Loading…
Loading…
Last amendment: Typographical correction (FR Doc C1-2024-13148, 89 FR 71803): in Supplement No. 5 to Part 744, on page 51662, first column, twentieth line, '[euro]' corrected to '(e)'. No substantive change. on 2024-09-04.
The rule is the headline BIS instrument from the 12 June 2024 US-G7 Russia-sanctions tranche. It operates across four lever families inside the EAR:
1. EAR99 enterprise-software licence requirement (§746.8(a)(8), effective 16 September 2024). A new licence requirement for thirteen named categories of EAR99 software destined to Russia or Belarus: enterprise resource planning (ERP); customer relationship management (CRM); business intelligence (BI); supply chain management (SCM); enterprise data warehouse (EDW); computerized maintenance management system (CMMS); project management software; product lifecycle management (PLM); building information modelling (BIM); computer-aided design (CAD); computer-aided manufacturing (CAM); and engineering to order (ETO). A carve-out at §746.8(a)(8)(iv) excludes entities that exclusively operate in the medical or agricultural sectors. This is the first time EAR99-classified business software has been brought into the Russia/Belarus licence perimeter — a notable extension because EAR99 historically caught only items not listed on the Commerce Control List, and enterprise software had been the principal IT channel still available to Russian state-owned enterprises and military-industrial buyers via Western vendors' foreign subsidiaries.
2. Address-only Entity List designations. The rule amends Part 744 procedures to permit Entity List entries that name an address rather than a juridical entity. This closes a long-standing diversion gap whereby front companies registered at known high-risk addresses (typically free-trade zones, mailbox clusters, and serviced-office hubs in third countries) could swap shell-entity names while keeping the same physical operational footprint. The rule's first use of the authority adds eight addresses in Hong Kong identified as high-diversion-risk forwarding hubs.
3. Industry Sector Sanctions / Common High-Priority List expansion. Adds further HS codes to the §746.5 Russia/Belarus Industry Sector Sanctions, with continued focus on the "common high priority" battlefield-relevant items list maintained jointly with G7 and EU partners.
4. Foreign Direct Product (FDP) and license-exception refinements. Technical refinements to the Russia/Belarus FDP rule scope and to several license exceptions, plus housekeeping clarifications to earlier 2022-2024 Russia/Belarus rulemakings.
The action sat inside a coordinated US-government package released 12 June 2024 (the day before the G7 leaders met in Italy): OFAC designated 300+ individuals and entities (including parties identified by the State Department); State issued visa restrictions; Treasury simultaneously imposed secondary-sanctions exposure on foreign financial institutions servicing Russia's military-industrial base. BIS's contribution was the export-control half of that package.
Brings the Russia/Belarus EAR architecture into structural alignment with the Iran/Cuba/Syria/Crimea sanctions in which EAR99 business software has long been licence-controlled. The thirteen named software categories collectively constitute the industrial-IT stack on which Russian heavy industry, oil & gas, and defence procurement depend.
Once used at scale, this lever materially raises the cost of shell-company diversion: re-incorporating under a new name no longer breaks the perimeter as long as the physical address is listed. Expect the lever to migrate into China, Iran, and DPRK perimeters in subsequent rulemakings.
(FR Doc 2024-19132)** — pending in the filing queue at the time of this filing — which builds on this rule's MEU FDP rule expansion and adds further Russia/Belarus refinements.
Regulation 2024/1745, in-register as 2024-06-24-eu-council-regulation-1745-14th-russia-sanctions-package): the EU's parallel software-services restrictions and no-Russia-clause obligations in Regulation 2024/1745 land twelve days after this BIS rule, closing the US-EU perimeter on a tight cadence.
beyond Hong Kong to the UAE, Türkiye, and Central Asian jurisdictions that have featured prominently in subsequent diversion-focused entity-list rounds.
practice for cloud-delivered (SaaS) versions of the named categories, given that the cloud-delivery model complicates the classical export-control nexus.