NVIDIA GB300 KYC & EUC Requirements Explained: How SourceIT Makes Procurement Easier
KYC (know your customer) is the supplier's check on who you are. An end-user certificate (EUC), often combined with an end-use statement, is the signed document in which you say who will use an NVIDIA GB300 system, where it will be installed, what it will be used for, and that it won't be passed on or moved without authorisation. Suppliers ask for both because GB300 systems are among the advanced AI hardware covered by US advanced-computing export controls. US guidance tells sellers to collect end-user certifications, and manufacturers can decline orders they cannot verify. The forms are not difficult, but they have to be complete and consistent. Preparing the information before you ask for a quotation is the single best way to keep a GB300 order moving. This guide explains each document and each field. For the rules behind them, read our overview of how export controls affect AI hardware buyers in Singapore.
What is the difference between KYC, an EUC and an end-use statement?
KYC is something the supplier does. The US Bureau of Industry and Security (BIS) sets out its "Know Your Customer" guidance in Supplement 3 to Part 732 of the Export Administration Regulations. Its principles are short: decide whether there are red flags; if there are, inquire; and "do not self-blind". In practice a supplier verifies your company, its ownership and whether your stated use fits your business.
An end-user certificate is something you sign. It identifies the party that will actually use the equipment and records your assurances about it. An end-use statement describes what the system will do. Most suppliers combine the two in one form.
The formal US version is BIS Form 711, the "Statement by Ultimate Consignee and Purchaser". Under 15 CFR §748.11 it supports licence applications and is not required for every GPU sale. Many manufacturers and distributors model their own forms on it, so its structure is a good guide to what you'll be asked.
Who asks for them, and why might you be asked more than once?
A GB300 order passes through several parties: the reseller you buy from, a distributor, the system manufacturer (ASUS, Dell, HP, MSI, GIGABYTE or Supermicro for a DGX Station), and sometimes NVIDIA itself. Each has its own obligations, so each may ask for the same facts on its own form.
BIS's guidance of 13 May 2025 on preventing diversion of advanced computing chips recommends that sellers obtain an end-user certification covering all parties to the transaction and the intended end use. Singapore Customs Circular 01/2025 (4 April 2025) asks traders to run an internal compliance programme with KYC and end-user screening. Large orders are reviewed. In a US case reported by The Register on 26 March 2026, NVIDIA could not verify the ultimate buyer of 750 servers, and the purchase was not completed.
What does each field usually ask for?
| Field | What it usually asks | Why it exists | What to prepare |
|---|---|---|---|
| Legal entity | Registered name, UEN, registered address, website | Confirms you exist and are who the purchase order says | ACRA business profile; the exact name that will appear on the PO and invoice |
| End user | Who will operate the system, if not the buyer | Suppliers must know the party that actually uses it | The end user's legal name and UEN, and your relationship to it |
| Ownership and headquarters | Ultimate parent company and the country it is headquartered in | US licence requirements can depend on where the buyer or its parent is headquartered | A simple group structure chart |
| Installation site | Full address of where the system will run | The equipment is tracked to a place, not just a company | Street address, data-centre name and hall if applicable |
| End use and workload | What the system will do; internal use, resale or providing compute to others | Checks that the use fits your business and isn't a restricted end use | Two or three specific sentences about the workload |
| Products and quantity | Model numbers and how many | Ties the declaration to the order | The quoted configuration |
| Onward transfer | Undertaking not to resell, re-export or relocate without authorisation | US rules follow US-origin items after they leave the US | Any plans to move or share the system later |
| Prohibited uses | Statements of no military, weapons or restricted supercomputer end use | Covers end-use controls that apply alongside the chip rules | Confirmation from someone who knows the business |
| Signature | Authorised officer's name, title, date and company stamp | Someone accountable confirms the facts | A director or officer able to bind the company |
Source: BIS Supplement 3 to Part 732 (KYC guidance); 15 CFR §748.11 and Supplement 3 to Part 748 (Form BIS-711); BIS "Industry Guidance to Prevent Diversion of Advanced Computing Integrated Circuits" (13 May 2025); structure of published distributor and manufacturer end-user forms. Exact fields vary by supplier. Facts as of 9 Nov 2026.
Why does the parent company's headquarters matter?
BIS guidance of 31 May 2026 says a US licence is needed to export these advanced computing items to any destination when the entity, or its ultimate parent, is headquartered in a US Country Group D:5 country or Macau, even if the entity itself is located elsewhere. That is why a supplier asks about your parent even when you are a Singapore-incorporated company buying for a Singapore office. Leaving the field blank, or answering "N/A" for a group with an overseas parent, creates exactly the uncertainty the guidance tells sellers to resolve. We cover the ownership edge cases in the hidden compliance challenges behind GB300 purchases.
Why do suppliers want the installation site and workload?
BIS's May 2025 red flags include an unknown ultimate delivery or installation address, and a data centre that cannot confirm it has the power, cooling or space for the servers. Workload matters because the end use has to make sense for your line of business. Both fields deserve more than one line, so we've given them their own guide: why suppliers need to know where your AI server will be installed.
What does signing actually commit you to?
The person who signs is confirming the facts are true and that the company will keep its undertakings. BIS's rules for its own form say a signed statement cannot be altered. If facts change, a new statement is needed. Supplier forms work the same way. Some are valid for a single transaction; others last a set period unless something changes. If you later move the system, change who uses it, or start offering its compute to other companies, tell your supplier before you do it.
A GB300 order moves only as fast as its least clear answer. Complete, consistent end-user information is what keeps it moving.
How does SourceIT make the process easier?
We can't decide whether your order needs a licence, and we can't obtain approvals or speed them up: BIS, Singapore Customs, the manufacturer and the distributor make those decisions. What we can do is take the guesswork out of the paperwork:
- tell you at quotation stage what the manufacturer and distributor will ask for, so nothing arrives as a surprise;
- help you gather and organise the company, ownership, site and end-use information;
- check that names, addresses and descriptions match across your PO, ACRA record and declarations before anything is submitted;
- coordinate with the OEM and distributor, and pass questions back to you in plain language.
The commonest ways these packs go wrong are covered in seven documentation mistakes that hold up GB300 orders, and data-centre buyers will also want the documents to prepare before requesting a quote. For the commercial side of a DGX Station purchase, see our DGX Station GB300 buyer's guide, and for a general RFQ checklist, what IT vendors wish customers knew before asking for a quote.
This article is general information, not legal advice; confirm requirements for your situation with your legal or trade-compliance adviser.
Buying in Singapore
SourceIT lists DGX Station GB300 systems from six manufacturers, each supplied through that OEM's channel: the ASUS ExpertCenter Pro ET900N G3, Dell Pro Max with GB300, HP ZGX Fury G1n, MSI XpertStation WS300, GIGABYTE W775-V10-L01 and Supermicro ARS-511GD-NB-LCC. All are price on request, a supplier condition. SourceIT does not list GB300 NVL72 racks. For data-centre projects, ask us to source through our partners; we will confirm availability, lead time and facility requirements rather than assume stock. Tell us early who the end user is and where the system will go, and we'll send you the information checklist with the quotation. To start, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.
Frequently asked questions
Is an end-user certificate the same as an export licence? No. An EUC is a declaration you give the supplier. A licence is a government authorisation, and signing an EUC does not mean one has been granted or is needed.
Do I need a KYC check for a single DGX Station GB300? Expect one. Suppliers in the chain typically screen every buyer of GB300-class systems, whatever the quantity, because the controls apply to the hardware, not the order size.
Who in our company should sign the EUC? An authorised officer, such as a director, who has personal knowledge of the facts and authority to bind the company. Procurement staff usually prepare it but shouldn't be the only people who check it.
What happens if our plans change after delivery? Tell your supplier before you move the system, change the end user or start providing its compute to others. A changed fact usually needs a new statement, and moving it out of Singapore can be an export in its own right.
Can SourceIT fill in the forms for us? We can explain each field, help organise your information and check it for consistency. The facts must come from you, and an officer of your company must sign.
SourceIT Approved
Researched and verified by the SourceIT team for Singapore buyers.
