Import and export of commercial encryption products in China
Control lists

Import and export of commercial encryption products in China

While some details are still amiss, businesses engaging in import or export of commercial encryption products in China should carefully review relevant lists.

Changes for commercial encryption products in China

Companies that import or export commercial encryption products in China need to obtain the appropriate licenses in accordance with China’s Encryption Announcement of December 2, 2020. This announcement was released a day after the new Export Control Law in China took effect on December 1, 2020 and 11 months after China’s landmark Encryption Law came into force on January 1, 2020.

This development further reflects China’s continued efforts to tighten controls on imports and exports with a potential impact on national security and public interests and to consolidate previously separate regimes under a more unified regulatory framework.

As part of the Encryption Announcement, three official documents were released jointly by China’s Ministry of Commerce (MOFCOM), State Cryptography Agency (SCA), and the General Administration of Customs (GAC):

  • List of Commercial Encryption Subject to Import Licensing Requirement (“Import List”)
  • List of Commercial Encryption Subject to Export Control (“Export List”)
  • Procedural Rules on [Applications for] Licenses for the Import and Export of Commercial Encryption (“Procedural Rules”)

More detailed product lists or exact processes are currently not available. But businesses, in particular multinational companies, that engage in import or export in China should carefully review and identify items that may be subject to latest import licensing and/or export control requirements. 

You can find more information on the scope of the new Export Control law in China here and please read on in this article for some explanatory notes, lists of goods categories, and exemptions under the Encryption Announcement.


Secure and efficient export controls with AEB

Export Controls from AEB automatically checks all your relevant transactions for license requirements and embargo restrictions worldwide. Ad hoc, fully automated, or company-specific. In the cloud or integrated in your ERP.

Explanatory notes for commercial encryption products in China

Explanatory notes: Commercial Encryption Export List

The Export List represents the first list of controlled items since China’s new Export Control Law took effect. Commercial encryption items listed in this Export List are designated as “dual-use items and technologies”. The previous legal framework included general license requirements without a detailed export control list.

Explanatory notes: Commercial Encryption Import List

The Import List details the types of commercial encryption that may be subject to import licensing requirements under China’s Encryption Law. It supersedes and replaces previous versions of applicable catalogues. Commercial encryption items listed in this Import List are designated as “dual-use items and technologies”.

Explanatory notes: Commercial Encryption Procedural Rules

Changes under the Procedural Rules include shifts in responsible administrations in China:

  • Before the new Export Control Law was in force, the import and export of encryption items in China were administered by the SCA. Importers and exporters of encryption items were required to apply for relevant licenses directly with the SCA or its local counterparts on provincial, regional, or municipal level.
  • Since January 1, 2021, MOFCOM is the central authority to review and issue import and export licenses for dual-use items and technologies for the import and export of commercial encryption items as listed in the Export List and Import List. However, MOFCOM may consult with SCA and GAC accordingly.
  • Importers and exporters of the commercial encryption products controlled under the Import List and Export List must submit license applications to MOFCOM (via its provincial branches). If the application is approved, MOFCOM will issue the appropriate license, which then needs to be presented to GAC as part of the applicable customs procedures.

It is to note that a “mass-market” exception is also included under the Encryption Announcement and the Export Control Law. But there is no exact definition included which items qualify for such exception. You can find some guidance under question 87 in SCA’s encryption Q&A, which details among other things that:

  • Article 28 of the "Encryption Law" stipulates that the commercial encryption used in mass consumer products shall not be subject to import licensing and export control systems.
  • Commercial encryptions used by mass consumer products are not subject to import licensing and export control systems, which can minimize the impact on trade. This is not only a common practice in the international community, but also in line with the country's existing commercial encryption import and export management practices.

Commercial encryption products under the Export List

Hardware, software, and technology related to the following items are controlled under China’s Export List:

  1. Security chips
  2. Cipher/crypto machines (cipher/crypto cards)
  3. Encrypted VPN devices
  4. Products for cryptographic key management
  5. Security devices for special cryptographic purposes
  6. Quantum cryptographic devices
  7. Devices used to analyze encryption technologies, products, or systems
  8. Items specifically designed to develop or manufacture products as detailed in 1) to 7)
  9. Items specifically designed to measure, test, evaluate, and examine products listed in 1) to 7)

Commercial encryption products under the Import List

Four types of commercial encryption products are controlled under China’s Import List:

  1. Encrypted phones
  2. Encrypted fax machines
  3. Cipher/crypto machines (including cipher/crypto cards)
  4. Encryption VPN devices

Play it safe with AEB: License Management

The lawful use of licenses forms a key component of global trade compliance. This includes application, decrement reporting, and working with relevant authorities. Automate and do it right.