Industrial Policy & Trade Monitor· 2666 actions· ✨ 90 recent

The Wet veiligheidstoets investeringen, fusies en overnames ("Vifo Act") is the Netherlands' cross-sector statutory FDI screening regime. Adopted by the States-General on 18 May 2022 (Stb. 2022, 215) and entered into force on 1 June 2023 together with two implementing decrees (Stb. 2023, 173 — main implementing decree; Stb. 2023, 172 — decree defining the scope of "sensitive technology"), the Act establishes mandatory pre-closing notification and a security review by the Bureau Toetsing Investeringen (BTI, part of the Ministry of Economic Affairs and Climate) for transactions affecting (i) "vital providers" in critical infrastructure sectors — energy, transport, telecoms, port operators, banking infrastructure — and (ii) Dutch undertakings active in "sensitive technology", defined to include EU Reg 2021/821 Annex I dual-use items, military goods, and additional national-security technologies. The regime applies retrospectively to transactions completed after 8 September 2020. It is the foundational instrument under which the Dutch national export-control measures on ASML DUV immersion lithography (filed: 2023-06-30 and 2024-09-07) operate, and the Dutch peer of US CFIUS, EU Regulation 2019/452, the German AWG §§55-62, the French Décret 2014-479 / R. 151-1 et seq., and the UK NSI Act 2021.

Canada amended the Special Economic Measures (Russia) Regulations via SOR/2022-067, registered and in force 24 March 2022, establishing a new "Restricted Goods and Technologies List" and prohibiting any person in Canada, and any Canadian outside Canada, from exporting, selling, supplying or shipping any listed good or technology to Russia or to any person in Russia. The list is maintained and published separately by Global Affairs Canada and covers items with dual civilian/military applications across electronics, computers, telecommunications, sensors and lasers, navigation and avionics, marine, aerospace and transportation equipment.

On 28 February 2022, South Korea's government condemned Russia's invasion of Ukraine and announced it would strengthen export control review to block strategic items -- microelectronics, telecommunications equipment, sensors, navigation equipment, avionics, marine equipment, and aircraft components -- from reaching Russia. The statement also committed Korea to joining the exclusion of designated Russian banks from the SWIFT international payments system, with implementation details to follow through interagency consultation, alongside plans to release strategic petroleum reserves and divert LNG cargoes to Europe.

On 24 February 2022, hours after Russia's invasion of Ukraine began, the UK Foreign Secretary announced a full asset freeze on VTB, Russia's second-largest bank (£154bn in assets, 95,000 employees), alongside a freeze on all Russian bank assets in the UK and a ban on Russian companies raising finance on UK markets. The package designated more than 100 companies and individuals -- including five major defence firms (Rostec, Uralvagonzavod, Tactical Missile Corporation, United Aircraft Corporation, United Shipbuilding Corporation) and Putin-inner-circle figures such as Kirill Shamalov -- for asset freezes and travel bans. Aeroflot was banned from UK airspace and new export controls were imposed on electronics, telecommunications and aerospace goods to Russia.

Effective 24 February 2022 — the date of Russia's full-scale invasion of Ukraine — the US Bureau of Industry and Security (BIS) published an interim final rule (87 FR 12226, FR Doc 2022-04300) adding sweeping new export license requirements under a new § 746.8 of the Export Administration Regulations (EAR). The rule requires a licence for any item in CCL Categories 3–9 (electronics, computers, telecommunications, sensors, lasers, navigation/avionics, marine, aerospace, propulsion) exported, reexported, or transferred to Russia, with a review policy of denial. Two new Russia-specific Foreign Direct Product (FDP) rules extend US jurisdiction to foreign-manufactured goods: the Russia FDP Rule (§ 734.9(f)) covers all foreign-made items using US technology/equipment destined for Russia, and the Russia-MEU FDP Rule (§ 734.9(g)) covers items destined to 47 designated military-end-user (MEU) entities with no licence exceptions available. All three restrictions carry a presumption of denial, making this the most sweeping peacetime expansion of the EAR since its modern codification.

The Autonomous Sanctions Amendment (Ukraine Regions) Regulations 2022 (F2022L00179) apply to the Ukrainian regions of Donetsk and Luhansk the autonomous sanctions measures already in place for Crimea and Sevastopol, commencing 28 March 2022. DFAT describes the measures as prohibiting trade in the transport, energy, telecommunications, and oil, gas and minerals sectors of those regions. Foreign Minister Marise Payne announced Australia's response on 24 February 2022, alongside listings of Russian individuals and banks.

Council Regulation (EU) 2022/263 prohibits importing into the EU any goods originating in the non-government-controlled areas of Ukraine's Donetsk and Luhansk oblasts, and bans the sale, supply, transfer or export of Annex II goods and technology (transport, telecommunications, energy, resource extraction) to those areas. It also bars new investment and financing there. It entered into force the day after adoption, 24 February 2022.

OFAC codified the Chinese Military-Industrial Complex Sanctions Regulations at 31 CFR Part 586, implementing Executive Order 13959 (November 12, 2020) as amended by Executive Order 14032 (June 3, 2021). The regulations prohibit US persons from purchasing or selling publicly traded securities of entities designated on OFAC's Non-SDN Chinese Military-Industrial Complex Companies (NS-CMIC) List, which identifies firms determined to support the People's Liberation Army or Chinese surveillance-technology programs. A divestment deadline of June 3, 2022 applied to entities named in the original EO 13959 annexes; future additions carry a one-year divestment window from the date of designation.

The Bahraini Council of Ministers, chaired by HRH Crown Prince and Prime Minister Prince Salman bin Hamad Al Khalifa and issued pursuant to directives of HM King Hamad bin Isa Al Khalifa, launched the five-pillar Economic Recovery Plan on 31 October 2021 as the government's post-COVID-19 structural-adjustment and growth framework through 2024–2030. The plan catalyses a USD 30 billion strategic-projects pipeline, delivers six new priority-sector strategies (oil and gas, tourism, logistics, financial services, telecommunications/ICT, manufacturing), targets 20,000 new Bahraini jobs and 10,000 annual training slots, and mandates fiscal balance by 2024 including the doubling of VAT from 5% to 10% effective 1 January 2022 under Royal Decree 33/2021. It is the foundational parent framework for all subsequent Bahraini sectoral decrees and investment decisions through 2030, and is materially relevant to the global non-Chinese aluminium supply chain through Aluminium Bahrain (Alba), one of the world's largest non-Chinese primary aluminium smelters at approximately 1.5 million tonnes per annum.

The Personal Information Protection Law of the People's Republic of China (中华人民共和国个人信息保护法 — PIPL) was adopted at the 30th meeting of the 13th NPC Standing Committee on 20 August 2021 and entered into force on 1 November 2021, constituting the third and final pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Data Security Law (2021). The PIPL is China's comprehensive personal-information statute establishing consent-based and necessity-based legal bases for PI processing, a tiered cross-border personal-data transfer regime (CAC security assessment / PI protection certification / Standard Contractual Clauses), extraterritorial application (Art. 3) to non-Chinese controllers offering services to or analysing the behaviour of PRC residents, and a heightened protection regime for sensitive personal information and data of minors under 14. It mandates data-protection impact assessments, personal-information-protection-officer obligations at designated handlers, breach notification, and a full suite of data-subject rights including access, rectification, deletion, portability, objection, and automated- decision-making opt-out. Article 53 requires overseas controllers to establish a domestic representative or designated entity in China, providing a domestic enforcement counterparty.

The Bureau of Industry and Security (BIS) added four Burma-based entities to the Entity List effective July 6, 2021 under the Export Administration Regulations (EAR), citing their support for the Myanmar State Administration Council (SAC) military that seized power on February 1, 2021. The listing covers King Royal Technologies Co., Ltd. (satellite communications services for the Burmese military) and three Wanbao-affiliated copper mining companies (Myanmar Wanbao Mining Copper Ltd., Myanmar Yang Tse Copper Ltd., and Wanbao Mining Ltd.) that maintain revenue-sharing arrangements with Myanmar Economic Holdings Limited (MEHL), a military conglomerate that funds Burma's Ministry of Defence. All four entities face a presumption-of-denial license policy with no exceptions permitted for any items subject to the EAR.

The Data Security Law of the People's Republic of China (中华人民共和国数据安全法) was adopted at the 29th meeting of the 13th NPC Standing Committee on 10 June 2021 and entered into force on 1 September 2021, constituting the second pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Personal Information Protection Law (2021). The DSL establishes a tiered data-classification regime — "important data" and "national core data" — with escalating security obligations including risk assessment, risk monitoring, breach reporting, and classified-protection requirements for data handlers. It introduces a data-export security review for "important data" generated or collected within China, the statutory parent authority operationalised by the 2024 CAC Cross-Border Data Flow Provisions, and enacts a §36 blocking statute prohibiting Chinese organisations and individuals from transferring data stored in China to foreign judicial or law-enforcement authorities without prior PRC government approval.

The Bureau of Industry and Security (BIS) added eight entities to the Entity List — six based in Pakistan and two in the UAE — on grounds that they were acting contrary to US national security or foreign policy interests through involvement in proliferation to unsafeguarded nuclear activities. All EAR items destined for these entities require a license with a presumption of denial; no license exceptions are available. Separately, one China-based entity (Molecular Devices Shanghai Corporation) was removed from the Military End-User (MEU) List, and a second China MEU entry was renamed (Hutchison Optel Telecom Technology → Chongqing Optel Telecom Technology Co., Ltd.).

Regulation (EU) 2021/821, adopted 20 May 2021 and applied from 9 September 2021, establishes the Union regime for controlling exports, brokering, technical assistance, transit, and transfer of dual-use items, repealing Regulation (EC) No 428/2009. Annex I lists controlled items implementing internationally agreed dual-use controls under the Wassenaar Arrangement, MTCR, Australia Group, NSG, and Chemical Weapons Convention. The regulation introduces a new catch-all control on cyber-surveillance technologies that could facilitate human-rights violations (Art. 5 and Annex IV), and strengthens cooperation between Member States and the European Commission, placing specific obligations on exporters. It serves as the statutory anchor for all EU export licences, every multilateral-regime transposition into EU law, and coordination mechanisms with US BIS, UK ECJU, JP METI, and KR MOTIE export-control regimes.

The Bureau of Industry and Security (BIS) amended the Export Administration Regulations (EAR) on April 9, 2021 to extend military-intelligence end-use and end-user controls to Burma (Myanmar) and to apply U.S.-person activity prohibitions to Burma's military-intelligence entities — specifically the Office of Chief of Military Security Affairs (OCMSA) and the Directorate of Signal. The rule also corrected technical errors introduced by BIS's January 15, 2021 interim final rule (FR Doc 2021-01879), which had originally established the military-intelligence end-use and end-user control framework covering China, Cuba, Iran, North Korea, Russia, Syria, and Venezuela. The addition of Burma responded directly to the February 1, 2021 SAC military coup and the Burmese military's use of surveillance technology to oppress civil society, restrict internet access, and imprison protesters.

The Bureau of Industry and Security (BIS) issued an interim final rule on January 15, 2021 substantially expanding the Export Administration Regulations (EAR) Part 744 end-use and end-user control framework to cover military-intelligence entities in China, Cuba, Iran, North Korea, Russia, Syria, and Venezuela. The rule created a new license requirement for exports of ANY EAR-subject item to named military-intelligence end-users — including EAR99-classified items — and separately imposed restrictions on U.S. persons worldwide providing "support" to military-intelligence end-uses or end-users without a BIS licence. It also broadened chemical and biological weapons controls from "will directly assist" to "will support," expanding the reach of §744.4 and §744.3 on WMD-delivery systems. A technical correction published March 17, 2021 (FR Doc 2021-05623) fixed a drafting error in Instruction 9 that would have inadvertently deleted §744.3(a)(3)(i)-(ii), the rocket systems and UAV provisions.

The US Bureau of Industry and Security (BIS) added 47 entities across 51 entries to the EAR Entity List effective 22 September 2020, covering entities in China, Hong Kong, Iran, Pakistan, Canada, Malaysia, Oman, Thailand, Turkey, the UAE, and the UK. All 47 entities were determined to be acting contrary to US national security or foreign policy interests. For 39 of the 47 entities BIS imposed a license requirement for all EAR-subject items with a presumption-of-denial review policy; the remaining eight face case-by-case review. The round targeted Iranian dual-use procurement networks, Chinese military-affiliated research institutes, and Pakistan-linked proliferators, reinforcing the layered export-control perimeter across multiple adversary programs simultaneously.

MOFCOM Order No. 4 of 2020, issued and effective 19 September 2020, establishes the Unreliable Entity List (UEL / 不可靠实体清单) regime — China's primary countermeasure framework for designating foreign companies, organisations, and individuals that are deemed to endanger Chinese national sovereignty, security, or development interests, or that apply discriminatory measures against Chinese entities in violation of normal market principles. The UEL inter-ministerial Working Mechanism, administered through MOFCOM, may impose restrictions or prohibitions on the designated entity's China-related import/export activities, investment in China, and entry or stay of senior personnel in China, as well as fines. Promulgated under the Foreign Trade Law of the PRC and the National Security Law of the PRC, the Provisions serve as the statutory parent for every UEL designation announcement since 2023, and operate as the structural peer of the US BIS Entity List / OFAC SDN architecture and the simultaneously promulgated Anti-Foreign Sanctions Law framework.

Effective 17 August 2020 (published in the Federal Register 20 August 2020, Vol. 85 No. 162, FR Doc 2020-18213), BIS implemented three simultaneous measures targeting Huawei's global supply chain. First, 38 non-U.S. affiliates of Huawei Technologies Co., Ltd. were added to the Entity List with the most restrictive license review policy (presumption of denial) and designated under footnote 1, extending the Huawei-specific Foreign-Produced Direct Product Rule (FDPR) to their operations. Second, the Temporary General License (TGL), which since May 2019 had authorized limited ongoing transactions with Huawei (network maintenance, software updates, standards participation), was allowed to expire on 13 August 2020 and replaced with a narrower authorization. Third, BIS expanded the scope of the Huawei FDPR (General Prohibition Three) to cover foreign-produced items when a footnote 1 entity is a party to any transaction or when the item will be used in the production or development of products for any footnote 1 entity, closing the design-house loophole that had allowed TSMC to supply HiSilicon/Kirin chips as long as Huawei was not the direct importer.

The Investitionskontrollgesetz (InvKG, "Investment Control Act") is Austria's horizontal, statutory FDI screening regime. Published as Article 1 of the Federal Law BGBl. I Nr. 87/2020 on 24 July 2020 and entering into force on 25 July 2020, the Act replaced the previous narrow §§25a–25e Außenwirtschaftsgesetz 2011 (Foreign Trade Act) regime — under which fewer than 10 permits were issued from 2013 to mid-2020 — and transposes EU Regulation 2019/452 establishing a framework for the screening of foreign direct investments into the Union. The InvKG introduces mandatory ex-ante notification and approval of non-EU / non-EEA / non-Swiss acquisitions where the acquirer crosses any of the 10% / 25% / 50% voting-rights thresholds in an Austrian target operating in the critical sectors listed in Annex Part 1 (especially sensitive: defence, energy / water / telecoms critical infrastructure, dual-use technology, cybersecurity, AI, quantum technology, robotics, semiconductors, biotech, health, vaccines) and 25% / 50% in the sectors listed in Annex Part 2 (broader, including media, food-security, electronic communications infrastructure, financial infrastructure). Administered by the Bundesministerium für Arbeit und Wirtschaft (BMAW), with case decisions taken in coordination with the Komitee für Investitionskontrolle (inter-ministerial Investment Control Committee) and, where the case is escalated to the EU cooperation mechanism, the Commission and EU peer Member States. The InvKG is Austria's functional peer of US CFIUS / FIRRMA, UK NSI Act 2021, Germany AWG §§55–62, France Décret 2014-479 / R. 151-1 et seq., Italy Golden Power Decree, Netherlands Wet Vifo, Denmark investeringsscreeningsloven, and Belgium ISC. Sunset clause: originally limited to 30 June 2022 under §17(2) InvKG; permanently extended by BGBl. I Nr. 80/2022 of 14 July 2022.

The Cybersecurity Law of the People's Republic of China (中华人民共和国网络安全法) was adopted at the 24th meeting of the 12th NPC Standing Committee on 7 November 2016 and entered into force on 1 June 2017, establishing the foundational legal framework for network security governance across all sectors. The law creates the Critical Information Infrastructure Operator (CIIO) designation and protection regime administered by the Cyberspace Administration of China (CAC), mandates data localisation for personal information and important data collected or generated by CIIOs in China, and establishes cross-border data-transfer security assessment requirements under Article 37 — the provision later operationalised by DSL 2021, PIPL 2021, and the 2024 CAC Cross-Border Data Flow Provisions. The CSL introduced multi-level protection scheme (等级保护制度 / MLPS) obligations for all network operators and network-product/service security-review procedures, under which CAC triggered the cybersecurity review of Didi Global in 2021 and the exclusion of Micron's products from Chinese critical-infrastructure projects in 2023.