Starting September 12, 2024, American individuals and those located in the U.S. will be prohibited from providing consulting or expert services on technical issues related to the use of information technology, software development, and database services, as well as configuration, integration, modification, configuration, and installation of existing software to individuals located in the Russian Federation. Services for software intended for enterprise management, as well as for design and manufacturing, will be prohibited, including technical support services, patches, and updates, and access through the Internet or cloud. The sanctions will not apply to services related to software whose export, re-export, or transfer within the Russian Federation is permitted by the U.S. Department of Commerce under a license or otherwise.

On September 12, 2024, an expansion of sanctions against the Russian Federation, announced by the U.S. Treasury on June 12, 2024, under Executive Order 14071, will come into effect, prohibiting the provision of:

  • IT consulting and design services;
  • IT support services and cloud services for the following software categories: enterprise management software, and design and manufacturing software.

The sanctions do not apply to:

  • any services to Russian organizations directly or indirectly owned or controlled by American owners;
  • services related to the closure of a company, provided the company is not directly or indirectly owned by a Russian entity;
  • services related to software whose export, re-export, or transfer within the Russian Federation is permitted by the U.S. Department of Commerce under a license or otherwise.

Sanctions do not prohibit Internet access or providing communication services via the Internet. Additionally, services related to Internet messaging such as instant messaging, chat, email, social networks, photo and video sharing, web browsing, blogging, social media platforms, collaboration platforms, video conferencing, online games, e-learning platforms, automatic translation, web maps, user authentication services, web hosting, and domain name registration services are not prohibited.
The Office of Foreign Assets Control (OFAC) of the U.S. Treasury provides the following clarifications regarding the terminology used in the U.S. Treasury determination of June 12, 2024:

The term enterprise management software means the following types of software: enterprise resource planning (ERP), customer relationship management (CRM), business intelligence (BI), supply chain management (SCM), enterprise data warehouse (EDW), computerized maintenance management system (CMMS), project management, and product lifecycle management (PLM) software.

The term design and manufacturing software means the following types of software: building information modeling (BIM), computer-aided design (CAD), computer-aided manufacturing (CAM), and engineer to order (ETO) software.

The term IT consulting and design services includes both IT consulting services and IT design and application development services, as defined by codes 83131 and 83141 of the United Nations Central Product Classification (CPC), respectively.

  • IT consulting services include providing consulting or expert opinions on technical issues related to the use of information technology, such as: (a) consulting on issues like hardware and software requirements and procurement; (b) system integration; (c) system security; and (d) providing expert opinions on IT-related issues.
  • IT design and application development services include services related to the design of the structure and/or writing of computer code necessary to create and/or implement a software application, such as: (a) designing the structure of a web page and/or writing the computer code necessary to create and implement a web page; (b) designing the structure and content of a database and/or writing the computer code necessary to create and implement a database; (c) designing the structure and writing the computer code necessary to design and develop a custom software application; (d) configuring and integrating, adapting (modifying, configuring, etc.), and installing existing applications so that they operate in the client’s information system environment.

OFAC provides the following examples of IT consulting and design services that will be prohibited starting September 12, 2024:

  • Upgrading IT systems for a Russian company, including consulting on software and hardware types, among other things;
  • Modifying existing applications to function in the internal IT environment of a Russian company;
  • Developing custom (i.e., bespoke) software that a Russian company uses for internal purposes;
  • Designing the structure of a Russian company’s commercial website;
  • Developing and delivering proprietary supply chain management software;
  • Developing and delivering proprietary accounting software from an American company to a software reseller in a third country (Company Y), which Company Y indicates they intend to supply to a Russian company.

The term technical support services is defined by code 83132 of the United Nations Central Product Classification (CPC) and includes:

  1. providing technical expertise to solve client problems in using software, hardware, or the entire computer system, such as: (a) providing client support for software use or troubleshooting; (b) updating services and providing patches and updates; (c) providing client support for using or troubleshooting computer hardware, including regular testing and cleaning, and repairing IT equipment; (d) providing technical assistance in moving the client’s computer system to a new location; (e) providing client support for using or troubleshooting a combination of computer hardware and software; and
  2. providing technical expertise to solve specialized client problems in using the computer system, such as: (a) auditing or evaluating computer operations without providing recommendations or other follow-up actions, including auditing, evaluating, and documenting the server, network, or process for components, capabilities, performance, or security; (b) data recovery services, i.e., extracting client data from a damaged or unstable hard disk or other storage medium, or providing backup computer equipment and duplicating software in a separate location to allow the client to relocate regular staff to resume and maintain routine computer operations in case of failure. disaster, such as fire or flood; and (c) other IT technical support services not classified elsewhere.

The term cloud services includes providing software via the Internet or cloud, including “Software as a Service” (SaaS) or SaaS cloud services related to such software.
Below are examples of technical support services that U.S. contractors will be prohibited from providing to individuals in the Russian Federation starting September 12, 2024:

  • An American company sells a Russian company a subscription to cloud-based enterprise resource planning software.
  • An employee of a third-country company in the U.S. provides client support services to a Russian company experiencing technical difficulties with its human resources management software.
  • An American company provides a Russian company with a software patch to fix an error in its computer-aided design software;
  • An American consulting company signs a contract to provide enterprise management software and related IT technical support services to Company X. Company X provides access to these services to its Russian parent company, so that employees of the Russian parent company call the American consulting company when they have problems with their enterprise management software.

According to OFAC clarifications, the following services are not prohibited:

  • An American service provider provides a Russian company with Internet access;
  • An American service provider provides a Russian company with Internet services. Providing Internet services includes, for example, domain name services;
  • An American company provides Russian individuals and entities with continuous access to cloud-based, free, public web applications such as email, spreadsheets, and document processing applications;
  • An American company provides virtual private network (VPN) services to clients in the Russian Federation;
  • An American company sells a Russian company a subscription to cloud-based electronic medical records software;
  • An American company provides client support services to a Russian citizen experiencing technical difficulties with their public cloud web application for spreadsheets;
  • A U.S. citizen working at a third-country company provides client support services to a Russian citizen experiencing technical difficulties with their free public video conferencing application;
  • An American company provides IT support services to a Russian individual for an application not covered by the program.

Sanctions do not apply to services provided by U.S. contractors to individuals outside the Russian Federation who are owned or controlled by individuals in the Russian Federation, provided the services do not constitute an indirect export to an individual in the Russian Federation. OFAC interprets “indirect” provision of prohibited services as instances where the benefit of the services ultimately accrues to a “person located in the Russian Federation.” Thus, if an American company provides services to a subsidiary of a Russian company located in a third country, and this subsidiary has an office and employees in the third country and conducts business in that third country, and the services will not be re-exported to the Russian parent company, such services will not be subject to sanctions.