FIN-043: Managing Export and Sanction Compliance in Support of University Activities
- Activities Subject to U.S. Export Controls
- Thesis or Dissertation Submissions
- Promotion and Tenure Review
- Sanctioned Countries
- Research Data Security
- Compliance with Policy
The conduct of certain University research, teaching, service, and patient care activities is subject to control under Federal export control or sanction regulations. Controls may be applicable due to the use or generation of controlled technology or the conduct of controlled activities which may occur inside or outside the U.S.
This policy serves two purposes: 1) a formal expression of the University’s commitment to compliance with U.S. export control and sanction requirements; and 2) describes the general framework the University has established to support that commitment.
An activity involving the export of controlled technology or that due to its nature or the parties involved is otherwise subject to U.S. government export controls or sanctions requirements.
For purposes of this policy, this term includes any item, component, material, software, source code, object code, or other commodity specifically identified on the Commerce Control List [Part 774 of the Export Administration Regulations (EAR)] or U.S. Munitions List [Part 121 of the International Traffic in Arms Regulations (ITAR)]. This term also includes information to the extent required in the applicable regulation.
Export and “Deemed Export”:
An export is any shipment or transmission of controlled technology out of the U.S. The term "deemed export" is commonly used to refer to the release of controlled information (as specified in the regulations) to a foreign national in the U.S. Under the regulations, such a transfer is deemed to be an export to the individual’s home country.
Export Control Regulations (Export Controls):
Specific government-imposed restrictions and limitations on the dissemination of controlled technology and other goods (e.g., tissue samples, agricultural products, plants and animals) or services to foreign persons or destinations. This includes the Export Administration Regulations (EAR); the International Traffic in Arms Regulations (ITAR); Assistance to Foreign Atomic Energy Activities regulations; and any other U.S. government regulations that similarly govern exports and are applicable to University activities.
A natural person who is not a U.S. citizen, lawful permanent resident (green card holder) or protected individual (formally granted asylum or refugee status). It also means any foreign corporation, business association, partnership, trust, society or any other entity or group that is not incorporated or organized to do business in the United States, as well as international organizations, foreign governments and any agency or subdivision of foreign governments (e.g., diplomatic missions). An equivalent term used by the Department of Commerce is “foreign national”.
Sanction Regulations (Sanctions):
Includes all the embargoes and trade sanction regulations administered by the Office of Foreign Assets Control (OFAC), U.S. Department of the Treasury. Sanctions programs are typically country-based (e.g., those imposed against the governments of Iran, Cuba, and North Korea) or list-based (e.g., Counter Terrorism and Counter Narcotics).
Technology Control Plan (TCP):
A document that sets forth the specific physical, electronic and procedural controls that will be taken to prevent unauthorized access to or export of controlled technology. (A template TCP is available on the forms page of the Office of Export Controls website.)
The University discourages any restriction on the ability of its students, faculty and staff to communicate unclassified information to any individuals, including foreign persons, engaged in research at the University or in the international community of scholars. However, the University recognizes that in some instances restrictions on access, dissemination/publication, or services may be necessary to comply with Federal regulatory requirements. The University does not prohibit acceptance of dissemination/publication restrictions or the conduct of controlled activities. However, those wishing to engage in such activities must assist the University in preventing regulatory violations. The University has determined that projects proposing to use or produce controlled technology or that involve the provision or receipt of regulated services require special review and authorization to ensure that they will not interfere with the University’s mission.
Activities Subject to U.S. Export Controls:
The University shall decide whether to sponsor or support a particular controlled activity on its own merits. Among the factors to be considered in determining whether to proceed with a particular activity are its academic merit, the compatibility with the mission of the University, the nature of the restrictions, and the contribution of the activity to the benefit of humanity. The review will also consider whether adequate time exists to assess the activity and, if necessary, obtain licenses or other required authorizations.
The University will only go forward with a controlled activity once the necessary export license or other authorization has been obtained from the appropriate regulatory agency.
The University shall not engage in business relationships with entities identified on any export or sanction program restriction list nor shall it engage in activities subject to sanctions, without the explicit authorization of the Office of Export Controls. Decisions regarding engaging in business relationships with entities on other government lists, e.g., state and federal non-procurement lists, shall be at the discretion of the responsible business units and contracting officials.
Foreign nationals shall be allowed access to controlled technology and may participate in controlled activities to the extent necessary to perform their assigned duties provided such access and participation is permitted by the regulations or authorized in an export license or other authorization issued by the appropriate regulatory agency.
Faculty members wishing to use (or authorize students or staff to use) controlled technology or work on a project intended to generate controlled technology, regardless of funding source, must develop a Technology Control Plan (TCP) and have it approved by the Office of Export Controls. (Note: A TCP may not be required if the project only involves EAR-controlled items, does not involve controlled source code or proprietary technical information, and the work will be conducted exclusively in the U.S.)
Faculty members wishing to engage in research subject to publication/dissemination restrictions or approval requirements must obtain the approval of their department chair, dean and the Vice President for Research (or their respective designees) and receive clearance from the Office of Export Controls before the Office of Sponsored Programs may accept the restriction and finalize the research funding agreement. Approval is to be gained serially and each position must support the request for it to move forward in the process. No procurement, grant, contract or other agreement to conduct controlled activities, or to produce or obtain controlled technology may be finalized until the TCP has been approved and the required University authorizations have been obtained.
International travel with controlled technology is an export and subject to this policy. Controlled technology includes, but is not limited to, University laptops, cell phones, and other devices as well as technical information subject to publication or dissemination restrictions, which may include research results.
Thesis or Dissertation Submissions:
A thesis or dissertation submitted in fulfillment of a degree program requirement must not contain information that is subject to export control regulations. Should a student choose to participate in an export-controlled activity, any resulting information may be used in a thesis or dissertation only after approved for unlimited public release or dissemination by the appropriate regulatory agency. Students wishing to include controlled technology in their thesis or dissertation will be required to work with their graduate advisor to develop a TCP or modify an existing approved TCP to detail how all degree requirements will be met while preventing unauthorized exports of controlled technology. This new or revised TCP must be submitted by the student’s graduate advisor to the Office of Export Controls for review and approval. Following approval of the TCP by the Office of Export Control, the graduate advisor must submit a request that the student be allowed to prepare a thesis or dissertation containing export-controlled technology to the department chair and the dean of the student’s degree program and receive their support. The Vice President for Research (or designee) must give final approval of any plan to include controlled technology in a student thesis or dissertation.
Promotion and Tenure Review:
Decisions regarding the inclusion or exclusion of export-controlled activities as part of the promotion and tenure review process shall be determined by the faculty member’s academic department, school, and when applicable, the Provost. However, controlled technology may not be submitted for consideration of promotion and tenure unless and until one of the following has occurred:
- the information is approved for unlimited public release or dissemination by the appropriate regulatory agency; or
- the Office of Export Controls has performed an export assessment, provided any necessary training to individuals requiring access to the controlled technology, and documented that one or more of the following permits all proposed exports associated with the promotion and tenure review process:
- that an export license is not required;
- a valid license exception exists and any conditions are fulfilled; or
- an export license or other authorization has been obtained by the University and that any attached provisos or conditions can be met.
Certain countries are subject to a comprehensive or near comprehensive program of embargoes and trade sanctions by the U.S. government. The broad scope and applicability of these programs necessitates that all University activities that will be conducted in, involve the participation of parties located in, or benefit a sanctioned country be reviewed and authorized by the Office of Export Controls. The following are examples of activities that are subject to control under these regulations:
- Import of goods originating in a sanctioned country;
- Direct or indirect export of goods, including both controlled technology and items that are not specifically listed on the CCL or USML (e.g. research samples, basic lab and office supplies) to a sanctioned country;
- University travel to a sanctioned country;
- Provision of a service of value (e.g., research, testing, and advisory/consulting services or providing courses via remote learning) to a party in a sanctioned country; and
- Obtaining services from a party located in a sanctioned country.
The countries currently subject to a comprehensive or near comprehensive program of sanctions include the following: Cuba, Iran, North Korea, and Syria. A near comprehensive program of sanctions also applies to the Crimean region of Ukraine.
Research Data Security:
Per IRM-003: Data Protection of University Information, unpublished research data (inputs or results) are “sensitive data” or “highly sensitive data” and must be safeguarded in accordance with the applicable data protection standard and procedures. When a discrepancy exists between a University data protection standard and an applicable external data protection standard the more stringent will apply and must be implemented to safeguard the data. See the Research Data Security content on the Vice President for Research’s website for information on sponsor requirements/expectations and links to UVA resources available to support research.
The Director of Research Regulatory Affairs is responsible for:
- Providing general oversight of the export controls function (Office of Export Controls) and the direct supervision of the export controls staff;
- Serving as an empowered official as defined in §120.25 of the ITAR; and
- Signing and submitting export compliance documents to Federal agencies and other parties on behalf of the institution.
The role of the Office of Export Controls is to facilitate the University’s research, teaching, service, and patient care mission by administering a program of activities to support this policy; to that end, the Office of Export Controls is responsible for:
- Developing and delivering outreach and training materials for University faculty, staff, students and trainees to increase export control and sanctions awareness;
- Providing tools to the University community to assist in the identification and management of export control and sanctions issues;
- Acting as the University’s principal point of contact for University faculty, staff, students and trainees as well as agencies with regulatory or enforcement authority under export control and sanctions regulations;
- Preparing and submitting requests for export or sanctions authorization or regulatory clarifications to Federal agencies on behalf of the institution as necessary and appropriate to support University activities;
- Establishing and administering forms, procedures and processes to facilitate compliance with this policy;
- Advising individuals with Institutional Signature authority on export control and sanctions issues related to contracts (FIN-036) and academic program agreements (FIN-035);
- Managing the University’s registrations and online accounts with regulatory agencies; and
- Performing or supporting the conduct of compliance monitoring, risk assessments, and investigations as directed by the Director of Research Regulatory Affairs, the Office of University Counsel or Internal Audit.
Faculty members are responsible for:
- Consulting with and providing assistance to the Office of Export Controls to ensure that:
- controlled technology, regardless of whether it is instructional or research technology, used or produced by them or under their supervision is categorized correctly under export control regulations;
- controlled activities are identified, approved, and licensed if necessary; and
- all exports of controlled technology, both physical and deemed, including those associated with international travel are conducted in compliance with applicable export control, sanctions, census, and customs requirements;
- Knowing and complying with the terms and conditions of their funding awards and other agreements, including export controls, sanctions, applicable data and system security standards, and limitations on dissemination/publication of research data and results;
- Assisting the University in preventing unauthorized exports and/or sanctions violations and applying for government licenses where appropriate;
- When applicable, developing a technology control plan, submitting the plan for approval, and following the requirements of the approved plan;
- Seeking advice from the Office of Export Controls when acquiring proprietary (non-public) information or items via a mechanism other than procurement/purchase; and
- Ensuring that staff, students, trainees, and volunteers under their supervision, and visitors are made aware of any applicable requirements (e.g., University, regulatory, or sponsor imposed) and receive adequate training in how to conduct their activities in compliance with those requirements.
All University faculty, staff, trainees, and volunteers are responsible for:
- Knowing and complying with any requirements applicable to their activities;
- Seeking assistance from the Office of Export Controls prior to performing any controlled activities (examples include temporary exports associated with international travel, international shipping, and deemed exports); and
- Reporting any suspected non-compliance with export controls, sanctions, or this policy to the Office of Export Controls.
Compliance with Policy:
Failure to comply with the requirements of this policy may result in violations of federal export control laws and regulations for which substantial individual and/or institutional penalties may be assessed; penalties may be civil, criminal, or both. In addition, failure to comply with the requirements of this policy may result in disciplinary action up to and including termination or expulsion in accordance with relevant University policies.
Questions about this policy should be directed to the Office of Export Controls.
Export control procedures, forms and templates are posted on the Office of Export Controls website.