Industrial Policy & Trade Monitor· 2667 actions· ✨ 89 recent

FinCEN amended 31 CFR Part 1010 to remove civil penalty language that had become obsolete following the American Jobs Creation Act of 2004 (AJCA). The AJCA restructured FBAR (Report of Foreign Bank and Financial Accounts) penalties, raising the maximum for willful violations beyond what the pre-existing regulation text authorised, creating an inconsistency between statute and regulation. The final rule is administrative in nature: it deletes superseded penalty provisions and aligns regulatory text with the statutory penalty structure already in force since 2004, imposing no new obligations on FBAR filers.

FinCEN issued a final rule (86 FR 62914, effective 15 November 2021) amending 31 CFR 1010.370 to align its Geographic Targeting Order (GTO) regulations with statutory amendments to 31 U.S.C. 5326 (Bank Secrecy Act). The principal change extends GTO authority to cover nonfinancial trades or businesses in addition to domestic financial institutions — broadening the pool of entities that FinCEN can subject to heightened transaction-reporting and recordkeeping requirements in a designated geographic area. The rule also updates the notification procedure (directing GTOs to chief executive officers) to conform to the amended statute. No new GTO was issued by this rule; it is a framework update enabling future GTO issuance to a wider class of obligees.

The Personal Information Protection Law of the People's Republic of China (中华人民共和国个人信息保护法 — PIPL) was adopted at the 30th meeting of the 13th NPC Standing Committee on 20 August 2021 and entered into force on 1 November 2021, constituting the third and final pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Data Security Law (2021). The PIPL is China's comprehensive personal-information statute establishing consent-based and necessity-based legal bases for PI processing, a tiered cross-border personal-data transfer regime (CAC security assessment / PI protection certification / Standard Contractual Clauses), extraterritorial application (Art. 3) to non-Chinese controllers offering services to or analysing the behaviour of PRC residents, and a heightened protection regime for sensitive personal information and data of minors under 14. It mandates data-protection impact assessments, personal-information-protection-officer obligations at designated handlers, breach notification, and a full suite of data-subject rights including access, rectification, deletion, portability, objection, and automated- decision-making opt-out. Article 53 requires overseas controllers to establish a domestic representative or designated entity in China, providing a domestic enforcement counterparty.

The Data Security Law of the People's Republic of China (中华人民共和国数据安全法) was adopted at the 29th meeting of the 13th NPC Standing Committee on 10 June 2021 and entered into force on 1 September 2021, constituting the second pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Personal Information Protection Law (2021). The DSL establishes a tiered data-classification regime — "important data" and "national core data" — with escalating security obligations including risk assessment, risk monitoring, breach reporting, and classified-protection requirements for data handlers. It introduces a data-export security review for "important data" generated or collected within China, the statutory parent authority operationalised by the 2024 CAC Cross-Border Data Flow Provisions, and enacts a §36 blocking statute prohibiting Chinese organisations and individuals from transferring data stored in China to foreign judicial or law-enforcement authorities without prior PRC government approval.

Denmark's foundational cross-sector horizontal FDI screening statute. Lov nr 842 of 10 May 2021 — investeringsscreeningsloven — was adopted by the Folketing on 4 May 2021, signed on 10 May 2021, and entered into force on 1 July 2021 (with application to transactions implemented from 1 September 2021). The Act is administered by Erhvervsstyrelsen (Danish Business Authority) and combines (i) a mandatory pre-closing authorisation regime for foreign investments in "particularly sensitive sectors" — defence, dual-use products, IT-security functions/services, critical technology, critical infrastructure — triggered at 10% ownership / voting rights or equivalent control, with (ii) a voluntary notification scheme (typically engaged at 25%+) for foreign investments and special economic agreements in other sectors. Enforcement runs through blocking orders, unwinding orders, and criminal sanctions including fines and imprisonment. Structural peer of the US CFIUS regime, EU Regulation 2019/452, the German AWG §§55-62, the French Décret 2014-479 / R. 151-1 et seq., the UK NSI Act 2021, the Netherlands Wet Vifo, the Italian Golden Power Decree, and the Swedish FDI screening regime.

On 20 January 2021, DOE's Office of Fossil Energy (now FECM), managed through the National Energy Technology Laboratory, announced Funding Opportunity Announcement DE-FOA-0002404, making USD 28.35 million available for cost-shared R&D projects developing advanced midstream processing technologies for rare earth elements and critical minerals from coal and coal by-products, for industrial and manufacturing applications. Applications were due 1 March 2021, with up to eight Phase 1 awards anticipated; no specific recipients were named at announcement.