They do not export devices, they export services.

Precisely. BIS does not consider cloud compute services to be exports.

There are some rules around when you knowingly know that a customer is military or WMD, and you obviously can’t supply services to someone on the entity list; but KYC-through-credit card kinda works at small scale.