Written and maintained by CASRAI Editorial Board
Last updated
License Exception ENC is the provision in 15 CFR 740.17 of the Export Administration Regulations (EAR) that lets exporters ship certain encryption commodities, software and components without an individual export license. Which tier of ENC an item falls in decides whether the exporter must first file a classification request with the Bureau of Industry and Security (BIS), wait 30 days, or simply file a report afterwards. This guide describes that structure as it appears in the regulation, with a tier table and the reporting deadlines. It is a description of the rule, not compliance advice; classification decisions belong with your export control officer or counsel. Facts below are as described on the official pages on 2026-10-29.
What it is and who runs it
License Exception ENC is an authorization inside the EAR, administered by BIS, for exports, reexports and in-country transfers of items controlled for encryption reasons. It sits in Part 740 (License Exceptions) as section 740.17. BIS publishes the rule in the Code of Federal Regulations and explains it on its encryption controls pages. Classification requests and reports for encryption items are reviewed by BIS together with the ENC Encryption Request Coordinator at Ft. Meade, Maryland, according to the regulation text.
An item that relies on ENC remains subject to the EAR until the applicable classification or self-classification requirements in the section are fulfilled. For items classified under the “mass market” note (Note 3 to Category 5, Part 2 of the Commerce Control List), the regulation states that the result is ECCN 5A992 or 5D992, removed from “EI” and “NS” controls. For background on how items receive an ECCN in the first place, see our ECCN lookup guide for research equipment and the dictionary entry for ECCN.
ENC tiers at a glance
The section sorts items into four tiers. The table summarises what the text of 740.17 says for each; the paragraph references are the ones to cite internally.
| Tier | What it covers (summary) | Classification request first? | Reporting |
|---|---|---|---|
| 740.17(a) | Specified end users and end uses: private sector end users headquartered in a Supplement No. 3 country for internal development or production of new products; U.S. subsidiaries; certain foreign-made products incorporating previously classified U.S. encryption items | No | No classification request, self-classification report or sales report |
| 740.17(b)(1) | Items self-classified under ECCN 5A002.a, z.1 or 5B002, and related software under 5D002, that are not described in (b)(2) or (b)(3) | No (self-classify) | Self-classification report under 740.17(e)(3) |
| 740.17(b)(2) | Specified items such as certain network infrastructure, non-publicly-available encryption source code, items customised for government end users, quantum cryptography, network penetration tools, cryptanalytic items and 5E002 technology | Yes. Authorised 30 days after submission, and immediately after submission for many items to Supplement No. 3 destinations | Semiannual sales reports under 740.17(e)(1) |
| 740.17(b)(3) | Specified items including non-“mass market” components, toolsets and toolkits, “non-standard cryptography” and advanced network vulnerability analysis and digital forensics tools, for any end user | Yes. Same 30-day structure | Semiannual sales reports apply to (b)(3)(iii); other (b)(3) items are excluded from that report |
Eligibility (summary, with the official source)
Tier (a): no classification request or reporting
Paragraph (a) authorises exports, reexports and transfers to the end users and end uses in (a)(1) through (a)(3) without a classification request, self-classification report or sales report. It covers private sector end users, wherever located, headquartered in a country listed in Supplement No. 3 to Part 740 for the internal development or production of new products; certain related-party transfers of non-U.S.-origin items among subsidiaries of the same Supplement No. 3 parent; and U.S. subsidiaries wherever located. The regulation defines a “private sector end user” as an individual not acting on behalf of any foreign government, or a commercial firm not wholly owned or controlled by, or acting for, a foreign government.
Tiers (b)(1) to (b)(3): the item decides
Beyond tier (a), eligibility turns on what the item does. Paragraph (b)(1) authorises self-classified items under ECCN 5A002.a, z.1 or 5B002 and related 5D002 software, except items described in (b)(2) or (b)(3), subject to the self-classification report. Paragraphs (b)(2) and (b)(3) list the functions that require a classification request first. An item that performs the functions of a (b)(2) item cannot use (b)(3).
What ENC does not authorise
The regulation states that ENC does not authorise export or reexport to, transfer within, or services in any country in Country Groups E:1 or E:2, or release of source code or technology to a national of those countries.
What it funds or requires
ENC funds nothing; it removes the need for an individual license in exchange for process obligations. The obligations are: a classification request for (b)(2) and (b)(3) items, a self-classification report for (b)(1) items, and the periodic reports in paragraph (e). Exports under (b)(1), (b)(3)(i), (ii) or (iv) are excluded from the sales reporting, but the regulation reminds exporters of the recordkeeping rules in Part 762 of the EAR. See also the software export controls entry for how the EAR treats software.
Application or compliance steps
- Classify the item. Work out whether the item is controlled in Category 5, Part 2 and which paragraph of 740.17 it matches. Our export control classification guide explains the general method.
- If (b)(2) or (b)(3) applies, submit a classification request. Under 740.17(d) this goes through BIS’s SNAP-R system and includes the technical questionnaire in Supplement No. 6 to Part 742. BIS returns a decision on the request.
- Observe the 30-day period. If BIS has not, within 30 days of registration of a complete request in SNAP-R, said the item is not authorised for ENC, the exporter may proceed under ENC. Time the request spends on “hold without action” status does not count toward the 30 days.
- If (b)(1) applies, self-classify and report. No request is needed, but the annual self-classification report in 740.17(e)(3) is.
- File the reports on time. See the deadlines below.
- Answer BIS follow-ups. BIS may ask for additional technical information at any time. If it is not supplied within 14 days of the request, BIS may return the classification request without action or suspend or revoke ENC eligibility for that item; BIS may grant up to 14 additional days on request.
Reporting deadlines
- Semiannual sales reports (paragraph (e)(1)): exports from January 1 to June 30 are due no later than August 1 of that year; exports from July 1 to December 31 are due no later than February 1 the following year. Reporting applies to exports to destinations other than Australia, Canada or the United Kingdom, and to reexports from those three, for items under (b)(2) and (b)(3)(iii).
- Self-classification report (paragraph (e)(3)): for items exported or reexported in a calendar year, it must be received by BIS and the ENC Encryption Request Coordinator no later than February 1 the following year.
- Key length upgrades (paragraph (e)(2)): a product already classified under (b)(2) or (b)(3) that is modified only to upgrade the key length must be reported before the upgraded product is exported.
- Exclusions: the regulation lists items and transactions exempt from the sales reporting, including encryption items with a symmetric key length not exceeding 64 bits and items exported via free and anonymous download.
Typical timeline phases
For a (b)(2) or (b)(3) product the phases run in this order: classification of the item; assembly of the technical questionnaire; submission in SNAP-R; the 30-day period (paused during any “hold without action” status, and interrupted if BIS requests more information); authorised exports under ENC; then the periodic reports on the next August 1 or February 1. For a (b)(1) product there is no waiting phase: self-classification, export, then the self-classification report by the following February 1.
Common mistakes
- Assuming a patch needs a new request. It usually does not: the regulation says a new classification request is required if the cryptographic functionality (for example, algorithms) or other technical characteristics affecting ENC eligibility change, but not for bundling, patches, upgrades or releases, name changes, or updates limited to encryption software components where the product is otherwise unchanged.
- Skipping a report because nothing changed. For the (b)(1) self-classification report, each product is listed only once, but if no new products became eligible during the calendar year the regulation still requires an email stating that nothing has changed since the previous report.
- Treating tier (a) as a general academic exemption. Paragraph (a) is written for private sector end users, U.S. subsidiaries and related-party uses. The text does not mention universities or research collaborators, so an institution relying on it should confirm that its transaction fits the paragraph as written.
- Forgetting the Country Group E:1 and E:2 exclusion. ENC does not reach those destinations or their nationals for source code and technology releases.
- Overlooking the government end user distinction in (b)(2). Some (b)(2) authorisations, such as those for encryption source code and for cryptanalytic items, are limited to non-government end users, as the regulation describes.
Related programs
| Related rule or concept | How it relates to ENC | Read more |
|---|---|---|
| “Mass market” note (Note 3 to Category 5, Part 2) | Items meeting the note are classified under ECCN 5A992 or 5D992 after self-classification or classification by BIS, as 740.17(b) describes | ECCN lookup guide |
| Export Control Classification Number | The classification that determines which ENC paragraph is relevant | ECCN |
| Software export controls | How the EAR treats software and source code, including encryption software | Software export controls |
| University export compliance | Institutional context for EAR and ITAR obligations in research | ITAR and EAR compliance in university research |
FAQ
Does License Exception ENC always require a classification request?
No. Tier (a) needs no classification request or reporting, and tier (b)(1) relies on self-classification plus a self-classification report. Only the items in (b)(2) and (b)(3) require a request.
How long does the BIS review take?
The regulation sets a 30-day period from registration of a complete request in SNAP-R, after which the exporter may proceed under ENC if BIS has not said the item is not authorised. Time on “hold without action” status does not count.
When are the ENC reports due?
Semiannual sales reports are due August 1 for January to June exports and February 1 for July to December exports. The self-classification report is due February 1 of the following year.
Does a software update require a new classification?
Not by itself. A new request is needed when cryptographic functionality or other characteristics affecting ENC eligibility change; patches, upgrades, releases and name changes do not trigger one on their own.
Sources
- Electronic Code of Federal Regulations, 15 CFR 740.17, License Exception Encryption Commodities, Software, and Technology (ENC): ecfr.gov/current/title-15/part-740/section-740.17, checked 2026-10-29.
- Bureau of Industry and Security, License Exception ENC 740.17(a): bis.gov encryption controls, 740.17(a), checked 2026-10-29.
- Bureau of Industry and Security, License Exception ENC 740.17(b)(2): bis.gov encryption controls, 740.17(b)(2), checked 2026-10-29.
