New OFAC determination on IT and software services

The US Treasury Department’s Office of Foreign Assets Control (“OFAC”) published a determination pursuant to Section 1 (a)(ii) of Executive Order (“EO”) 14071, “Prohibition on Certain Information Technology and Software Services” (the “Determination“), prohibiting the export, reexport, sale, or supply, directly or indirectly, from the US, or by a US person, wherever located, of (i) information technology (“IT”) consultancy and design services (irrespective of the type of software involved); and (ii) IT support services or cloud-based services for enterprise management software and design and manufacturing software (collectively, “Covered Software”) to any person located in Russia is prohibited, effective 12 September 2024.

The Determination explicitly excludes the following:

• Any service to an entity located in Russia that is owned or controlled, directly or indirectly, by a US person;

• Any service in connection with the wind down or divesture of an entity located in Russia that is not owned or controlled, directly or indirectly, by a Russian person;

• Any service for software that is:

  • Subject to the Export Administration Regulations (“EAR”) and for which the export, reexport, or transfer to Russia of such software is licensed or otherwise authorized by the Department of Commerce; or

  • Not subject to the EAR and for which the export, reexport, or transfer to Russia of such software would be eligible for a license exception or otherwise authorized by the Department of Commerce if it was subject to the EAR.

OFAC also issued several FAQs that provide guidance regarding the Determination:

• FAQ 1184 clarifies that the Determination does not prohibit internet access or the delivery of internet-based communications services or the importation from any country, or the exportation to any country of any information or informational materials, regardless of format or medium.

• FAQ 1185 provides examples of activities that OFAC would, and would not, consider prohibited IT consultancy and design services.

• FAQ 1187 defines the following terms:

  • IT consultancy services – includes providing advice or expert opinion on technical matters related to the use of information technology

  • IT design services – includes services of designing the structure and/or writing the computer code necessary to create and/or implement a software application

  • IT support services – includes providing technical expertise to solve problems for the client in using software, hardware, or an entire computer system and providing technical expertise to solve specialized problems for the client in using a computer system

  • Cloud-based services – includes the delivery of software via the internet or over the cloud, including through Software-as-a-Service (“SaaS”), or SaaS cloud services in relation to such software

  • Enterprise management software – enterprise resource planning (“ERP”), customer relationship management (“CRM”), business intelligence (“BI”), supply chain management (“SCM”), enterprise data warehouse (“EDW”), computerized maintenance management system (“CMMS”), project management, and product lifecycle management (“PLM”) software

  • Design manufacturing software – building information modelling (“BIM”), computer aided design (“CAD”), computer-aided manufacturing (“CAM”), and engineer to order (“ETO”) software

• FAQ 1186 provides examples of activities that OFAC would consider to be prohibited IT support services and cloud-based services (e.g., a US company selling a cloud-based enterprise resource planning software subscription to a Russian company) and examples that OFAC would not consider to be prohibited IT support services and cloud-based services (e.g., a US company selling a cloud-based electronic health records software subscription to a Russian company).

• FAQ 1188

  • Clarifies that the Determination generally does not prohibit US persons from providing services to entities located outside of Russia that are owned or controlled by persons located in Russia, provided that the provision of services is not an indirect export to a person located in Russia; and

  • Provides examples of services that would, and would not, be prohibited under the IT and Software Services Determination.

BIS actions related to EAR99 software destined to or within Russia or Belarus

Also on 12 June 2024, the US Commerce Department’s Bureau of Industry and Security (“BIS”) issued a final rule imposing additional export control measures against Russia and Belarus by imposing a license requirement, effective 16 September 2024, to export, reexport, or transfer (in-country) to or within Russia or Belarus any of the following types of EAR99-designated software and related software updates:

• Enterprise resource planning (ERP);

• Customer relationship management (CRM);

• Business intelligence (BI);

• Supply chain management (SCM);

• Enterprise data warehouse (EDW);

• Computerized maintenance management system (CMMS);

• Project management software, product lifecycle management (PLM);

• Building information modelling (BIM);

• Computer aided design (CAD);

• Computer-aided manufacturing (CAM); and

• Engineering to order (ETO).

The license requirement also includes software updates of software identified above.

EAR99 software that is intended for civil end-users that are entities owned by US companies or companies headquartered in Country Groups A:5 and A:6 of the Supplement No. 1 to Part 740 of the EAR, as well as joint ventures between companies headquartered in the US or in these country groups, are excepted from the licensing requirement. BIS also has added a new paragraph (a)(12)(iv) in § 746.8 to exclude entities exclusively operating in the medical or agricultural sectors from this software license requirement. Further, newly added (a)(12)(ii) in § 746.8 provides a carve out for certain civil end-users from this restriction.

Expansion of supplements No. 4 and 6 to part 746 of the EAR

The new BIS rule also expanded Russian and Belarusian industry sector sanctions by adding EAR99 items to Supplement No. 4 (certain industrial items) and Supplement No. 6 (certain items related to chemical and biological weapons) to Part 746 of the EAR. Specifically, BIS added more than 500 six-digit Harmonized Tariff System (“HTS”) codes to Supplement No. 4. With respect to Supplement No. 6, BIS added a new paragraph (h) to control certain riot control agents that are isomers of CS (o-Chlorobenzylidenemalononitrile or o-Chlorobenzalmalononitrile) (CAS 2698-41-1); CN (Phenylacyl chloride or w-Chloroacetophenone) (CAS 532-27-4); or Oleoresin Capsicum (CAS 8023-77-6). Items identified on these supplements require a license for export, reexport, or transfer to or within Russia and Belarus.

BIS published a downloadable list of all the six-digit HTS codes that are controlled for export to Russia, Belarus, Iran, and temporarily occupied regions of Ukraine as set forth in Supplements No. 2, 4, 5, and 7 to Part 746 of the EAR to assist exporters in understanding their export control obligations. BIS is now controlling 22 entire two-digit chapters of HTS codes to Russia. Agricultural and medical sectors represent most of the remaining trade with Russia.

Narrowing license exception Consumer Communications Devices (“CCD”)

BIS limited the scope of eligible commodities and software that may be authorized for export, reexport, or transfer (in-country) to and within Russia and Belarus pursuant to License Exception CCD (15 CFR § 740.19).

After this revision, the commodities and software described in revised paragraphs (b)(1) through (8) of License Exception CCD—such as mobile phones and monitors—are eligible for export, reexport, and transfer (in-country) to or within Russia, Belarus, and Cuba. Commodities and software described in paragraphs (b)(9) through (18)—such as consumer disk drives, solid-state storage equipment, and digital cameras—are eligible for export, reexport, or transfer (in-country) under this section to or within Cuba only.

New SDN designations and related General Licenses (“GLs”)

SDN designations

OFAC designated approximately 200 persons as to the Specially Designated Nationals (“SDNs”), including ones involved in sanctions evasion and Russia’s war economy. In addition, the US Department of State designated more than 100 persons as SDNs, including ones involved in sanctions evasion, Russia’s war effort, or in Russia’s energy, metals, or mining sectors.

Please see this OFAC webpage for a full list of designations from June 12, this OFAC webpage for the associated press release, and this US Department of State webpage for the Fact Sheet in connection with its designations.

The new designations mean a US person would be prohibited from engaging in virtually any transaction directly or indirectly involving any of these SDNs (and entities owned at 50% or more, directly or indirectly, individually or in the aggregate, by an SDN, per OFAC’s 50% Rule) unless otherwise authorized by OFAC via general or specific license. It is also a violation of US primary sanctions to “cause” a US person to violate US primary sanctions. Even where there is no US nexus involved in the transaction, there is risk of exposure to US secondary sanctions for activities OFAC would consider providing “material support” to an SDN (or an entity that must be treated as one under OFAC’s 50% Rule).

New and amended GLs

OFAC has issued six new and amended GLs.

Amended GLs

GL 6D replaces GL 6C for transactions related to agricultural commodities, medicine, medical devices, replacement parts and components, or software updates, the Coronavirus Disease 2019 (“COVID-19”) pandemic, or clinical trials. It authorizes transactions prohibited by the Determination, so the Determination (when it takes effect) does not appear to impact IT or software services related to the production or sale of agricultural commodities/equipment, medicine, and medical devices in Russia from a US sanctions perspective. However, “new investment” in Russia is still prohibited and not authorized by GL 6D, as is the provision of “engineering” services even if they are “related to” eligible products such as food or medicine (unless they are provided to an entity in Russia that is ultimately US owned). GL 6D does not have an expiration date.

GL 8J authorizes, with certain exceptions, through 12:01 a.m. eastern daylight time, 1 November 2024, energy-related transactions involving one or more entities listed in GL 8J, including the newly designated National Clearing Center (“NCC”).

GL 25D authorizes, with certain exceptions, (A) transactions ordinarily incident and necessary to the receipt or transmission of telecommunications involving Russia; (B) the exportation or reexportation, sale, or supply, directly or indirectly, from the United States or by US persons, wherever located, to Russia of services incident to the exchange of communications over the internet; and (C) the exportation or reexportation, sale, or supply, directly or indirectly, from the United States or by US persons, to the Russian Federation of software, hardware, or technology (collectively, “Item”) incident to the exchange of communications over the internet, provided that (i) if the Item is subject to the EAR, the exportation, reexportation, sale, or supply to Russia of such Item is licensed or otherwise authorized by BIS, or (ii) if the Item is not subject to the EAR, the exportation, reexportation, sale, or supply to Russia of such Item would be eligible for a license exception or otherwise authorized by BIS if it were subject to the EAR. Of note, as compared to GL 25C, GL 25D separates transactions related to services, software, hardware, and technology from one section into two sections—(B) and (C), as set forth above—in order to specify the two EAR-related conditions ((C)(i) and (C)(ii)) for section (C).

New GLs

GL 98 authorizes, with certain exceptions, through 12:01 a.m. eastern daylight time, 27 July 2024, transactions that are ordinarily incident and necessary to the wind down of any transaction involving one or more of the blocked entities listed in GL 98 (the “GL 98 Entities”), provided that any payment to any of the GL 98 Entities is made into a blocked account.

GL 99 authorizes, with certain exceptions, through 12:01 a.m. eastern daylight time, 13 August 2024 transactions (A) that are ordinarily incident and necessary to the wind down of any transaction involving Moscow Exchange (“MOEX”), NCC, Non-Bank Credit Institution Joint Stock Company National Settlement Depository (“NSD”), and/or any entity in which one or more of the aforementioned blocked persons own, directly or indirectly, individually or in the aggregate, a 50 percent or greater interest (collectively, the “GL 99 Entities”), provided that any payment to a blocked person is made into a blocked account; (B) that are ordinarily incident and necessary to the divestment or transfer, or the facilitation of the divestment or transfer, of debt or equity issued or guaranteed by any of the GL 99 Entities (“Covered Debt or Equity”) to a non-US person; (C) that are ordinarily incident and necessary to facilitating, clearing, and settling trades of Covered Debt or Equity that were placed prior to 4:00 p.m. eastern daylight time, 12 June 2024; and (D) that are ordinarily incident and necessary to the wind down of derivative contracts entered into prior to 4:00 p.m. eastern daylight time 12 June 2024 that (i) include a GL 99 Entity as a counterparty or (ii) are linked to Covered Debt or Equity, provided that any payments to a blocked person are made into a blocked account.

GL 100 authorizes, with certain exceptions, all transactions that are ordinarily incident and necessary to the divestment of debt or equity to a non-US person, who is not a person whose property or interests in property are blocked, or the conversion of currencies, involving MOEX, NCC, NSD, and/or any entity in which one or more of the aforementioned blocked persons own, directly or indirectly, individually or in the aggregate, a 50 percent or greater interest that is acting solely as a securities, trade, or settlement depository, central counterparty or clearing house, or public trading market.

Secondary sanctions risks for Foreign Financial Institutions (“FFIs”)

EO 14114 (22 December 2023) adds a new Section 11 to EO 14024, which provides authority to OFAC to impose secondary sanctions on FFIs determined to have (i) conducted or facilitated any significant transaction or transactions for or on behalf of any person designated for operating or having operated in certain Russian Federation military-industrial sectors; or (ii) conducted or facilitated any significant transaction or transactions, or provided any service, involving Russia’s military-industrial base, including the sale, supply, or transfer, directly or indirectly, to the Russian Federation of any item or class of items as may be determined by the Secretary of the Treasury, in consultation with the Secretary of State and the Secretary of Commerce. (FFIs are defined as “any foreign entity that is engaged in the business of accepting deposits, making, granting, transferring, holding, or brokering loans or credits, or purchasing or selling foreign exchange, securities, futures or options, or procuring purchasers and sellers thereof, as principal or agent” and do not include “international financial institutions” (see OFAC’s FAQ 1151).)

OFAC has broadened the definition of Russia’s military-industrial base, effective 12 June 2024, (see OFAC’s FAQ 1151, 1181) to include all persons blocked pursuant to EO 14024, meaning that FFIs risk being sanctioned for conducting or facilitating significant transactions, or providing any service, involving (among other SDNs) Russian banks designated under EO 14024, including major Russian banks such as VTB and Sberbank. Effectively, any Russian SDNs can trigger this exposure for FFIs (such as banks and insurers) that process a significant transaction involving such SDN even if the SDN was not designated as part of the defense sector in Russia.

However, FAQ 1182 states that FFIs will not face secondary sanctions risks if they continue to conduct or facilitate any transaction(s) or provide any service related to activities that are otherwise authorized or exempted under the Russian Harmful Foreign Activities Sanctions (“RuHSR”) program, including those authorized under general licenses (e.g., certain agricultural/medical transactions as per GL 6D, certain energy-related transactions as per GL 8J).

Relatedly, OFAC updated the “Guidance for Foreign Financial Institutions on OFAC Sanctions Authorities Targeting Support to Russia’s Military-Industrial Base,” in part to reflect the broadening of the definition of Russia’s military-industrial base.

BIS designations

BIS added the following five entities to the Entity List, determining four (bolded) to be military end users (“MEUs”) and applying the Russia/Belarus-Military End User Foreign Direct Product (“FDP”) rule under a footnote 3 designation: Advantage Trading Company Limited (China); Duling Technology (HK) Limited (China); FY International Trading Company (China); Shenzhen Daotong Intelligent Aviation Technology Co., Ltd. (China); and LLC Volgogradpromproyekt (Russia). (As a reminder, one may not export, reexport, or transfer (in-country) any item subject to the EAR without a license if, at the time of the export, reexport, or transfer (in-country), one has “knowledge” that the item is intended, entirely or in part, for a military end user, wherever located.)

Further, BIS stated in its press release that it revised § 744.16 of the EAR to allow listing addresses on the Entity List that present a high risk of involvement in unlawful diversion. This aims to curb shell companies from using these addresses for illicit trade. Relatedly, BIS added eight Hong Kong addresses to the Entity List. Any company that uses the addresses as a Purchaser, Intermediate Consignee, Ultimate Consignee, or End User will be faced with restrictions on their ability to engage in transactions subject to the EAR.

BIS Temporary Denial Orders (“TDOs”)

BIS issued two TDOs against Russian procurement networks, meaning these entities and individuals are prohibited from participating in any way in a transaction involving items exported or to be exported from the US that are subject to the EAR. The TDOs also prohibit any person, directly or indirectly, from exporting/reexporting/transferring items subject to the EAR to these individuals, or taking actions to facilitate their acquisition of items subject to the EAR.

The two networks are:

• Turboshaft FZE, Treetops Aviation, Black Metal FZE, Timur Badr, and Elaine Balingit (which BIS found to be involved in the export of aircraft parts to Russia in violation of BIS export controls); and

• Skytechnic, Skywind International Limited, Hong Fan International, Lufeng Limited, Unical dis Ticaret Ve Lojistik JSC, Izzi Cup DOO, Alexey Sumchenko, Anna Shumakova, Branmir Salevic, and Danijela Salevic (which involved in a transnational scheme to circumvent BIS export controls and are responsible for the export of approximately 260 shipments, the majority of which contained aircraft parts, to Russia).

The TDOs are valid for 180 days unless extended.

Next steps

Companies should review to confirm whether they directly or indirectly engage in provision of any services or items to Russia or Belarus that are impacted by the new restrictions. To the extent that companies are engaged in providing newly restricted services or items, they should assess compliance measures to obtain required licenses or wind down such activities prior to the effective date of the OFAC and BIS restrictions. In addition, companies should screen business partners against the new restricted party designations and continue to review their business activities and compliance procedures regularly to ensure they conform with applicable new restrictions. Hogan Lovells lawyers can assist you with assessing the potential impact of these and other trade restrictions on the global operations of your company.

Summer associate Kelly Heesch Sharbo contributed to this post.