United StatesEAR encryption items: Category 5 Part 2 classification, License Exception ENC and the annual self-classification report
15 C.F.R. 740.17; 742.15(a); Supp. No. 1 to part 774, Category 5 Part 2
In force.
An encryption items rule binding private bodies.
As of .
What it requires
- Classify the software or technology under Category 5 Part 2 of the Commerce Control List before you export, reexport or transfer it, because ECCNs 5A002 and 5D002 are controlled for encryption item (EI) and national security reasons (Supplement No. 1 to part 774; 15 C.F.R. 742.15(a)).
- If the software is mass market encryption software that meets Note 3 to Category 5 Part 2, self-classify it under ECCN 5D992 or obtain a classification from BIS, and where 15 C.F.R. 740.17(b)(1) applies, make sure BIS and the ENC Encryption Request Coordinator receive your self-classification report by February 1 for the previous calendar year (15 C.F.R. 740.17(b)(1), (e)(3)).
- For an item described in 15 C.F.R. 740.17(b)(2), submit a classification request to BIS, and export under License Exception ENC only on the terms that provision sets, with the semi-annual sales reports it requires (15 C.F.R. 740.17(b)(2), (d), (e)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
A willful violation, attempt or conspiracy is punishable by a fine of up to $1,000,000 and, for an individual, imprisonment of up to 20 years, or both (50 U.S.C. 4819(b)).
Penalty structure
The statute sets the greater of $300,000 or twice the value of the transaction that is the basis of the violation; the amount coded is the inflation-adjusted maximum that Commerce publishes.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 374,474
Who enforces it
Enforcement body
Department of Commerce, which imposes civil penalties through the Secretary of Commerce under 50 U.S.C. 4819(c); willful violations are criminal offenses under 50 U.S.C. 4819(b).
What it reaches
Obligation class
Licensing, Reporting
Applicability criteria
- As of
- Combinator
- All of
- Criteria
- The software or technology performs or contains encryption or another information security function described in Category 5 Part 2 of the Commerce Control List.
- The item is subject to the Export Administration Regulations (15 C.F.R. part 734).
What this law does
Software and technology that performs or contains encryption or another information security function is classified in Category 5 Part 2 of the Commerce Control List (ECCNs 5A002, 5D002 and 5E002), is controlled for encryption item (EI) reasons as well as national security, and may be exported under License Exception ENC.
Mass market encryption items that meet Note 3 to Category 5 Part 2 (the Cryptography Note) are classified under ECCN 5A992 or 5D992 after self-classification or classification by BIS and are no longer subject to the EI and NS controls.
License Exception ENC authorizes some end users and end uses with no filing, requires a self-classification report for certain self-classified items, and authorizes other items thirty days after a classification request is submitted to BIS; the self-classification report for exports and reexports in a calendar year must be received by February 1 of the next year. The eCFR gives the section's source as 81 FR 64669 of , amended since, and prints no commencement day.
When LexLint raises it
When your app profile says your app ships encryption.