In 2010 Belarus, Kazakhstan and Russia formed a customs union that was later transformed into the Eurasian Economic Union (EAEU) and enlarged to include Armenia and Kyrgyzstan. The EAEU main objectives are to create a single labor market, impose a common external tariff on goods entering the union, introduce unified standards and compliance assessment procedures, etc. Aside from that, the EAEU also implemented a common set of non-tariff barriers that require companies participating in international trade obtain a license in order to import certain types of goods from non-EAEU countries.

The goods with licensing restrictions are specified in the Decision of the Eurasian Economic Commission Board dated April 21, 2015 № 30. They are grouped into sections, each of which contains products with similar properties (e.g. dangerous waste, pharmaceuticals, human organs and tissues). One of the sections includes encryption (cryptographic) items or goods that contain encryption (cryptographic) items such as smartphones, mobile base stations, managed switches, wireless routers, software operating systems, etc.

But since cryptography grew to enter almost all household products, the Eurasian Economic Commission Board decided to develop a simplified procedure for importation of goods whose encryption functions are either weak or inaccessible to the end-user. The purpose of this procedure is to eliminate the need to apply for a license, which is a complicated and time-consuming process, and allow importers to simply notify the competent government agency of the cryptographic specifications supported by an imported product. If the product complies with certain criteria and its cryptographic functionality can be considered weak, it receives the green light for importation.

In Russia the role of the government agency competent in encryption and cryptography plays the Federal Security Service (FSB). To get the FSB approval, an applicant fills in a notification form and prepares the corresponding paperwork (cover letter, electronic copy of the notification, etc.). The final set of documents is then submitted to the FSB and processed for up to 10 work days. If the documents are correct and the product specifications meet the criteria of weak cryptography, the FSB issues a registered notification and hands its memo (product name, manufacturer’s details, etc.) over to the Eurasian Economic Commission (EEC). After that the ECC includes the registered notification into the unified and publicly accessible register of notifications.

The notification can be applied for either by the manufacturer or its authorized representative (legal entity or individual residing in Russia). The manufacturer usually gives authorization in the form of a power of attorney (POA). Since the POA is issued in the territory of a foreign country, it must be legalized (apostille or consular authentication) to become legitimate for use in Russia. If the manufacturer wishes to apply for a notification on its own, but it is not registered as a legal entity in Russia, the notification form will have to be legalized.

It is also worth noting that the unified register of notifications is valid in the territory of all EAEU members states and it only contains information about the product name and manufacturer, but not about the applicant. It means that once a notification has been registered, it can be used to import the product by any legal entity or individual residing in Armenia, Belarus, Kazakhstan, Kyrgyzstan and Russia.

If you are planning to import goods that support cryptographic functionality into Russia, we can help you prepare and register an FSB notification. The only document that we need to register a notification is a legalized power of attorney (POA) from the manufacturer. If you do not know how to prepare a legalized POA, we can provide a list of requirements that the POA should comply with and guide you trough the notarization and legalization process.

In 1-2 days we prepare all the documents required to register an FSB notification:

• draft notification (if necessary, our experts in cryptography will determine cryptographic algorithms and protocols);
• cover letter;
• power of attorney;
• electronic copy of the notification.

You will only need to provide:

• list of product models and names;
• manufacturing company name, address and phone number;
• legalized (apostille or consular authentication) power of attorney (POA) from the manufacturer.

Notes:

• one notification can include either one product name or a set of similar models of the same product with identical intended use, functionality and cryptographic capabilities;
• notification can be submitted to the FSB by any Russian entity authorized by the manufacturer to apply for notifications and then it can be used to get customs clearance (by referring to the unified register of notifications) by any company registered in the Eurasian Economic Union member states;
• legalized POA must be signed by the manufacturer's authorized representative(s).