§ 734.19 Transfer of access information and export, reexport, and transfer (in-country) of software keys.

(a) To the extent an authorization would be required to transfer “technology” or “software,” a comparable authorization is required to transfer “access information” if done with “knowledge” that such transfer would result in the release of such “technology” or “software” without a required authorization.

For purposes of this section, a release of “software” includes source code and object code.

(b) Software keys, also called software license keys, that allow users the ability to use the “software” or hardware, or software keys that renew existing “software” or hardware use licenses, are classified and controlled under the same ECCNs on the CCL as the corresponding “software” or hardware to which they provide access. If authorization is required for the export, reexport, or transfer (in-country) of the “software” or hardware, the same level of authorization is required for the software key. If authorization is obtained for the export, reexport, or transfer (in-country) of the “software” or hardware, that authorization also applies to the corresponding software license key. If no authorization was required for the initial export of the “software” or hardware and the associated software key, but a license requirement is later imposed on the “software” or hardware, (e.g., a license requirement is imposed because the end user becomes listed on the Entity List in supplement no. 4 to part 744), then subsequent exports, reexports, or transfers (in-country) of both the “software” and hardware, and the associated software license key will be subject to the new license requirement.

This paragraph does not apply to keys that unlock dormant functionality in an item. However, in some cases, changes to, or the addition of, features may impact the classification of the item.