Industrial Policy & Trade Monitor· 2665 actions· ✨ 90 recent

The Bureau of Industry and Security (BIS) published a final rule (FR Doc 2023-18772; 88 FR 59927) amending 15 CFR 766.24 of the Export Administration Regulations (EAR) to create an additional option for the renewal of Temporary Denial Orders (TDOs). Under the new provision, BIS may request the Assistant Secretary for Export Enforcement renew a TDO for up to one year — rather than the standard maximum of 180 days — where the record demonstrates a pattern of repeated, ongoing, and/or continuous apparent violations. The rule was motivated by the sustained TDO enforcement campaign against Russian and Belarusian civil aviation entities that began in April 2022 following Russia's invasion of Ukraine.

Regulation (EU) 2023/956 of the European Parliament and of the Council, published in OJ L 130 on 16 May 2023 and entering into force on 17 May 2023, establishes the EU Carbon Border Adjustment Mechanism (CBAM) — the Union's primary instrument for preventing carbon leakage at the external border. The regulation applies an equivalent carbon price to embedded greenhouse gas emissions in imports of six sector groups (iron and steel, aluminium, cement, fertilizers, electricity, and hydrogen) from non-EU/EEA/Swiss counterparts, complementing the EU Emissions Trading System's domestic coverage. A transitional reporting-only phase operated from 1 October 2023 through 31 December 2025; the definitive certificate-purchase-and-surrender regime entered full application from 1 January 2026.

FinCEN published a final rule on January 19, 2023 (88 FR 3312) adjusting the maximum civil monetary penalties for Bank Secrecy Act (BSA) violations under 31 CFR § 1010.821, as mandated by the Federal Civil Penalties Inflation Adjustment Act of 1990 (as amended by the 2015 Improvements Act). The 2023 multiplier is 1.07745, reflecting the October 2021 → October 2022 CPI-U change per OMB Memorandum M-23-05. A correction notice (88 FR 7357, Feb. 3, 2023) revised certain table entries; the corrected amounts are authoritative and are reflected in this filing. The table covers 10 BSA statutory penalty provisions, with the largest single-penalty ceiling rising to $1,677,030.

Regulation (EU) 2022/2065 on a Single Market For Digital Services (Digital Services Act, DSA) was adopted by the European Parliament and Council on 19 October 2022, published in OJ L 277 on 27 October 2022, entered into force on 16 November 2022, and applied in full from 17 February 2024 (with VLOP/VLOSE obligations applying from 25 August 2023 following the Commission's initial designation letters of February 2023). The DSA establishes a graduated intermediary-liability and platform-safety framework covering all online intermediaries serving EU users, with the heaviest obligations falling on designated Very Large Online Platforms (VLOPs, ≥45m monthly active EU users) and Very Large Online Search Engines (VLOSEs): systemic-risk assessments, annual independent audits, vetted-researcher data access, recommender-system transparency, online-advertising transparency, and crisis-response cooperation mechanisms under Commission coordination. The European Commission holds exclusive enforcement authority over VLOPs and VLOSEs, with fines up to 6% of global turnover. The DSA is the structural twin-pillar to the Digital Markets Act (Reg (EU) 2022/1925): the DMA governs ex-ante competition obligations on designated gatekeepers; the DSA governs ex-post intermediary-liability, content-moderation, and platform-safety obligations across all online intermediaries.

The Bureau of Industry and Security (BIS) Office of Antiboycott Compliance amended Supplement No. 2 to Part 766 of the Export Administration Regulations to update penalty determination guidance for administrative enforcement cases involving antiboycott violations. The rule recategorizes violations — Category A now contains only the most serious violations with penalties beginning at the statutory maximum — and eliminates "no admit/no deny" settlements, requiring all settlement agreements to include admissions of fact. The changes apply to all US persons subject to antiboycott provisions, principally those receiving or complying with requests tied to the Arab League boycott of Israel.

Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector (Digital Markets Act, DMA) was published in OJ L 265 on 12 October 2022, entered into force on 1 November 2022, and applied for the most part from 2 May 2023. The DMA establishes an ex-ante competition framework imposing binding obligations and prohibitions on designated "gatekeepers" operating Core Platform Services (CPS) in the EU — covering search engines, social-networking services, video-sharing platforms, number-independent interpersonal communications, operating systems, web browsers, virtual assistants, cloud computing, online intermediation services, and online advertising. The European Commission designated six gatekeepers on 6 September 2023 (Alphabet, Amazon, Apple, ByteDance, Meta, Microsoft); full compliance with all obligations was required by 7 March 2024. Subsequent designations added Booking.com (May 2024) and Apple iPadOS (April 2024). The DMA functions as the EU's structural anchor for ex-ante digital competition regulation, closing the enforcement gap left by ex-post competition law (Articles 101–102 TFEU) where market-tipping dynamics make remedies ineffective after the fact.

FinCEN published a final rule on January 24, 2022 (87 FR 3729) adjusting the maximum civil monetary penalties (CMPs) for Bank Secrecy Act (BSA) violations under 31 CFR § 1010.821, as mandated by the Federal Civil Penalties Inflation Adjustment Act of 1990 (as amended by the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015). The 2022 multiplier is 1.06222, reflecting the October 2020 → October 2021 CPI-U change per OMB Memorandum M-22-07 of December 15, 2021 — the same unusually large ~6.2% inflationary adjustment applied across all federal agency CMP schedules that cycle. The largest single-penalty ceiling rises to $1,556,481 (due-diligence and special-measures violations under 31 U.S.C. § 5321(a)(7)).

FinCEN amended 31 CFR Part 1010 to remove civil penalty language that had become obsolete following the American Jobs Creation Act of 2004 (AJCA). The AJCA restructured FBAR (Report of Foreign Bank and Financial Accounts) penalties, raising the maximum for willful violations beyond what the pre-existing regulation text authorised, creating an inconsistency between statute and regulation. The final rule is administrative in nature: it deletes superseded penalty provisions and aligns regulatory text with the statutory penalty structure already in force since 2004, imposing no new obligations on FBAR filers.

FinCEN issued a final rule (86 FR 62914, effective 15 November 2021) amending 31 CFR 1010.370 to align its Geographic Targeting Order (GTO) regulations with statutory amendments to 31 U.S.C. 5326 (Bank Secrecy Act). The principal change extends GTO authority to cover nonfinancial trades or businesses in addition to domestic financial institutions — broadening the pool of entities that FinCEN can subject to heightened transaction-reporting and recordkeeping requirements in a designated geographic area. The rule also updates the notification procedure (directing GTOs to chief executive officers) to conform to the amended statute. No new GTO was issued by this rule; it is a framework update enabling future GTO issuance to a wider class of obligees.

The Personal Information Protection Law of the People's Republic of China (中华人民共和国个人信息保护法 — PIPL) was adopted at the 30th meeting of the 13th NPC Standing Committee on 20 August 2021 and entered into force on 1 November 2021, constituting the third and final pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Data Security Law (2021). The PIPL is China's comprehensive personal-information statute establishing consent-based and necessity-based legal bases for PI processing, a tiered cross-border personal-data transfer regime (CAC security assessment / PI protection certification / Standard Contractual Clauses), extraterritorial application (Art. 3) to non-Chinese controllers offering services to or analysing the behaviour of PRC residents, and a heightened protection regime for sensitive personal information and data of minors under 14. It mandates data-protection impact assessments, personal-information-protection-officer obligations at designated handlers, breach notification, and a full suite of data-subject rights including access, rectification, deletion, portability, objection, and automated- decision-making opt-out. Article 53 requires overseas controllers to establish a domestic representative or designated entity in China, providing a domestic enforcement counterparty.

The Data Security Law of the People's Republic of China (中华人民共和国数据安全法) was adopted at the 29th meeting of the 13th NPC Standing Committee on 10 June 2021 and entered into force on 1 September 2021, constituting the second pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Personal Information Protection Law (2021). The DSL establishes a tiered data-classification regime — "important data" and "national core data" — with escalating security obligations including risk assessment, risk monitoring, breach reporting, and classified-protection requirements for data handlers. It introduces a data-export security review for "important data" generated or collected within China, the statutory parent authority operationalised by the 2024 CAC Cross-Border Data Flow Provisions, and enacts a §36 blocking statute prohibiting Chinese organisations and individuals from transferring data stored in China to foreign judicial or law-enforcement authorities without prior PRC government approval.

BIS issued a final rule (FR Doc 2020-25453) amending and clarifying Export Administration Regulations (EAR) to implement the export enforcement provisions of the Export Control Reform Act of 2018 (ECRA). The rule replaces legacy references to the Export Administration Act of 1979 (EAA) throughout the EAR with citations to ECRA and other applicable statutes, and formally expands BIS investigative authority to conduct pre-license checks, post-shipment verifications, and enforcement investigations both within and outside the United States. Additional amendments address license issuance procedures, denial orders, and civil penalty payment processes.

The Bureau of Industry and Security (BIS) amended the Export Administration Regulations (EAR) to revise the licensing review policy for items controlled for Crime Control (CC) reasons, explicitly embedding human rights considerations into the review calculus. License applications for CC-controlled items — including stun guns, less-lethal ammunition, restraints, and biometric equipment such as fingerprint analyzers, polygraphs, and voice-stress devices — will be assessed case-by-case, with presumption of denial when the destination country or region exhibits civil disorder or when there is a risk items will be used to violate or abuse human rights (through censorship, surveillance, detention, or excessive force). The rule also extended human rights review as a factor to nearly all other EAR license applications, not only CC-flagged items.

The Bureau of Industry and Security (BIS) establishes procedures under 15 C.F.R. Part 764, Supplement No. 2, for submitting classified national security information ex parte and in camera to courts reviewing enforcement actions taken under the Export Administration Regulations (EAR). Implementing the judicial-review provision of the Export Control Reform Act of 2018 (ECRA § 1702(d)(4)), the rule enables BIS to present classified evidence to a reviewing court without public disclosure, protecting sensitive intelligence sources and methods while preserving respondents' due-process rights. The rule applies to any EAR enforcement action subject to judicial review and was effective upon publication.

MOFCOM Order No. 4 of 2020, issued and effective 19 September 2020, establishes the Unreliable Entity List (UEL / 不可靠实体清单) regime — China's primary countermeasure framework for designating foreign companies, organisations, and individuals that are deemed to endanger Chinese national sovereignty, security, or development interests, or that apply discriminatory measures against Chinese entities in violation of normal market principles. The UEL inter-ministerial Working Mechanism, administered through MOFCOM, may impose restrictions or prohibitions on the designated entity's China-related import/export activities, investment in China, and entry or stay of senior personnel in China, as well as fines. Promulgated under the Foreign Trade Law of the PRC and the National Security Law of the PRC, the Provisions serve as the statutory parent for every UEL designation announcement since 2023, and operate as the structural peer of the US BIS Entity List / OFAC SDN architecture and the simultaneously promulgated Anti-Foreign Sanctions Law framework.

Effective 17 August 2020 (published Federal Register 20 August 2020, Vol. 85 No. 162, FR Doc 2020-17908), BIS issued a final rule clarifying that Entity List license requirements under the Export Administration Regulations (EAR) apply to listed entities regardless of their role in a transaction — as purchaser, intermediate consignee, ultimate consignee, or end-user. Prior regulatory text had been read as applying license requirements only when a listed entity was the ultimate consignee or end-user; this rule amends 15 CFR §§ 744.11 and 744.16 and the introductory text of Supplement No. 4 to Part 744 to close that gap. The clarification is substantively a housekeeping rule (no new entities are listed or delisted), but it removes an exploitable interpretive loophole in Entity List enforcement and was published the same day as the major Huawei affiliate expansion (FR Doc 2020-18213).

Japan's Foreign Exchange and Foreign Trade Act (FEFTA, Act No. 228 of 1 December 1949; 外国為替及び外国貿易法) is the foundational umbrella statute governing the entire modern Japanese economic-statecraft toolkit. Originally a restrictive positive-list regime for foreign-exchange transactions, FEFTA was fundamentally liberalised by the 1980 revision (positive-list to negative-list shift) and again overhauled in 1998 to establish the modern regulatory architecture. Three principal enforcement arms operate under FEFTA: (i) security export controls administered by METI via the Export Trade Control Order and the Foreign Exchange Order (covering the Wassenaar Arrangement, Australia Group, MTCR, NSG, and CWC controlled-items lists plus Japan-specific catch-all controls); (ii) inward FDI screening administered jointly by the Ministry of Finance and sector ministries (prior notification and pre-notification regime, substantially expanded 2019–2020 with Core Business Sectors covering semiconductors, critical minerals, advanced materials, cloud computing, and aerospace added 2021); and (iii) autonomous economic sanctions (asset- freeze and payment-restriction designations against Russia, Iran, DPRK, Myanmar, Belarus, and others via Cabinet Orders made under FEFTA authority). Structurally peer-foundational to the US Trade Expansion Act 1962, US Trade Act 1974, UK SAMLA 2018, CN Export Control Law 2020, and CN Anti-Foreign Sanctions Law 2021 as the G7+CN foundational economic- statecraft statute cluster.