Below are the steps to take to submit a Classification Request to BIS via BIS’s electronic filing system called SNAP-R. This is assuming you have already registered an account in SNAR-R.
Step 1: Prior to making you submission it is extremely helpful to understand the ECCNs under Cat. 5 Part 2 and whether the products you want to export are described by either Section 740.17(b)(1), (b)(2) or (b)(3) of the Export Administration Regulations (EAR).
Note: Items described under 740.17(b)(1) do not require a classification be submitted to BIS, rather a self-classification report can be done, however, if a classification is completed by BIS for an item, that item does not need to be reported in a self-classification report.
Step 2: If you are not the manufacturer or producer of the products, determine whether the manufacturer or producer has filed a License Exception ENC classification request. If the manufacturer or producer has filed an ENC classification, then you may export based on the manufacturer’s classification and ENC authorization for the product. If you are the manufacturer or producer, or if you cannot obtain the manufacturer’s classification information, then follow the steps below.
Step 3: Go to the main SNAP-R screen and select Classification Request, then check the encryption checkbox. Block instructions:
Block 9: A pulldown list will appear in the Special Purpose block. Select "License Exception ENC."
Block 14-15: Be sure the information in these blocks is complete and correct, because this is where the official response from BIS will be sent. If both blocks are filled in, the official response will be sent to the individual or entity identified in Block 15.
Block 22(a): Enter 5A002, 5A003, 5A004 or 5A992.c for hardware, 5D002 or 5D992.c for software, or 5E002 or 5E992 for technology.
Block 22(c): Enter the product name with model number, if available.
Block 22(i): Enter the name of the manufacturer. If you will sell the product under your company's label, then enter the name of your company in the manufacturer block.
Block 22(j): Provide a brief technical description including the basic purpose of the encryption item (e.g., XYZ is a PDA used for ...). Comments such as "See letter of explanation" or "See brochure" are NOT sufficient. The information identified in this block is printed on the CCATS response issued by BIS. All other blocks or block portions appropriate for review requests should be completed in accordance with Part 748 of the EAR.
Step 4: Attach Support documents
- For items described in 740.17(b)(2) or (b)(3), there are two support documents required:
o Supplement No. 6 to Part 742 Encryption Questionnaire: If the classification request if for an item described under 740.17(b)(2) or (b)(3) be sure to prepare a PDF document containing the information in Supplement No. 6 to Part 742 of the EAR. Complete all questions. Be sure to address question number 11 and 12 as to whether and how the item meets the criteria set forth in 740.17(b)(2) and (b)(3), respectively.
o Data sheet, technical specifications, or marketing brochures for the product(s).
- For items not described in 740.17(b)(2) or (b)(3), the Supplement 6 information is not required, however, you must provide sufficient documentation of the product's features in order for BIS to make an accurate determination. Typically this includes a data sheet and information on the encryption functionality of the product.
- Other information that is not required but can be helpful:
o Cover letter or Letter of Explanation: to provide the licensing officer with information on the product and how it uses encryption functionality.
o ECCN: Include what you think is the appropriate ECCN with an explanation of why.
o Mass Market Explanation: Supporting material such as Mass market support is also appropriate.
Step 5:. You may include up to six items on a classification. Supplement 1 to Part 748 provides general multipurpose application instructions.
Step 6: Submit the application to BIS electronically through SNAP-R. You will obtain an Application Control Number that begins with the letter Z. Use this number in all communications with BIS about your classification request.
Step 7: Export items described by Section 740.17(b)(2) or (3) immediately if you obtained a classification request from the producer, or thirty (30) days after the submission of a classification request to BIS in accordance with Section 740.17(d). Items submitted for classification may be immediately exported to countries listed in Supplement No. 3 to Part 740.
The semi-annual reporting requirement for License Exception ENC can be found in 740.17(e) of the Export Administration Regulations (EAR). See 740.17(e)(i) and (ii) for specific instructions.
Semi-annual reporting is required for exports to all destinations other than Canada, and for reexports from Canada, ONLY for items described under paragraphs 740.17(b)(2) and 740.17(b)(3)(iii) of the EAR.
Certain encryption items and transactions are excluded from this reporting requirement, see paragraph 740.17(e)(1)(iii) of this section. These exclusions include:
• Encryption commodities or software with a symmetric key length not exceeding 64 bits.
• Encryption items exported (or reexported from Canada) via free and anonymous download.
• Encryption items from or to a U.S. bank, financial institution or its subsidiaries, affiliates, customers or contractors for banking or financial operations.
• Foreign products developed by bundling or compiling of source code.
Reporting Key Length Increases
Reporting is required for commodities and software that, after having been classified and authorized for License Exception ENC in accordance with paragraphs (b)(2) or (b)(3) of this section, are modified only to upgrade the key length used for confidentiality or key exchange algorithms. Such items may be exported or reexported under the previously authorized provision of License Exception ENC without a classification resubmission.
What to file for reporting key length increases:
• Certification that no other encryption changes have been made.
• Original Commodity Classification Automated Tracking System (CCATS).
• New key length.
When and where to file for reporting key length increases:
• The report must be received by BIS and the ENC Encryption Request Coordinator before the export or reexport of the upgraded product; and
• The report must be e-mailed to This email address is being protected from spambots. You need JavaScript enabled to view it. and This email address is being protected from spambots. You need JavaScript enabled to view it..
|
“Government end user” (as applied to encryption items). |
|
A government end user is any foreign central, regional or local government department, agency, or other entity performing governmental functions; including governmental research institutions, governmental corporations or their separate business units (as defined in part 772 of the EAR) which are engaged in the manufacture or distribution of items or services controlled on the Wassenaar Munitions List, and international governmental organizations. This term does not include: utilities (including telecommunications companies and Internet service providers); banks and financial institutions; transportation; broadcast or entertainment; educational organizations (except public schools and universities); civil health and medical organizations (including public civilian hospitals); retail or wholesale firms; and manufacturing or industrial entities not engaged in the manufacture or distribution of items or services controlled on the Wassenaar Munitions List. |
|
“Less sensitive government end users” (as applied to encryption items). |
|
The following “government end users” (as defined in this Section of the EAR) are considered “less sensitive” for the purposes of License Exception ENC (§ 740.17 of the EAR): (1) Local/state/provincial "government end users" (departments, agencies and entities), including local/state/provincial executive, legislative, judicial, police, fire, rescue and public safety agencies. (2) National/federal/royal "government end users" (departments, agencies and entities) providing the following civil government functions and services:
(ii) Civil public works infrastructure services (construction, maintenance, repair, regulation and administration) as follows: buildings, public transportation, roads and highways, trucking;
(v) Economic (trade/commerce/investment), business and industrial development, promotion, regulation and administration, excluding the following end users/end uses:
(x) Labor/community/social services planning, regulation and administration, including: housing and urban development, municipality and rural affairs;
|
|
“More sensitive government end users “(as applied to encryption items). |
|
The following national/federal/royal (departments, agencies and entities) “government end users” (as defined in this section of the EAR) providing the following government functions and services, are considered “more sensitive:” (1) Agencies, departments, boards and councils for science and technology (including research, development and state / national laboratories, but not including measurements and standards); (2) Currency and monetary authorities (including departments and offices of the national / federal / royal reserve); (3) Executive agents of state (including offices of president / vice president / prime minister, royal courts, national security councils, cabinet / council of ministers / supreme councils / executive councils, crown princes and other deputies of the rulers, departments and offices of political / constitutional / mainland affairs); (4) Legislative bodies responsible for the enactment of laws; (5) Import/export control, customs and immigration agencies and entities; (6) Intelligence agencies and entities; (7) Judiciary (including supreme courts and other national / federal / regional / royal high courts and tribunals); (8) Maritime, port, railway and airport authorities; (9) Military and armed services (including national guard, coast guard, security bureaus and paramilitary); (10) Ministries, departments and garrisons of defense (including defense technology agencies); (11) Ministries and departments of finance and taxation (including national / federal / royal budget and revenue authorities); (12) Ministries and departments of foreign affairs / foreign relations / consulates / embassies; (13) Ministries of interior, internal / home / mainland affairs, and homeland security; (14) State / national telecommunications and information technology agencies, boards, councils and development authorities (including national information / critical infrastructure data centers, and Information and Communications Technology (ICT) /telecommunications infrastructure / spectrum planning, policy, regulation and testing); (15) Police, investigation and other law enforcement agencies and entities (including digital crime / cyber crime / computer forensics, counter narcotics / counter terrorism / counter proliferation agencies); (16) Prisons; (17) Public safety agencies and entities (including national / federal / royal agencies and departments of civil defense, emergency management, and first responders). |
An annual self-classification report is a requirement for items exported under License Exception ENC - 740.17(b)(1), UNLESS a Commodity Classification (CCATS) has been submitted for the item.
You will need a copy of Supplement No. 8 to Part 742 "Self-Classification Report."
How to create the annual self-classification report in .CSV file format
The table in this sample annual self-classification report provides an example of the various fields required within the Annual Self-Classification Report as required per Supp. 8 to Part 742, section (b) and demonstrates how various instructions & tips published in Supplement 8 to part 742 works out in practice.
- First line of the annual self-classification report must consist of the following 12 entries: PRODUCT NAME, MODEL NUMBER, MANUFACTURER, ECCN, AUTHORIZATION TYPE, ITEM TYPE, SUBMITTER NAME, TELEPHONE NUMBER, E-MAIL ADDRESS, MAILING ADDRESS, NON-U.S. COMPONENTS, NON-U.S. MANUFACTURING LOCATIONS.
- No entry may be left blank.
- PRODUCT NAME and ECCN must be completed.
- For MODEL NUMBER and MANUFACTURER, if necessary, enter "NONE" or "N/A".
- For AUTHORIZATION TYPE, enter ENC or MMKT.
- For ITEM TYPE, pick from the list of item types provided in the Supp. 8 to Part 742 (a)(6).
- Column headers SUBMITTER NAME through NON-U.S. MANUFACTURING LOCATIONS relate to the company as a whole, and thus should be entered the same for each product (i.e., only one point of contact, one ‘YES’ or ‘NO’ answer to whether any of the reported products incorporate non-U.S. sourced encryption components, and one list of non-U.S. manufacturing locations, is required for the report). Duplicate this information into each row of the spreadsheet
- The only permitted use of a comma is the necessary separator between the 12 entries for each line item. The only commas allowed are the ones inserted automatically during spreadsheet conversion.
- An encryption self-classification report data table created and stored in spreadsheet format can be converted and saved into a comma delimited file (.CSV) format directly from the spreadsheet program.
License Exception ENC
740.17(b)(1)
If an item or transaction does not fall under any of the above provisions (740.17(a), (b)(2), or (b)(3) then it falls under 740.17(b)(1).
Items described in 740.17(b)(1) DO NOT require a classification submission to BIS to be eligible for license exception ENC or NLR status for mass market items. They may be self-classified by the exporter.
If an exporter chooses to self-classify an item under 740.17(b)(1), they must submit an Annual Self-Classification Report. However, if the item is submitted for a classification request with BIS and the classification request has been issued, that item does not need to be included on the Annual Self-Classification Report.