Real-world scenario: A Singapore distributor of semiconductor materials (photoresist, specialty gases) wants to open an Asian logistics hub serving fabs. They ask: “Beyond ISO 9001, what ‘standards’ must we meet — and why does every partner make us sign end-use undertakings?”
This touches something newcomers to the semiconductor chain rarely expect: in this industry, “standards” are not only wall-hung quality certificates but export-control regimes and traceability systems — a form of “certification” imposed by technology-origin governments, where violations can cost a company access to the entire supply chain. Comparing Vietnam vs Taiwan here is not about ISO (identical on both sides) but about exposure to export-control regimes and how to build a compliance programme at each location.
Legal position updated to 18 October 2026. Taiwan and foreign-law sections are framework-level; local counsel should confirm details.
The industry’s second “standard”: export control
The semiconductor supply chain operates under overlapping export-control layers:
Layer 1 — US controls (extraterritorial). US export regulations (such as the EAR — Export Administration Regulations) apply to US-origin goods, software and technology wherever they are. A photoresist lot made in Vietnam but using a US-origin formula, exported to a restricted destination, may still need a US licence. The foreign direct product rule extends coverage to foreign-made products built with US equipment or technology. This is a “standard” no certification body issues — companies build compliance programmes to meet it.
Layer 2 — Allied controls (Japan, the Netherlands, South Korea…). These countries control exports of key semiconductor equipment, materials and technology under their own lists, coordinated with each other. A logistics hub in Taiwan or Vietnam importing Japanese materials must comply with Japanese export licensing.
Layer 3 — Host-country rules. Vietnam manages trade under the 2017 Foreign Trade Management Law and Decree 69/2018/ND-CP (prohibited, suspended and conditional goods lists). Taiwan has its own export-control regime for strategic goods. Companies must satisfy all three layers simultaneously — the strictest layer decides.
The export-compliance programme: five pillars
Whether the hub sits in Vietnam or Taiwan, the “certification” partners and regulators demand is a documented compliance programme:
Pillar 1 — Product classification. Determine whether each material/equipment/technology falls under control lists and the corresponding control code (ECCN under the US system or equivalent). This is technical-plus-legal work, done before the first purchase contract is signed.
Pillar 2 — Partner screening. Check customers, suppliers and end users against restricted/denied-party lists. One-off screening at signing is not enough — re-screen periodically and on each new transaction.
Pillar 3 — End-use/end-user undertakings. These are the commitment letters every partner makes the Singapore company in our scenario sign: no military end-use, no re-transfer without permission. These undertakings carry legal force — signing casually creates liability.
Pillar 4 — Licence management. Track granted export licences (conditions, validity, quantities) and ensure each shipment sits within licence scope.
Pillar 5 — Training and record-keeping. Sales, logistics and engineering staff must all be trained to spot “red flags” (customers hiding end users, circuitous delivery requests, unusual payments). Keep screening and licence records for at least 5 years — when regulators ask, “no records” means “no compliance”.
Vietnam vs Taiwan: where they differ
Exposure level: Taiwan is the world’s chip-manufacturing centre — new export-control measures are often aimed directly at technology flows through Taiwan, so businesses there feel policy changes first and hardest. Vietnam sits “downstream” in the semiconductor value chain — less directly targeted, but not immune: any US-origin material or technology passing through Vietnam faces the same rulebook.
Compliance ecosystem: in Taiwan, law firms and consultancies specialising in semiconductor export controls have served the industry for decades — specialists are easy to hire. In Vietnam, deep export-control advisory capacity is thinner — companies typically combine international counsel (for the US/allied layers) with Vietnamese counsel (for the host-country layer).
Enforcement risk: violating US export controls can land a company on a denied list — losing the right to buy materials and equipment from the entire US-technology supply chain, a business death sentence for a materials distributor. The risk is identical wherever the hub sits — which is why a compliance programme is not “nice to have” but existential.
Checklist: building the programme in Vietnam
- Classify the full material/equipment/technology catalogue against relevant control lists.
- Set up automated partner screening plus manual review of high-risk transactions.
- Draft standard end-use/end-user undertaking templates, lawyer-reviewed — not home-made forms.
- Register and track export licences per technology-origin country.
- Train all transaction-facing staff (sales, trade compliance, warehousing) on red flags.
- Keep complete records with access controls and a regulator-inquiry response procedure.
- Review every 6 months — control lists move with policy; a “build once” programme goes stale.
Semiconductor supply-chain companies needing to build an export-control compliance programme in Vietnam, or reviewing legal duties for a semiconductor-materials logistics hub, can speak with our team.
Red flags in partner screening: what training must cover
A compliance programme fails most often not in classification but in daily vigilance. Every transaction-facing employee should recognise the classic red flags: a customer reluctant to name the end user or final destination; delivery routes that make no commercial sense (goods routed through multiple intermediaries for a nearby destination); payment from a third party unrelated to the contract; orders for controlled materials far exceeding the customer’s plausible production capacity; and requests to remove or alter origin markings. The procedure for each flag must be written, not tribal knowledge: who escalates, to whom, within how many hours, and what happens to the shipment meanwhile (hold, not release). Document every escalation decision — including the decision to proceed after investigation — because a regulator reviewing the file later will judge the quality of the decision-making process, not just its outcome. Annual refresher training with real anonymised cases from your own pipeline keeps the programme alive; a slide deck read once at onboarding does not.
Frequently asked questions
1. We only do logistics/transit, not manufacturing — must we comply with export controls?
Yes. Export controls cover transit and re-export too — “just passing through” is no shield. Logistics players in the semiconductor chain must screen like manufacturers.
2. Is there risk in signing an end-use undertaking?
Yes — it is a legal commitment. If materials are later diverted beyond your control (e.g. a customer lied), you can still face exposure unless you can show reasonable due diligence. Hence lawyer-drafted templates and documented diligence procedures.
3. What about materials made in Vietnam purely with Vietnamese technology?
In principle less subject to foreign controls — but real semiconductor chains rarely have “pure” single-origin technology content. Run a technology-content analysis per product; do not assume.
4. How do companies learn when US denied lists update?
Through automated screening tools with list updates, specialist law-firm bulletins, and internal periodic reviews. “Heard it somewhere” is not enough — systematic update sources are required.
5. What are the penalties for export-control violations?
Depending on the regime: heavy administrative fines, criminal penalties for individuals, and most seriously, restricted-list designation — loss of supply-chain access. For a materials distributor, this is existential risk.
6. Does the compliance programme need independent audit?
Not legally required under every regime, but large partners (fabs, material makers) increasingly demand compliance audits as a cooperation condition. An independent audit report also evidences good-faith compliance when regulators review.
This article has been quality-reviewed by the FLAW AI Legal Council