U.S. Export Administration Regulations (EAR) — Encryption/Crypto Controls
- Record: software-cert-033 — US Export Administration Regulations (EAR) - encryption/crypto controls
- Issuing body / enforcer: U.S. Department of Commerce, Bureau of Industry and Security (BIS)
- Jurisdiction: United States — with extraterritorial application to re-exports and certain deemed exports
- Record type / importance: regulation / license
- Last verified: 2026-09-30
What it is
The EAR (15 CFR Parts 730–774) control exports, re-exports, and in-country transfers of dual-use items — including commercial encryption software and technology. For software engineers, the EAR's encryption provisions (notably Category 5, Part 2 of the Commerce Control List) determine whether cryptographic software can be shipped, published, or transferred across borders, to foreign nationals, or into sanctioned destinations. Violations carry criminal exposure — this is one of the few software-regulatory areas where individual engineers face personal liability risk.
Scope: who/what it applies to, triggers, thresholds
- Controlled items: encryption commodities, software, and technology classified under ECCNs 5A002, 5D002, 5E002 (and related 5A992/5D992 mass-market items). The trigger is functionality: symmetric key length >56 bits, asymmetric >512 bits, and various cryptographic functions beyond narrow exclusions.
- Who: any U.S. person or company exporting/re-exporting; foreign persons re-exporting U.S.-origin controlled software; and deemed exports — releasing controlled encryption technology (source code, detailed design information) to a foreign national inside the U.S.
- Key exclusions that matter for software teams: publicly available encryption source code under § 742.15(b) (notification to BIS required, but no license for most destinations); mass-market encryption under 5A992/5D992 (self-classification + reporting); certain ancillary cryptography (authentication-only, etc.).
Key requirements and compliance obligations
- Classify first: determine the correct ECCN for the product — 5D002 (non-mass-market encryption software) is the common classification for commercial crypto products; mass-market items may qualify for 5D992 with lighter treatment.
- License Exception ENC (§ 740.17): the workhorse for encryption — authorizes exports/re-exports of most 5D002/5A002 items to non-government end users in most destinations without a license, subject to registration, self-classification reporting, and semi-annual sales reporting to BIS.
- Restricted parties/destinations: no exception covers sanctioned/embargoed destinations or listed denied parties — restricted-party screening is mandatory regardless of ECCN.
- Deemed exports: technology-control plans for teams with foreign-national engineers working on controlled crypto internals; note that using encryption APIs is generally not a deemed export — developing controlled crypto technology is.
- Record-keeping: five-year retention of classification, reporting, and screening records (Part 762).
Penalties and consequences
- Criminal: up to 20 years imprisonment and fines up to $1M per violation (50 U.S.C. § 4819; criminal penalties under IEEPA-based provisions have varied with statutory authority — verify current penalty statute before quoting).
- Administrative: civil penalties up to the greater of ~$300,000+ per violation (inflation-adjusted) or twice the transaction value; denial of export privileges (entity listing / denial orders) — effectively a business death sentence for a hardware/software exporter.
- Voluntary self-disclosure to BIS is a significant mitigating factor in penalty calculus.
Version/edition status and LIVE changes (verified 2026-09-30)
- The EAR encryption framework (License Exception ENC, mass-market provisions) is long-standing and structurally stable; changes arrive as Federal Register amendments to specific ECCNs and the Entity List rather than framework overhauls.
- Live 2026 context: BIS enforcement posture on technology controls remains aggressive (semiconductor/computing controls dominate headlines); encryption-specific enforcement continues at a steady background level. The 2024–2025 semiconductor control expansions did not fundamentally alter the ENC encryption-software pathway, but teams shipping AI-accelerator-adjacent software should confirm whether computing-control ECCNs (3A090/4A090 family) attach to their product in addition to encryption classification.
- Practitioner note: the § 742.15(b) public-source-code notification is a one-time email to BIS — the cheapest compliance step in export control and the most commonly skipped.
Related certifications (Software flagship/license)
- CISSP (software-cert-010): Legal/Regulatory/Compliance domain tests export-control concepts including EAR encryption provisions at a conceptual level. The deep operational competence (ECCN classification, ENC reporting) is carried by trade-compliance specialists, not engineer credentials.
Honest flags
- Penalty figures are inflation-adjusted and move; verify current maxima in the statute/regulation before quoting in a compliance document. The "steady background level" of encryption enforcement is a practitioner characterization, not a BIS-published statistic.
Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.