Encryption registration no longer exists under the EAR. BIS eliminated it in 2016 and replaced it, for most of the items that needed it, with the annual self-classification report, due by 1 February each year. Older guidance that talks about "encryption registration", a form exporters had to file with BIS before using certain provisions, is out of date.
What changed in 2016
Registration required exporters to submit company and product information before relying on some encryption provisions. The 2016 rule removed that step. For the items that previously depended on registration, exporters now self-classify and include the items in an annual report.
What is a self-classification report?
It is a report in the format set out in Supplement No. 8 to Part 742, listing each relevant product with certain technical details. It is filed electronically with BIS and the ENC Encryption Request Coordinator, annually by 1 February, and covers the previous calendar year. Entries use a specified format so BIS can process them, so follow Supplement No. 8 to Part 742 exactly. Each entry gives:
- the product name and model or version;
- the manufacturer and the ECCN (for example 5A992.c or 5D002);
- the type of product (for example network infrastructure, chip, application);
- the cryptographic functions and, where required, algorithms and key lengths;
- the paragraph of § 740.17 relied on.
Which items need the report
- items exported under § 740.17(b)(1) of License Exception ENC;
- certain mass-market items classified 5A992.c or 5D992.c that § 740.17 requires to be reported.
More sensitive items need a classification request instead, reviewed by BIS before export. These are the § 740.17(b)(2) and (b)(3) items and some mass-market items, such as certain chips and chipsets. See License Exception ENC for the paragraphs and self-classification vs. a BIS classification request for how the two filings compare.
Items that need no encryption filing
Items outside Category 5 Part 2 (for example authentication-only products), items excluded by the notes, and some mass-market items need no encryption filing at all. Publicly available open-source encryption code is subject to its own rules, set out in open-source encryption. How an item lands in 5A002, 5A992.c or outside Category 5 is covered in encryption export controls explained.
A simple annual routine
- Keep a register of encryption products and their classifications through the year.
- Flag those that fall under (b)(1) or reportable mass market.
- Compile the report in the Supplement No. 8 format in January.
- File by 1 February and keep the confirmation.
- Update classifications when products change.
Common mistakes
- still trying to "register" and never filing the report;
- filing a report for items that actually need a classification request;
- missing new products released during the year;
- relying on a supplier's report for your own modified product.
Frequently asked questions
Do I report every export?
No. The report lists products only. Semi-annual sales reports are a separate requirement for some items under ENC.
What if a product was released mid-year?
Include it in the report due the following 1 February.
Can a manufacturer's report cover my exports?
A manufacturer's report covers its own products as it sells them. Resellers of unmodified products generally rely on the manufacturer's filing, but check the specific requirement. Where manufacturers publish their ECCNs explains how far you can rely on their classifications.
The filing question in ECCN.help
The ECCN.help Classification Workflow asks the filing question as part of every encryption classification and records the answer, so your register of classifications shows which items need the annual report. For which items reach mass market in the first place, see the mass-market release.
ECCN.help provides research and assistance, not legal advice. Verify every result against the regulation.