Commerce Significantly Expands Controls on Advanced Computing and Semiconductor Manufacturing Items

The US government recently announced another package of export controls on semiconductor manufacturing equipment designed to further curb China’s ability to produce advanced-node semiconductors that can be used in artificial intelligence and advanced computing applications.

On December 2, 2024, the US Department of Commerce’s Bureau of Industry and Security (BIS) announced further significant updates to the Export Administration Regulations (EAR) through two final rules published in the Federal Register:

• The first final rule adds 140 entities to the Entity List under Supplement No. 4 to Part 744 of the EAR; (2) removes three entities from the Validated End-User (VEU) Program; and (3) designates nine of the newly added entities and seven modified entries with entity-specific restrictions involving foreign-produced items.
• The second (interim) final rule (1) introduces new controls on 24 types of semiconductor manufacturing equipment (SME) and three related types of software tools for developing or producing semiconductors; (2) revises existing regulations to control high-bandwidth memory (HBM); (3) expands the Foreign Direct Product Rules (FDPR) to restrict the production of advanced-node integrated circuits (ICs) by introducing a new set of SME FDPR and a new Entity List FDPR for parties with a Footnote 5 (FN5) designation, as well as revising the related de minimis threshold; (4) adds eight new red flag indicators designed to address some of the unique situations involved in the semiconductor industry in China; and (5) clarifies existing controls on software keys used to enable software tools such as electronic computer aided design and technology computer aided design.

These regulatory updates build on earlier efforts by BIS in October 2022, October 2023, and April 2024 to slow China’s development of advanced artificial intelligence (AI) and impair its development of an indigenous semiconductor ecosystem. As with the prior restrictions, BIS includes a number of exceptions or exclusions to the regulation, offering some time to the regulated industry to adjust to the changes.

TIMELINES FOR COMPLIANCE

The new final rules, including the additional red flags and clarification of controls on software keys, are generally effective December 2, 2024 (the date the rules were posted for public inspection in the Federal Register). However, changes related to Entity List license requirements and other Entity List–related requirements linked to FN5 designations must be complied with by December 31, 2024; and changes concerning Export Control Classification Number (ECCN) revisions, HBM controls, FN5 and FDPR, and dynamic random-access memory (DRAM) definition updates also have a compliance date of December 31, 2024.

Additionally, as final rules, these regulations are subject to potential review and action under the Congressional Review Act, which Speaker Mike Johnson has indicated will be utilized to scrutinize various regulations issued by the Biden-Harris administration over the past several months.

SUMMARY OF ENTITY LIST CHANGES

Additions to the Entity List

BIS added 140 entities to the Entity List, including entities in China, Japan, South Korea, and Singapore. These additions target organizations involved in the development and production of advanced-node ICs, contributions to semiconductor manufacturing items, and support for China’s Military-Civil Fusion (MCF) Development Strategy. A license will be required for all items subject to the EAR, and for the majority of these entities, a license application review policy of a presumption of denial will apply.

Several of the newly named entities are cited by BIS for aiding in the development or production of indigenous ICs to support the Chinese government’s military modernization efforts. Of these, nine entities have been assigned FN5 designations, imposing stricter restrictions on foreign-produced items, including those related to advanced-node IC production. A license will be required for all these entities and the application review policy is a presumption of denial, except certain FN5 entities receive case-by-case review for applications involving items not described in ECCN 3B001.a.4, .c, .d, f.1.b.2, .k to .p; 3B002.c, 3B993, or 3B994.

Modifications of Existing Entries

In addition to the Entity List additions, BIS modified 14 existing entries on the Entity List. The modifications include the application of FN5 designations, updates to the addresses associated with some entries, and revisions to license application review policies to further restrict the acquisition of foreign-produced items that support advanced-node IC production.

Removal from the Validated End-User Program

BIS removed three entities from the Validated End-User (VEU) program, which allows exports, reexports, and in-country transfers of eligible items subject to the EAR under a general VEU authorization, rather than a specific license. The removals were based on either direct requests by the entities themselves or by their inability to continue meeting the program’s requirements. These entities no longer have access to the streamlined licensing benefits previously provided under the VEU program.

UPDATES RELATED TO ADVANCED COMPUTING ITEMS, SUPERCOMPUTERS, AND SEMICONDUCTOR MANUFACTURING EQUIPMENT

According to BIS, because the development of an “independent and controllable” semiconductor industry is a critical factor in China’s ability to achieve its goal of military-civil fusion, the Export Control Reform Act of 2018 (ECRA) (codified, as amended, at 50 USC 4801–4852) authorizes BIS to implement controls to prevent China’s possession of sensitive items and is necessary to advance US national security and foreign policy interests. In line with the Biden-Harris administration’s “small yard, high fence” strategy of implementing strict restrictions on targeted technologies while maintaining normal economic exchange in other areas, this interim final rule (IFR) implements several new regulatory measures.

Establishing New FDPR

The FDPR in §734.9 of the EAR have been expanded under the IFR to target additional specific areas of concern.

First, the new SME FDPR focuses on specified foreign-produced SME and related items specified in ECCN 3B001.a.4, c, d, f.1, f.5, k ton, p.2, p.4, r, or 3B002.c that originate in foreign countries but are produced with US technology, software, or tools, or that contain essential components such as ICs that could not be produced without US technology, software, or tools. The SME FDP Rule extends jurisdiction if there is “knowledge”—defined to include not only positive knowledge that a circumstance exists, but also an awareness of a high probability of its existence or future occurrence—that the foreign-produced commodity is destined to Macau or a destination in Country Group D:5 (including China).

The second FDPR addresses entities listed with FN5 designations on the Entity List (FN5 FDPR). Again, the rule introduces a new license requirement for certain commodities specified in ECCN 3B001 (except 3B001.a.4, c, d, f.1, f.5, g, h, k to n, p.2, p.4, r), 3B002 (except 3B002.c), 3B903, 3B991 (except 3B991.b.2.a through 3B991.b.2.b), 3B992, 3B993, or 3B994 that originate in foreign countries but are produced with US technology, software, or tools, as well as items that contain essential components such as ICs that could not be produced without US technology, software or tools. Here, the FN5 FDPR extends jurisdiction where the exporter has “knowledge” (including reason to know) that FN5 entities are involved in the transaction.

Commerce provided a table to aid in analyzing the updated FDPR. Below is an excerpt of the table focusing on the SME FDPR and the FN5 FDPR.

Revising Corresponding De Minimis Thresholds

In conjunction with the new SME FDPR and FN5 FDPR, the IFR eliminates any de minimis threshold for US-controlled content in commodities specified under certain ECCNs (3B001.a.4, c, d, f.1, f.5, k to n, p.2, p.4, r, or 3B002.c) if these commodities are incorporated into or contain US-origin ICs from Categories 3, 4, or 5 of the Commerce Control List (CCL) and are destined for Macau or Country Group D:5, unless exempted under the national security or regional stability license requirements in §§ 742.4(a)(4) and 742.6(a)(6), respectively.

Additionally, Section 734.4(a)(9) sets no de minimis threshold for items meeting ECCNs specified in Category 3B (except 3B001.a.4, c, d, f.1, f.5, k to n, p.2, p.4, r, or 3B002.c) of the CCL, when incorporated into or containing US-origin ICs from Categories 3, 4, or 5, and destined for entities designated with FN5 in the Entity List.

New ECCN 3A090.c Controls for HBM and Related License Exception HBM

The IFR introduces a new control under ECCN 3A090.c to target HBM stacks with a memory bandwidth density greater than 2 GB per second per square millimeter. According to BIS, HBM is critical for advanced computing and AI applications, providing the necessary memory capacity and bandwidth to support high-performance logic chips.

The IFR also includes a technical note defining memory bandwidth density and clarifies that certain co-packaged ICs are excluded unless the dominant function is processing. Controls under ECCN 3A090.c apply specifically to stand-alone HBM, while HBM incorporated into higher-level commodities, such as computers or electronic assemblies, falls under other ECCNs like 3A090.a or 3A090.b. Additionally, the IFR reorganizes notes within ECCN 3A090 for clarity, ensuring that the updated controls effectively address the export of advanced memory technologies to destinations of concern.

Relatedly, the IFR also introduces new License Exception HBM under §740.25, allowing authorized exports, reexports, and in-country transfers of some of the new HBM commodities added to ECCN 3A090.c. This exception applies when the transactions involve US or allied-headquartered companies and meet strict conditions, including tracking HBM shipments (encompassing detailed monitoring of shipment locations, quantities, and recipients), direct purchases by designers, and delivery to authorized packaging sites to prevent diversion (by, for example, attempts to reroute or redirect goods to unauthorized parties or locations).

The IFR specifies technical and reporting requirements, such as memory bandwidth density thresholds, written confirmations of proper packaging, and mandatory reporting of discrepancies greater than 1%.

It also establishes detailed recordkeeping and notification obligations, requiring exporters to resolve any red flags or report unresolved discrepancies to BIS within 60 days. The report must include the date of shipment, the quantity shipped and returned, the name of the consignee or designer of the co-packaged commodities, the name and address of the packaging site, the end use of the items, and an explanation of the measures taken or planned to address the red flag.

Additionally, the packaging site must provide written confirmation to the chip producer that a 3A090.c item was packaged and exported, reexported, or transferred (in-country) to the specified designer of the co-packaged commodity. Both this confirmation and the report are classified as “export control documents” and are therefore subject to the recordkeeping requirements outlined in Part 762.

The expanded control on HBM and the related HBM License Exception reflects BIS’s continued commitment to its “catch-and-release” strategy, where stringent restrictions are paired with license exceptions to maintain control while enabling business activities to proceed.

Clarification on Software Keys

The IFR clarifies the controls on software keys (also known as software license keys, which allow users the ability to use software or hardware by providing access to it). Specifically, BIS confirms that software keys are classified and controlled under the same ECCNs on the CCL as the corresponding software or hardware to which they provide access (or in the case of hardware, the software key is classified under the corresponding ECCN in the software group). If authorization is required for the export, reexport, or in-country transfer of the underlying software or hardware, authorization is likewise required for the software key.

Revisions to Advanced-Node IC Definition

The IFR revises the definition of “Advanced-Node Integrated Circuits (Advanced-Node IC)” under §772.1 by updating how DRAM ICs are defined. The previous criterion based on a “production” “technology node” of “18 nanometer half pitch or less” is replaced with two new criteria—DRAM ICs are now classified as advanced-node if they have

• a memory cell area smaller than 0.0019 square micrometers (μm2), or
• a memory density greater than 0.288 gigabits per square millimeter.

This update aims to address loopholes in the previous definition, which allowed advancements in memory density by using more compact memory cell architectures, as well as by stacking DRAM in three dimensions without meeting the definition. As a result of this updated definition, the IFR now also captures HBM and other devices critical to AI and advanced computing.

New License Exception Restricted Fabrication Facility (RFF)

The IFR introduces a second new License Exception, RFF, in §740.26, allowing certain items, including specified SME, to be exported, reexported, or transferred (in-country) to fabrication facilities that are subject to end-user-based license requirements but are not currently producing advanced-node ICs. This exception enables these facilities to obtain legacy equipment for producing non-advanced-node ICs under a framework designed with guardrails, such as pre-shipment notifications, end-use monitoring, annual reporting, and exclusions for items essential to advanced-node IC production. Restrictions also apply to the operation, installation, and repair of certain items already installed at the facility, ensuring alignment with US national security and foreign policy objectives.

Notably, this license exception only applies to entities with an explicit reference in the Entity List to §740.26 and does not override other destination-based or end-use-based license requirements. Items eligible under this exception exclude those specified in certain ECCNs, including 3B001, 3B002, 3B993, 3B994, and related categories. It also prohibits the use of exported items for advanced-node IC production. Notifications must be sent to BIS 45 days before shipment, and additional notifications are required within one business day if knowledge arises that the equipment is being used for advanced-node IC production.

The RFF License Exception also introduces new reporting requirements, including a 30-day post-installation report (that includes the end-user's name and address, description of equipment that was installed, and date of installation) and an annual end-use confirmation report confirming that equipment is not being used for advanced-node IC production. Additionally, records related to License Exception RFF are now classified as “export control records” under the EAR, requiring retention per Part 762 regulations.

Expanded Red Flags for Exporters

To strengthen compliance, BIS added eight new red flags to the “Know Your Customer” guidance (Supplement No. 3 to Part 732). These additions are designed to help exporters, reexporters, and transferors identify and avoid high-risk transactions, ensuring alignment with US export control objectives.

• Red flag 20 identifies a scenario when non-advanced fabrication facilities order equipment designed for “advanced-node IC” production, indicating potential production of advanced-node ICs.
• Red flag 21 discusses a scenario when the ultimate owner or user of ordered items is unclear, such as a distributor without manufacturing operations. This requires due diligence to confirm the end user before proceeding.
• Red flag 22 discusses a scenario in which a foreign government requires a license to export the item, and the nature of the end-user raises questions about whether the exporter, reexporter, or transferer would have been granted a license for the item.
• Red flag 23 identifies a scenario where an exporter, reexporter, or transferor receives a request to service, install, upgrade, or otherwise support an item that was altered after export by a third-party for a more advanced end use that would normally require a license for the destination.
• Red flag 24 identifies a request for servicing, a request for an item or service from a new customer whose senior management or technical leadership is associated with an Entity List entity.
• Red flag 25 concerns a request from a new customer for an item or service that was designed or modified for an existing or former customer that is a FN5 entity for items requiring a license for this entity.
• Red flag 26 concerns export, export from abroad, reexport, or transfer of a foreign-produced item described in Category 3B ECCNs in FN5 or SME FDPR and that contains at least one IC, then there is a red flag that the foreign-produced item meets the product scope of that Entity List FDPR.
• Red flag 27 identifies a scenario where the end user is a facility that is connected to another facility where development or product of advance compute ICs. BIS explains that in this scenario, the two facilities are traded as a single facility under Part 744.23 of the EAR, unless the red flag is resolved through an advisory opinion confirming that the two facilities are considered separate.

TAKEAWAYS

Exporters in the semiconductor industry should consider how their global business operations must adapt to meet these new requirements, including verifying export classifications against the new controls, enhancing screening and other end user diligence processes to confirm whether customers may implicate FN5 controls, communicating new compliance requirements to internal and external stakeholders, and considering whether there is a need to submit license applications to BIS or if one of the two new license exceptions may apply.

Given the complexity of the new rules, companies should take the time to carefully evaluate the impact and ensure they prepare for the potential application of the regulations when the bulk of the requirements under the new rules come into effect at the end of 2024.

Additionally, in light of these December 2024 regulatory updates, China immediately responded by imposing export bans on antimony, gallium, and germanium, which are essential for semiconductor and defense technology manufacturing in the United States. This escalation underscores the importance of strategic planning and supply chain risk mitigation to navigate the evolving geopolitical tension.

Export controls related to Chinese semiconductor manufacturing have historically enjoyed broad bipartisan support from the US government. As such, we do not anticipate a reduction or relaxation of these controls by the upcoming change of administration. In fact, these restrictions may be further tightened given continued national security concerns shared across both political parties. For this reason, exporters should remain vigilant in monitoring the potential impact of these new rules and ensure they have robust export compliance programs in place to navigate the increasingly complex regulatory landscape effectively.