New Prohibitions on Providing SaaS Services to Russia
In line with Group of Seven (G7) efforts to disrupt the Russian military-industrial base’s reliance on foreign IT systems, in June 2024 the U.S. Department of Commerce and the Department of the Treasury jointly issued new restrictions on the provision of software as a service (SaaS) to Russia and Belarus.
Specifically, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) issued a new determination under Executive Order (E.O.) 14071 prohibiting U.S. persons from the direct or indirect export, reexport, sale, or supply from the United States of (1) IT consultancy and design services or (2) IT support services and cloud-based services for enterprise management software and design and manufacturing software to any entity located in Russia. 1
The Department of Commerce’s Bureau of Industry and Security (BIS) issued a final rule to revise the Export Administration Regulations (EAR) and impose a licensing requirement 2 on the following software, classified for export as EAR99, when destined to or within Russia or Belarus:
- Enterprise resource planning (ERP)
- Customer relationship management (CRM)
- Business intelligence (BI)
- Supply chain management (SCM)
- Enterprise data warehouse (EDW)
- Computerized maintenance management system (CMMS)
- Project management
- Product life cycle management (PLM)
- Building information modeling (BIM)
- Computer-aided design (CAD)
- Computer-aided manufacturing (CAM)
- Engineering to order (ETO)
FAQs
How does OFAC define “enterprise management software” and “design and manufacturing software”?
- Enterprise management software includes the following types of software: ERP, CRM, BI, SCM, EDW, CMMS, project management, and PLM.
- Design and manufacturing software includes the following types of software: BIM, CAD, CAM, and ETO. 3
When do the new rules take effect?
- OFAC’s new sanctions prohibitions take effect on Sept. 12, 2024.
- BIS’s new export controls take effect on Sept. 16, 2024.
Are there exceptions?
- OFAC Exceptions to Software Restrictions:
- Services related to the winding down or divestiture of a business entity located in Russia that is not under the ownership or control, either directly or indirectly, of a Russian person
- Any software service that is either eligible for a license exception 4 or otherwise authorized for export or reexport to Russia by the Department of Commerce
- Any service to an entity located in Russia that is owned or controlled, directly or indirectly, by a U.S. person
- Transactions related to the production, manufacturing, sale, transport, or provision of agricultural or medical items specified under General License 6D
- Certain transactions relating to the receipt or transmission of telecommunications and the provision of certain services incident to the exchange of communications via the internet as authorized under General License 25D
- Servicing of Russia-owned entities located outside of Russia (unless somehow benefiting an entity located in Russia)
- Retail sale of off-the-shelf software falling under United Nations Central Product Classification (UNCPC) code 63252 is not included in the scope of IT consultancy and design services.
How should companies respond?
Before the new restrictions take effect, companies should take the following steps:
- Conduct an internal review to ensure you know the export classification of your software.
- Determine whether your software falls under either prohibition.
- Determine whether any exceptions apply.
- If a prohibition is applicable, consider applying for a license well before the new rules are in place to avoid a gap in service.
- Update your compliance policies and procedures to reflect the new prohibitions.
- Train relevant employees on the new prohibitions.
As a coordinated measure, update your recordkeeping policies and procedures to reflect OFAC’s recent expansion of its statute of limitations from five years to 10.
