Law Messenger

New U.S. IT sanctions: exploring nuances and impact

20.06.2024

On 12 June 2024, the U.S. Office of Foreign Assets Control (OFAC) announced new restrictive measures targeting the Russian IT sector. The newly introduced rules closely mirror the European Union’s approach to IT services and software, which saw significant expansion of restrictive measures under the EU’s 12th package of sanctions in December 2023. Furthermore, certain United States rights holders were contemplating access restrictions as early as this spring, following the spirit of the EU’s measures. However, OFAC’s new independent regulations have their own unique nuances.

The restrictive measures adopted by OFAC prohibit the exportation, reexportation, sale, or supply—directly or indirectly—from the United States, or by a United States person, wherever located, of the following categories of services to any person located in the Russian Federation:

IT consultancy and design services; and
IT support services or cloud-based services for enterprise management software and design and manufacturing software.

These restrictions will take effect on 12 September 2024.

Note that the restrictions do not apply to (1) any service to an entity located in the Russian Federation that is controlled, directly or indirectly, by a United States person, or (2) any service in connection with the wind down or divestiture of an entity located in the Russian Federation that is not owned or controlled, directly or indirectly, by a Russian person.

The OFAC FAQ gives examples of situations that fall under the new restrictions:

A U.S. company sells a cloud-based enterprise resource planning software subscription to a Russian company.
A U.S. company signs a contract with a Russian company to assist the Russian company in upgrading its IT systems.
A U.S. service provider signs a contract with a Russian company for the design and engineering of software that the Russian company uses for internal purposes.

The OFAC FAQ also explains that the prohibition does not apply to scenarios where a U.S. company provides Russian individuals and entities with continued access to cloud-based, free-of-charge, publicly available web applications, such as email, spreadsheet, and document applications. However, no mention is made as to whether these services can be used for commercial purposes.

General Licenses

Alongside the new restrictive measures, OFAC has also issued corresponding General Licenses. Specifically, General License 6D permitting software updates for medical devices, and General License 25D addressing transactions related to telecommunications and certain Internet-based communications.

The following transactions are authorized under General License 25D:

All transactions ordinarily incident and necessary to the receipt or transmission of telecommunications.
Exportation or reexportation, sale, or supply—directly or indirectly—from the United States or by U.S. persons, wherever located, to the Russian Federation of services incident to the exchange of communications over the Internet, such as instant messaging, chat and email, social networking, sharing of photos and movies, web browsing, blogging, social media platforms, collaboration platforms, video conferencing, e-gaming, e-learning platforms, automated translation, web maps, user authentication services, web hosting, and domain name registration services.
Exportation or reexportation, sale, or supply—directly or indirectly—from the United States or by U.S. persons, to the Russian Federation of software, hardware, or technology incident to the exchange of communications over the Internet, provided that:
- The software, hardware, or technology is subject to the Export Administration Regulations (EAR); or
- The software, hardware, or technology is not subject to the EAR but would be eligible for a license exception or otherwise authorized by the Department of Commerce if it were subject to the EAR.

General License 25D does not authorize:

The opening or maintaining of a correspondent account or payable-through account for or on behalf of any entity subject to Directive 2 under Executive Order (E.O.) 14024;
Any debit to an account on the books of a U.S. financial institution of the Central Bank of the Russian Federation, the National Wealth Fund of the Russian Federation, or the Ministry of Finance of the Russian Federation;
Any transactions prohibited by E.O. 14066 or E.O. 14068; or
Any transactions involving Joint Stock Company Channel One Russia, Joint Stock Company NTV Broadcasting Company, Television Station Russia-1, Limited Liability Company Algoritm, New Eastern Outlook, Oriental Review, or Garantex Europe OU, unless separately authorized.

Impact of the new restrictions

In the near future, as the discussed restrictive measures come into effect, Russian businesses are set to encounter new challenges. It is highly likely that these sanctions will be enforced not only by U.S. companies but also by rights holders from other countries, mindful of the risk of secondary sanctions. We cannot dismiss the possibility of overcompliance, where foreign companies might restrict access to IT products beyond OFAC restrictions to fully protect themselves.

According to the Determination and OFAC FAQ, the categories of prohibited software align with those under EU restrictions. Similar to the EU context, uncertainty persists as to which specific software products are subject to prohibition. Further analysis of current software and IT services in use is necessary to ascertain their alignment with restricted categories.

Among the most prevalent U.S. software solutions used in Russia are, for example, IT solutions from Microsoft, widely adopted across the vast majority of companies. It is worth noting that, in certain cases, some software within Microsoft software packages may qualify under General License 25D (for instance, the Outlook email service), while the status of other software remains undetermined (including Excel, Word, and other products not explicitly mentioned in the prohibited software categories nor listed in General License 25D).

Given the risks associated with the new restrictions, it is recommended to focus on analyzing how these measures apply to the software your company uses and developing strategies to mitigate their impact. This analysis will require input from technical IT experts, IT directors and legal professionals specializing in sanctions and intellectual property.

The B1 team has extensive experience in legal consulting on sanctions and is prepared to provide advice on any issues concerning IT-related restrictive measures.