Industrial Policy & Trade Monitor· 2665 actions· ✨ 90 recent

On 23 April 2026, the Council of the European Union adopted the 20th package of restrictive measures against Russia, anchored by Council Regulation (EU) 2026/506 amending Regulation 833/2014 (sectoral sanctions) and Council Regulation (EU) 2026/511 amending Regulation 269/2014 (asset-freeze listings — 120 additional individuals and entities, the largest single tranche in two years). The package operationalises and extends the crypto-sanctions architecture introduced in the 19th package and constructs the legal scaffolding for a future full prohibition on maritime services to vessels carrying Russian crude/petroleum products. Headline measures: (i) full sectoral prohibition on transactions with crypto-asset service providers and exchange platforms established in Russia or Belarus, plus designation of the rouble-backed stablecoin RUBx and the digital rouble (CBDC) on Annex LIII — effective 24 May 2026, with EU support for the digital rouble's development banned outright; (ii) 36 new energy-sector listings spanning upstream extraction, refining and transportation; (iii) prohibition on providing technical, financial, brokering and insurance services to Russia-flagged, Russian-certified or Russian-managed LNG tankers and icebreakers effective 25 April 2026, extending to foreign-flagged vessels operating in Russian interests by January 2027 and culminating in a categorical ban on LNG terminal services to Russian-controlled entities on 1 January 2027; (iv) full transaction ban on 20 Russian banks plus four third-country banks listed for SPFS connectivity / sanctions circumvention; (v) 46 newly listed shadow-fleet vessels and new tanker sale-due-diligence obligations on EU shipping operators; (vi) 58 designations of companies and associated individuals in the Russian military-industrial complex including drone developers/manufacturers; (vii) further Annex IV third-country circumvention enabler listings (China, Hong Kong, Turkey, UAE); (viii) parallel measures against Belarus. Entry into force on 24 April 2026 (day following publication in OJ L_202600506), except for measures with explicit deferred application dates.

The US Treasury's Office of Foreign Assets Control designated 18 individuals and entities that make up the "rahbar" shadow-banking networks of sanctioned Iranian banks Bank Melli and Shahr Bank, including Singapore-based Golden Mist PTE Ltd, UAE-based Empire International Trading FZE and HMS Trading FZE, Iran-based Nikan Pezhvak Aria Kish Company and Tejarat Hermes Energy Qeshm, and UK-based Nanshan Ltd. Separately, OFAC designated senior Iranian security officials, including SCNS Secretary Ali Larijani, for their role in the regime's violent crackdown on peaceful protesters that began in December 2025. The financial designations were made under E.O. 13902 (Iran's financial/petroleum/petrochemical sectors) and the human-rights designations under E.O. 13553 and E.O. 13876, in furtherance of NSPM-2; Treasury noted it sanctioned more than 875 persons, vessels, and aircraft under the same maximum-pressure campaign in 2025.

On 18 November 2025, the European Supervisory Authorities (EBA, ESMA, and EIOPA) jointly designated 19 Critical ICT Third-Party Providers (CTPPs) under DORA Article 31, with immediate effect — the first-ever exercise of direct EU financial-regulator supervision over hyperscale cloud and infrastructure providers. The designated entities include Amazon Web Services, Microsoft Azure, Google Cloud, Deutsche Telekom, Oracle, SAP, IBM, Bloomberg LP, London Stock Exchange Group (LSEG), Tata Consultancy Services, and Orange, among others. Designation triggers direct oversight by a lead ESA (EBA for banking-critical, ESMA for capital-markets-critical, EIOPA for insurance-critical) via Joint Examination Teams (JETs), with powers to conduct investigations, carry out on-site inspections, and impose fines of up to 1% of average daily worldwide turnover per day for non-compliance.

On 23 October 2025, the Council of the European Union adopted the 19th package of restrictive measures against Russia, anchored by Council Regulation (EU) 2025/2033 amending Regulation 833/2014 (sectoral sanctions), Council Implementing Regulation (EU) 2025/2035 amending Regulation 269/2014 (asset-freeze listings — 22 individuals + 42 entities, total 69 listings), and Council Regulation (EU) 2025/2041 (parallel Belarus measures). The package closes the Russian-LNG import loophole left open by the 18th package and establishes the architectural template for crypto-asset sanctions. Headline measures: (i) full prohibition on imports of Russian-origin LNG into the EU — short-term contracts banned six months from entry into force (effective 25 April 2026), long-term contracts (> 1 year, executed before 17 June 2025) phased out by 1 January 2027; (ii) full transaction ban on Rosneft and Gazprom Neft (tightening prior partial measures); (iii) five additional Russian banks added to Annex XIV transaction ban (Alfa-Bank, MTS Bank among them; effective 12 November 2025); (iv) full transaction bans on the Mir card payment system and the Faster Payments System (SBP), effective 25 January 2026; (v) first-ever EU sanctions on a stablecoin — the rouble-backed A7A5 (issuer + developer designated) — and a Paraguay-based cryptocurrency exchange used as a circumvention rail; (vi) prohibition on EU operators contracting with 11 listed Russian Special Economic Zones (Annex LII), with mandatory divestment from Alabuga (Tatarstan) and Technopolis Moscow effective 25 January 2026 — no five-year wind-down available; (vii) 45 entities added to Annex IV military end-user list (28 Russian + 17 third-country: 12 Chinese/Hong Kong, 3 Indian, 2 Thai); (viii) new export restrictions on electronic components, microelectronics, acyclic hydrocarbons, pneumatic rubber tires and propellant chemicals (~EUR 155 m of EU 2024 exports); (ix) prohibition on supply of AI, HPC, and quantum-computing services to Russian persons (effective 25 November 2025); (x) tourism-services ban (1 January 2026 wind-down); (xi) 117 additional shadow-fleet vessels listed (cumulative 557, exceeding the 18th package's 444); (xii) four Belarus + Kazakhstan banks listed for SPFS use (effective 2 December 2025); (xiii) binding ownership/control definitions added to Reg. 269/2014 (50 % proprietary-rights threshold + eight-criterion control test). Entry into force on 24 October 2025 (day following publication in OJ L_202502033), except for measures with explicit deferred application dates.

FinCEN issued a final rule under Section 311 of the USA PATRIOT Act (31 U.S.C. § 5318A) prohibiting US covered financial institutions from opening or maintaining a correspondent account for, or on behalf of, Cambodia-based Huione Group, a foreign financial institution found to be of primary money-laundering concern. Treasury determined that Huione Group and its subsidiaries — including Haowang Guarantee, Huione Pay PLC, and Huione Crypto — laundered at least $4 billion of illicit proceeds between August 2021 and January 2025, including funds tied to North Korean cyber-heist actors and Southeast Asian "pig-butchering" investment-scam compounds. The rule also imposes a special-due-diligence requirement on US covered institutions to guard against indirect access via foreign correspondent accounts. Effective November 17, 2025.

Presidential Decree No. 693 of 30 September 2025 ("On certain particularities of the sale of property held in federal ownership"), signed by Vladimir Putin and entered into force on the day of its official publication, creates an accelerated pathway for disposing of federally-owned property in cases determined by a separate decision of the President, where the goal is to ensure the Russian Federation's defence capability and security. Market valuation and the appraisal report must be completed within 10 business days of signing the appraisal contract; PSB Bank JSC (formerly Promsvyazbank, the state-controlled defence-procurement bank) is designated as the sale-organising agent and seller-on-behalf-of-the-state. The Decree also authorises the President to set special features of how Russian legislation on privatisation, joint-stock companies, limited-liability companies, the securities market, banks and competition protection applies to such sales. Expressly framed as a counter-measure to "unfriendly" actions by the United States and its allies; structurally the disposal-mechanism complement to the foreign-asset external- administration and seizure decrees (95/322/520/442) — the fast-track liquidation channel that converts seized or nationalised assets into state-budget cash for defence purposes.

The US Treasury's Office of Foreign Assets Control designated two Iranian financial facilitators — Alireza Derakhshan and Arash Estaki Alivand — along with more than a dozen Hong Kong- and UAE-based individuals and entities for operating a shadow-banking network that laundered proceeds from Iranian oil sales through front companies and cryptocurrency. The designated addresses account for over $600 million in total inflows, including more than $100 million in cryptocurrency purchases tied to oil sales between 2023 and 2025. Proceeds are alleged to benefit the IRGC-Qods Force and Iran's Ministry of Defense and Armed Forces Logistics (MODAFL). This is the second round of OFAC sanctions targeting Iran's shadow-banking infrastructure since National Security Presidential Memorandum 2 (NSPM-2) directed a maximum-pressure campaign on Iran in February 2025.

Czech Republic's first standalone federal statute on the resilience of critical-infrastructure entities — Act No. 266/2025 Sb., "Zákon o odolnosti subjektů kritické infrastruktury a o změně souvisejících zákonů" (Critical Infrastructure Act). Transposes EU Directive 2022/2557 (CER Directive on the resilience of critical entities) into Czech law and removes critical-infrastructure regulation from the earlier crisis-management law (Zákon č. 240/2000 Sb.) into a dedicated statute. Covers the 11 CER-Directive sectors (energy, transport, banking, financial-market infrastructure, health, drinking water, wastewater, digital infrastructure, public administration, space, food production-processing-distribution) and obligates designated operators of essential services to conduct risk analyses, implement technical/organisational resilience measures, report incidents to sector-competent authorities, and submit to inspection. Published in the Sbírka zákonů on 4 August 2025; in force 19 August 2025; operator information-obligation deadline 1 March 2026.

On 18 July 2025, the Council of the European Union adopted the 18th package of restrictive measures against Russia, anchored by Council Regulation (EU) 2025/1494 amending Regulation 833/2014 (sectoral measures), Council Implementing Regulation (EU) 2025/1476 implementing Regulation 269/2014 (asset-freeze listings), Council Decision (CFSP) 2025/1495 (vessel listings), and Council Regulation (EU) 2025/1472 (parallel Belarus measures). The package is the largest energy-sector escalation since 2022 and pivots from new-perimeter creation toward enforcement and circumvention closure. Headline measures: (i) the Russian-crude price cap is lowered from USD 60 to USD 47.6 per barrel with a new automatic dynamic mechanism re-indexing the cap to global oil prices every six months at a 15 % discount to the 22-week trailing average (effective 3 Sep 2025, with a transitional exemption to 18 Oct 2025 for pre-20 Jul 2025 contracts compliant with the prior cap); (ii) full transaction ban extended to 22 additional Russian banks, bringing the total cut off from the EU financial system to 45; transaction ban extended to third-country financial institutions and crypto-asset service providers facilitating circumvention; (iii) full transaction ban on Nord Stream 1 and Nord Stream 2 pipelines; (iv) import ban on refined oil products derived from Russian crude processed in third countries; (v) 105 additional vessels added to the shadow-fleet port-access ban (cumulative total 444); (vi) 26 new entities added to Annex IV military end-user list (15 Russian + 11 from China/Hong Kong/Turkey); (vii) Council Implementing Regulation 2025/1476 lists 14 individuals + 41 entities under asset-freeze, including a major Indian refinery (Nayara Energy, part-owned by Rosneft), three Chinese suppliers of battlefield goods, shadow-fleet operators, and entities involved in the deportation of Ukrainian children; (viii) parallel Belarus complementary measures via Regulation 2025/1472. Wind-down periods vary: 90 days for oil-price-cap contracts; banking-software wind-down to 30 Sep 2025; trade-goods wind-downs Oct 2025–Jan 2026 by category. Entry into force on 19 July 2025 (day following publication in the Official Journal), except for measures with explicit deferred application dates.

On 11 April 2025 President Javier Milei signed Decreto de Necesidad y Urgencia 269/2025, published in the Boletín Oficial on 14 April 2025 (edición Nº 35.647). The decree repealed Decreto 28/2023, formally lifting the cepo cambiario — the foreign-exchange restrictions that had been in continuous operation in some form since November 2011. Operative provisions include elimination of the 80/20 export-proceeds-channelling mandate, removal of individual USD purchase and wire-transfer caps, permission for companies to repatriate post-1-January-2025 dividend profits, and replacement of the daily crawling-peg with a band float within a $1,000–$1,400 ARS/USD corridor with BCRA floor/ceiling intervention rules. The measure was coordinated with the IMF Extended Fund Facility (USD 20bn total; USD 15bn 2025 free-availability tranche) approved 11 April 2025, and operationalises the currency-stability guarantee embedded in the RIGI large- investment regime (Law 27.742, July 2024).

On 24 February 2025 President Prabowo Subianto launched Badan Pengelola Investasi Daya Anagata Nusantara (Danantara), Indonesia's new state investment-management agency, consolidating around USD 900bn–1tn of Indonesian state-owned-enterprise assets — including Pertamina, PLN, Bank Mandiri, BRI, BNI, Telkom, MIND ID, Antam and Inalum — into a single super-holding modelled on Singapore's Temasek. Danantara was created by the Third Amendment to the BUMN Law (Law No. 1 of 2025, enacted 24 February 2025) and Government Regulation No. 10 of 2025 on its organisation and governance, with board appointments formalised by Presidential Regulation No. 30 of 2025. The agency reports directly to the President, bypassing the Ministry of State-Owned Enterprises, and is mandated to deploy SOE balance-sheet capacity into Prabowo's 8% growth target via co-investment in mineral downstreaming, refinery and EV-battery build-out, food security, and semiconductor / data-centre infrastructure.

Ethiopia's Banking Business Proclamation No. 1360/2025, ratified by the House of Peoples' Representatives on 17 December 2024 and gazetted in March 2025, repeals Proclamation 592/2008 and opens Ethiopia's banking sector to foreign participation for the first time since the 1974 Derg-era nationalisations. Foreign banks may enter via subsidiary establishment, branch licensing, representative offices, or equity acquisition in existing domestic banks. A single strategic foreign investor is capped at 40% ownership per domestic bank, with aggregate foreign ownership across all investors capped at 49%. The reform positions Ethiopia — Africa's second-most-populous country — as a competitor to Nairobi, Lagos, and Johannesburg as an African banking centre, unlocking entry plans by Standard Bank, KCB Group, Equity Bank, ABSA, and GCC-based institutions.

FinCEN issued a final rule under Section 311 of the USA PATRIOT Act (31 U.S.C. § 5318A) prohibiting US covered financial institutions from opening or maintaining a correspondent account for, or on behalf of, Iraq-based Al-Huda Bank, a foreign financial institution found to be of primary money-laundering concern. Treasury determined that Al-Huda Bank exploited its access to US dollars to support designated Foreign Terrorist Organizations including Iran's Islamic Revolutionary Guard Corps (IRGC) and IRGC-Quds Force, as well as Iran-aligned Iraqi militias Kata'ib Hizballah and Asa'ib Ahl al-Haq. The rule also imposes a special-due-diligence requirement on US covered institutions to guard against indirect access via foreign correspondent accounts. Published in the Federal Register on July 3, 2024; effective August 2, 2024.

Presidential Decree No. 442 of 23 May 2024 establishes a special judicial-administrative procedure by which the Russian Federation or the Central Bank of the Russian Federation can claim, before a Russian court, that an "unjustified deprivation" of Russian sovereign property has been effected by a state body or judicial authority of the United States — and, on a court finding to that effect, receive equivalent-value US-affiliated property located in Russia (real assets, securities issued by Russian companies, cash held in Russian bank accounts, and other property rights) by way of compensation. The mechanism is an explicit reciprocal counter-instrument to the US REPO for Ukrainians Act (Title II of H.R.815, signed 24 April 2024) authorising US executive confiscation of immobilised Russian sovereign assets in US jurisdiction. The decree is structurally extensible: by separate presidential decision, the same procedure may be applied to any other state Russia designates as "unfriendly". Implementing procedural acts and amendments to Russian legislation were required to be adopted by 23 September 2024.

Three Commission Delegated Regulations (CDR 2024/1772, 1773, 1774) adopted 13 March 2024 and published in the EU Official Journal on 25 June 2024 constitute the first batch of binding Level 2 implementing rules under DORA (Regulation (EU) 2022/2554). CDR 2024/1772 sets ICT incident classification criteria and materiality thresholds for mandatory reporting; CDR 2024/1773 specifies the required content of contractual policies for ICT third-party services supporting critical or important functions; CDR 2024/1774 defines the ICT risk management tools, methods, processes, and policies — including a simplified framework for smaller in-scope entities. All three apply from 17 January 2025 alongside the parent DORA regulation, covering approximately 22,000 EU regulated financial entities.

Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities, published OJ L 333, 27 December 2022, entered into force 16 January 2023, with Member State transposition deadline 17 October 2024 (rules applicable from 18 October 2024). The CER Directive repeals Council Directive 2008/114/EC on European Critical Infrastructures, extending the scope from two sectors (energy, transport) to eleven essential-service sectors: energy, transport, banking, financial market infrastructures, health, drinking water, wastewater, digital infrastructure, public administration, space, and food. Member States must adopt national resilience strategies, conduct risk assessments at least every four years, identify "critical entities" providing essential services whose disruption would have significant cross-border impacts, and ensure those entities implement technical, security, and organisational resilience measures, business-continuity plans, incident-reporting obligations, and personnel-security background checks. The CER Directive is the physical and hybrid resilience twin to the NIS2 Directive (2022/2555) — the two instruments form the binding EU critical-infrastructure-protection architecture replacing the 2008/114/EC regime.

Regulation (EU) 2022/2554 (Digital Operational Resilience Act, DORA) is the EU's first horizontal cyber- and ICT-resilience instrument for the financial sector. Adopted 14 December 2022 and published in the Official Journal on 27 December 2022, it entered into force on 16 January 2023 and applies from 17 January 2025. DORA covers approximately 22,000 EU regulated financial entities across ~20 entity types (credit institutions, insurers, investment firms, CCPs, trading venues, crypto-asset service providers, etc.) under five pillars: ICT risk management, ICT-incident reporting, digital operational resilience testing (including threat-led penetration testing for significant entities), ICT third-party risk management, and information sharing. Structurally novel, DORA establishes the Critical ICT Third-Party Provider (CTPP) oversight regime under which the European Supervisory Authorities (EBA, ESMA, EIOPA) acquire direct supervisory powers over hyperscale cloud providers (AWS, Azure, GCP, Oracle) servicing EU financial entities — the first EU mechanism for ESA direct oversight of non-financial cloud providers.

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), published OJ L 333, 27 December 2022, entered into force 16 January 2023. NIS2 repeals and substantially expands the 2016 NIS1 Directive (2016/1148), extending the scope from ~7 sectors to 18 enumerated essential and important sectors, imposing binding cybersecurity risk- management and incident-reporting obligations on covered entities, introducing board-level management accountability, and mandating Member State transposition by 17 October 2024. NIS2 is the structural EU statutory anchor for national cybersecurity frameworks across the bloc, operating alongside DORA (Reg 2022/2554) for financial-sector digital resilience and CRA (Reg 2024/2847) for product cybersecurity.

The Wet veiligheidstoets investeringen, fusies en overnames ("Vifo Act") is the Netherlands' cross-sector statutory FDI screening regime. Adopted by the States-General on 18 May 2022 (Stb. 2022, 215) and entered into force on 1 June 2023 together with two implementing decrees (Stb. 2023, 173 — main implementing decree; Stb. 2023, 172 — decree defining the scope of "sensitive technology"), the Act establishes mandatory pre-closing notification and a security review by the Bureau Toetsing Investeringen (BTI, part of the Ministry of Economic Affairs and Climate) for transactions affecting (i) "vital providers" in critical infrastructure sectors — energy, transport, telecoms, port operators, banking infrastructure — and (ii) Dutch undertakings active in "sensitive technology", defined to include EU Reg 2021/821 Annex I dual-use items, military goods, and additional national-security technologies. The regime applies retrospectively to transactions completed after 8 September 2020. It is the foundational instrument under which the Dutch national export-control measures on ASML DUV immersion lithography (filed: 2023-06-30 and 2024-09-07) operate, and the Dutch peer of US CFIUS, EU Regulation 2019/452, the German AWG §§55-62, the French Décret 2014-479 / R. 151-1 et seq., and the UK NSI Act 2021.

Between 22 and 28 February 2022 — coinciding with Russia's full-scale invasion of Ukraine — OFAC issued a Financial Services Sectoral Determination and four directives under Executive Order 14024 of April 15, 2021. Together they authorise designation of any person operating in Russia's financial sector, prohibit US persons from trading Russian sovereign debt, bar US banks from maintaining correspondent accounts for designated Russian financial institutions (Sberbank, Alfa-Bank and others), prohibit new investment in certain Russia-related entities, and block all transactions involving the Central Bank of the Russian Federation, the National Wealth Fund, and the Ministry of Finance — effectively freezing approximately USD 640 billion in Russian sovereign reserves held in Western financial systems. The package was formally published in the Federal Register on 31 May 2022.

On 8 October 2020, the US Treasury's Office of Foreign Assets Control (OFAC) determined that section 1(a)(i) of Executive Order 13902 (10 January 2020) applies to the financial sector of the Iranian economy, exposing non-US persons that operate in or knowingly facilitate significant transactions with that sector to secondary sanctions. Concurrently, OFAC designated eighteen Iranian banks (sixteen under E.O. 13902, one as an owned-or-controlled affiliate, and Hekmat Iranian Bank under E.O. 13382 non-proliferation authority). After a 45-day wind-down, the secondary-sanctions exposure became effective on 22 November 2020. The determination was formally republished in the Federal Register on 1 October 2025 (FR Doc 2025-19123) under Trump 2.0's maximum-pressure restoration; the underlying economic measure dates to the 2020 action.

Tanzania's Parliament enacted Act No. 5 of 2017, the Natural Wealth and Resources (Permanent Sovereignty) Act, as part of a landmark resource-nationalism legislative trio (alongside Act No. 6 on unconscionable contract renegotiation and Written Laws Miscellaneous Amendments No. 7), signed into law by President John Magufuli on 4 July 2017. The Act vests all of Tanzania's natural wealth and resources — minerals, oil and natural gas, fisheries, wildlife, forestry, water, and related sub-surface assets — as the permanent and inalienable property of the People of the United Republic, held in trust by the President on their behalf. Key operative provisions prohibit international commercial arbitration of natural-resource disputes (mandating adjudication within Tanzanian courts under Tanzanian law), empower Parliament to review and require renegotiation of any natural-resource arrangement containing "unconscionable terms," impose an in-country banking rule on earnings from natural wealth extraction, and authorise statutory override of contractual stabilisation clauses embedded in pre-2017 mining development agreements. The Act is the foundational parent statute underpinning all subsequent Tanzanian mining-sector reform, including the 2024 Written Laws (Miscellaneous Amendments) (No. 4) Act critical/strategic minerals classification and the 2025 Finance Act mining amendments.

The International Emergency Economic Powers Act of 1977 (IEEPA, Title II of Pub. L. 95-223, 91 Stat. 1626, codified at 50 U.S.C. §§ 1701–1708) was signed by President Carter on 28 December 1977 and grants the President sweeping authority to declare a national emergency with respect to "any unusual and extraordinary threat, which has its source in whole or substantial part outside the United States, to the national security, foreign policy, or economy of the United States" — and then to investigate, regulate, direct, compel, nullify, void, prevent, or prohibit any transaction in, or involving, foreign exchange, banking transfers, importing, exporting, or dealings in property by persons subject to US jurisdiction. IEEPA is the parent enabling statute for every OFAC-administered autonomous sanctions program (Russia, Iran, DPRK, Venezuela, Cuba, Syria, Belarus, Myanmar, cyber, Global Magnitsky, Hong Kong, ICC, and others) as well as the legal basis for the entire Trump-era IEEPA-tariff regime (EO 14193–14195 fentanyl tariffs, Canada/Mexico/China; EO 14257 reciprocal-tariff framework; EO 14323 Brazil; EO 14380 Cuba; EO 14382 Iran; and the US-India interim tariff agreement). Between 1977 and 2025 Presidents invoked IEEPA in 77 national-emergency declarations; of these, 7+ directly parent IPTM-filed implementing actions, with ~dozens of OFAC SDN designation actions tracing their legal root to this statute.