OFAC final rule amending 31 CFR 560.540 — codifies GL D-2 internet-freedom authorization into ITSR; new APP > 1 WT exclusion for laptops/tablets/PCs (eff. 2024-06-17)

Mechanism

OFAC took the September 23, 2022 web-published General License D-2 — which expanded the long-running ITSR § 560.540 authorization for internet-freedom services to ordinary Iranians (in response to Mahsa Amini / nationwide protest crackdowns and the Iranian government's tightening of internet censorship) — and codified it into the Code of Federal Regulations as a formal amendment to § 560.540. The codification has three structural effects:

1. Permanence of GL D-2 expansion. Cloud-based services, third-country importation of communications hardware/software that has been previously exported to Iran (§ 560.540(a)(5)), and ex-Iran installation/repair/replacement services (§ 560.540(a)(7)) are now in the regulation rather than only on OFAC's website. 2. New § 560.540(d) case-by-case window. Specific-license track for internet-freedom activities not falling within the general authorization, formalising a discretionary tool OFAC has been using informally since 2022. 3. APP > 1 WT exclusion (effective 2024-06-17). The § 560.540 List of Services, Software, and Hardware Incident to Communications is amended to exclude laptops, tablets and personal-computing devices whose Adjusted Peak Performance (APP) exceeds 1 Weighted TeraFLOP. This mirrors the compute-threshold logic used in BIS export controls and prevents the GL D-2 channel from being used to ship high-performance client devices into Iran under a humanitarian-services pretext.

Downstream implications

• For consumer-electronics OEMs and cloud/software vendors with Iran-end-user

exposure, the GL D-2 codification is mostly a stabilising move: the authorization is now in the CFR rather than a website-only general license, reducing the risk of arbitrary withdrawal.

• The APP > 1 WT carve-out is narrow but tightens the perimeter on

high-end consumer laptops/tablets (workstation-class devices, AI-accelerated PCs) — those now need a specific OFAC license rather than relying on the general authorization.

• Sits inside the broader US Iran-sanctions architecture: this rule is

humanitarian-leaning (codifying internet-freedom exceptions) but precedes the 2025-26 NSPM-2 maximum-pressure tightening, so the GL D-2 codification has survived the policy reversal so far — useful signal that the internet-freedom carve-out is one of the more durable exceptions in the ITSR stack.

Open questions

• Has the APP > 1 WT threshold been updated since 2024-06-17 (e.g., to

align with the late-2024 BIS HPC-export-control APP recalibration)?

• Did OFAC ever issue interpretive guidance on whether AI-accelerated

consumer devices (NPUs, integrated graphics > 1 WT APP) fall inside or outside the GL D-2 channel?

• Status of § 560.540(d) case-by-case approvals — is OFAC publishing any

aggregate statistics on internet-freedom specific licenses?