In line with Group of Seven (G7) efforts to disrupt the Russian military-industrial base’s reliance on foreign IT systems, in June 2024 the U.S. Department of Commerce and the Department of the Treasury jointly issued new restrictions on the provision of software as a service (SaaS) to Russia and Belarus. 

Specifically, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) issued a new determination under Executive Order (E.O.) 14071 prohibiting U.S. persons from the direct or indirect export, reexport, sale, or supply from the United States of (1) IT consultancy and design services or (2) IT support services and cloud-based services for enterprise management software and design and manufacturing software to any entity located in Russia.1

The Department of Commerce’s Bureau of Industry and Security (BIS) issued a final rule to revise the Export Administration Regulations (EAR) and impose a licensing requirement2 on the following software, classified for export as EAR99, when destined to or within Russia or Belarus:

  • Enterprise resource planning (ERP) 
  • Customer relationship management (CRM) 
  • Business intelligence (BI) 
  • Supply chain management (SCM) 
  • Enterprise data warehouse (EDW) 
  • Computerized maintenance management system (CMMS) 
  • Project management 
  • Product life cycle management (PLM) 
  • Building information modeling (BIM) 
  • Computer-aided design (CAD) 
  • Computer-aided manufacturing (CAM) 
  • Engineering to order (ETO)

FAQs

How does OFAC define “enterprise management software” and “design and manufacturing software”?

  • Enterprise management software includes the following types of software: ERP, CRM, BI, SCM, EDW, CMMS, project management, and PLM.
  • Design and manufacturing software includes the following types of software: BIM, CAD, CAM, and ETO.3

When do the new rules take effect?

  • OFAC’s new sanctions prohibitions take effect on Sept. 12, 2024.
  • BIS’s new export controls take effect on Sept. 16, 2024.

Are there exceptions?

  • OFAC Exceptions to Software Restrictions:
    • Services related to the winding down or divestiture of a business entity located in Russia that is not under the ownership or control, either directly or indirectly, of a Russian person
    • Any software service that is either eligible for a license exception4 or otherwise authorized for export or reexport to Russia by the Department of Commerce
    • Any service to an entity located in Russia that is owned or controlled, directly or indirectly, by a U.S. person
    • Transactions related to the production, manufacturing, sale, transport, or provision of agricultural or medical items specified under General License 6D
    • Certain transactions relating to the receipt or transmission of telecommunications and the provision of certain services incident to the exchange of communications via the internet5 as authorized under General License 25D
    • Servicing of Russia-owned entities located outside of Russia (unless somehow benefiting an entity located in Russia)
    • Retail sale of off-the-shelf software falling under United Nations Central Product Classification (UNCPC) code 63252 is not included in the scope of IT consultancy and design services.

  • BIS Exceptions to EAR99 Software Restrictions: 
    • Deemed exports and deemed reexports
    • Mass market encryption commodities and software6
    • Exports to subsidiaries, branches, or sales offices of U.S. companies or companies headquartered in authorized third countries7
    • Exports to joint ventures between two or more U.S. companies, between U.S. companies and companies headquartered in authorized countries, or between two or more companies headquartered in authorized countries
    • Exports for medical and agriculture industry end uses 

How should companies respond?

Before the new restrictions take effect, companies should take the following steps:

  1. Conduct an internal review to ensure you know the export classification of your software.
  2. Determine whether your software falls under either prohibition.
  3. Determine whether any exceptions apply. 
  4. If a prohibition is applicable, consider applying for a license well before the new rules are in place to avoid a gap in service. 
  5. Update your compliance policies and procedures to reflect the new prohibitions.
  6. Train relevant employees on the new prohibitions. 

As a coordinated measure, update your recordkeeping policies and procedures to reflect OFAC’s recent expansion of its statute of limitations from five years to 10. 

1 See https://ofac.treasury.gov/media/932951/download?inline. For more information on the new determination, see OFAC’s press release here. 
2 Most license applications will be subject to a policy of denial. 
3 See https://ofac.treasury.gov/faqs/1187. 
4 Or, if not subject to the EAR, would be eligible for a license exception if under EAR jurisdiction. 
5 The exchange of communications via the internet includes instant messaging, chat and email, social networking, sharing of photos and movies, web browsing, blogging, social media platforms, collaboration platforms, videoconferencing, e-gaming, e-learning platforms, automated translation, web maps, user authentication services, web hosting, or domain name registration services.
6 Commodities specified under ECCN 5A991, and commodities and software classified under ECCN 5A992.c or 5D992.c that have been classified in accordance with EAR Section 740.17.
7 “Authorized countries” as used herein refers to those listed in Country Groups A:5 and A:6 in Supplement no. 1 to part 740 of the EAR.