Chinese regulators set import license or export control requirement for certain commercial encryption products

The MOFCOM, together with the SCA and the General Administration of Customs (GAC), are required under the Encryption Law to list out the commercial encryption products that are subject to import license or export control measures. On 2 December 2020, the day following China's Export Control Law took effect, the MOFCOM, the SCA, and GAC jointly released the long-awaited catalogs of commercial encryptions subject to the import license or export control measures as well as administrative procedures for applications, namely (i) the list for import licensing of commercial encryption (import list); (ii) the list for export control of commercial encryption (export list); and (iii) the licensing procedures for import and export of commercial encryptions (licensing procedures), all of which will take effect from 1 January 2021.

Trade control on commercial encryption products

Import license

According to the import list, the following commercial encryptions are subject to import license if its key length or encryption or decryption rate exceeds certain threshold technical requirements:

• Encrypted telephone.
• Encrypted fax machine.
• Cryptographic machine (cryptographic card).
• Encrypted virtual private network (VPN) device.

The import list marks a big step forward to a more streamlined, clear, and practical import licensing regime for commercial encryptions. China's current import licensing regime, which basically leaves the scope of its applicability open-ended by including a "catch-all" provision to cover any products that contain cryptographic technology, leads to huge ambiguities, and uncertainties to applicability scope as well as inconsistencies in local practices of different places. The new import list, which explicitly scales back the categories of commercial encryption products that require an import license to currently only four groups of products as named above, will provide importers with more regulatory certainties and transparency for their import activities.

Export control

For commercial encryptions subject to export control, China seems to follow the approach adopted in the Wassenaar Arrangement, an international control regime overseeing the controls over the transfer of both conventional weapons and sensitive dual-use goods and technologies. Chinese regulators include four categories of commercial encryption products that satisfy certain technical characteristics into the export list. For easy reference, the broad categorization of commercial encryptions subject to export control are set out in the below table:

The export list is China's first list of commercial encryption products subject to export controls. Before that, China does not have a specific list thus generally all exports of commercial encryption products are subject to prior approval of the SCA. Although the export list is seemingly quite broad, it is still a welcoming progress towards a clearer and more predictable export control regime for commercial encryption products.

Procedures for applications

Unlike the current regulatory regime for import license or export control, where the SCA and its local counterparts take leads in reviewing and approving import and export applications, the licensing procedures follow the new administration mechanism established in the Encryption Law (i.e., bringing the MOFCOM into the encryption fields to play a leading position in the administration of import and export of commercial encryption products) and indicate that all import and export applications for commercial encryption products must be filed with the provincial equivalents of the MOFCOM who will then coordinate with the SCA and other relevant authorities for a review and examination.

Importers or exporters passing the review and examination will be granted a dual-use item import or export license issued by the MOFCOM. With the license, importers or exporters can then proceed to commence customs clearance procedures with local customs offices.

Exemption of controls

As an exception to the import license or export control requirements, the Encryption Law provides that mass-market consumer products are exempted from the import license or export control requirements. However, the scope of so-called mass-market consumer products are subject to future clarification. Therefore, such practical issues as whether mobile phones and laptops featuring security chips would be entitled to such blanket exemption still require official interpretations to be made clear.

If you would like to have a full copy of in-house English translation of the import list and the export list or have any questions regarding China's encryption administration regime or import/export controls, please feel free to reach out to the contact persons listed herein.

Authored by Roy Zou, Jessie Xie, Lan Xu, and Carol Shao.