About new sanctions and export controls regarding software and related services

Disclaimer: Although the original text was written by representatives of an American law firm, this translation is provided for informational purposes only. It is possible that the original text and translation may contain errors or inaccuracies. Therefore, any decisions related to changes discussed in the text should be guided by the advice of your legal or other advisors and not by this translation.

What you need to know

• The United States has imposed new sanctions and export controls on Russia and Belarus in connection with Russia's “transition to a full-fledged military economy.”

• Restrictions include prohibitions on the supply of enterprise and industrial software and services, the provision of IT consulting and design services, and the supply of a wide range of EAR99 products to or within Russia.

• More than 300 individuals were sanctioned, including those associated with Russian financial infrastructure and circumvention of US and Western sanctions.

• New secondary sanctions have been announced that will likely force global banks to further withdraw from business with Russia.

• These measures are aimed at limiting Russia's access to goods, software and services that support its military efforts and target circumvention channels in third countries.

Citing Russia's “transition to a full-scale war economy,” the United States today introduced [1] sweeping new sanctions and export controls on Russia and Belarus, including companies and individuals that continue to supply the Russian economy. Office of Foreign Assets Control (OFAC) Bureau of Industry and Security (BIS) and State Department have announced coordinated updates to their respective rules and regulations ahead of the Group of Seven (G7) leaders meeting this week.

New sanctions measures include:

• Prohibition on providing (i) IT consulting and IT design services and (ii) IT support or cloud services for “enterprise management software” and “design and manufacturing software.” This measure comes into force on September 12, 2024.

• Expands the authority to impose secondary sanctions on foreign banks that conduct or facilitate significant transactions or provide any services to persons blocked under Executive Order (EO) 14024 [2], including sanctioned Russian banks and their foreign branches. The move is likely to further limit the willingness of global banks to conduct transactions involving Russia.

• Imposing blocking sanctions on more than 300 individuals, including those central to Russia's financial infrastructure, those working in defense and related materiel, manufacturing, energy, metals and mining, technology, transportation and financial services, as well as those involved in circumventing US and Western sanctions, among others.

New export controls include four major changes to the Export Administration Regulations (EAR) [3]:

• Expand export controls on Russia and Belarus to cover certain enterprise and industrial software and include more items subject to industry sanctions.

• Consolidation of sanctions against Russia and Belarus into a single section of the Rules.

• Changes to the entity list structure to include physical addresses associated with shell company service providers and additional lists.

• Narrowing the Scope of the Consumer Communications Device (CCD) License Exception [4] for Russia and Belarus and clarification of the standards used to remove license exceptions.

The new measures further bind the United States to sanctions imposed by the European Union and other allies, creating new risks for companies that continue to have ties to Russia or the Russian economy. Taken together, they indicate that OFAC and BIS remain focused on limiting Russia's access to goods, software, and services that could provide material support to its military efforts, as well as paying close attention to circumvention channels in third countries.

New sanctions measures

a. Software and IT services: IT consulting and design services, IT support and cloud services

According to the new Definitionissued by OFAC pursuant to EO 14071 [1], in general, it will be prohibited to provide, directly or indirectly, certain IT services and software to any person located in Russia, subject to a number of exceptions and certain permitted activities. Specifically, this Definition prohibits the provision of (i) “IT consulting and design services” or (ii) “IT support services” and “cloud services” for “software” that is currently defined as “software for Enterprise management” and “design and manufacturing software.” The restrictions specifically apply to service upgrades and the provision of patches and updates to software already installed in Russia that is covered by this Determination. OFAC expects this element of the new sanctions to be will have a significant impact on the use of sanctioned software in the country.

OFAC has issued a series of frequently asked questions that define key terms and describe the anticipated scope of the new restrictions, including the following:

IT consulting and design services – these are both IT consulting services and IT design and application development services, which are determined in accordance with codes 83131 [2] and 83141 [3] according to the United Nations Core Product Classification (CPC) respectively:

• IT consulting services include the provision of advice or expert opinion on technical issues related to the use of information technology, such as: (a) advice on issues such as hardware and software requirements and procurement; (b) systems integration; (c) systems security; and (d) providing expert opinions on IT-related issues.

• IT design and application development services include services for designing the structure and/or writing computer code necessary to create and/or implement a software application, such as: (a) designing the structure of a web page and/or writing computer code necessary to create and implement a web page; (b) designing the structure and content of the database and/or writing the computer code necessary to create and implement the database; (c) designing the structure and writing the computer code necessary to design and develop a custom software application; (d) customization and integration, adaptation (modification, configuration, etc.) and installation of an existing application so that it functions in the client's information system environment.

OFAC also clarified that retail sales of mass market software covered by CPC 63252 [4], is not included in the scope of IT consulting and IT design services. However, such software may be subject to other restrictions, including separate export controls administered by BIS. Frequently asked questions 1185 [5] contain examples of services that may or may not be prohibited under the Definition.

Enterprise Management Software [6] are enterprise resource planning (ERP), customer relationship management (CRM), business intelligence (BI), supply chain management (SCM), enterprise data warehouse (EDW), computerized maintenance management system (CMMS), project management and product life cycle management (PLM).

Design and Manufacturing Software [7] is software for building information modeling (BIM), computer-aided design (CAD), computer-aided manufacturing (CAM) and design-to-order (ETO).

Cloud services [8] include the delivery of software over the Internet or the cloud, including software as a service (SaaS), or SaaS cloud services with respect to such software.

IT Help Desk [9] determined according to CPC code 83132 [10] and include:

• providing technical expertise to solve customer problems related to the use of software, hardware or the entire computer system as a whole, such as: (a) providing customer support in using the software or troubleshooting problems; (b) update services and provision of corrections and updates; (c) providing support to customers in using or troubleshooting computer equipment, including testing and cleaning on a regular basis, and repairing information technology (IT) equipment; (d) technical assistance in moving the client's computer system to a new location; (e) providing support to customers in using or troubleshooting computer hardware and software in combination; And

• providing technical expertise to resolve a client's specialized problems in the use of a computer system, such as: (a) auditing or evaluating computer operations without providing recommendations or other follow-up, including auditing, evaluating, and documenting a server, network, or process for components, capabilities, performance or security; (b) data recovery services, i.e. retrieving customer data from a damaged or unstable hard drive or other storage medium, or providing backup computer hardware and redundant software in a separate location so that the customer can redeploy staff to resume and maintain routine computer operations in the event of a disaster such as a fire or flood ; and (c) other IT technical support services not otherwise grouped together.

Frequently asked questions 1186 contain examples of what may and may not be considered IT support or cloud services related to the software mentioned.

i. Exceptions, limitations and general licenses

The definition contains exceptions for services provided to legal entities in Russia that are owned or controlled by a US individual; services related to the closure or alienation of a legal entity in Russia that is not owned or controlled by an individual from Russia; and services for software that are subject to a license exception or otherwise authorized for export or re-export to Russia by the Department of Commerce. Such services are not prohibited by the Decree.

OFAC indicated in Frequently asked questions 1188, that this Definition does not apply to the provision of services to legal entities or individuals located outside of Russia, except in cases where the benefits from the services are ultimately received by a person located in the Russian Federation. As a result, companies can continue to provide services to companies outside of Russia that may be owned or controlled by a Russian entity, but must ensure that the ultimate benefit from providing the services will not be received in Russia. The FAQs provide useful examples of what may and may not be considered unacceptable indirect provision of services to Russia.

OFAC published Frequently asked questions 1184 and amended certain general licenses to provide that this Determination does not prohibit certain services related to Internet communications, telecommunications, and certain agricultural and medical activities. Amendments to the general license include an updated General license No. 25Dchanging the scope of permitted activities related to the exchange of messages over the Internet.

ii. Effective date

The definition comes into force on September 12, 2024. Companies subject to U.S. jurisdiction that maintain contacts with Russia should review the potential impact of this decision on their business and begin planning to suspend any services not covered by the Determination that would constitute a violation of OFAC rules.

b. Powers for new secondary sanctions on foreign banks

On December 23, 2023, President Biden issued an Executive Order 14114, authorizing OFAC to impose secondary sanctions on foreign financial institutions that engage in or facilitate any significant transaction or transactions or provide any services related to the Russian military industrial base. OFAC today expanded the definition of a “military industrial base” to include any entity subject to blocking sanctions under Executive Order 14024, which includes most entities designated as SDNs in Russia [11], entities involved in Russia-related sanctions evasion, and entities that directly or indirectly own 50 percent or more of such SDNs. As a result of the changes, foreign banks that transact with, facilitate, or provide services to persons blocked under Executive Order 14024, including major Russian financial institutions, risk being subject to secondary U.S. sanctions.

The change will likely force banks to further limit ties to Russia given the severity of the consequences of secondary US sanctions, including loss of access to the US and global financial systems.

c. Additions to the SDN list

Today, OFAC and the State Department have imposed sanctions on more than 300 individuals. These include:

• Legal entities and individuals in Russia, Belarus, the British Virgin Islands, Bulgaria, Kazakhstan, the Kyrgyz Republic, China, Serbia, South Africa, Turkey and the United Arab Emirates involved in sanctions evasion, circumvention and substitution;

• Key elements of the Russian financial infrastructure, including the Moscow Exchange (MOEX), the National Clearing Center (NCC), the non-bank credit organization Joint Stock Company National Settlement Depository (NSD), the gas industry insurance company Sogaz and the Joint Stock Company Russian National reinsurance company” (RNPC);

• Companies with activities related to future energy production, including liquefied natural gas and shipbuilding projects; And

• Companies operating in the Russian defense and related materiel sectors, manufacturing, metals and mining, technology, transportation and financial services.

Transactions with these persons are prohibited to all US citizens and persons otherwise subject to US jurisdiction. Foreign financial institutions also risk secondary sanctions for dealing with these individuals. OFAC also issued or amended general licenses to permit certain limited transactions involving certain entities that were subject to the new sanctions. Some of these permits have time limits.

New export controls

a. New controls for enterprise and industrial software EAR99 and other items

Prior to today's regulations, most EAR99 software [1] remained permitted for export to Belarus and Russia. This final rule adds new licensing requirements for EAR99 enterprise and industrial software, including updates to such software. The new rule will prohibit the transfer of ERP, CRM, BI, SCM, EDW, CMMS, PLM, BIM, CAD, CAM and ETO software to or within both countries without prior approval from the Department of Commerce or the use of a license exception. The new licensing requirements do not apply to organizations operating exclusively in the medical or agricultural sectors, or to certain companies that are subsidiaries or joint ventures of companies headquartered in the United States and certain allied countries.

The new restrictions on enterprise and industrial software will take effect 90 days after the rule is formally published in the Federal Register. Other changes made to the EAR are effective immediately.

In addition, BIS is adding many more EAR99 items to its list of industry critical items in Supplement No. 4 to Part 746 [2]. This change imposes licensing requirements on goods classified under Harmonized Tariff Code Class 522 at the 6-digit level (HTS-6 codes) for export to Belarus and Russia. In addition, the list of highly sensitive items in Supplement No. 6 to Part 746 [3] Riot control equipment used by Russia as a method of warfare against Ukrainian forces in violation of the Chemical Weapons Convention will now be included.

To assist with compliance, BIS publishes a list of all HTS-6 codes listed in Part 746 Supplements No. 2, 4, and 5 that comply with the Russian and Belarus part 746 restrictions in a downloadable XML format available Here.

b. Combination of provisions on Russia and Belarus

The new rule reorganizes and consolidates the Russia and Belarus specific licensing requirements and policies set forth in Part 746 of the EAR into a revised and expanded Section 746.8 [4]. Specifically, the previous licensing requirements in section 746.8 (Russia and Belarus general restrictions) are now contained in paragraphs (a)(1) through (3) of section 746.8; the licensing requirements from former section 746.5 (industrial sanctions) are now contained in section 746.8, paragraphs (a)(4) through (6); and the licensing requirements from former section 746.10 (luxury goods) are now contained in paragraph (a)(7) of section 746.8.

This rule also consolidates the Russian and Belarus licensing exceptions set forth in paragraph (a)(12) of section 746.8. These exceptions apply to certain intended exports or re-exports to Russian and Belarusian citizens to the United States or third countries, certain transactions involving encryption products and mass market software, and newly EAR99-regulated enterprise and industrial software intended for U.S. companies. and friendly countries, and the application of certain export jurisdiction rules to transactions from Global Export Controls Coalition (GECC) participants (i.e., friendly countries), described in Supplement No. 3 to part 746. New section 746.8 also consolidates applicable licensing policies under paragraph (b) and combines the availability of license exceptions in paragraph (c).

c. Changes and updates to the List of Organizations

To limit the transfer of goods to persons from the List of Entities [5], BIS has added the basis for identifying entities on the list—“High Redirection Risk Addresses”—to new paragraph (f) of section 744.16 of the EAR. Under the new provision, BIS may identify by address a legal entity (or multiple legal entities) on the List of Entities that pose a high risk of diversion of goods without indicating the name of the associated legal entity. This designated address will have licensing requirements for all items with Export Control Classification Numbers (ECCNS) [6]included in the Commerce Control List (CCL), as well as for the more sensitive EAR99 items contained in Supplement No. 6 to part 746, but not for other EAR99 items.

In accordance with this new practice, BIS has added eight addresses in China to the Entity List. BIS reported that these addresses are associated with multiple legal entities and indicate significant volumes of shipments of sensitive goods into Russia. BIS also added five named entities in China and Russia to the Entity List based on the diversion of prohibited goods to Russia.

d. Narrowing the scope of exceptions to the CCD license

BIS has revised and narrowed the list of license exceptions in section 740.19 [7], to limit the range of permitted communications equipment for consumers that can be supplied to Russia and Belarus for personal use. This final rule has revised paragraphs (b)(1) through (17) and reordered them so that all products that are eligible for Russia, Belarus, and Cuba are described in paragraphs (b)(1) through (8). and those that are suitable only for Cuba are in paragraphs (b)(9) – (18). The list of products available in Russia and Belarus has been shortened to cover the most basic personal communications equipment, such as laptops and mobile phones, as well as related peripherals, excluding consumer-grade networking equipment and storage devices that could be used to set up a small office .

e. Refusal and Notice Orders for Electronic Component Distributors in the United States

In addition to rulemaking, BIS announced that it has issued two temporary prohibition orders (TDOs) against Russian procurement networks facilitating the export of aircraft parts to Russia through third countries in violation of US export controls. TDOs are severe enforcement actions that deny not only the right to export and re-export goods subject to the EAR, but also the ability to receive or engage in transactions in goods subject to the EAR (including restrictions on receiving or participating in such goods). support for such products).

BIS also noted that it recently informed more than 130 U.S. distributors of additional restrictions on shipments to known suppliers in Russia, building on the U.S. government's efforts to interdict and prevent the diversion of prohibited items. BIS notes that the control measures were aimed at disrupting the supply of electronic components and related products to Russia.

Additional notes:

1. Illustration details: photo credit Jose Maria Martinssource: Unsplash.

2. If you notice any error/inaccuracy, thank you for your feedback! Better in PM. If necessary, I will try to fix it quickly (within 24 hours).

3. The post contains only links that were in the original text. The rest (which were added during translation) are collected in footnotes at the end of each section.