U.S. sanctions against Russia: restrictions on the provision of IT services

On September 12, 2024, come into force the U.S. restrictions against the Russian Federation (adopted on July 12, 2024), which impose a ban on the provision of IT services.

For reference: the restrictions of the European Union in the field of IT services against the Russian Federation, adopted within the framework of the 12th package of sanctions, can be found in the previous material of the lawyers of the arbitration and IT disputes sub-practice of REVERA law group.

In this material REVERA lawyers will analyze which particular services fall under the restrictions; exceptions that will allow to provide such services, as well as practical consequences of the restrictions.

What is prohibited?

On July 12, 2024, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) issued a determination pursuant to Executive Order 14071, dated April 6, 2022, that prohibits U.S. persons* (US persons) from providing the following services to Russian persons**:

information technology consulting and design services;
IT support services and cloud services for the following categories of software (software):
- Enterprise management software;
- Design and manufacturing software.

US person: U.S. citizens; persons having the right of permanent residence in the United States; legal entities organized under U.S. law, including foreign branches; any person located in the United States.

**Taking into account OFAC’s clarifications, Russian persons in the context of the Definition include companies/persons that are located in the territory of the Russian Federation (i.e., companies registered in the Russian Federation). Thus, OFAC will not consider as a sanctions violation the provision of IT services to third-country subsidiaries (e.g., Armenia, Kazakhstan, etc.) located outside of Russia, even if such a company is owned or controlled by persons located in Russia, provided, however, that the services are not further exported or re-exported to persons located in Russia. This means that a subsidiary may purchase IT services for its own needs, but may not purchase them for its Russian parent company.

Exceptions

The prohibition does not apply to the provision of services by US persons to:

companies located in the Russian Federation that are directly or indirectly owned or controlled by US persons;
in connection with the termination or sale of companies located in the Russian Federation that are not owned or controlled, directly or indirectly, by Russian persons;
that are subject to the Export Administration Regulations and export, re-export, or transfer to the Russian Federation that are authorized by the U.S. Department of Commerce.

OFAC also published General License No. 25D, which allows:

engage in transactions related to and necessary to receive or transmit telecommunications involving RF,
provide services related to Internet messaging, including instant messaging, chat rooms, e-mail, social networking, web browsing, blogging, video conferencing, electronic gaming, e-learning, automatic translation, web maps, user authentication services, web hosting, and domain name registration services;
export software, hardware or technology related to Internet messaging when it:
- are subject to the Export Administration Regulations; or
- are not subject to the Export Administration Regulations but would be subject to a license exception or would otherwise be authorized by the Department of Commerce if they were so subject.

OFAC Clarifications

In light of the adopted restrictions, OFAC has also updated its list of frequently asked questions to clarify the content of prohibited services, the meaning of terms used in the definition, and situations that may arise in practice.

For example, OFAC has clarified that the prohibition does not apply to situations where a U.S. company provides Russian individuals and entities with ongoing access to free public cloud-based web applications, such as email, spreadsheets, and document applications.

OFAC also indicated that the provision of the IT services in question to companies located outside of Russia that are owned or controlled by Russian persons is not prohibited, provided that such services are not indirectly provided to Russian persons.

REVERA Commentary

The restrictions imposed by the U.S. largely resemble the EU’s approach to IT services and software subject to sanctions under the EU’s 12th Package. However, as in the EU, there is still uncertainty as to which software products fall under the ban, which requires individual analysis of the software and IT services used on a case-by-case basis.

It is important to note that it is highly likely that sanctions will be applied not only by US companies, but also by rights holders from other countries for whom there is a risk of secondary sanctions.

Moreover, there may be cases of “ overcompliance,” where foreign companies will restrict access to IT products even in situations not subject to OFAC sanctions in order to minimize their risks despite the absence of violations of U.S. sanctions laws.

If you still have questions, REVERA’s arbitration and IT disputes sub-practice lawyers will be able to advise you.

Author: Aliaksei Fedarovich

Dear journalists, the use of materials from the REVERA website in publications is possible only with our written permission.

To coordinate materials, contact us at e-mail: i.antonova@revera.legal or Telegram: https://t.me/PR_revera