Classification
If encryption registration IS required, AND you cannot self-classify the item, then you must file an encryption classification request.
What items require an encryption classification?
How to file a License Exception ENC classification request
Additional guidance for License Exception ENC (740.17) items
How to file a mass market classification request
Additional guidance for Mass Market (742.15) items
What items require an encryption classification?
Items described in License Exception ENC - 740.17(b)(2) and (b)(3), and items described in the Mass Market provision - 742.15(b)(3), require submission of an encryption classification request to BIS before export.
License Exception ENC
The following descriptions of items still require an encryption classification request under License Exception ENC:
Items described in 740.17(b)(2) include:
- Network infrastructure commodities, software, and components as described in 740.17(b)(2)(i)(A).
- Encryption source code that would not be eligible for export or reexport under License Exception TSU because it is not publicly available as that term is used in 740.13(e)(1) of the EAR.
- Commodities, software, and components that have been designed, modified, adapted or customized for "government end-user(s)".
- Commodities, software, and components with cryptographic functionality that has been modified or customized to customer specification.
- Commodities, software, and components with cryptographic functionality or "encryption component" that is user-accessible and can be easily changed by the user.
- Commodities and software for quantum cryptography.
- Commodities and software that have been modified or customized for computers classified under ECCN 4A003.
- Commodities and software that provide penetration capabilities that are capable of attacking, denying, disrupting or otherwise impairing the use of cyber infrastructure or networks.
- Public safety/first responder radio (P25 or TETRA).
- cryptanalytic items.
- "Cryptographic items".
- "Open Cryptographic Interface" items.
- Encryption technology classified under ECCN 5E002.
After an encryption classification submission has been made via SNAP-R and subject to the reporting requirements in paragraph 740.17(e), all items under 740.17(b)(2), except cryptanalytic items, may be immediately exported to countries listed in Supplement No. 3 to Part 740.
There is a 30-day wait while the encryption classification is pending before exports of (b)(2) items may be made outside of the countries listed in Supplement No. 3 to Part 740.
A license will be required for exports to "government end user(s)" outside the countries listed in Supplement No. 3 to Part 740.
In addition:
- Cryptanalytic items require a license for export to any "government end user" anywhere except Canada.
- "Non-standard" technology (5E002), cryptanalytic technology (5E002), and open cryptographic interface items may be exported only to end users located or headquartered in Supplement 3 countries using License Exception ENC.
- Other 5E002 technology may be exported after review to any non-"government end-user" not located in a country listed in Country Group D:1 or E:1.
Items described in 740.17(b)(3) include:
- Chips, chipsets, electronic assemblies and field programmable logic devices.
- Cryptographic libraries, modules, development kits and toolkits, including for operating systems and cryptographic service providers (CSPs).
- Application-specific hardware or software development kits implementing cryptography.
- Items that provide or perform "non-standard cryptography".
- Items that provide or perform vulnerability analysis, network forensics, or computer forensics as described in 740.17(b)(3)(iii) (these items are subject to the reporting requirements in paragraph 740.17(e)).
After an encryption classification submission has been made via SNAP-R, and subject to the reporting requirements in paragraph 740.17(e), all items under 740.17(b)(3), except cryptanalytic items, may be immediately exported to countries listed in Supplement No. 3 to Part 740.
There is a 30-day wait while the encryption classification is pending before exports of (b)(3) items may be made outside of the countries listed in Supplement No. 3 to Part 740.
Mass Market
The following descriptions of items still require a mass market encryption classification request under the Encryption Mass Market provision:
Items described in 742.15(b)(3) include commodities and software that meet Note 3 to Category 5, Part 2 and are:
- Chips, chipsets, electronic assemblies and field programmable logic devices.
- Cryptographic libraries, modules, development kits and toolkits, including for operating systems and cryptographic service providers (CSPs).
- Application-specific hardware or software development kits implementing cryptography.
- Mass market encryption commodities, software and components that provide or perform "non-standard cryptography" as defined in Part 772 of the EAR.
Once a mass market classification request is accepted in SNAP-R, you may export and reexport the encryption commodity or software under License Exception ENC as ECCN 5A002 or 5D002, whichever is applicable, to any end-user located or headquartered in a country listed in Supplement No. 3 to Part 740 as authorized by 740.17(b) of the EAR, while the mass market classification request is pending review with BIS.
Thirty (30) days after the submission of a classification request to BIS, Section 742.15(b)(3) authorizes exports and reexports of the mass market items submitted for classification, using the symbol "NLR", provided the items qualify for mass market treatment and are classified by BIS under ECCNs 5A992 or 5D992.
How to file a License Exception ENC classification request
Below are the steps to take to export under Sections 740.17(b)(2) or (b)(3) of the EAR:
Step 1: Determine whether the products you want to export are described by either Section 740.17(b)(2) or (b)(3) of the EAR and therefore require a License Exception ENC classification. If so, then proceed to the next step.
Step 2: If you are not the manufacturer or producer of the products, determine whether the manufacturer or producer has filed a License Exception ENC classification request. If the manufacturer or producer has filed an ENC classification, then you may export immediately based on the manufacturer’s classification of the product. If you are the manufacturer or producer, or if you cannot obtain the manufacturer’s classification information, then follow the steps below.
Step 3: Register for Simplified Network Application Process Redesign (SNAP-R). After you have received your Company Identification Number (CIN) and have activated your account, within SNAP-R select “Encryption Registration.” Complete and attach a PDF version of Supplement No. 5 to Part 742.
Step 4: Return to the main SNAP-R screen and select Classification Request, then check the encryption checkbox. Block instructions:
- Block 9: A pulldown list will appear in the Special Purpose block. Select "License Exception ENC."
- Block 14-15: Be sure the information in these blocks is complete and correct, because this is where the official response from BIS will be sent. If both blocks are filled in, the official response will be sent to the individual or entity identified in Block 15.
- Block 22(a): Enter 5A002 for hardware, 5D002 for software, or 5E002 for technology.
- Block 22(c): Enter the product name with model number, if available.
- Block 22(i): Enter the name of the manufacturer. If you will sell the product under your company's label, then enter the name of your company in the manufacturer block.
- Block 22(j): Provide a brief technical description including the basic purpose of the encryption item (e.g., XYZ is a PDA used for ...) and the type of encryption used in the software (e.g., 168-bit Triple DES for secure e-mail, 1024-bit RSA for key exchange). Comments such as "See letter of explanation" or "See brochure" are not sufficient. The information identified in this block is entered directly into the BIS license application database, and will be printed on the official response issued by BIS. A brief technical description is essential. All other blocks or block portions appropriate for review requests should be completed in accordance with Part 748 of the EAR.
- Block 24: Insert your most recent encryption registration number (ERN).
Step 5: Prepare a PDF document containing the information and documentation described in Supplement No. 6 to Part 742 of the EAR. Attach this and other product information.
Step 6: Supplement 1 to Part 748 provides general multipurpose application instructions. Apply over the Internet using BIS' SNAP-R. You may include up to six items on a classification.
Step 7: Submit the application to BIS electronically through SNAP-R. You will obtain an Application Control Number that begins with the letter Z. Use this number in all communications with BIS about your classification request.
Step 8: Export items described by Section 740.17(b)(2) or (3) immediately if you obtained a classification request from the producer or thirty (30) days after the submission of a classification request to BIS in accordance with Section 740.17(d). Items submitted for classification may be immediately exported to countries listed in Supplement No. 3 to Part 740.
Additional guidance for License Exception ENC (740.17) items
How to file a mass market classification request
Below are the steps to take to export under Section 742.15(b)(3) of the EAR.
Step 1: Determine whether the products you want to export qualify for mass market treatment under the criteria in the Cryptography Note (Note 3) of Category 5, Part 2 ("Information Security"), of the Commerce Control List (Supplement No. 1 to part 774 of the EAR). If so, proceed to the next step.
Step 2: Determine that the products are mass marketed encryption components (chips, electronic assemblies, crypto libraries), toolkits, development kits, and non-standard crypto items described in 742.15 (b)(3) of the EAR.
Step 3: If you are not the manufacturer or producer of the products, determine whether the manufacturer or producer has filed a Mass Market classification request. If they have, you may export immediately based on the manufacturer’s Mass Market classification.
Step 4: Register for Simplified Network Application Process Redesign (SNAP-R). After you have received your Company Identification Number (CIN) and have activated your account, within SNAP-R select “Encryption Registration.” If required, complete the encryption registration by attaching a PDF version of Supplement No. 5 to Part 742.
Step 5: Return to the main SNAP-R screen and select "Classification Request" and check the encryption checkbox. Block instructions
- Block 9: A pulldown list will appear in the Special Purpose block. Select "Mass Market Encryption."
- Block 14-15: Be sure the information in these blocks is complete and correct, because this is where the official response from BIS will be sent. If both blocks are filled in, the official response will be sent to the individual or entity identified in Block 15.
- Block 22(a): For hardware, enter 5A992. For software, enter 5D992.
- Block 22(c): Enter the product name with model number, if available.
- Block 22(i): Enter the name of the manufacturer. If you will sell the product under your company's label, then enter the name of your company in the manufacturer block.
- Block 22(j): Provide a brief technical description including the basic purpose of the encryption item (e.g., XYZ is a PDA used for ...) and the type of encryption used in the software (e.g., 168-bit Triple DES for secure e-mail, 1024-bit RSA for key exchange). Comments such as "See letter of explanation" or "See brochure" are not sufficient. The information identified in this block is entered directly into the BIS license application database, and will be printed on the official response issued by BIS. A brief technical description is essential. All other blocks or block portions appropriate for review requests should be completed in accordance with Part 748 of the EAR.
- Block 24: Insert your most recent encryption registration number (ERN).
Step 6: Prepare the following supporting documentation for your classification requests for products that are described in 742.15(b)(3) of the EAR.
- Demonstrate that the commodities and software meet the criteria of the Cryptography Note [Note 3 of Category 5, Part 2, of the Commerce Control List (Supplement No. 1 to Part 774 of the EAR)]. Compare your product with the Cryptography Note criteria and state specifically where and how it is mass marketed.
- Prepare a document containing the information and documentation described in Supplement No. 6 to Part 742 of the EAR.
Step 7: Submit the application to BIS electronically through SNAP-R and attach supporting documents prepared in Step 5 above. Supporting documents include a justification of how the item(s) meets the criteria of the Cryptography Note as well as the documentation required by Supplement No. 6 to Part 742. Supplement No. 6 to Part 742 of the EAR contains details regarding the technical information you must submit. You will obtain and Application Control Number that begins with the letter Z. Use this number in all communications with BIS about your classification request.
Step 8: Items described by Section 742.15(b)(3) may be exported immediately thirty-days (30-days) after the submission of a classification request to BIS in accordance with 742.15(b)(7). Section 742.15(b)(3) authorizes exports and reexports of the mass market items submitted for classification, using the symbol "NLR", provided the items qualify for mass market treatment as described in paragraph (b) of this section and are classified by BIS under ECCNs 5A992 or 5D992.