporters, industry associations, and experts on the proposed amendments. 3. Stakeholders are requested to submit proposals, recommendations, or inputs to this Directorate for examination within 10 days from the issuance of this Trade Notice. Submissions may be made via email to scomet-dgft@ gov.in. 4. This Trade Notice is issued with the approval of the competent authority in accordance with the provisions of Para 1.07A of FTP 2023. (B Kruti) Deputy Director General of Foreign Trade (Issued from F.No.01/77/171/059/AM24/EC(S) Annexure: Draft Public Notice for notifyin....
X X X X Extracts X X X X
X X X X Extracts X X X X
....character of these items. Dual-use refers to the nature of an item, allowing it to be used in military applications or in weapons of mass destruction (WMD), as well as in civilian/industrial applications. The list of these dual-use items is called the Special Chemicals, Organisms, Materials, Equipment and Technologies (SCOMET) List. Export of SCOMET items is either prohibited for export, or restricted, or exempted from such authorisation for export to certain destinations with certain port-reporting and recordkeeping requirements etc. India is a member of three multilateral export control regimes: the Wassenaar Arrangement, Missile Technology Control Regime, and Australia Group, which have contributed to the goals of non-proliferation by issuing guidelines for export controls and lists of specific items whose exports are to be regulated. As per our national laws and regulations, export of technology related to items specified under the SCOMET list is also controlled and requires an authorisation from the licensing authority. Companies and other organisations dealing with dual-use items are mandated ....
X X X X Extracts X X X X
X X X X Extracts X X X X
....pliance management systems • ISO 31000:2018 - Risk management - Guidelines • ISO 27001:2022 - Information security management systems 3.0 Terms and Definitions This section provides commonly used terms in the Internal Compliance Programme (ICP), explained in plain language. These definitions are derived from internationally accepted standards, such as ISO 37301 (Compliance Management Systems), ISO 31000 (Risk Management), and ISO 27000 (Information Security), and adapted for the Indian export control context. For the purposes of this document, the following terms and definitions apply. ISO and IEC maintain terminology databases for use in standardization at the following addresses: 7. ISO Online browsing platform: available at https://www.iso.org/obp 8. IEC Electropedia: available at https://www.electropedia.org/ 3.1 Objective An objective is a specific result an organisation aims to achieve. ISO 37301:2021 - Clause 3.6 3.2 Organisation An organisation refers to a company, institution, or any group of people that work together toward shared goals and have defined roles and....
X X X X Extracts X X X X
X X X X Extracts X X X X
....pliers and partners) that contribute to producing a good or service. 4.0 Context of the Organisation 4.1 Understanding the organization and its context The factors that affects the organisation's ICP are: 7. Size and complexity: Consider the size and organizational structure, including subsidiaries, partnerships, and outsourcing arrangements. 8. Nature of operations: Understand activity types, operational complexity, and risk landscape to shape an effective ICP. 9. Geographical Location: Specific regulatory requirements and enforcement activities may vary depending on the organization's geographic locations and operations. 10. Subsidiaries and customers: The compliance risk and complexity can increase with subsidiaries in various jurisdictions and diverse customer profiles. 11. Nature of dual-use items: Analyse the types of dual-use items involved, their applications, and associated risks. 4.2 Understanding the needs of interested parties The main interested party in ICP are the regulatory bodies, which are often government entities, which have several key needs. They requi....
X X X X Extracts X X X X
X X X X Extracts X X X X
....n Internal Compliance Programmes for Dual-use Trade Controls under Council Regulation (EC) No 428/2009, European Commission. 11. Authorised Economic Operator (AEO) Programme of Indian Customs, CBIC Circular 33/2016 - Customs, as amended. 5.0 Leadership 5.1 Management Commitment The top management should build a corporate/organisational compliance culture for export control. It results in allocation of adequate organisational, human, and technical resources for the organisation's commitment to compliance. The objective is to communicate to all employees the importance of export compliance, the commitment to adhere to the export control regulations and support to the internal compliance procedures of the organisation. The management commitment entails a formal statement on the organisation's letterhead, dated and signed by the senior management of an organisation. This statement should be reviewed and disseminated annually. It should also be included in the organisation's ICP document and made available to all the employees. The management commitment statement should contain the following: ....
X X X X Extracts X X X X
X X X X Extracts X X X X
....define the responsibility of this role, these responsibilities may include the following: 8. Development and revision of the ICP, operational procedures, etc. 9. Having expertise and staying updated with the current information on export control laws and regulations. 10. Represent the organisation in matters related to export regulations such as licensing requirements, items classification, disclosures, etc. 11. Classification/Identification, screening, and approval of export controlled and related business transactions. 12. Providing guidance to the employees and organisation's affiliated entities. 13. Grant the Chief Export Control Officer or any other equivalent designation and the team access to all relevant laws and regulations; for example, national laws and regulations, UN Security Council sanction lists, SCOMET/dual-use export control list, etc. 14. Make available the contact details of the Chief Export Control Officer or any other equivalent designation and the team. If the duties of export control officer are being outsourced, then organise ....
X X X X Extracts X X X X
X X X X Extracts X X X X
....the end user, buyer/intermediary/consignee, customer, other entities such as carrier/transporter, freight forwarder, agent, etc. are not specified on UNSC sanctions lists (or is not owned or controlled by a UNSC listed entity) or is not identified with red flags or other warning signs. 9. Screening the risk of diversion of items from authorised enduser to unauthorised end-users. 10. Establishing procedures to determine if there is information of concern about the stated end-use (catch-all controls for unlisted items). Pursuant to this, it should be ensured that the transaction does not happen without clarifying the points of concern and if necessary, to obtain proper authorisation from the relevant government authority. 10. Screening for red flags or warning signs, these are: 7. The customer is being opaque or unclear about the end-use or end-user of dual use items. 8. The stated end-use or the product's capabilities is inconsistent or do not fir with the customer/buyer's line of business, level of technical sophistication, etc. 9. Receiving unsolicited communicatio....
X X X X Extracts X X X X
X X X X Extracts X X X X
....icable national export control laws and regulations or noncompliance with the organization's ICP should pe promptly reported. 9. The organisation should take prompt corrective action to eliminate the cause of non-compliance and prevent its recurrence. This includes establishing appropriate actions within the organization for non-compliance. 10. If needed, the ICP should be revised after identifying potential vulnerabilities in it, to ensure that non-compliance does not recur. The revised ICP should be communicated to the employees. 11. The organization should communicate with the relevant government authority to discuss possible ways of strengthening the organization's ICP. The corrective measures taken by the organization for suspected or actual breaches should be documented. 12. The organization should review the effectiveness of the corrective actions to ensure that they have achieved their intended purpose. This is a crucial step in the continual improvement process. 6.4 Applicability to Sustainable Development Goals The organization should recognize the potential connect....
X X X X Extracts X X X X
X X X X Extracts X X X X
....ons, which include staying updated with the changes in them. An awareness session should also be provided the new employees on export control related compliance, the importance of ICP and its benefits, providing a comprehensive understanding from the beginning. 7.4 Communication The organization should establish a process for internal and external communication relevant to the ICP. The contact details of Chief Export Control Officer or any other equivalent designation and the team can also be made available. If the duties of export control officer are being outsources, then organise and make available the communication of the organisation with the outsourced persons to ensure that all the relevant parties are kept informed about the ICP's progress and any changes made. 7.5 Documented Information 7.5.1 General The organization should establish a general framework for managing documented information related to the ICP. This framework should outline the processes for creating, updating, and controlling documented information. 7.5.2 Creating and updating documented information Recordkeeping comprises proce....
X X X X Extracts X X X X
X X X X Extracts X X X X
....0. Monitor transportation routes and logistics for potential security risks. 8.2 Complaints/grievance handling Complaints/grievance handling is an integral part of the ICP. The organization should establish a fair, transparent, and timely process for receiving, investigating, and resolving complaints or grievances related to compliance. The organisation should: 7. Establish a mechanism for reporting suspected security breaches or unauthorized access attempts. 8. Investigate reported incidents promptly and take appropriate corrective actions. 9. Communicate lessons learned from security incidents to prevent future occurrences. 9.0 Performance Evaluation 9.1 Performance Review The ICP must be reviewed, tested and recalibrated periodically, to keep it effective and up to date. This entails performance reviews and audits to verify whether the ICP is being implemented effectively, i.e., consistent with the applicable export control laws and regulations. These reviews are designed to detect inconsistencies, so that procedures can be revised in case they are resulting in non-compliance. ....
X X X X Extracts X X X X
X X X X Extracts X X X X
....ining and awareness enhancements 12. Resource allocation adjustments 13. Risk assessment and mitigation strategy refinements 14. Communication and reporting channel improvements 15. Development of action plans for implementing identified improvements. 10.0 Improvement 10.1 Continual Improvement The organization should strive for continual improvement in the effectiveness of the ICP. This involves using the results of monitoring, measurement, analysis, evaluation, internal audits, and management reviews to identify opportunities for improvement. In case of any known or suspected incidents of non-compliance with the applicable national export control laws and regulations or non-compliance with the organisation's ICP, the incident should be promptly reported to the responsible person. Thereafter, necessary corrective actions to identify vulnerabilities in the ICP should be put in place to ensure that similar violations do not recur in the future. 10.2 Corrective actions When non-compliance or potential non-compliance is identified, the organization should take prompt corrective acti....
X X X X Extracts X X X X
X X X X Extracts X X X X
....l Export Control Compliance Policy signed by top management, committing to zero-tolerance for export violations and regular training. 6.0 Planning and Risk Mitigation: • The company implemented item classification protocols aligned with Wassenaar Arrangement and BIS standards. • All employees underwent ISO 37301:2021-based compliance training. • A denied party screening solution was integrated with the ERP system for real-time vetting of clients and end-users. 7.0 Support: • The company used ISO 31000:2018 to structure its export risk management framework, especially for high-risk transactions involving re-exports or third-country shipments. • Staff were trained in ISO 19011:2018 audit practices to conduct quarterly internal audits of export records. 9.0 Performance Review: • KPIs included: (a) percentage of SCOMET-screened transactions, (b) compliance training completion rate, (c) violations reported and closed. • Lessons learned from audits led to updating ICP checklists and training content. • The ICP implementati....