U.S. Department of Commerce Strengthens Export Controls on Advanced Computing and Semiconductor Manufacturing Items

On December 2, 2024, the U.S. Commerce Department, Bureau of Industry and Security (“BIS”) issued an interim final rule, Foreign-Produced Direct Product Rule Additions, and Refinements to Controls for Advanced Computing and Semiconductor Manufacturing Items (the “December 2024 IFR”) that revised and expanded the controls in the Export Administration Regulations (“EAR”) on advanced computing and semiconductor manufacturing items[1] by:

• Adding eight new Export Control Classification Number (“ECCN”) entries to the Commerce Control List (“CCL”) in the EAR and revising an additional eight entries for high bandwidth memory (“HBM”), semiconductor manufacturing equipment (“SME”), and associated software and technology;
• Expanding the jurisdiction of the EAR to apply to additional non-U.S.-made items by:
  • Adding two new foreign direct product (“FDP”) rules—the Footnote 5 (“FN 5”) FDP rule and the SME FDP rule—targeting certain non-U.S.-made SME (and related item) shipments involving parties designated on the Entity List with a new FN 5 or destined to Macau or a destination in Country Group D:5 at Supplement No. 1 to EAR Part 740 (e.g., China);
  • Making corresponding changes to add U.S.-origin items for which there is no de minimis threshold when incorporated into certain non-U.S.-made SME or certain other items destined for FN 5 parties on the Entity List or to Macau or a destination in Country Group D:5; and
  • Adding HBM stacks described in new ECCN 3A090.c to the product scope of the previously issued Advanced Computing FDP Rule;
• Clarifying and expanding certain controls on advanced computing and SME, including imposing new license requirements on HBM;
• Establishing two new license exceptions and revising the scope of two temporary general licenses (“TGLs”) as relevant to the new controls;
• Specifying the export controls applicable to software keys; and
• Adding eight new “Red Flags” to BIS’s Red Flag Guidance.

In parallel with the December 2024 IFR, BIS issued a final rule, Additions and Modifications to the Entity List; Removals from the Validated End User (VEU) Program (the “Entity List Updates Rule”), through which BIS designated 140 entities to the Entity List, modified the Entity List entries for 14 additional parties, and removed three parties from the Validated End User (“VEU”) program. Following these revisions, 16 entities are identified on the Entity List with a new FN 5 designation and subject to the new FN 5 FDP Rule (and corresponding provisions in the de minimis rule). These include, among others, certain affiliates of Semiconductor Manufacturing International Corporation (“SMIC”); SwaySure; PXW Semiconductor Manufactory Co., Ltd.; and Fujian Jinhua Integrated Circuit Company, Ltd. (a.k.a. JHICC).

Both the December 2024 IFR and the Entity List Updates Rule took effect on December 2, 2024. BIS has stated that the December 2 effective date applies to the new and revised Red Flags, license exceptions, and TGLs. However, industry has until December 31, 2024 to come into compliance with most of the rules’ other provisions, including but not limited to:

• The two new FDP rules and related revisions to the de minimis rules;
• The expansion of National Security (“NS”) and Regional Stability (“RS”) controls, end-use/end-user controls, and U.S. person activities restrictions on certain advanced computing and SME items; and
• The changes to licensing requirements resulting from certain additions and revisions to the CCL.

Each of the new rules also includes certain savings clauses.

New and Revised ECCNs

High Bandwidth Memory

The December 2024 IFR added new subparagraph “.c” under existing ECCN 3A090 to control all HBM stacks that are currently in production. With the addition of HBM stacks to ECCN 3A090, non-U.S.-made HBM stacks that meet the product and end-user criteria of the Advanced Computing FDP Rule at EAR § 734.9(h) are now subject to the EAR by virtue of that FDP Rule. In the preamble to the December 2024 IFR, BIS explained that it imposed these new controls because HBM stacks are “an important part of the production process for making advanced computing ICs” and provide the necessary memory capacity and bandwidth needed for artificial intelligence (“AI”) models and supercomputing applications.

The HBM stacks that are controlled under the new threshold of “HBM2” are those having a “memory bandwidth density” greater than 2 gigabytes (“GB”) per second per square millimeter, where “memory bandwidth density” is the memory bandwidth of the package or stack measured in GB per second divided by the area of the package or stack measured in square millimeters. 

HBM stacks that are incorporated into an integrated circuit (“IC”) or a higher-level commodity (e.g., a computer or electronic assembly) may be controlled under ECCN 3A090.a or .b, 4A090.a or .b, or the “.z” subparagraph of an ECCN; however, the performance parameters under ECCN 3A090.c are not used for determining whether an item is classified in ECCN 4A090.a or .b or in a “.z” ECCN.

HBM items specified in ECCNs 3A090.c, 3D001 software (for 3A090.c), and 3E001 technology (for 3A090.c) are subject to a new RS license requirement at EAR § 742.6(a)(6)(i)(B) when exported, reexported, or transferred (in-country) to or within Macau, China, or other destinations specified in Country Group D:5. This license requirement does not apply to deemed exports or deemed reexports of such technology or software. A review policy of a presumption of approval applies for entities neither headquartered in nor whose ultimate parent company is headquartered in Macau or Country Group D:5. All other license applications will be reviewed under a policy of a presumption of denial.

The December 2024 IFR added a new License Exception HBM at EAR § 744.25 that authorizes certain exports, reexports, and in-country transfers of ECCN 3A090.c items with a memory bandwidth density less than 3.3 GB/s/mm² when shipped from an entity headquartered in the United States or Country Group A:5 that does not have an ultimate parent headquartered in Macau or Country Group D:5 directly to a packaging site, provided certain other criteria are met. Notably, License Exception HBM includes certain reporting requirements if red flags are identified and not resolved within 60 days.

Additionally, the product scope of the Advanced Computing Items TGL (see Supplement No. 1 to Part 736, at para. (d)(2)) was expanded to include new ECCN 3A090.c and the end-use scope of the Advanced Computing Items TGL was revised to (i) cover exports, reexports, or in-country transfers of ECCN 3A090.c items to or within a destination specified in Country Group D:5 when the preexisting conditions of the TGL are met, and (ii) add two new permitted ultimate end uses for ECCN 3A090.c items. However, there appears to have been a drafting error in the rule, as this TGL states that it overcomes § 742.6(a)(6)(iii), which does not apply to ECCN 3A090.c; it is likely that BIS intended for the TGL to overcome § 742.6(a)(6)(i)(B), which imposes a license requirement on ECCN 3A090.c. It is possible BIS may clarify or address this discrepancy in a future correction rule or guidance.

The December 2024 IFR also clarified that items classified under ECCN 3A090.c are not eligible for License Exceptions Notified Advanced Computing (“NAC”) or Advanced Computing Authorized (“ACA”) due to concerns that such items could be diverted for incorporation into other items that would be of national security and foreign policy concern for advanced AI model training applications.

Semiconductor Manufacturing Equipment

Through the December 2024 IFR, BIS has added eight new ECCNs (3B993, 3B994, 3D992, 3D993, 3D994, 3E992, 3E993, and 3E994) and revised seven additional ECCNs (3B001, 3B002, 3B991, 3B992, 3D001, 3D002, and 3E001) relevant to SME and associated software and technology. These ECCNs are technical in nature and should be reviewed closely by parties operating in or providing products, software, or technology to the semiconductor manufacturing industry. At a high level, the new ECCNs include:

• ECCN 3B993 contains certain former ECCN 3B001 entries and controls certain additional equipment and related items that enable production of advanced-node ICs, but which BIS stated also have legitimate applications in non-advanced-node production such that license requirements to all parties in China and a presumption of denial license policy are not warranted.
• ECCN 3B994 is a broad new control that applies to SME designed for volume production. BIS explained that these items can support advanced-node IC production, but also have legitimate applications in non-advanced-node production.
• ECCN 3D992 controls software for the development or production of specified commodities, as well as electronic computer-aided design (“ECAD”) software for advanced semiconductor packaging involving multiple chips or chiplets co-packaged in a single device.
• ECCN 3D993 controls software for the production or development of commodities in ECCN 3B993 (3D993.a), as well as ECAD software designed or modified for the development or production of ICs using multipatterning (3D993.b), computational lithography software (3D993.c), and software designed or modified to improve the productivity of controlled deep ultraviolet (“DUV”) photolithography equipment (3D993.d).
• ECCN 3D994 controls software for the development or production of commodities specified in ECCN 3B994.
• ECCNs 3E992, 3E993, and 3E994 control technology for the development or production of certain commodities specified in ECCNs 3B001, 3B002, 3B993, and 3B994, as well as in the case of ECCN 3B993.b technology designed or modified to increase the wafers processed per hour by greater than 1% of equipment specified in ECCNs 3B001.f.1 or 3B993.f.1.

The December 2024 IFR revised the NS license requirement at EAR § 742.4(a)(4) —applicable to the export, export from abroad, reexport, or transfer (in-country) of certain SME to or within Macau or Country Group D:5—to apply to ECCNs 3B001.a.4, c, d, f.1, f.5, k to n, p.2, p.4, r, 3B002.c, 3D992, and 3E992, with exceptions for deemed exports and deemed reexports, as well as certain items subject to the EAR under the new SME FDP Rule and related de minimis rule. The license review policy will follow the policy applicable under EAR § 744.23, unless no license would be required under any provision of EAR Part 744, in which case applications will be reviewed on a case-by-case basis.

ECCNs 3B993, 3B994, 3D993, 3D994, 3E993, and 3E994 are controlled for anti-terrorism (“AT”) reasons and when subject to the EAR under the EAR’s traditional jurisdictional rules and not subject to the EAR pursuant to the new FN 5-related de minimis and FDP jurisdictional rules at §§ 734.4(a)(9) or 734.9(e)(3), respectively, are subject to the EAR’s end-use and end-user controls, including the Entity List license requirements at EAR § 744.11(a). The license requirements applicable to these items when subject to the EAR under the new FN 5-related de minimis or FDP rules are discussed below.

In addition, RS license requirements that are duplicative of, and do not expand upon, other preexisting EAR license requirements were added for SME identified in the new and revised SME ECCNs. Rather than adding additional EAR license requirements, these new RS controls establish the relevant ECCNs as critical technologies for purposes of the reviews undertaken by the Committee on Foreign Investment in the United States (“CFIUS”).

Also on December 2, 2024, BIS updated the Implemented Export Controls table on its website to make conforming changes to reflect the SME ECCN changes described above and to extend License Exception IEC eligibility for the Netherlands, New Zealand, and Slovenia.

Revisions to EAR Jurisdiction

Entity List FN 5 FDP Rule and Related De Minimis Rule Changes

The December 2024 IFR introduced at EAR § 734.9(e)(3) a new Entity List FDP Rule: FN 5 that extends the jurisdiction of the EAR to certain non-U.S.-made SME and related items when both the product scope and the end-user scope of the rule are met.

The end-user scope is met if the exporter, reexporter, or transferor has “knowledge,” as that term is defined in the EAR, that (i) such non-U.S.-made items will be incorporated in any part, component, or equipment produced, purchased, or ordered by an entity on the Entity List with a FN 5 designation; or (ii) any FN 5 entity is a party to any transaction involving such items. As of the date of this alert, 16 entities are on the Entity List with a FN 5 designation. (See below for a discussion of these and other Entity List designations made in parallel with the December 2024 IFR.)

The product scope is met if the non-U.S.-made item is (i) specified in ECCN 3B001 (except 3B001.a.4, c, d, f.1, f.5, g, h, k to n, p.2, p.4, r), 3B002 (except 3B002.c), 3B903, 3B991 (except 3B991.b.2.a through 3B991.b.2.b), 3B992, 3B993, or 3B994, and (ii) that item:

• Is the direct product of technology or software that is subject to the EAR and specified in ECCN 3D001 (for 3B commodities), 3D901 (for 3B903), 3D991 (for 3B991 and 3B992), 3D993, 3D994, 3E001 (for 3B commodities), 3E901 (for 3B903), 3E991 (for 3B991 and 3B992), 3E993, or 3E994;
• Was produced by a plant or major component of a plant (i.e., equipment) that is itself the direct product of U.S.-origin technology or software specified in ECCN 3D001 (for 3B commodities), 3D901, 3D991 (for 3B991 and 3B992), 3D992, 3D993, 3D994, 3E001 (for 3B commodities), 3E901 (for 3B903), 3E991 (for 3B991 and 3B992), 3E992, 3E993, or 3E994; or
• Contains a non-U.S.-made commodity produced by a plant or equipment that is itself the direct product of U.S.-origin technology or software specified in ECCN 3D001 (for 3B commodities), 3D901, 3D991 (for 3B991 and 3B992), 3D992, 3D993, 3D994, 3E001 (for 3B commodities), 3E901 (for 3B903), 3E991 (for 3B991 and 3B992), 3E992, 3E993, or 3E994.

This third prong of the product scope—explicitly controlling non-U.S.-made items that contain another non-U.S.-made commodity that is itself an FDP—is a new approach for the FDP rules. A Note to this subparagraph confirms that a non-U.S.-made item containing a non-U.S.-made IC produced at a plant using equipment that is the direct product of U.S-origin technology is covered by this prong where the relevant technical parameters for the item are met. As a result, non-U.S.-made SME containing any IC produced using U.S.-designed SME is likely to meet the product scope of the rule. Indeed, given the prevalence of certain types of U.S.-designed SME and software used in the development and production of ICs, BIS has added new Red Flag 26, which establishes a red flag that the product scope of this FDP rule is met where relevant types of non-U.S.-made SME contain at least one IC.

In parallel, the December 2024 IFR established that there is no de minimis threshold for a commodity described in a Category 3B ECCN (except 3B001.a.4, c, d, f.1, f.5, k to n, p.2, p.4, r, or 3B002.c) when the commodity contains a U.S.-origin IC specified under Category 3, 4, or 5 of the CCL, and the commodity is destined for a FN 5 entity. See EAR § 734.4(a)(9).

Together, these changes extend EAR jurisdiction over non-U.S.-made SME described in the relevant Category 3B ECCNs that contain ICs either produced in the United States or produced outside the United States using U.S.-designed equipment, where the relevant technical parameters are met and there is a nexus to an Entity List FN 5 party.

SME FDP Rule and De Minimis Rule Changes

The December 2024 IFR also introduced the SME FDP Rule at EAR § 734.9(k), which extends the jurisdiction of the EAR to certain non-U.S.-made SME and related items when both the product scope and the destination scope of the rule are met.

The destination scope is met if the exporter, reexporter, or transferor has “knowledge,” as defined in the EAR, that the non-U.S.-made item is destined to Macau or a destination in Country Group D:5.

The product scope of the SME FDP Rule is met if the non-U.S. made item is (i) specified in ECCN 3B001.a.4, c, d, f.1, f.5, k to n, p.2, p.4, r, or 3B002.c, and (ii) the item:

• Is the direct product of technology or software that is subject to the EAR and specified in ECCN 3D992 or 3E992;
• Was produced by a plant or equipment that is itself the direct product of U.S.-origin technology or software specified in ECCN 3D001 (for 3B commodities), 3D901, 3D991 (for 3B991 and 3B992), 3D992, 3D993, 3D994, 3E001 (for 3B commodities), 3E901 (for 3B903), 3E991 (for 3B991 or 3B992), 3E992, 3E993, or 3E994; or
• Contains a non-U.S.-made commodity produced by a plant or equipment that is itself the direct product of U.S.-origin technology or software specified in ECCN 3D001 (for 3B commodities), 3D901, 3D991 (for 3B991 and 3B992), 3D992, 3D993, 3D994, 3E001 (for 3B commodities), 3E901 (for 3B903), 3E991 (for 3B991 or 3B992), 3E992, 3E993, or 3E994.

In parallel, the December 2024 IFR established new EAR § 734.4(a)(8), which provides that there is no de minimis threshold for a commodity meeting the parameters in ECCNs 3B001.a.4, c, d, f.1, f.5, k to n, p.2, p.4, r, or 3B002.c, when the commodity contains a U.S.-origin IC specified under Categories 3, 4, or 5 of the CCL, and the commodity is destined for Macau or a destination specified in Country Group D:5, unless excluded from the NS license requirement in § 742.4(a)(4) or the RS license requirement in § 742.6(a)(6) of the EAR. Exclusions from the NS and RS license requirements apply to exports from abroad and reexports by entities located in a country specified in Supplement No. 4 to EAR Part 742 or in a country with controls and a license review policy equivalent to BIS’s controls, unless the exporting/reexporting entity is headquartered in, or has an ultimate parent headquartered in, Macau or Country Group D:5.

End-User License Requirements Applicable to Items Subject to the EAR Pursuant to the Entity List FN 5 FDP Rule or Related FN 5 De Minimis Rule

Whether non-U.S.-made items that are subject to the EAR under the new FN 5 jurisdictional rules (which apply when the transaction has the requisite nexus to a FN 5 entity and the product scope of the rule is met) require a license for export, reexport, or in-country transfer depends on the classification of the items and circumstances, as follows:

• ECCN 3B993 items subject to the EAR pursuant only to EAR § 734.9(e)(3) (the FN 5 FDP rule) or EAR § 734.4(a)(9) (the FN 5 de minimis rule) require a license when:
  • Exported from abroad or reexported by an entity headquartered in, or whose ultimate parent company is headquartered in, Macau or a destination specified in Country Group D:5;
  • Exported from abroad or reexported from a country in Country Group A:5 that is not listed in Supplement No. 4 to Part 742, if the country from which the shipment is made does not impose equivalent controls on such items;
  • Exported from abroad or reexported from a country not identified in Country Group A:5; or
  • Transferred within the country of the FN 5 entity (e.g., if SMIC in China is the FN 5 party that causes the item to be subject to the EAR, transfers of that item within China require a license).
• ECCN 3B001 (except 3B001.a.4, c, d, f.1, f.5, g, h, k to n, p.2, p.4, r), 3B002 (except 3B002.c), 3B611, 3B903, 3B991 (except 3B991.b.2.a through 3B991.b.2.b), 3B992, 3B993, and 3B994 items subject to the EAR pursuant only to EAR § 734.9(e)(3) (the FN 5 FDP rule) or EAR § 734.4(a)(9) (the FN 5 de minimis rule) require a license when:
  • Exported from abroad or reexported from a country not identified in Country Group A:5 by an entity that is headquartered or whose ultimate parent company is headquartered in a country not specified in Supplement No. 4 to EAR Part 742; or
  • Transferred within the country of the FN 5 entity by an entity whose ultimate parent company is headquartered in a country not described in Supplement No. 4 to EAR Part 742.

As noted, these license requirements apply to the covered items only when such items are subject to the EAR under the new FN 5-related jurisdictional rules and when the transaction has a nexus to a FN 5 entity. Such items are excluded from the “advanced-node IC” end-use controls at EAR § 744.23(a)(2) and the new RS controls on FN 5 entities at EAR § 742.6(a)(11). The license review policy for these transactions is set forth in the Entity List entry for the relevant FN 5 party.

New and Expanded End Use and U.S. Person Controls

Advanced-Node IC Controls

The December 2024 IFR expanded the Advanced-Node IC end-use controls at EAR § 744.23(a)(2) by adding a license requirement for the export, reexport, or transfer (in-country) of any ECAD or Technology Computer Aided Design (“TCAD”) software and technology subject to the EAR with “knowledge,” as defined in the EAR, that it will be used in the design of an “advanced-node IC” that will be produced in Macau or a destination specified in Country Group D:5.

The December 2024 IFR also revised the EAR’s definition of “advanced-node IC” by revising the criteria for how a DRAM IC is defined, replacing the criterion tied to a production technology node with two new technical parameters: (i) a memory cell area of less than 0.0019 square micrometers (μm²) or (ii) a memory density greater than 0.288 gigabits per square mm.

Advanced Computing Item Controls

The December 2024 IFR requires a different destination scope for 3A090.c items compared to other items referenced in § 744.23(a)(3)(i). Specifically, for an ECCN 3A090.c commodity, the destination scope is met when there is “knowledge,” as defined in the EAR, that the item is destined to any destination other than Macau or Country Group D:5, for an entity that is headquartered in, or whose ultimate parent company is headquartered in, Macau or Country Group D:5. For all other advanced computing items referenced in § 744.23(a)(3)(i), it remains the case that the destination scope is met where there is “knowledge” that the items are destined to any destination other than those specified in Country Groups D:1, D:4, or D:5 (excluding any destination also specified in Country Groups A:5 or A:6) for an entity that is headquartered in, or whose ultimate parent company is headquartered in, either Macau or Country Group D:5.

Further, the December 2024 IFR revised the advanced computing items end-use controls at EAR § 744.23(a)(3)(ii) to add an exclusion for 3E001 technology for 3A090.c items from the scope of the 3E001 technology (for 3A090 items) subject to the end-use controls.

SME Controls

The December 2024 IFR broadened the license requirement at EAR § 744.23(a)(4)(i)—which applies to all items subject to the EAR and identified on the CCL when destined directly to Macau or Country Group D:5 for end use in the development or production of certain SME—by eliminating the front-end IC production equipment qualification and updating the list of covered SME items to include the new SME ECCN entries. As a result, items subject to the EAR and identified on the CCL require a license when destined to Macau or Country Group D:5 for use in the development or production of SME, even if the SME is for use in back-end production steps that do not alter the performance of the IC. BIS explained this change was made to address diversion risk between front-end and back-end production equipment.

In parallel, the December 2024 IFR revised paragraph (d)(1) of General Order No. 4 in Supplement No. 1 to EAR Part 736 to make certain changes to the product scope and validity period for the preexisting Less Restricted SME TGL—which overcomes the license requirement for certain SME at EAR § 744.23(a)(4).

Specifically, the product scope of the Less Restricted SME TGL was expanded to include the following new ECCNs: 3B001.c.4; 3B993.b.1, .c.2, .c.3, .d.4, .f.2, .f.3, .o.2, .q.1, and .q.2; 3B994; 3D993.b, .c, and .d; 3D994; 3E993.b; 3E994; and 3D993.a and 3E993.a (in each case for commodities described by the preceding ECCNs). The end-use scope of this TGL, which did not change as a result of the December 2024 IFR, is limited to recipients that are developing or producing parts, components, or equipment specified in ECCNs 3B001 (except 3B001.g and .h), 3B002, 3B611, 3B903, 3B991 (except 3B991.b.2.a through 3B991.b.2.b), 3B992, 3B993, 3B994 or associated software and technology in Categories 3D or 3E of the CCL at the direction of a company headquartered in the United States or Country Groups A:5 or A:6 and not majority-owned by an entity headquartered in Macau or Country Group D:5.

The December 2024 IFR established a December 31, 2026 expiration date for all items covered by the Less Restricted SME TGL—including the newly-added ECCNs set out above.

U.S. Person Controls

The December 2024 IFR revised the license requirement at EAR § 744.6(c)(2)(iii)—which applies to U.S. persons shipping, transmitting, or transferring (in-country); facilitating the shipment, transmission, or transfer (in-country) of; or servicing (including installation) SME not subject to the EAR to or within Macau or Country Group D:5—to include new ECCNs 3D992 and 3E992 and to update the references to ECCNs 3B001 and 3B002 to align with the scope of SME now subject to NS controls at § 742.6(a)(4).

Entity List and Validated End-User Program Revisions

Entity List Designations and Modifications

In parallel with the December 2024 IFR, BIS issued the Entity List Updates Rule designating to the Entity List 140 entities in China, Japan, South Korea, and Singapore that BIS has determined are acting contrary to the national security and foreign policy interests of the United States. BIS also modified the Entity List entries of 14 already-listed parties located in China. According to BIS, all of these entities are or have been involved in (i) the development and production of advanced-node ICs; (ii) the development and production of semiconductor manufacturing items; and/or (iii) support for the Chinese government’s military-civil fusion development strategy, including indigenous production of advanced-node ICs to support China’s military modernization.

Nine of the newly designated entities and seven of the modified entries have been given a FN 5 designation, such that they will be subject to the new FN 5 FDP Rule described above after the December 31, 2024 compliance date for those restrictions. Among others, the FN 5 entities include the following: Chinese Academy of Sciences Institute of Microelectronics; SwaySure Technology Co., Ltd.; PXW Semiconductor Manufactory Co., Ltd.; and Fujian Jinhua Integrated Circuit Company, Ltd. (a.k.a. JHICC); and SMIC and certain of its affiliates.

The license review policy for each entity identified on the Entity List is set out in that entity’s Entity List entry. For example, the Entity List Updates Rule modified the license review policy for SMIC to be a presumption of denial for all items subject to the EAR, except that case-by-case review applies for items used for production of 200mm wafers destined to a 200mm production facility. Three SMIC affiliates—Semiconductor Manufacturing International (Beijing) Corporation; Semiconductor Manufacturing South China Corporation; and SMIC Northern Integrated Circuit Manufacturing (Beijing) Co., Ltd.—are now subject to a blanket presumption of denial license review policy. Seven additional SMIC affiliates are subject to the license review policy set forth in EAR §§ 744.11 and 744.23(d), which provide for a presumption of denial for applications for destinations or end-users that are Macau, a destination in Country Group D:5, or an entity headquartered in or with an ultimate parent company headquartered in Macau or Country Group D:5 except that: 

• Applications for end users headquartered in the United States or a destination specified in Country Groups A:5 or A:6, that are not majority-owned by an entity headquartered in either Macau or a destination specified in Country Group D:5, will be subject to a presumption of approval; and
• Case-by-case review will apply to:
  • Items specified in ECCNs 3A090, 4A090, 3A001.z, 4A003.z, 4A004.z, 4A005.z, 5A002.z, 5A004.z, 5A992.z, 5D002.z, or 5D992.z, except for items designed or marketed for use in a datacenter and meeting the parameters of 3A090.a;
  • Items subject to the license requirements of EAR § 744.23 where there is a non-U.S.-made item that is not subject to the license requirements of this section and performs the same function as an item subject to the EAR license requirements of this section; or
  • Destinations or end users other than (i) Macau, Country Group D:5, or any entity headquartered in or with an ultimate parent company headquartered in Macau or Country Group D:5; or (ii) end users headquartered in the United States or Country Groups A:5 or A:6, that are not majority-owned by an entity headquartered in Macau or Country Group D:5 (which are subject to a presumption of approval).

The December 2024 IFR added at EAR § 740.26 a new License Exception RFF, which authorizes, subject to the certain specified limitations and reporting requirements, the export, reexport, export from abroad, and in-country transfer to a “restricted fabrication facility”—i.e., an entity on the Entity List with a reference to EAR § 740.26 in the license requirement column—of items subject to the EAR that are not specified in ECCNs 3B001, 3B002, 3B993, 3B994, 3D992, 3D993, 3D994, 3E992, 3E993, or 3E994. License Exception RFF is intended to allow certain items, including certain legacy SME, to be supplied to certain fabrication facilities that are on the Entity List but that BIS has determined are not producing advanced-node ICs. Currently, there is only one “restricted fabrication facility” on the Entity List: Wuhan Xinxin Semiconductor Manufacturing Company Limited (“XMC”).

Validated End-User Program Revisions

Additionally, the Entity List Updates Rule removed three entities from the VEU Program: CSMC Technologies Corporation (“CSMC”); Shanghai Huahong Grace Semiconductor Manufacturing Corporation (“HHGrace”); and Advanced Micro-Fabrication Equipment, Inc., China (a.k.a. Advanced Micro-Electronics Corporation, or “AMEC”). VEUs are entities located in eligible destinations to which eligible items subject to the EAR may be exported, reexported, or transferred (in-country) under a general EAR authorization instead of a specific license. Eligible VEUs are identified in Supplement No. 7 to EAR Part 748.

Export Control Status of Software Keys

Separate from the above China-focused controls, the December 2024 IFR revised EAR § 734.19 (“Transfer of access information”) to add a new paragraph (b), which specifies that “software keys” or “software license keys” (BIS used the terms interchangeably)—which allow users the ability to use software or hardware by providing access to it or by renewing existing software or hardware use licenses—are classified and controlled under the same ECCNs on the CCL as the corresponding hardware or software for which they allow use. BIS further explained that in the case of hardware, the software key would be classified under the corresponding ECCN in the software group (e.g., a software license key that allows the use of hardware classified under ECCN 5A992 would be classified under ECCN 5D992).

New paragraph (b) also explains the following:

• If authorization is required for the export, reexport, or in-country transfer of the relevant software or hardware, then authorization is likewise required for the corresponding software key.
• If a BIS license is obtained for the export, reexport, or in-country transfer of the relevant software or hardware, then the BIS license also authorizes the export, reexport, or in-country transfer of the corresponding software key, subject to the terms and conditions of the BIS license.
• If no authorization was required for the initial export of the software or hardware and associated software key, but a license requirement is later imposed on the software or hardware (e.g., because the end user is designated to the Entity List), subsequent exports, reexports, or in-country transfers of the software, hardware, and software key are subject to the new license requirement.

The December 2024 IFR also added a new Note 2 to paragraph (b), which clarifies that new paragraph (b) does not impact software keys that unlock dormant functionality in a controlled item. BIS explained in the preamble that this scenario could occur if an item is already activated and useable, but a customer wants to purchase and add additional features. In some cases, those previously dormant features transform uncontrolled hardware or software to controlled hardware or software, or move such hardware or software from a lower level of control to a higher level of control (e.g., an item controlled for AT reasons may become NS-controlled). BIS noted that it has existing policies for such a scenario that vary by category.

With respect to the treatment of software keys under the EAR, BIS is requesting comments from industry on:

• Whether these revisions effectively describe the treatment of software keys that allow users the ability to use software and hardware or that renew existing software use licenses;
• Whether BIS should address the export control status under the EAR of other types of keys and software access control mechanisms; and
• The relationship between the treatment of software keys as described in the new EAR § 734.19(b) and the treatment of keys that activate new dormant functionality in software or hardware that has already been activated.

The December 2024 IFR provided additional guidance on identifying “red flags” (i.e., circumstances in a transaction that indicate that the export, reexport, or transfer (in country) may be destined for an unauthorized end use, end user, or destination). To assist exporters, reexporters, and transferors with compliance, the December 2024 IFR added eight new red flags under new paragraphs (b)(20) through (27) in Supplement No. 3 to EAR Part 732. These new red flags include, for example, red flags relating to non-advanced fabrication facilities (red flag 20), orders for which the ultimate owner or user of the items is uncertain (21), new customers (23 through 25), and, as noted, the product scope of the SME and FN 5 FDP rules where certain non-U.S.-made SME contains at least one IC (26).

In response to these measures, China issued a rule that (1) imposes new controls on exports to the United States of gallium, germanium, antimony and certain superhard dual-use items, and (2) prohibits exports to the United States of dual-use items to military end-users or for military end-uses. In parallel, certain Chinese trade associations issued statements cautioning Chinese companies that U.S. chips are “no longer safe or reliable,” and calling for Chinese industry to avoid procuring U.S. chips and to prioritize chips produced in China and other ex-U.S. countries and regions.

*           *           *

We are closely monitoring developments concerning U.S. export controls and will issue further updates in the event of material developments. In the meantime, we would be happy to address any questions you may have.

Covington’s International Trade Controls team—which includes lawyers in the firm’s offices in the United States, London, and Frankfurt—regularly advises clients across business sectors, and would be well-placed to provide support in connection with these new and proposed export controls developments, or to assist with comments on these proposed rules. Our trade controls lawyers also work regularly with Covington's Global Public Policy team—consisting of over 120 former diplomats and policymakers in the United States, Europe, the Middle East, Latin America, Africa, and Asia—many of whom have had substantial government experience in sanctions and export controls matters, and who regularly advise our clients on emerging sanctions policy matters and related engagements with government stakeholders.

If you have any questions concerning the material discussed in this client alert, please contact the members of our International Trade Controls practice.

[1] These controls were first introduced in October 2022 and subsequently expanded and revised in October 2023 and March 2024, as summarized in our prior client alerts linked here.