BIS Publishes Clarification of Grace Period for New Encryption Registration Requirement

On July 27, 2010, the U.S. Department of Commerce's Bureau of Industry and Security (BIS) published a final rule in the Federal Register to clarify the intent of the encryption registration requirement that appeared in the new encryption rules published on June 25, 2010. 

The June 25, 2010 final rule established, inter alia, an encryption registration requirement for authorization under provisions of License Exception ENC, as codified in § 740.17(b)(1), (b)(2) and (b)(3) of the EAR, and for transactions in connection with mass market encryption transaction, as codified in §§ 742.15(b)(1) and (b)(3) of the EAR. In § 740.17(d)(1)(i)(A) and (d)(1)(i)(B), the rule specified that an encryption registration was required to be filed the first time that a party submits an encryption classification request under § 740.17(b)(2) and (b)(3) or performs an encryption self-classification under § 740.17(b)(1) on or after August 24, 2010. The rule also stated that an encryption registration was required to be submitted in support of an encryption classification or in circumstances where a party is making a mass market encryption item eligible for export and reexport (including the definition at § 734.2(b)(9) for encryption software) under § 742.15(b)(1) for the first time on or after August 24, 2010. Although the rule was issued in final form on June 25, the rule intended to establish a grace period permitting parties to wait until August 24 to submit their registration requirements.

In the clarification, BIS states:

The intent of this grace period was to allow industry time to gather information necessary to accurately submit the information required in the encryption registration (Supplement No. 5 to part 742), to change internal procedures, and to train personnel before submitting the encryption registration. However, the rule inadvertently omitted language that clarifies that parties may self-classify or seek classifications between June 25, 2010 and August 24, 2010 without first submitting a registration. It also inadvertently omitted language that clarifies the post-classification registration requirement for parties that self-classified or sought classifications between June 25, 2010 and August 24, 2010, but did not self-classify or seek a classification again on or after August 24, 2010. This rule corrects the regulations to include language that clarifies the intent of the grace period.