New Sanctions and Export Controls Restrict Russia’s Access to IT Services and Software

On June 12, 2024, the Biden administration imposed additional sanctions and export controls to intensify pressure on Russia for its continued war against Ukraine. Among other things, the latest measures block Russian access to certain information technology (IT) and software-related services. The measures also target Russia’s efforts to circumvent existing restrictions. The specific measures implemented by the U.S. Departments of Treasury and Commerce are summarized below.

Treasury Department Imposes Additional Sanctions on IT and Software Services

The U.S. Department of Treasury, Office of Foreign Assets Control (OFAC) issued a new determination under Executive Order 14701 that restricts the provision of (1) IT consultancy and design services and (2) IT support services and cloud-based services for enterprise management software and design and manufacturing software. Therefore, beginning on September 12, 2024, the export, reexport, sale, or supply of these services, directly or indirectly, from the United States or by a U.S. person wherever located to any person within the Russian Federation will be prohibited.

OFAC published a new Frequently Asked Question (FAQ) defining the newly prohibited services and the two categories of covered software (i.e., enterprise management software and design and manufacturing software) as follows:

• IT consultancy services — including providing advice or expert opinion on technical matters related to the use of information technology
• IT design and development services for applications — including services of designing the structure and/or writing the computer code necessary to create and/or implement a software application
• IT support services — including providing technical expertise to solve problems for the client in using software, hardware, or an entire computer system; or providing technical expertise to solve specialized problems for the client in using a computer system
• Cloud-based services — including the delivery of covered software via the internet or over the cloud, including through Software-as-a-Service (SaaS), or SaaS cloud services in relation to such software
• Enterprise management software — enterprise resource planning, customer relationship management, business intelligence, supply chain management, enterprise data warehouse, computerized maintenance management system, project management, and product lifecycle management software
• Design and manufacturing software — building information modelling, computer-aided design, computer-aided manufacturing, and engineer to order software

Importantly, the new determination does not apply to the provision of services (1) to an entity in Russia that is owned or controlled, directly or indirectly, by a U.S. person; (2) in connection with the wind down or divestiture of an entity in Russia that is not owned or controlled, directly or indirectly, by a Russian person; (3) for software subject to the U.S. Export Administration Regulations (EAR) for which the exportation, reexportation, or transfer (in-country) to Russia is licensed or authorized by the U.S. Department of Commerce; or (4) for software not subject to the EAR for which the exportation, reexportation, or transfer (in-country) to Russia would be eligible for a license exception or otherwise authorized by the U.S. Department of Commerce if it were subject to the EAR.

Moreover, consistent with other sanctions regimes, OFAC also issued a revised general license to cover these new restrictions, in line with its support for the free flow of information and communications. Similar to the previous version of the general license, General License (GL) 25D authorizes certain transactions ordinarily incident and necessary to the receipt or transmission of telecommunications involving Russia and the provision of certain services incident to the exchange of communications over the internet. GL 25D adds additional examples of services incident to the exchange of communications over the internet that are authorized, by adding social media platforms, collaboration platforms, e-gaming, e-learning platforms, automated translation, web maps, and user authentication services. In addition, GL 25D expands the scope of the General License to also cover the exportation, reexportation, sale, or supply of software, hardware, or technology incident to the exchange of communications over the internet provided that (1) if subject to the EAR, the exportation, reexportation, sale, or supply to Russia of such software, hardware, or technology is licensed or otherwise authorized pursuant to the EAR or (2) if not subject to the EAR, the exportation, reexportation, sale, or supply of such software, hardware, or technology would be eligible for a license exception or otherwise authorized if it were subject to the EAR.

Commerce Department Issues New Export Controls

Acting in concert with OFAC, the U.S. Department of Commerce, Bureau of Industry and Security (BIS) imposed new export control measures against Russia and Belarus.

New License Requirement on EAR99 Software

Similar to OFAC, BIS’ new measures restrict Russian access to software. Specifically, effective September 16, 2024, certain EAR99-designated software will require a license when destined for Russia or Belarus. The following kinds of software will be subject to the new license requirement:

• Enterprise resource planning
• Customer relationship management
• Business intelligence
• Supply chain management
• Enterprise data warehouse
• Computerized maintenance management system
• Project management software, product lifecycle management
• Building information modelling
• Computer aided design
• Computer-aided manufacturing
• Engineering to order

Narrower Scope for the CCD License Exception

Alongside the new license requirement, BIS also narrowed the scope of commodities and software that are eligible under the License Exception for Consumer Communications Devices (CCD) when destined to Russia and Belarus. As a result, the following items are no longer eligible for License Exception CCD for Russia and Belarus:

• Consumer disk drives and solid-state storage equipment classified under Export Control Classification Number (ECCN) 5A992 or designated EAR99
• Graphics accelerators and graphics coprocessors designated EAR99
• Modems, network interface cards, routers, switches, and WiFi access points designated EAR99 or classified under ECCNs 5A992.c or 5A991; drivers, communications, and connectivity software for such hardware designated EAR99 or classified under ECCN 5D992.c
• Network access controllers and communications channel controllers classified under ECCN 5A991.b.4, 5A992.c or designated EAR99
• Memory devices classified under ECCN 5A992.c or designated EAR99
• Digital cameras (including webcams) and memory cards classified under ECCN 5A992 or designated EAR99
• Television and radio receivers, set top boxes, video decoders, and antennas classified under ECCNs 5A991, 5A992 or designated EAR99
• Recording devices classified under ECCN 5A992 or designated EAR99
• Commodities described under 3A991.p or 4A994.l
• Batteries, chargers, carrying cases, and accessories for the equipment described in paragraphs (b)(8) through (17) of the revised License Exception CCD that are designated EAR99

Other Export Control Changes

BIS expanded the scope of the Russian and Belarussian Industry Sector Sanctions. The latest additions include certain riot control agents and fasteners. Notably, BIS clarified that the specific fasteners listed and covered by the Harmonized Tariff Schedule Codes in Supplement Nos. 2, 4, 5, and 7 are now outside the scope of the general exclusion for fasteners.

To address unlawful diversion through the use of shell companies, BIS is now identifying certain addresses on the Entity List as having high risk of diversion. Entities using the addresses identified on the Entity List will be subject to the Entity List restrictions, regardless of whether those particular entities are identified on the Entity List by name. This means that to conduct full Entity List screening, one must screen both the entity name and the address.

Furthermore, BIS consolidated the Russian and Belarus sanctions into a single section and made related conforming changes to promote clarity and facilitate compliance. In addition, BIS confirmed its existing criteria for revising, suspending, or revoking EAR license exceptions by specifying that it has the authority to revise, suspend, or revoke EAR license exceptions without notice.

Additional Designations

Also on June 12, 2024, OFAC and BIS made additional specific restrictions designations. In particular, BIS added five entities and eight addresses to the Entity List. Likewise, OFAC added 33 individuals, over 300 entities, and 7 vessels to the Specially Designated Nationals List. Among other things, the new sanctions designations target:

• Foreign locations of designated Russian banks
• Russian financial infrastructure
• Sanctions evasion networks
• Companies contributing to Russia’s domestic war economy
• Entities involved in construction for natural gas-related projects or manufacturing specialized equipment for liquified national gas (LNG) transportation, as well as under-construction LNG vessels

Conclusion

The new sanctions and export controls came as President Biden and the G7 member nations prepared to meet in Italy. These measures are designed to further isolate Russia financially and technologically, as well as increase the effectiveness of existing restrictions. For questions about U.S. export controls or sanctions, contact the authors or any of their colleagues in Arnold & Porter’s White Collar Defense & Investigations or Export Control & Sanctions practice groups.

*Inbar Pe'er contributed to this Advisory. Ms. Pe'er is a summer associate in the firm’s Washington, D.C. office and will graduate in 2025 from Yale Law School. She is not admitted to the practice of law.

© Arnold & Porter Kaye Scholer LLP 2024 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.