US sanctions on the ICC: what they mean for your cloud services
ICC sanctions and cloud services: what the OFAC licences of 9 October 2026 allow, what ends on 7 April 2027, and why EU hosting does not change who decides.
On 9 October 2026 the US Treasury’s Office of Foreign Assets Control (OFAC) added the International Criminal Court (ICC) itself to its Specially Designated Nationals (SDN) sanctions list. US providers, including their foreign branches and subsidiaries, may now supply cloud services to the court only where an exemption or an OFAC licence applies: General Licence 13 allows routine subscriptions until 7 April 2027, and General Licence 14 allows email, collaboration, authentication, hosting and listed enterprise software with no stated end date, both revocable at any time. For any organisation, the ICC sanctions show that hosting data in Europe does not decide whether a US provider may keep serving it.
This post reads the licence texts for IT teams: what is still allowed, what stays barred, why hosting in Europe does not settle it, and what to do by when, whether you work with the court or not. Facts are as of 12 October 2026; the licences were checked again on 31 October 2026.
What did the US decide on 9 October 2026?
The SDN entry names “INTERNATIONAL CRIMINAL COURT” in The Hague under the programme tag “[ICC-EO14203]”. The State Department’s fact sheet of 9 October 2026 says the court is designated under section 1(a)(ii)(A) of Executive Order 14203 of 6 February 2025.
Several news reports describe a 180-day delay, and the High Representative’s statement on behalf of the EU of 12 October 2026 takes note “of the US decision to delay the entry into force of its latest measures”. The OFAC texts contain no such delay: the blocking applies from 9 October 2026, and the 180 days are GL 13, a time-limited authorisation within it.
The court called the step “unprecedented” and said it had worked with its States Parties to ensure “the continuity and resilience of its activities”.
The same action issued four general licences, listed on OFAC’s ICC sanctions programme page:
| Licence | What it authorises | Stated end |
|---|---|---|
| GL 13 | Maintenance or wind-down of operations, contracts or agreements involving the ICC, including routine subscriptions | 12:01 a.m. EDT, 7 April 2027 |
| GL 14 | Telecommunications, internet communication services and enterprise software involving the ICC | None stated |
| GL 15 | Pension payments involving the ICC, with conditions for blocked payees | None stated |
| GL 16 | Continued detention of the persons named in its annex | None stated |
Which cloud services may US providers still supply to the ICC?
General Licence 14, which the State Department’s fact sheet describes as authorising “certain IT-related activities, including cloud and software services”, has no stated end date. It has three operative parts:
- Telecommunications, paragraph (a). Receiving and transmitting telecommunications involving the court.
- Internet communication services, paragraph (b). Supply to the court “from the United States or by U.S. persons, wherever located” of internet communication services, including “chat and email”, collaboration platforms, video conferencing, user authentication, web hosting and domain name registration.
- Enterprise software, paragraph (c). Note 1 says the term “includes” software for enterprise management, ERP, finance, HR and payroll, relationship management, procurement, facilities, project and grant management, cybersecurity, and data storage, backup and recovery, “as well as cloud-based services, including Software-as-a-Service, in support of the foregoing”.
“In support of the foregoing” sets the scope. On our reading, cloud services and SaaS are covered when they deliver a listed function, such as hosted payroll or backup, not as a category of their own. The list opens with “includes”, so it is open-ended, but it does not cover all SaaS.
The text does not name AI assistants or code hosting, nor, as ComplexDiscovery noted on 11 October 2026, document review, forensic collection or incident response. Whether each fits a listed category is open.
What GL 14 does not cover may still fit GL 13 until 7 April 2027, as maintenance or wind-down. Its note covers “routine services … such as subscription based or other standard commercial services” and invoices incurred before 9 October 2026.
Two limits apply. GL 14 Note 2 keeps US export-control licence requirements (Bureau of Industry and Security) in force. And the licences authorise transactions: nothing in them obliges a provider to keep supplying.
What stays barred, and what ends on 7 April 2027?
Both licences stop at other blocked persons. GL 13(c) excludes transactions involving any blocked person “other than the International Criminal Court”, and GL 14(e) has the same effect.
On 18 August 2026 the Secretary of State designated the court’s President, Tomoko Akane, and its Senior Trial Lawyer, Abdoulaye Seye, and OFAC added them to the SDN List. Their wind-down licence, GL 12, ended on 17 September 2026. On the text, GL 14 does not authorise a service to the court where it involves an individually designated person.
Unless OFAC acts, GL 13 lapses on 7 April 2027 and only GL 14, 15 and 16 of the four remain. Routine subscriptions outside GL 14’s categories would then need another authorisation, such as a specific licence from OFAC.
None of this is fixed. Licences “may be amended, modified or revoked at any time” (31 CFR 501.803), and OFAC may exclude “any person, property, transaction, or class thereof” from any licence (31 CFR 528.503).
- Decided: the designation and GL 13 to GL 16, all dated 9 October 2026, none amended or revoked as of 12 October 2026, nor when we checked again on 31 October 2026.
- Stated US policy: the State Department says the 180-day licence “can be adjusted in response to the success or failure” of States Parties’ efforts.
- Reported, 26 October 2026: NL Times, relaying De Volkskrant, reports that GL 14 does not cover the 13 current and former ICC staff sanctioned individually, who are “still unable to use Microsoft, Amazon, Google, Booking.com, and Airbnb”. The court’s Registrar, Osvaldo Zavala Giler, told the paper: “The events surrounding the ICC have made it clear that the American technology sector cannot guarantee the continuity of its services.” A State Department official said the exemption “should not be interpreted as a softening of our position toward the ICC”.
- Requested, not proposed or decided: applying the EU Blocking Statute, Regulation (EC) No 2271/96, to these sanctions. On 23 September 2026 the Netherlands said it had asked the European Commission to prepare it. The EU statement of 12 October 2026 does not mention the statute, and we found no Commission act as of 12 October 2026. If the statute were extended, Article 5 would bar the persons in Article 11, including companies incorporated in the EU, from complying, putting EU subsidiaries of US providers between two laws. Organisations incorporated in Switzerland are not among them, though their EU subsidiaries are.
- Not yet published: any OFAC FAQ or guidance on the ICC licences, by 31 October 2026.
Does hosting in Switzerland or the EU protect you from US sanctions?
Hosting data in Switzerland or the EU does not change whether a US provider may keep serving a sanctioned customer. Microsoft 365, Google Workspace and AWS are no exception: the provider and its European subsidiaries may serve a designated customer only where an exemption or an OFAC licence applies, wherever the data sits.
The ICC regulations define a US person to include a US entity’s “foreign branch, subsidiary, or employee” (31 CFR 528.318), as does section 8(c) of the order. That is wider than usual: the Global Magnitsky and Ukraine-related definitions cover foreign branches but not foreign subsidiaries (31 CFR 583.314, 31 CFR 589.339).
Keep two risks apart. The CLOUD Act is about disclosure: whether a US authority can obtain your data. Sanctions are about service: whether the provider may keep serving you at all. Data residency, such as Microsoft 365’s Swiss data setting, addresses neither: it changes where data sits, not which company answers to US law. Customer-held keys can limit what a disclosure reveals, but they do not keep the service running.
Contracts do not help: section 1(b) of the order applies the prohibitions “notwithstanding any contract entered into … before the date of this order”.
A provider outside US jurisdiction is not bound directly: the State Department’s fact sheet says the prohibitions cover “transactions by U.S. persons or within (or transiting) the United States”. Nor is such a provider out of reach. Section 1(a)(ii)(B) of the order lets the Secretary of State designate foreign persons that provided “goods or services to or in support of” a blocked person, by determination, not automatically. Any US service in a non-US provider’s path, such as an edge network or an email relay, brings US rules back for that part. The useful question is which companies in your service path answer to US sanctions law.
Do the ICC sanctions affect organisations outside the court?
Organisations that work with the court. Counsel and law firms, NGOs that submit evidence, States Parties’ agencies, contractors and research partners. Section 3 of the order covers funds, goods or services “by, to, or for the benefit of” a blocked person. A shared workspace, data room or case platform run by a US provider is a question for sanctions counsel. For firms, see legal.
International organisations, NGOs and public bodies in Geneva, The Hague and elsewhere. Organisations have been listed under this order before: on 4 September 2025 the US designated Al-Haq, Al Mezan Center for Human Rights and the Palestinian Centre for Human Rights (OFAC). The texts show how a listing reaches IT: by service category, on licence terms, with a date, and revocable at any time. See international organisations.
What to do, and by when
These dates are our suggestions. Only 7 April 2027 is set by OFAC.
- By 30 October 2026: list which of your providers are US persons. For email, files, chat, video, identity, backup, document review and AI, record the contracting entity and its ultimate parent. A US company’s foreign subsidiary counts.
- By 30 October 2026, if you work with the ICC: take sanctions advice. Map each shared service against GL 13 and GL 14, and check whether any user or workflow involves an individually designated person.
- By 30 November 2026: read the suspension and termination clauses. Note whether the provider can suspend at once to comply with law, how long the export window runs afterwards and who holds the keys.
- By 31 December 2026: take a full export you can read without the provider. Mailboxes, files, directory and chat history, in open formats, stored where you choose, with counts checked against the source.
- By 31 January 2027: name a fallback for each critical service, identity first. Every other service signs in through identity, so start there, for example with Keycloak, then files, for example on Nextcloud. Write each choice into your exit strategy. See the Swiss federal open-source workplace for one planned beside Microsoft 365.
- By 15 March 2027: test the switch. Restore the export into the fallback, time it and record what failed. See why restore tests matter.
- Until 7 April 2027 and after: watch OFAC. Check Recent Actions and the ICC programme page for amendments to GL 13 and GL 14 and for a first FAQ.
How Pilae fits
What protects you from a provider being cut off or compelled is where the apps run and who holds the keys, not the provider’s nationality (CLOUD Act and your data location). Apps run on your premises, air-gapped with no outbound connection, or on dedicated machines in a Swiss or EU region of Pilae Cloud, run by European datacentre operators outside US jurisdiction. A few supporting services, such as the public edge and email delivery, come from US companies. Apps that answer only on the private network never touch the edge, and the US-controlled services you exclude are written into your contract.
An exit plan gives each critical SaaS or cloud dependency a fallback that exists: an open-source or source-available app you control, or an alternative provider, with scheduled exports in open formats, a runbook and a dated test record. Pilae does not operate mail: for email, the fallback is another provider outside US jurisdiction. You can keep the provider and hold the fallback in reserve. Every app Pilae runs is backed up daily and encrypted before it leaves, and on the Enterprise plan restore-tested every month (backups). Talk to an engineer about which of your services would stop, and what would replace them.
This post is general information on the OFAC licences and US regulations as of 12 October 2026, re-checked on 31 October 2026, not legal advice: check GL 13, GL 14 and 31 CFR part 528 with your counsel.