New Russia Sanctions Target IT Services, Enterprise Management Software, and Foreign Financial Transactions

The U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) and the U.S. Department of Commerce’s Bureau of Industry and Security (“BIS”) recently issued a significant new round of sanctions and export controls against Russia. The new measures target IT consultancy and design services, services and exports involving enterprise management software, over 500 new industrial items and chemicals, and a range of non-U.S. financial services with a nexus to Russia.

IT and cloud service providers, developers and exporters of enterprise management software, exporters of covered items, and non-U.S. financial institutions should be mindful of the new measures, which create new vectors of risk for companies with indirect exposure to Russia that may not immediately be apparent. Further, companies should review the new U.S. measures in conjunction with the European Union’s recently issued 14th sanctions package against Russia.

Overview

The new OFAC sanctions designate hundreds of additional individuals and entities on OFAC’s List of Specially Designated Nationals and Blocked Persons (“SDN List”) (many of which are organized outside of Russia), broaden secondary sanctions targeted at non-U.S. foreign financial institutions (“FFI”) supporting transactions with Russia, and restrict Russia’s access to certain IT services and software. The new sanctions aim to:

• Cut off Russia’s war economy from remaining avenues of obtaining materials and equipment to aid Russia’s military by targeting supplies from third-party countries, sanctions evasion, and Russia’s ability to profit from liquefied natural gas (“LNG”) projects;

• Increase the secondary sanctions risk for FFIs that engage with sanctioned parties; and

• Restrict the Russian military’s use and reliance on certain IT systems, software, and services.

In a coordinated action, effective June 12, 2024, BIS imposed new export controls regarding Russia and Belarus under the Export Administration Regulations (“EAR”). This includes controls over more than 500 new Harmonized Tariff Schedule (“HTS”) codes, as well as (effective September 16, 2024) enterprise resource management and other business planning software classified as “EAR99.” 

OFAC Sanctions

SDN List Designations

OFAC added more than 300 individuals and entities in 16 countries to the SDN List. Notable designations include:

• Russia’s Financial Infrastructure: OFAC designated the Moscow Exchange (“MOEX”), the National Clearing Center (“NCC”), the Non-Bank Credit Institution Joint Stock Company National Settlement Depository (“NSD”), gas industry insurance company Sogaz (“Sogaz”), and joint stock company Russian National Reinsurance Company (“RNRC”). Blocking MOEX, NCC, and NSD, OFAC could have a significant impact on Russian securities, including those held by non-Russians. OFAC issued general licenses that authorize the winding down of certain activities involving MOEX, NCC, and NSD.   

• Russia’s Military-Industrial Base: OFAC designated over 100 entities that operate in the defense and related manufacturing, technology, transportation, or financial sectors of the Russian economy. 

• Russian LNG Industry: OFAC targeted entities involved in the following three LNG projects that Russia hopes to bring online in the future: (i) Obsky LNG, (ii) Artic LNG 1, and (iii) Artic LNG 3. These designations include entities involved in construction, manufacturing, and in constructing LNG vessels.

• Sanctions Evasion: OFAC designated almost 100 entities assisting blocked Russian individuals and entities in evading sanctions. These designations include individuals and entities in Belarus, the British Virgin Islands, Bulgaria, Kazakhstan, the Kyrgyz Republic, China, Serbia, South Africa, Turkey, and the United Arab Emirates.

Secondary Sanctions for FFIs

OFAC expanded the reach of secondary sanctions targeted at FFIs that facilitate or conduct transactions, or provide any service, involving the Russian military-industrial base. Specifically, OFAC broadened the definition of Russia’s military-industrial base to include: (i) any individual or entity designated under Executive Order 14024 (as amended by Executive Order 14114), regardless of the basis for that individual’s or entity’s designation; and (ii) any person operating in the technology, defense and related materiel, construction, aerospace, and manufacturing sectors of the Russian economy. OFAC also released a new compliance advisory for FFIs to help them avoid sanctions risk. 

Sanctions Affecting IT Services

OFAC is also acting in concert with BIS to inhibit the Russian military-industrial base’s access to certain IT services and resources. Specifically, OFAC issued a determination, effective September 12, 2024, prohibiting U.S. persons from exporting to Russia:

• IT consultancy and design services, and

• IT support services and cloud-based services for enterprise management software and design and manufacturing software.

The OFAC determination does not apply to services for:

• Russian entities owned or controlled by U.S. persons;

• Wind down or divestiture of Russian entities not owned or controlled by Russian persons; or

• Software subject to the EAR (which is separately addressed by the BIS rule, noted below) or non-EAR software that, if subject to the EAR, would be eligible for a BIS license exception.

BIS Export Controls

Over 500 New HTS Codes Identified:

Effective June 12, 2024, BIS identified 522 HTS codes that are controlled for export to Russia and Belarus. 

Certain EAR99 Business Software:

As of September 16, 2024, BIS is imposing new restrictions on the export, re-export, and in-country transfer of the following types of EAR99 software: enterprise management and resource planning software, customer relationship management software, supply chain management software, enterprise data warehouse, project management software, computer aided design software, computer aided manufacturing and engineering software, and software updates. The full list of covered EAR99 software will be set out in 15 C.F.R. § 746(a)(8). 

Entity List Designations:

BIS added four Chinese companies and one Russian company to the entity list. Based on this, no person may export, re-export, or transfer any item subject to the EAR to these companies without a BIS license. 

Furthermore, in a novel measure, BIS designated eight Hong Kong addresses to the Entity List because they are “associated with significant transshipment of sensitive goods to Russia.” BIS explained that this is an effort to combat diversion by shell companies using service providers at such addresses. This is the first time that BIS has designated physical addresses without specifying an associated entity. As a result of these designations, a license will be required to export, re-export, or transfer any item subject to the EAR to these addresses.