Just in case you were starting to get comfortable with last year’s massive raft of regulations on the advanced computing, supercomputer, and semiconductor industries in China, the US Department of Commerce, Bureau of Industry and Security (BIS) has dropped another 400-something pages of export controls. The new package of regulations introduced on October 17, 2023, expands BIS’s China-related regulations even further and closes loopholes left by the 2022 controls.

The new controls consist of two interim final rules – found here and here – and one final rule adding 13 Chinese parties to the Entity List. One of the interim final rules focuses on advanced computing controls and related end use restrictions, so we’ll call that the Advanced Computing Rule. The other targets semiconductor manufacturing equipment, so let’s call it the Semicon Manufacturing Rule. BIS has issued its own summary of the new regulations in a press release. The two interim final rules will come into effect on November 17, 2023. You have until December 18, 2023, to submit comments on the federal rulemaking portal using reference numbers BIS-2022-0025 and BIS-2023-0016. The Entity List additions are effective as of October 17, 2023.

The new rules continue the escalation of US-China tensions and the Biden Administration’s ongoing attempts to limit Chinese access to advanced chipmaking technology. A year ago, on October 7, 2022, BIS introduced regulations targeting China’s advanced computing, supercomputer, and semiconductor industries. You can read our analysis of the October 2022 rules here. Political pressure for even stricter regulations has built steadily over the 12 months, particularly after Chinese smartphone giant Huawei reportedly successfully produced a phone which incorporates an advanced 7-nanometer processor, raising questions as to whether the October 2022 regulations had been skirted. The new export controls introduced this week are meant to bolster the October 2022 regulations by expanding the items controlled and by closing off perceived loopholes that allowed China to avoid US export controls.

Luckily, we are here to help you digest and understand these new rules by providing a Top 10 list of what the heck the new rules do. We wrap up with a few concluding thoughts.

Top 10 List: What Do These New Rules Do?

1. More Chips Controlled

First off – BIS added some chips to the controlled bucket (adjusting the parameters under ECCN 3A090), added little subparagraph “.z’s” to a number of other ECCNs to make sure we don’t miss powerful chips that fall under those ECCNs, and shuffled the semiconductor equipment from 3B090 to 3B001 and 3B002 in ways that will perplex all but the semiconductor equipment engineer.

Notably, BIS has restructured and added a performance density parameter to ECCN 3A090, seeking to “prevent[] the workaround of simply purchasing a larger number of smaller diameter AI chips, which, if combined, would be equally powerful as the restricted chips.” According to multiple public reports, this is likely targeted at Nvidia’s A800 and H800 chips.

2. More Countries Controlled and Controls based on Headquarters and Ownership

Second – you now need to get a license for this expanded high-powered chip/semicon equipment list for more countries than just China, Hong Kong, and Macau:

A) You now need a license to export, reexport or transfer controlled semiconductor manufacturing equipment, and related software and technology,  not only to China, Hong Kong, and Macau, but also to all the US arms embargoed countries, some of which were already banned (e.g. Russia and Belarus) and most of which won’t care as they have more serious problems to worry about than chips and semicon equipment: Afghanistan, Belarus, Burma, Cambodia, Central African Republic, Congo, Cuba, Cyprus, Eritrea, Haiti, Iran, Iraq, North Korea, Lebanon, Libya, Russia, Somalia, South Sudan, Syria, Venezuela and Zimbabwe.  

B) You now also need a license to export, reexport, or transfer controlled advanced computing items, including many high-powered logic chips, and related software and technology, to country groups D:1 and D:4 (excluding countries also in Country Groups A:5 and A:6), as well as D:5.   Who else are they, you ask? In addition to the arms embargoed countries above, they are: Armenia, Azerbaijan, Bahrain, Egypt, Georgia, Israel, Jordan, Kazakhstan, Kuwait, Kyrgyzstan, Laos, Moldova, Mongolia, Oman, Pakistan, Qatar, Saudi Arabia, Tajikistan, Turkmenistan, UAE, Uzbekistan, Vietnam, and Yemen. OK, for those of you who have cloud computing data centers in some of these countries, do not freak out. There are ways out.

C) But here is the kicker, for all the OTHER countries of the world – the Rest of World minus (we hope) the United States – you need a license to export, reexport, and transfer the high-powered chips and related 3E001 technology (under some circumstances) “for an entity that is headquartered in, or whose ultimate parent company is headquartered in, either Macau or a destination specified in Country Group D:5” -- the arms embargoed countries.  The worldwide restriction appears in a reorganized 744.23. So, when you export a high-powered chip to Ireland, you need to stop and research the customer. Are they headquartered in China or Cyprus? Is their ultimate parent company in China or Venezuela? What is the ultimate parent company anyway? The rule does not define “headquartered” or “ultimate parent company,” but it does ask for comments.

3. Help for Our Friends

BIS has issued two Temporary General Licenses (TGLs) — one in the Semicon Manufacturing Rule and one in the Advanced Computing Rule — that allow our friends in allied countries to keep exporting some lower-controlled items until the end of 2025:

A) The Semicon Manufacturing TGL is directed toward the end use restriction against exports for developing and producing semiconductor manufacturing equipment, first introduced in the October 2022 controls. Don’t forget – this prohibition now applies not just to China and Macau, but to all embargoed (aka D:5) countries. And just to keep things interesting, the whole thing has been renumbered under Section 744.23(a)(4)! But, back to the TGL – it allows you to export, re-export, or transfer (in-country) items which are only controlled for anti-terrorism reasons IF the recipient is developing or producing semiconductor manufacturing equipment for a company headquartered in Country Groups A:5 or A:6.

B) The Advanced Computing TGL deals with the licensing requirements for high-powered chips that we just talked about (again, now applicable to all D:1, D:4, and D:5 countries). The TGL’s end use scope is far from clear, but after several reads, we think that the TGL is available for recipients located in the proscribed destinations if:

i) neither the recipient nor the recipient’s ultimate parent company is headquartered in Macau or in an embargoed/D:5 country;

ii) the ultimate end use takes place outside of country groups D:1, D:4, and D:5 (except destinations also in groups A:5 and A:6); AND

iii) the ultimate end use will not be by entities headquartered in or whose ultimate parent companies are headquartered in Macau or in country group D:5.

4. Another License Exception, Because Why Not?

A new license exception (Notified Advance Computing or NAC) will allow you to export lower-end controlled chips – NOT the ECCN 3A090.a chips that are designed or marketed for use in data centers. To make things more fun, there is a two-tiered set of eligibility requirements in NAC. First, the requirements for sending the items a D:1 or D:4 country, or transferring them within Macau or a D:5 country:

• An export or re-export must be made pursuant to a written purchase order unless specifically excepted (such as exports and re-exports of commercial samples);
• NAC cannot overcome a license requirement that comes from an end use prohibition or embargo (EXCEPT the new “worldwide” license requirements in Section 744.23(a)(3)); and
• No exports, re-exports, or transfers can be made for/to a military end use/r.

If you are exporting or re-exporting to Macau or to a D:5 country, all of these requirements above must be met, but you also must:

• Notify BIS at least 25 days before any export or re-export to Macau or a D:5 country; and
• Obtain notification from BIS that License Exception NAC can in fact be used.

You read that right – for exports and re-exports to Macau and D:5 countries, NAC comes with a mandatory SNAP-R filing at least 25 days prior to export or re-export. Even after meeting all other requirements, BIS gets to decide whether you can use this license exception, which we see a little like a game of duck, duck, goose. “You yes, you yes, but no NAC for you!!!” What will be the criteria? And will an agency that has literally been taking years to decide whether to license items to China really be able to meet a 25-day deadline (presumably without interagency review)? We will have to find out. While the rule states that BIS will provide further information on the notification process in policy guidance, it remains to be seen whether the guidance sheds any light.

5. Restrictions on US Persons’ Activities Updated – Good News and Bad

The October 2022 controls put licensing requirements on US persons’ activities that support the development or production of ICs in China.

The good news: BIS condensed the long-winded list of nine restricted activities into just three (and also simplified the rules in a few more ways – see the two items following this one). Without going into painful detail here, the rebranded restricted activities still include shipping, transmitting, transferring, and servicing items not subject to the EAR: (A) for the development or production of advanced-node ICs; (B) for the development or production of advanced-node ICs using Category 3 items; and (C) that are controlled semiconducting manufacturing equipment.

The bad news: the US person restrictions introduced last year were limited to support of activities in China or Macau. The new rules expand the scope to Macau and all D:5 (i.e., embargoed) countries. BIS giveth, and BIS taketh away.

6. Back-End Steps Explicitly Removed

After much pondering last year, BIS finally released a FAQ clarifying that fabrication does not include back-end semiconductor manufacturing. To further alleviate any concerns, the new rule now includes a specific carve-out stating that semiconductor “production” (used to replace “fabrication” in the prior rule – see #7 below) does not include the back-end steps such as assembly, test, or packaging that do not alter the integrated circuit technology level. This back-end exclusion applies to the semicon manufacturing end use rule and to the US person restrictions. Recognizing that there may still be some uncertainty regarding this line, BIS states that one may submit an advisory opinion request to BIS to request clarification.

7. Just When We Thought We Figured Out the Meaning of Fabrication Facility, BIS Changed It!

After sleepless nights wondering what BIS meant when it referred to a “fabrication facility” in the October 7 rule, until BIS issued FAQs explaining what it meant, BIS decided fabrication facility could be read too narrowly to include only wafer production plants. To address these concerns, BIS replaced “that fabricates” with “where “production” … occurs” and removed the phrase “semiconductor fabrication” from the prior rule. In making this change, BIS attempted to more accurately capture “facilities where important late-stage product engineering or early-stage manufacturing steps (among others) may occur,” while noting that the new rule does not capture facilities where only “development” activities occur. Again, this change affects the semicon manufacturing end use rule and the restricted US person activities.

8. Reduced End-Use Controls on Exports for Front-End Semiconductor Manufacturing

The retooled semicon manufacturing end use rule prohibits the export, reexport, or transfer (in-country) of any item subject to the EAR that is on the Commerce Control List where there is knowledge that the item is destined to Macau or a country in Country Group D:5, and is to be used for the development or production of front-end integrated circuit “production” equipment (as well as components, assemblies, and accessories therefor) specified in ECCNs 3B001 (except 3B001.g, .h, and .j), 3B002, 3B611, 3B991 (except 3B991.b.2), or 3B992. This reduces the previous end-use controls in two ways: (I) last year’s controls included EAR99 items subject to the EAR, where now only items on the CCL have this end use control; (II) the scope is limited to front-end IC production, meaning equipment used in the production stages from a blank wafer or substrate to a completed wafer or substrate (i.e., the integrated circuits are processed but they are still on the wafer or substrate) -- this leads back to the back-end exclusion discussed already.

9. Addition of Five New KYC Red Flags

The new rule adds five new red flags to assist with customer due diligence, namely:

• A customer website that advertised the development or production of advanced-node integrated circuits (ICs) prior to October 7, 2022 (query how affected parties would gain such knowledge about prior website postings);
• The customer represents that the requested items are not intended for development or production of such ICs, despite the items typically being used for that purpose;
• The customer is known to develop or produce items for companies involved in supercomputers that are in Macau or a country in Country Group D:5;
• The exporter has knowledge that the customer intends to develop or produce restricted supercomputers; or
• The exporter has knowledge that it will be producing or developing certain ICs, computers, electronic assemblies or components at an advanced node IC facility in Macau or a Country Group D:5 country.

10. A Bunch of Scary Commentary 

Possibly recognizing that Halloween is fast approaching, BIS included broad scary interpretations of its 2022 and 2023 rules in the super long preambles. BIS claims that knowledge that an item “is destined for (either in its original form or as subsequently incorporated into a foreign-made product) a prohibited activity” triggers the Section 744.23 end use licensing requirements, thereby arguably wiping off the map foreign product de minimis rules in the semiconductor and advanced computing spaces (See Topics 45 and 46 of the Semicon Manufacturing Rule). BIS also says knowledge that any of your items will be used in development or production of the “advanced-node integrated circuits” means that you need a license to export “100% of the item” unless you can determine which items will not be used in advanced-node IC development or production (Topic 47). So go forth and prove the negative! How do you do this? Not sure – we just know that obtaining an end user certificate is not enough, because the exporter, re-exporter, or transferor also “must evaluate all the information that it obtains during the normal course of business to determine if it has ‘knowledge.’” (Topic 49).

Finally, when faced with the possibility that even its extraterritorial jurisdictional reach might not apply to all non-US person conduct, BIS warned that foreign persons could be “viewed as engaging in activities contrary to US national security or foreign policy interests” and placed on the Entity List (Topic 44). Speaking of which...

Bonus: Good Old-Fashioned Entity List Designations

BIS also found time to simultaneously add 13Chinese entities to the Entity List. These entities are involved in developing advanced computing ICs which may be used to “provide artificial intelligence capabilities to further development of weapons of mass destruction, advanced weapons systems, and high-tech surveillance applications that create national security concerns” and, as such, were found to be acting contrary to US interests. The newly added entities will have a footnote 4 designation on the Entity List, which means they will be subject to the Entity List Foreign Direct Product Rule (FDPR). We have discussed this FDPR on our alert from October 2022. In a nutshell: non-US chips that are direct products or made using equipment that are direct products of technology or software listed under 18 ECCNs – mostly related to semiconductor manufacturing, but also spanning information security, telecommunications, and other areas – cannot be exported to footnote 4 entities without a license.

Conclusions

BIS has substantially expanded the scope of its chip and semiconductor export controls vis-a-vis the US embargoed countries, leaving backdoors for US allies and a license exception that we suspect BIS will regret in the near future after it has to administer it.

We expect the new rules will further impact the supply chain headed in the direction of China’s chip and semiconductor manufacturing industries, making it even more difficult for China to source from the United States, or US allies. The question that remains is whether this effort will be effective at protecting US national security or will it instead provide China an invaluable incentive to step up its efforts to cut the United States out of its supply chain and hang up a “US-chip-free” sign.