US BIS adds three Kaspersky entities (Russia, UK) to Entity List

Mechanism

Three new entries added to Supplement No. 4 to part 744 of the EAR (15 CFR Part 744), placing all three Kaspersky entities behind a licence requirement for all items subject to the EAR. Licence applications are reviewed under a presumption of denial, no licence exceptions are available, and the standard EAR de minimis rules apply (so even foreign-produced items with sufficient US-origin content fall in scope).

The designation is grounded in §744.11 — entities determined to be acting contrary to the national security or foreign-policy interests of the United States — and was approved by the End-User Review Committee (ERC, with Commerce, State, Defense, Treasury, and Energy as voting members). The rule was signed by Eric Longnecker, Deputy Assistant Secretary for Technology Security.

The Entity List action operates on the export side of the Kaspersky measures: it restricts the flow of US-origin and EAR-controlled technology and software into the Kaspersky group. The parallel action — the Commerce ICTS final determination issued the same week under EO 13873 and EO 14034 — operates on the import / use side, prohibiting the sale and provision of Kaspersky cybersecurity software in the United States. Together they form a near-total ringfence around Kaspersky's US-facing operations.

Downstream implications

• First Entity List action explicitly designating a major commercial

cybersecurity vendor as an intelligence-cooperation risk. Signals that the perimeter the US is willing to draw around adversary-state software vendors has expanded beyond defence/semis into the broader enterprise-IT stack.

• Kaspersky Labs Limited (London) is added despite UK

jurisdiction — confirms BIS willingness to designate third-country subsidiaries of Russian-headquartered groups where the corporate control chain runs to Moscow.

• Paired with the ICTS prohibition, effectively ends Kaspersky's

ability to operate in the US market: existing transactions had to wind down by 2024-09-29 (sales/new contracts) and 2024-09-29 (software updates/anti-virus signature delivery to existing US customers).

• Reinforces the trajectory established by the 2022-2024 Russia-focused

Entity List packages (military end-user / military-intelligence end-user expansions, EAR99 controls) — narrowing the technology-and-services perimeter around the Russian state cyber apparatus.

Open questions

• Whether allied jurisdictions (EU, UK, Canada, Australia) follow

with parallel restrictions on Kaspersky software in their public sectors and enterprises.

• Whether the designation is later expanded to additional Kaspersky

group affiliates (Switzerland-based AO Kaspersky Lab Switzerland AG, Latin-America regional offices) as US authorities map the corporate-control chain.