Chip controls hold at the sale, then fail at end-use checks

Licensed at the sale, lost on resale

US chip controls work at the moment of sale. In a case opened on 25 March, 600 of 750 servers needed a licence to go to China. The break comes at the second step, once the product has passed to a buyer in a third country. The case against the owner of Earthmade Computer, who appeared in court in Los Angeles on 1–2 October, shows this plainly.

According to the indictment as reported by The Register, the defendant received more than $176 million from 2 Malaysian intermediaries. The filing traces 92 servers that left San Francisco airport for Kuala Lumpur and were then routed to buyers in Hong Kong. The shipments included A100 and H100 data-centre processors as well as RTX 4090 and RTX 5090 cards.

The telling figure is a duration that may stretch across 3 years. The Register says the scheme ran from October 2023 to 12 August 2026, roughly 34 months. Bloomberg puts the end in mid-August 2024, so the two sources diverge by 2 years on the end date. Whichever is right, an export declaration was filed for every shipment, yet the end user went unseen for at least 10 months.

The same pattern recurs in 2026. In March a co-founder of Supermicro was charged with diverting roughly $2.5 billion of Nvidia hardware to China. According to BIS, the servers in that 3-person case moved through Southeast Asia. Bloomberg data reported by the Taipei Times show that a leasing company controlled by Chinese local governments also financed the purchase of more than 700 servers. Of those, 32 carry B300 chips that cannot be sold without a licence.

Three transit states, three appetites for enforcement

Malaysia took the clearest step on 14 July 2025. That day its trade ministry made exports, transhipment and transit of high-performance US-origin AI chips subject to a permit. Companies must notify the authorities at least 30 days in advance. The 2 sources differ on whether the scheme in the Lui case continued after the rule took effect. How far the rule has curbed smuggling could not be verified.

Singapore has relied on the courts since 2025. According to Foreign Policy, 3 people were arrested there over sham server transactions worth about $390 million. On 6 July 2026 money-laundering charges were added against the main suspect, and bail was raised above 1.2 million Singapore dollars. Singapore is therefore prosecuting the smuggling as fraud against manufacturers in a deal worth about $390 million, not as an export violation.

Thailand looks like the weakest of the 3 links. Thailand Business News reported on 8 May 2026 that the US suspects OBON Corp, a Bangkok-based company involved in the national AI project, of passing servers worth billions of dollars to China. In the 25 March case, an order for 750 servers worth about $170 million had been placed on behalf of a Thai buyer. It was not BIS that stopped the order. It was 2 companies, Supermicro and Nvidia, which asked who the buyer was.

The limit of enforcement: 25 officers worldwide

The best account of BIS's capacity is the testimony Under Secretary Kessler gave the House of Representatives on 14 July 2026. By his account, the enforcement arm today runs on 299 staff and has only 25 officers abroad. The 2027 budget request proposes lifting its funding from $122 million to $301 million, an increase of 147%.

In the same testimony Kessler concedes that the 299-strong workforce is swamped by more cases and tip-offs than its peers. Penalty volumes have grown fast: fines imposed by BIS rose from $16 million in 2024 to $324 million in 2025. That twentyfold increase shows prosecution getting stronger. It also shows that on-site checks after shipment remain thin.

Foreign Policy reported in September 2025 that BIS had just 1 export control officer conducting on-site checks across the whole of Southeast Asia. That figure is a year old, and the current regional deployment could not be verified. Even so, a global team of 25 cannot plausibly verify, one by one, the end users of thousands of servers in Malaysia, Singapore and Thailand.

The second leak: renting and copying

As physical shipment gets harder, 2 channels come to the fore. The first is the cloud. According to The Register, Chinese companies have been renting controlled GPUs hosted abroad since at least 2023. On 12 January 2026 the House passed the Remote Access Security Act, which treats such access as an export, by 369 votes to 22. A 23 March note from Latham & Watkins said the bill was awaiting the Senate Banking Committee; its subsequent status could not be verified.

The second channel is distillation: harvesting a large model's answers and using them to train a smaller one. OpenAI's own developer guide sets out the method in 4 steps. It presents it as a legitimate way to cut costs, turning the large model's output into fine-tuning data for the small one. On 30 September OpenAI tied 16,000 requests, sent on 24–25 July by more than 4,000 users, to people linked to Moonshot AI.

The weakness of this second channel lies in the evidence. According to The Hacker News, OpenAI offered no public technical evidence for the attribution. Moonshot's response has not been verified since 30 September. In distillation not a single chip crosses a border; only text does. The licensing logic behind the $324 million in fines BIS imposed in 2025 therefore has no purchase here.

The link to the truce timetable

The 24 September summit left chip controls off the table and pushed decisions to 10 January 2027. The tougher line is coming not from the executive but from the 535-member Congress. Roll Call reported on 23 September that a bill requiring location verification for chips had been folded into the defence authorisation package. It cleared a House committee by 42 votes to 0. Location verification answers precisely the gap this report describes: 10 to 34 months of blindness after the sale.

Two things matter over the next 98 days. The first is whether the chip location clause survives in the conference text of the 2027 defence authorisation act. The second is whether Congress approves the funding that would lift BIS's overseas staff from 25 to 65. If neither step happens, the 10 January talks risk putting on the table, as a bargaining chip, a control the US cannot in practice enforce.