On June 12, 2024, U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) announced new prohibitions on the provision of certain information technology- (IT) and software-related services to persons in Russia. These prohibitions, enacted through a determination issued under Executive Order (E.O.) 14071 (IT and Software Services Determination), may have far-reaching consequences for companies who provide a broad range of IT and software-related services to customers based in Russia, including those delivering various software and IT solutions through cloud-computing. 

Background

The IT and Software Services Determination states that beginning September 12, 2024, U.S. persons will be prohibited from engaging in the exportation, reexportation, sale, or supply, directly or indirectly, from the U.S., or by a U.S. person, wherever located, of the following two categories of services:

1. IT consultancy and design services
2. IT support services or cloud-based services for enterprise management software and design and manufacturing software (Covered Software) to any person located in the Russian Federation

The IT and Software Services Determination was issued alongside related export controls measures announced by the U.S. Department of Commerce (Commerce) Bureau of Industry and Security (BIS), which impose new export license requirements on Covered Software when destined for end users in Russia. 

OFAC Frequently Asked Questions (FAQs) clarify the full breadth and scope of these new prohibitions and provide insight on how OFAC intends to define the various prohibited services in forthcoming regulations. Regarding the prohibitions described in category (1) above, OFAC issued guidance in FAQ 1187, defining "IT consultancy services" and "IT design and development services" as follows: 

• IT consultancy services include providing advice or expert opinion on technical matters related to the use of information technology, such as hardware and software requirements and procurement, systems integration, systems security, and provision of expert testimony on IT-related issues. 
• IT design and development services for applications include designing the structure and/or writing the computer code necessary to create and/or implement a software application, such as: designing the structure of a web page and/or writing the computer code necessary to create and implement a web page; designing the structure and content of a database and/or writing the computer code necessary to create and implement a database; designing the structure and writing the computer code necessary to design and develop a custom software application; and customization and integration, adapting (modifying, configuring, etc.), and installing an existing application so that it is functional within a client's information system environment.

Regarding the prohibitions outlined in category (2), FAQ 1187 clarifies the "IT support services" and "cloud-based services" that will be covered:

• IT support services include the provision of technical expertise to solve problems for the client in using software, hardware, or an entire computer system. The types of services covered by this term are further described at length in the FAQ. 
• Cloud-based services include the supply of software and associated services via the internet or the cloud, including through Software-as-a-Service (SaaS).

Notably, these category (2) services are prohibited to the extent that they are for Covered Software, which includes "enterprise management software and design and manufacturing software." Again, FAQ 1187 clarifies that "enterprise management software" includes: 

• Enterprise resource planning (ERP)
• Customer relationship management (CRM)
• Business intelligence (BI)
• Supply chain management (SCM) 
• Enterprise data warehouse (EDW) 
• Computerized maintenance management system (CMMS) 
• Project management and product lifecycle management (PLM)

"Design and manufacturing software" includes: 

• Building information modelling (BIM)
• Computer-aided design (CAD)
• Computer-aided manufacturing (CAM)
• Engineer to order (ETO)

Several services are explicitly excluded from the prohibitions imposed under the IT and Software Services Determination, including any IT-related services:

• Provided to an entity located in the Russian Federation that is owned or controlled, directly or indirectly, by a U.S. person
• In connection with the wind down or divestiture of an entity located in the Russian Federation that is not owned or controlled, directly or indirectly, by a Russian person
• Any service for software that would be eligible for a license exception or is otherwise authorized for export or reexport to Russia by Commerce

Finally, in announcing the IT and Software Services Determination, OFAC stated that it "strongly supports the free flow of information and communications globally." Accordingly and in an effort to "mitigate the impacts to Russian civil society and protect public access to information communications technology," OFAC issued amended general license (GL) 25D to broaden the scope of the authorization. This GL now authorizes transactions related to the receipt or transmission of telecommunications involving the Russian Federation and the provision of certain services incident to the exchange of communications over the internet, which might otherwise be prohibited under the IT and Software Services Determination. OFAC also issued amended GL 6D, which authorizes, among other things, transactions related to the provision of software updates for medical devices that would otherwise be prohibited. This GL was amended to further clarify that transactions prohibited under the IT and Software Services Determination are still permissible if authorized under GL 6D.

Takeaways

• The IT and Software Services Determination will impact a range of businesses who, to date, may not have been directly affected by the sanctions on Russia. Companies delivering essentially any services related to IT and software should take the time before these prohibitions go into place to evaluate whether the particular services they provide to any end-users in Russia are prohibited and, in particular, if they deal in Covered Software. 
• For some categories of Covered Software, such as CAD software, the prohibitions of the determination are straightforward, but for some types of software the new prohibitions may raise questions requiring nuanced analysis. The fact that the categories of Covered Software do not yet have a regulatory definition either under U.S. sanctions or the new export controls measures may further complicate this analysis. 
• Even companies providing cloud-based services for software that is not Covered Software should be aware of the category (1) prohibitions that might still apply regardless of what software they provide to persons in Russia. It is likely that such companies will face additional scrutiny or questions from third-party service providers, including financial institutions processing their payments. 

For more information, please contact:

Timothy P. O'Toole, totoole@milchev.com, 202-626-5552

Laura Deegan, ldeegan@milchev.com, 202-626-5942

Caroline J. Watson, cwatson@milchev.com, 202-626-6083

Melissa Burgess, mburgess@milchev.com, 202-626-5914

Manuel Levitt, mlevitt@milchev.com, 202-626-5921

Annie Cho, acho@milchev.com, 202-626-1570

Rebecca Tweedie, rtweedie@milchev.com, 202-626-1487

The information contained in this communication is not intended as legal advice or as an opinion on specific facts. This information is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. For more information, please contact one of the senders or your existing Miller & Chevalier lawyer contact. The invitation to contact the firm and its lawyers is not to be construed as a solicitation for legal work. Any new lawyer-client relationship will be confirmed in writing.

This, and related communications, are protected by copyright laws and treaties. You may make a single copy for personal use. You may make copies for others, but not for commercial purposes. If you give a copy to anyone else, it must be in its original, unmodified form, and must include all attributions of authorship, copyright notices, and republication notices. Except as described above, it is unlawful to copy, republish, redistribute, and/or alter this presentation without prior written consent of the copyright holder.