Semi-Annual ENC Reporting Requirements for Encryption Exporters: What You Need to Know

Exporters of encryption technologies under U.S. export regulations are required to comply with strict semi-annual reporting obligations. For the reporting period covering exports made between January 1 and June 30, 2025, companies must submit their ENC report no later than August 1, 2025. This requirement applies to all items classified under ECCNs 5A002, 5B002, 5D002 or 5E002 that qualify for the License Exception ENC.

This reporting step is mandatory even when no export license is required. It is designed to allow U.S. authorities to monitor the dissemination of sensitive encryption products that support critical communication, cybersecurity, and data protection functions.

The report must include several elements demonstrating full transparency regarding exported solutions. Companies must provide the CCATS number associated with their classification request, along with the precise name of the exported or reexported items. Detailed information on customers or distributors must also be included, as well as the quantity of items shipped during the reporting period. In addition, the exporter must supply a technical description of the encrypted product, including the interface used, encryption algorithms implemented, and any standards or certifications applied.

Reports must be submitted electronically to both the Bureau of Industry and Security (crypt@bis.doc.gov) and the National Security Agency (enc@nsa.gov). Accepted formats include structured text documents or spreadsheets. Failure to meet this reporting obligation can expose companies to significant compliance risks under the U.S. Export Administration Regulations.

For businesses exporting encryption technologies, this deadline is an important part of regulatory compliance. Preparing the required information early, establishing internal tracking mechanisms, and coordinating with distributors can help reduce the administrative burden and ensure full adherence to U.S. export control rules.