BIS Issues Formal ICTS Program Final Rule

This blog post was drafted with assistance from Sean C. Church, Paralegal.

On December 5, 2024, the U.S. Department of Commerce’s Bureau of Industry and Security (BIS or the Agency) issued a Final Rule formalizing the procedures the Agency will follow when reviewing transactions involving information and communications technology and services (ICTS) designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary that may pose a risk to the United States or U.S. persons. This Final Rule was published pursuant to Executive Order 13873 (“Executive Order on Securing the Information and Communications Technology and Services Supply Chain”).

This Final Rule is being published three years after BIS published the corresponding Interim Final Rule (IFR) on January 19, 2021. This Final Rule addresses feedback from the public on a number of issues, including the scope, the timeline of investigations, the procedures to make determinations, and the role of interagency partners. Notably, despite numerous comments received on the subject, BIS declined to establish a published procedure for determining what constitutes a ​“foreign adversary” for the purposes of ICTS transactions, and instead deferred to the general definitions provided in EO 13873.

The Agency did make a number of clarifying and organizational changes to the Final Rule from the 2021 IFR, including:

  • Removing the requirement that a party must collect sensitive personal data from more than one million U.S. persons to be included in the scope of certain aspects of the regulations;
  • Clarifying the software, hardware, and other products and services that may be considered for review;
  • Clarifying who are considered parties to an ICTS Transaction;
  • Consolidating the list of technologies within the scope of the rule; and
  • Outlining the sources of information the Secretary of Commerce may consider when formulating Initial and Final Determinations.

This rule will come into effect on February 3, 2025. If you have any questions regarding these ICTS developments, please contact our sanctions and export team.