NVIDIA GB300 and NVL72: Why Your AI Infrastructure Supplier Should Understand Export Compliance

Wei Fei|Published: November 9, 2026

⏱ 8 Min Read

Because the compliance work on a GB300 or GB300 NVL72 order starts with the supplier, not with you. Before a manufacturer or distributor accepts an order for advanced AI hardware, the seller is expected to know who is buying, who will use it, where it will be installed and what it is for, and to stop if the answers don't add up. A supplier who doesn't understand those expectations can stall your order, accept information that later proves wrong, or pass the risk to you. This post looks at the supplier's side: what a compliance-literate reseller actually does, and the questions to ask before you choose one.

Why does the supplier carry compliance responsibilities at all?

Advanced NVIDIA data-centre hardware is US-origin technology covered by US export controls, and those controls follow the hardware after it leaves the US. Every party in the chain, from manufacturer to distributor to reseller, is expected to know its customer. In May 2025 the US Bureau of Industry and Security (BIS) published guidance telling industry how to prevent diversion of advanced computing chips, including red flags to watch for and an end-user certification to collect. Its long-standing "know your customer" guidance adds a simple rule: do not "self-blind".

Singapore has its own position. Dr Tan See Leng told Parliament on 18 February 2025 that Singapore does not have legal obligations to enforce other countries' unilateral export controls, but expects "all companies operating in Singapore to take into account such regulations", and will act under Singapore law against companies that deceptively evade them. Singapore Customs followed with Circular 01/2025 (4 April 2025), which asks traders to run an internal compliance programme with KYC and end-user screening, and to watch for red flags such as unusual shipping routes or end-use inconsistencies.

The rules themselves are covered in our post on export controls and AI hardware in Singapore. Here the question is narrower: what should your supplier be doing with them?

What does a compliance-literate supplier actually do?

Task	What it looks like on your order	Basis
Screens the parties	Checks the buyer, end user and consignee against restricted-party lists	BIS diversion guidance (13 May 2025); Singapore Customs Circular 01/2025
Asks about ownership	Wants the headquarters of the buyer and its ultimate parent, not just the local entity	BIS guidance (31 May 2026): licence needed where the entity or its parent is headquartered in a D:5 country or Macau
Checks the end use fits	Asks what the system will run and whether that matches your line of business	BIS KYC red flags (Supp. 3 to 15 CFR Part 732)
Checks the site fits the hardware	Asks where it will be installed and whether the site has the power and cooling	BIS red flag: a data centre that cannot confirm power, cooling or space
Collects a signed end-user statement	A declaration on end use, site and no onward transfer contrary to it	BIS recommended end-user certification (May 2025)
Follows up on red flags	Asks again, or pauses, when answers are vague or inconsistent	KYC guidance: "If there are 'red flags', inquire"; "Do not self-blind"
Flags onward moves	Tells you that relocating or reselling abroad later can need permits	EAR re-export rules; e.g. Malaysia's permit rule for US-origin AI chips (14 Jul 2025)
Keeps the chain documented	Can show the OEM or distributor the unit came from, and keeps the declarations	Good practice; NVIDIA supports only authorised products (Jul 2025)

Source: BIS "Industry Guidance to Prevent Diversion of Advanced Computing Integrated Circuits" (13 May 2025) and "Guidance on Enforcing License Requirements for Advanced Computing Items" (31 May 2026); 15 CFR Part 732 Supp. 3; MTI oral reply, 18 Feb 2025; Singapore Customs Circular 01/2025 as summarised by Chambers (12 Jun 2025); MITI Malaysia press statement, 14 Jul 2025. Facts as of 9 Nov 2026.

Why is a supplier who asks nothing a problem?

It feels faster, but it rarely is. Manufacturers and distributors typically ask for end-user and installation details before they accept high-end AI system orders, so a reseller who skips the questions usually just pushes them to later, when an order is already waiting for allocation. In a US case reported in March 2026, NVIDIA reviewed a large server order, could not verify the ultimate buyer, and the purchase did not complete.

There is also a legal edge. In a 2025 Singapore case, individuals were charged with fraud over alleged false end-user representations to server suppliers; the case is before the courts. US prosecutors have also charged diversion schemes routed through Southeast Asia. The lesson for buyers is not that suppliers are suspects, but that the end-user information you give is taken seriously, and a supplier who treats it as a formality is not protecting you.

A good supplier's questions are not an obstacle to your order. They are the reason the manufacturer will accept it.

What should you ask a prospective GB300 or NVL72 supplier?

These ten questions separate a supplier who understands compliance from one who doesn't. You don't need perfect answers to all of them, but you do need straight ones.

Which manufacturer or distributor will this system come from, and can you confirm that in writing?
What end-user and site information will the manufacturer or distributor ask for, and when?
Do you screen buyers and end users against restricted-party lists, and what happens if something comes up?
Will you need our parent company's details, and why?
Who signs the end-user statement on our side, and what are we declaring?
What happens if our installation site changes after the order is placed?
If we later move or resell the system outside Singapore, what should we expect?
How do you handle repair and replacement shipments under warranty?
What records will you keep of this transaction, and what should we keep?
If something in our answers raises a question, how will you tell us, and how quickly?

A supplier who says it can "get approval" for you, or promises that no paperwork is needed, is overstating its role. Export licences are decided by the authorities, permits by Singapore Customs, and order acceptance by the manufacturer and distributor. A supplier's job is to know what will be asked, prepare it properly with you, and not proceed when it shouldn't.

For what each document is and why each field exists, see GB300 KYC and EUC requirements explained. For the trickier situations, such as a foreign parent company, colocation sites or later redeployment, see the hidden compliance challenges behind GB300 purchases. For what can go wrong with sellers who skip all this, read the risks of buying from unverified suppliers, and for general warning signs see red flags when buying IT equipment online in Singapore. This article is general information, not legal advice; confirm requirements for your situation with your legal or trade-compliance adviser.

Does compliance slow a GB300 order down?

Preparation speeds it up. The delays come from information that arrives late or changes: an entity name that doesn't match the purchase order, a site listed as "to be confirmed", or a parent company that wasn't mentioned. None of that is solved by a supplier who ignores it. Our post on documentation mistakes that hold up GB300 orders lists the common ones. Allocation and manufacturing still set the pace, as we explain in who gets hardware first in a shortage.

Buying in Singapore

When you ask SourceIT for a GB300 quotation, we tell you up front what end-user and site information the manufacturer or distributor is likely to need, help you prepare and organise it, and coordinate with the supplier until the order is accepted. We do not obtain export licences or speed up approvals; those decisions sit with the authorities and the manufacturer. We list DGX Station GB300 systems from ASUS, Dell, HP, MSI, GIGABYTE and Supermicro, each supplied through that OEM's channel, including the Dell Pro Max with GB300 and Supermicro ARS-511GD-NB-LCC, both price on request. SourceIT does not list GB300 NVL72 racks. For data-centre projects, ask us to source through our partners; we will confirm availability, lead time and facility requirements rather than assume stock. Use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.

Frequently asked questions

Does Singapore enforce US export controls? Not as such. Singapore's position (18 Feb 2025) is that it has no legal obligation to enforce other countries' unilateral controls, but expects companies here to take them into account, and it acts under Singapore law against deliberate evasion.

Why does my supplier want my parent company's details? Because US licence requirements for advanced AI hardware can depend on where the buyer or its ultimate parent is headquartered, not just where the local company is registered (BIS guidance, 31 May 2026).

Can a supplier get an export licence for me? No supplier can promise that. Licences are decided by the relevant authority. A supplier can help you prepare accurate information and tell you if a licence question is likely to arise.

Is it a red flag if a supplier asks no questions about end use? Yes. Manufacturers and distributors typically ask for end-user and site details on high-end AI systems, so a seller who skips them is either deferring the problem or not following normal practice.

What should we keep on file after buying a GB300 system? Keep the quotation, invoice, signed end-user statement, delivery records and serial numbers. Ask your legal or trade-compliance adviser how long to keep them for your situation.