Industrial Policy & Trade Monitor· 2667 actions· ✨ 89 recent

OFAC published a final rule on February 9, 2022 adjusting the maximum civil monetary penalty (CMP) ceiling amounts across multiple statutory sanctions authorities as mandated by the Federal Civil Penalties Inflation Adjustment Act of 1990 (as amended by the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015). The 2022 adjustment reflects the October 2020 to October 2021 CPI-U change (approximately 6.2%), raising the IEEPA ceiling from $311,562 to $330,947, the TWEA ceiling from $91,816 to $97,529, and the Narcotics Kingpin Act maximum from $1,548,075 to $1,644,396. The rule is issued as a final rule effective on publication without prior notice and comment under the non-discretionary "good cause" exemption.

FinCEN published a final rule on January 24, 2022 (87 FR 3729) adjusting the maximum civil monetary penalties (CMPs) for Bank Secrecy Act (BSA) violations under 31 CFR § 1010.821, as mandated by the Federal Civil Penalties Inflation Adjustment Act of 1990 (as amended by the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015). The 2022 multiplier is 1.06222, reflecting the October 2020 → October 2021 CPI-U change per OMB Memorandum M-22-07 of December 15, 2021 — the same unusually large ~6.2% inflationary adjustment applied across all federal agency CMP schedules that cycle. The largest single-penalty ceiling rises to $1,556,481 (due-diligence and special-measures violations under 31 U.S.C. § 5321(a)(7)).

FinCEN amended 31 CFR Part 1010 to remove civil penalty language that had become obsolete following the American Jobs Creation Act of 2004 (AJCA). The AJCA restructured FBAR (Report of Foreign Bank and Financial Accounts) penalties, raising the maximum for willful violations beyond what the pre-existing regulation text authorised, creating an inconsistency between statute and regulation. The final rule is administrative in nature: it deletes superseded penalty provisions and aligns regulatory text with the statutory penalty structure already in force since 2004, imposing no new obligations on FBAR filers.

FinCEN issued a final rule (86 FR 62914, effective 15 November 2021) amending 31 CFR 1010.370 to align its Geographic Targeting Order (GTO) regulations with statutory amendments to 31 U.S.C. 5326 (Bank Secrecy Act). The principal change extends GTO authority to cover nonfinancial trades or businesses in addition to domestic financial institutions — broadening the pool of entities that FinCEN can subject to heightened transaction-reporting and recordkeeping requirements in a designated geographic area. The rule also updates the notification procedure (directing GTOs to chief executive officers) to conform to the amended statute. No new GTO was issued by this rule; it is a framework update enabling future GTO issuance to a wider class of obligees.

The Personal Information Protection Law of the People's Republic of China (中华人民共和国个人信息保护法 — PIPL) was adopted at the 30th meeting of the 13th NPC Standing Committee on 20 August 2021 and entered into force on 1 November 2021, constituting the third and final pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Data Security Law (2021). The PIPL is China's comprehensive personal-information statute establishing consent-based and necessity-based legal bases for PI processing, a tiered cross-border personal-data transfer regime (CAC security assessment / PI protection certification / Standard Contractual Clauses), extraterritorial application (Art. 3) to non-Chinese controllers offering services to or analysing the behaviour of PRC residents, and a heightened protection regime for sensitive personal information and data of minors under 14. It mandates data-protection impact assessments, personal-information-protection-officer obligations at designated handlers, breach notification, and a full suite of data-subject rights including access, rectification, deletion, portability, objection, and automated- decision-making opt-out. Article 53 requires overseas controllers to establish a domestic representative or designated entity in China, providing a domestic enforcement counterparty.

The Data Security Law of the People's Republic of China (中华人民共和国数据安全法) was adopted at the 29th meeting of the 13th NPC Standing Committee on 10 June 2021 and entered into force on 1 September 2021, constituting the second pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Personal Information Protection Law (2021). The DSL establishes a tiered data-classification regime — "important data" and "national core data" — with escalating security obligations including risk assessment, risk monitoring, breach reporting, and classified-protection requirements for data handlers. It introduces a data-export security review for "important data" generated or collected within China, the statutory parent authority operationalised by the 2024 CAC Cross-Border Data Flow Provisions, and enacts a §36 blocking statute prohibiting Chinese organisations and individuals from transferring data stored in China to foreign judicial or law-enforcement authorities without prior PRC government approval.

OFAC published a final rule on March 17, 2021 (86 FR 14534) adjusting the maximum civil monetary penalty (CMP) ceiling amounts across multiple statutory sanctions authorities as mandated by the Federal Civil Penalties Inflation Adjustment Act of 1990 (as amended by the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015). The 2021 adjustment reflects the October 2019 to October 2020 CPI-U change (approximately 1.2%, reflecting COVID-suppressed inflation), raising the IEEPA ceiling from $307,922 to $311,562, the TWEA ceiling from $90,743 to $91,816, and the FNKDA maximum from $1,529,991 to $1,548,075. The rule is issued as a final rule effective on publication without prior notice and comment under the non-discretionary "good cause" exemption.

OFAC published an interim final rule on September 3, 2020 (85 FR 54909; FR_DOC 2020-19237) adjusting civil monetary penalty (CMP) ceiling amounts for recordkeeping and reporting violations under 31 CFR Part 501, effective October 5, 2020. The adjustment is a catch-up correction: recordkeeping/reporting CMPs were inadvertently omitted from the August 1, 2016 initial catch-up adjustment mandated by the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015 (Pub. L. 114-74 § 701). The rule raises the late-filing penalty from $5,000 to $5,942 (per occurrence), the blocked-assets late-filing recurring penalty from $1,000 to $1,189 (per 30-day period), and the failure-to-maintain-records maximum from $50,000 to $59,522.

The Cybersecurity Law of the People's Republic of China (中华人民共和国网络安全法) was adopted at the 24th meeting of the 12th NPC Standing Committee on 7 November 2016 and entered into force on 1 June 2017, establishing the foundational legal framework for network security governance across all sectors. The law creates the Critical Information Infrastructure Operator (CIIO) designation and protection regime administered by the Cyberspace Administration of China (CAC), mandates data localisation for personal information and important data collected or generated by CIIOs in China, and establishes cross-border data-transfer security assessment requirements under Article 37 — the provision later operationalised by DSL 2021, PIPL 2021, and the 2024 CAC Cross-Border Data Flow Provisions. The CSL introduced multi-level protection scheme (等级保护制度 / MLPS) obligations for all network operators and network-product/service security-review procedures, under which CAC triggered the cybersecurity review of Didi Global in 2021 and the exclusion of Micron's products from Chinese critical-infrastructure projects in 2023.

The Federal Act of 22 March 2002 on the Implementation of International Sanctions (Embargogesetz / EmbG, SR 946.231), in force 1 January 2003, is Switzerland's foundational enabling statute authorising the Federal Council to issue coercive-measure ordinances implementing UN Security Council mandatory sanctions (under UN Charter Art. 25 obligations accepted upon Switzerland's 2002 UN accession), OSCE sanctions decisions, and — via the progressive EU-tracking clause — the sanctions of Switzerland's most important trading partners, primarily the EU. The State Secretariat for Economic Affairs (SECO) administers all resulting ordinances; FINMA supervises financial-sector compliance and FOEN supervises trade-in-goods compliance. The EmbG is the parent authority for Switzerland's entire portfolio of approximately 25 country-specific sanctions ordinances, including the Ukraine/Russia ordinance (SR 946.231.176.72 implementing EU Russia packages 1-19+), the Iran ordinance (SR 946.231.143.6), the DPRK ordinance (SR 946.231.127.6), the Myanmar ordinance (SR 946.231.157.5), and the Belarus ordinance (SR 946.231.116.9).