Exporting

Citrix products are subject to the export jurisdiction of the U.S. Department of Commerce Bureau of Industry and Security ("BIS"), which administers the Export Administration Regulations ("EAR"). For additional information regarding export control requirements and restrictions, please consult the EAR.

Please note that this website is intended only for general reference purposes, and should not be construed as legal advice concerning U.S. export control laws and regulations. Depending on the end use and end users, U.S. export laws and regulations may impose restrictions in addition to those specified below.

Terms Used in the Product Export Classifications Matrix

ECCN: The Export Control Classification Number identifies the relevant category and paragraph of the Commerce Control List ("CCL"). The ECCN designates the level of control for an item. Citrix products are typically classified under the following ECCNs:

• 5A002 covers information security hardware "employing digital techniques performing any cryptographic function other than authentication or digital signature" and having the following characteristics:
  • "A 'symmetric algorithm' employing a key length in excess of 56-bits;" or
  • "An 'asymmetric algorithm' where the security of the algorithm is based on any of the following:
    • Factorization of integers in excess of 512 bits (e.g., RSA);
    • Computation of discrete logarithms in a multiplicative group of a finite field of size greater than 512 bits (e.g., Diffie-Hellman over Z/pZ); or
    • Discrete logarithms in a group other than mentioned [above] in excess of 112 bits (e.g., Diffie-Hellman over an elliptic curve)."
• 5A992 covers information security hardware that has encryption functions (e.g., cryptographic, cryptanalytic, or cryptologic) but otherwise does not meet the characteristics of 5A002.
• 5D002(c.1) covers information security software "having the characteristics, or performing or simulating the functions of" hardware that is classified as 5A002.
• 5D992(b) covers information security software that has encryption functions (e.g., cryptographic, cryptanalytic, or cryptologic) but otherwise does not meet the characteristics of 5D002.
• EAR 99 covers items that are not identified elsewhere on the Commerce Control List, including Citrix products that do not use encryption.

License Exception: Most Citrix products utilize a "License Exception, as defined in the EAR. In particular, certain Citrix products may be exported using License Exception ENC The designation "NLR" indicates a product for which no license is required for export to most countries.

Unrestricted/Restricted: Products exported under License Exception ENC may generally be classified as restricted or unrestricted depending on the classification of the product.

• Certain products may be classified as unrestricted, which means they may be exported to most government and non-government end-users in all destinations except for those listed in country group E:1 in Supplement 1 to Part 740 of the EAR. This group includes: Cuba, Iran, North Korea, Sudan, and Syria. Please refer to the EAR for the most current list of E:1 countries.
• Certain other products may be considered restricted under License Exception ENC and may require a license depending upon the particular country and end user.
  • Products designated as "restricted" may be exported without a license to most government and non-government end users in countries listed in Supplement 3 to Part 740 of the EAR. This list includes: Austria, Australia, Belgium, Bulgaria, Canada, Cyprus, Czech Republic, Estonia, Denmark, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Japan, Latvia, Lithuania, Luxembourg, Malta, Netherlands, New Zealand, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and the United Kingdom. Please consult the EAR for the most current list of countries.
  • Products designated as "restricted" may be exported without a license to most non-government end users (as defined in the EAR) in all other countries, excluding the E:1 countries; shipments to government end users in these other countries require a license.

CCATS: The Commodity Classification Automated Tracking System is a reference number assigned by BIS to identify each product that it has reviewed and classified.

ENC Reporting: For items classified ENC all exports or re-exports of these products must be reported to BIS Biannually including: Item Description, Model and Part Number, Country of Ultimate Destination, End-User Name and address and email address. Report will include transfers, exports and re-exports during the six month time period spanning January 1 through June 30 and July 1 though December 31. Reports for the period ending June 30 must be received by BIS and the ENC Encryption Request Coordinator (Ft. Meade, MD) no later than August 1. Reports for the period ending December 31 must be received by BIS and the ENC Encryption Request Coordinator (Ft. Meade, MD) no later than February 1.

Reports may be sent via email with the subject line reading (ENC Report) to BIS at crypt@bis.doc.gov and the ENC Encryption Request Coordinator at enc@NSA.gov. Floppy disk or CDs can be sent via mail to:

DEPARTMENT OF COMMERCE, BUREAU OF INDUSTRY AND SECURITY,OFFICE OF NATIONAL SECURITY AND TECHNOLOGY TRANSFER CONTROLS, 14TH STREET AND PENNSYLVANIA AVE., NW., ROOM 2705, WASHINGTON, DC 20230, and ATTN: ENCRYPTION REPORTS; AND ENC ENCRYPTION REQUEST COORDINATOR, 9800 SAVAGE ROAD, SUITE 6940, FT. MEADE, MD 20755-6000.

Product Export Classifications Matrix
This portion of the site provides information on the export control status of Citrix products.

NOTE: This information is subject to change based on BIS guidance and is not intended as legal advice.