IT consultancy and design services include the development and implementation of software, as well as assistance or advice relating to the development and implementation of software, including the supply and installation of bespoke software. However, the retail sale of off-the-shelf software, falling under United Nations’ Central Product Classification (CPC) Code 63252, is not included in the scope of IT consultancy and design services. IT consultancy and design services are distinct from information technology (IT) support services, which fall under United Nations’ CPC Code 83132. See FAQ 1187 for more information on how OFAC intends to define “IT consultancy and design services.” See FAQ 1186 for a description of prohibited “IT support services” and “cloud-based services” for enterprise management software and design and manufacturing software.
The following are examples of activities that would be prohibited by the IT and Software Services Determination if such services were provided to a company located in the Russian Federation that is not owned or controlled directly or indirectly by a U.S. person (Russian company):
- A U.S. company signs a contract with a Russian company to assist the Russian company in upgrading its IT systems. The U.S. consulting company advises on, among other matters, the kinds of software and hardware needed for the Russian company’s operations and how best to procure such technology.
- A U.S. company works to modify existing web applications to be functional within a Russian company’s internal IT environment.
- A U.S. service provider signs a contract with a Russian company for the design and engineering of bespoke (i.e., custom-made) software that the Russian company uses for internal purposes.
- A U.S. person working at a third country company signs a contract with a Russian company to design the structure of their sales website.
The following are examples of activities that would not be prohibited by the IT and Software Services Determination:
- A U.S. service provider provides a Russian company with internet access.
- A U.S. service provider provides a Russian company with internet services. The delivery of internet services includes, for example, Domain Name Services.
- A U.S. company provides Russian individuals and entities with continued access to cloud-based, free-of-charge, publicly available web applications, such as email, spreadsheet, and document applications.
- A U.S. company provides virtual private network (VPN) services to customers in the Russian Federation.
Some of these activities – such as the sale of off-the-shelf software – may be subject to other Federal laws or requirements of other Federal agencies, including export, reexport, and transfer (in-country) license requirements maintained by the Department of Commerce’s Bureau of Industry and Security under the Export Administration Regulations, 15 CFR parts 730–774 (EAR).