All operators who wish to transfer a dual-use item listed in Annex IV of Regulation (EC) 2021/821.

All operators who wish to transfer a dual-use item other than those listed In Annex IV of Regulation (EC) 2021/821, from the territory of the Grand Duchy of Luxembourg to another Member State of the European Union, where, at the time of transfer:

• the operator knows that the final destination of the items concerned is outside the European Union;
  
•  export of those items to that final destination is subject to an authorisation requirement in the Member State from which the items are to be transferred, and such export directly from its territory is not authorised by a general authorisation or a global authorisation;
  
• no processing or working is to be performed on the items in the EU Member State to which they are to be transferred.
   

List in Annex IV of Regulation (EU) 2021/821;

The sections do not always show a full description of the goods, nor do they contain the notes contained in Annex I which alone contains the full description.

The indication of a product in the current annexe does not impact the application of provisions concerning the mass products in annexe I.

Expressions between double quotation marks are those defined in the list of general definitions in annexe I.

PART 1

(possibility of National General Authorisation for intra-Community trade)

Exemptions

Annex IV does not control the following items of the MTCR technology:

• that are transferred on the basis of orders pursuant to a contractual relationship placed by the European Space Agency (ESA) or that are transferred by ESA to accomplish its official tasks;
• that are transferred on the basis of orders pursuant to a contractual relationship placed by a Member State's national space organisation or that are transferred by it to accomplish its official tasks;
• that are transferred on the basis of orders pursuant to a contractual relationship placed in connection with a Community space launch development and production programme signed by two or more European governments;
• that are transferred to a State-controlled space launching site in the territory of a Member State, unless that Member State controls such transfers within the terms of this Regulation.

PART II

(no National General Authorisation for intra-Community trade)

Preliminary steps

In order to be able to submit the application electronically, the operator must first make an express request (on free paper or by email) to OCEIT and get their approval.

Neither the application for authorisation (French, Pdf, 1.18 Mb) nor the issuance of the transfer authorisation by OCEIT shall give rise to the levying of any taxes or fees.

Submitting the application

The operator shall submit his / her application for an individual or global authorisation to OCEIT using the application form (French, Pdf, 1.18 Mb).

The application is made by mail or electronically (if the operator has previously obtained OCEIT’s approval).

The application (or the declaration) shall be signed by a person authorised to commit the applicant. By this signature, the applicant certifies the accuracy of the information provided in the application and that of the content of any documents attached to it. He/she undertakes as well to provide the goods concerned with a destination in accordance with his/her application.

Supporting documents

The supporting documents to be attached to the application for an individual or global authorisation are the following:

• detailed explanatory letter of the operation;
• end-use certificate (Pdf, 373 Kb) (or, after OCEIT’s approval, an exporter commitment (French, Pdf, 1.16 Mb));
• invoice / proforma invoice;
• sales agreement;
• recent extract from RCS (less than 3 months).

For items listed in Annex I, Category 5, Part 2, and not listed in Annex IV of Regulation (EC) 2021/821, the following documents and information are to be provided:

• Indication of the commercial reference of the cryptology mean, and of the version.
  General description of the means and its features.
  Indication of the category in which the means is to be classified (Personal computer encryption software. Operating system. Electronic messaging. Wireless communication system. Network encryption means. Telephone or fax. Other (to be specified)
• Presentation of the cryptology services provided (Authentication. Signature Integrity checking. Confidentiality. Timestamping. Secure archiving. Cryptographic key management. Key or data certification. Other (to be specified). Specify the names of the algorithms used and the maximum length of the cryptographic keys for each algorithm.
• Presentation of the implementation of the algorithms (software, hardware).
• Presentation of the security standards of the means
• Presentation of the type of data concerned by the service
• Document concerning the technical characteristics of the good, including the following elements:
  
  

  1. Elements necessary to implement the means of cryptology:

  a) 2 models of the cryptology means ;

  b) the installation guides of the means;

  c) activation procedures of the means, if applicable (license number, activation number, hardware device, etc.);

  d) key injection or network activation devices, if applicable.

  2. Elements related to cryptology algorithms:

  a) description of the cryptology function offered by the means (encryption, signature, key management, etc.);

  b) either the complete description of the cryptology processes used, in the form of a synoptic and mathematical description and a simulation in a high-level language;
  or the reference to a previously lodged file for a means using the same cryptology methods ; or the reference to a recognized and unequivocal standard, and whose technical details are easily and unconditionally accessible, with the parameters and the operating procedures of its implementation;

  c) if the encryption method implemented in the means is not a recognized standard, 3 reference outputs of the encryption method, in electronic format, from a clear text and an arbitrary chosen key, which will also be provided, in order to verify the conformity of the implementation of the process with the description thereof;

  3. elements related to the management of the keys:

  a) distribution mode of the keys;

  b) generation process of the keys;

  c) retention format of the keys;

  d) transmission format of the keys.

  4. The elements relating to the protection of the encryption method, namely the description of the technical measures implemented to prevent the alteration of the encryption method or the associated key management.

  5. Elements relating to data processing:

  a) description of pretreatments experienced by clear data before their encryption (compression, formatting, adding a header, etc.);

  b) description of the post-processing of the encrypted data, after their encryption (adding a header, formatting, packaging, etc.);

  c) 3 reference outputs of the means, in electronic format, made from a clear text and an arbitrary chosen key, which will also be provided, in order to verify the implementation of the means in relation to the description of this.

  6. Elements relating to implementation of the cryptology:

  a) the source code of the means, and the elements allowing a recompilation of the source code or the references of the associated compilers;

  b) the references of the components integrating the cryptology functions of the means and the names of the manufacturers of each of these components;

  c) the cryptology functions implemented by each of these components;

  d) the technical documentation of the components performing the cryptological functions;

  e) the types of memories (flash, ROM, EPROM, etc.) in which are stored the functions and cryptology parameters as well as the references of these memories.

  7. the description of the services offered to users of the service.

  8. the description of the cryptological functions implemented by the service provider.

  9. the description of the premises used to implement the service.

  10. the description of hardware and computer software including cryptography used by the provider.

  11. the description of the physical protection and access control systems for the premises and IT systems of the service provider.

  12. When the service consists of the management of cryptographic keys or electronic certificates for the benefit of users:

  a) the description of the procedure for generating keys and certificates;

  b) the description of the procedure for distributing and delivering keys and certificates to users;

  c) the description of the technical and organizational measures implemented for the protection and preservation of keys;

  d) the description of the key recovery procedure (only for the confidentiality service);

  e) the references of the means of cryptology implemented by the users of the service, when these means are specifically designed to work with the keys or certificates issued by this service.

Deadlines for reply

Any application for an individual or global authorisation shall be acknowledged by OCEIT.

In case of an incomplete application, the applicant shall be informed of the need to provide additional documents and any consequences for the period for processing the application.

The application for authorisation shall be processed within 60 working days of the day on which the file is complete.

This 60 day period may be extended for a maximum of 30 working days. The extension and its duration shall be duly reasoned and notified by OCEIT before the expiry of the initial period.

In the absence of a reply within the period provided for, the application for authorisation shall be considered as granted.

Validity period

Authorisations shall be valid:

• 1 year for individual authorisations, renewable for a period of 6 months;
• 3 years for global authorisations, renewable for a period of 18 months.

Obligations

The operator shall transmit to OCEIT, at the latest 10 working days after the expiry date, the obsolete authorisation which is in their possession.

The operator shall report to OCEIT any loss of an authorisation document.

The operator must comply with the special conditions contained in the authorisation.

The operator shall keep detailed and complete registers of operations carried out pursuant to the authorisation. These registers shall contain the commercial documents, such as invoices, manifests, transport documents or other shipping documents, showing the following information:

• the description of the items and their references in the lists of Annex I or Annex IV of Regulation (EC) 2021/821;
• the quantity and value of the imported products;
• the dates of transfer;
• the end-use and end-user of the goods.

For the transfer of dual-use items listed in Annex I of Regulation (EC) 2021/821, the supplier shall clearly indicate on all commercial documents (sales agreements, order confirmations, dispatch note) that those items are subject to control if exported outside of the European Union.

The exporter shall keep the registers for a period of 10 years from the end of the calendar year in which the transaction took place. He/she shall present them to the ministers at their request during that period.

Operators must provide, without delay, at the first request of the ministers or OCEIT, any elements and documents necessary to verify the conformity of the operation carried out or foreseen.

Disputes

In the event the authorisation is denied, a legal action may be lodged, by an Avocat à la Cour, against the administrative decision within the period of 3 months from the date of the notification of the administrative decision to the concerned person.

Penalties

A prohibition (limited to 6 months or definite) or another restriction to carry out one or more activities, and/or the suspension for a maximum period of 6 months from the use of a general European Union or national authorisation, or a global authorisation, and/ or a penalty payment (which cannot be higher than EUR 1,250per day, but cannot exceed EUR 25,000) may be pronounced against anyone who:

• refuses to provide the documents or other information requested of them by the ministers or OCEIT;
• provides the ministers or OCEIT with documents or other information that is found to be incomplete or false;
• impedes the exercise of the powers of the ministers or OCEIT;
• does not follow the orders of the ministers or OCEIT.

May be punished by an imprisonment of 5 to 10 years and/or a fine of an amount of EUR 25,000 to EUR 1,000,000, anyone who is transferring dual-use items without having been granted the required authorisation or without respecting the prohibition applicable to the operation.

May be punished by an imprisonment of 6 months to 5 years and/or a fine of EUR 7,500 to EUR 75,000, anyone who:

• fails to keep the registers or does not keep them during the period of 10 years (starting with the end of the calendar year during which the operation took place);
• fails to present the registers at the first request of the ministers;
• omits, repeatedly or significantly, to fill in one or more of the mandatory information in the registers;
• provides, in the context of an application for authorisation, information that is false or incomplete;
• does not fulfil the commitments made in the declarations of use and applications for authorisation submitted to the ministers;
• fails to provide information within the time limits and in the manner set out.

Review of the file

The ministers may, at any time, withdraw, suspend for a period not exceeding 90 days or restrict the use of the authorisations they have issued.

Such a review may happen in exceptional circumstances justifying urgent measures, for reasons of protection of the essential security interests of the State, for reasons of public order or national or eternal security, such as transport safety, storage safety, the risk of diversion, the prevention of crime, or for non-compliance with the conditions specified in the authorisation.

Procedures

Links