Industrial Policy & Trade Monitor· 2667 actions· ✨ 89 recent

On 19 November 2025, the U.S. Treasury's Office of Foreign Assets Control (OFAC), in a coordinated action with Australia's Department of Foreign Affairs and Trade and the UK's Foreign, Commonwealth and Development Office, designated 5 individuals and 7 companies linked to two Russia-based "bulletproof hosting" (BPH) providers, Media Land and Aeza Group, under Executive Order 13694. Media Land and its subsidiaries (Media Land Technology, Data Center Kirishi, ML Cloud) supplied server infrastructure to ransomware groups including LockBit, BlackSuit and Play. The designations also targeted three companies Aeza Group used to evade its July 2025 OFAC designation and rebrand its infrastructure: Hypercore Ltd. (United Kingdom), Smart Digital Ideas DOO (Serbia), and Datavice MCHJ (Uzbekistan). All designated persons' U.S.-nexus assets are blocked and U.S. persons are prohibited from transacting with them.

The European Investment Fund (EIF), part of the EIB Group, invested EUR 20 million (~USD 23.1 million) on 6 November 2025 in TIN Capital's European Cyber Tech Fund V, a growth-equity vehicle backing European cybersecurity scale-ups. EIF's participation is supported under the European Commission's InvestEU programme; alongside Invest-NL and private investors, the fund closed at over EUR 80 million. The EIF frames the investment as strengthening Europe's digital security and autonomy amid incoming EU cybersecurity regulation (NIS2, the Cybersecurity Act, DORA). Global Trade Alert separately logs the transaction as a "red"-flagged state-linked financial investment-support intervention.

On 17 October 2025 Türkiye's Ministry of Industry and Technology opened the "HIT-AI" call, a USD 1.6 billion support tranche under the HIT-30 High Technology Investment Programme (see `2024-07-26-turkiye-hit-30-high-technology- investment-programme`), targeting large-scale IT investments delivering AI services, managed/self-service cloud offerings, and AI-hardware buildouts of at least USD 100 million. The call bundles multiple instruments — tax reduction up to 60%, capex grants up to 40% (with an additional up to 20% grant specifically for AI-hardware investment), concessional financing up to 70%, employment support, and market-development support up to 20% — and was announced alongside a parallel USD 1.5 billion "HIT-Data Centre" call, a USD 300 million "HIT-Quantum" call, and a USD 1 billion "HIT-Industrial Robot" call. Minister Mehmet Fatih Kacır framed the combined package as designed to mobilise USD 10 billion in data-centre and AI investment by 2030, lifting national data-centre capacity from 250 MW to 1 GW.

On 17 October 2025 Türkiye's Ministry of Industry and Technology opened the "HIT-Data Centre" call, a USD 1.5 billion support tranche under the HIT-30 High Technology Investment Programme (see `2024-07-26-turkiye-hit-30-high-technology-investment-programme`), targeting data-centre facilities of at least 30 MW IT capacity with at least 50% AI-compatible hardware and a Power Usage Effectiveness (PUE) of 1.4 or lower. The call was announced alongside three parallel HIT-30 sector calls — a USD 1.6 billion "HIT-AI" call (see `2025-10-17-turkiye-hit-ai-cloud-infrastructure-call`), a USD 300 million "HIT-Quantum" call, and a USD 1 billion "HIT-Industrial Robot" call — and offers the same tax, grant, financing, employment, and market-development instrument stack used across the HIT-30 programme. Global Trade Alert logs this single government call as two separate "interventions" (tax/social insurance relief and unspecified state aid) under state act 95013.

On 17 October 2025 Türkiye's Ministry of Industry and Technology opened the "HIT-Industrial Robot" call, a USD 1 billion support tranche under the HIT-30 High Technology Investment Programme (see `2024-07-26-turkiye-hit-30-high-technology-investment-programme`), targeting manufacturers that commit to a minimum annual production capacity of 5,000 industrial robots and localisation of critical components (servo motors, reducers/gearboxes, servo drives), plus supporting R&D-centre buildout. The call was announced alongside three parallel HIT-30 sector calls — a USD 1.6 billion "HIT-AI" call (see `2025-10-17-turkiye-hit-ai-cloud-infrastructure-call`), a USD 1.5 billion "HIT-Data Centre" call (see `2025-10-17-turkiye-hit-data-centre-call`), and a USD 300 million "HIT-Quantum" call — and offers the same tax, grant, financing, employment, and market-development instrument stack used across the HIT-30 programme. Global Trade Alert logs this single government call as two separate "interventions" (state loan and tax/social-insurance relief) under state act 95018.

On 17 October 2025 Türkiye's Ministry of Industry and Technology opened the "HIT-Quantum" call, a USD 300 million support tranche under the HIT-30 High Technology Investment Programme (see `2024-07-26-turkiye-hit-30-high-technology-investment-programme`), aimed at building high-capacity infrastructure for quantum computing services, a scalable quantum hardware/software ecosystem for research centres, universities and the private sector, and skilled-workforce development. The call was announced alongside three parallel HIT-30 sector calls — a USD 1.6 billion "HIT-AI" call (see `2025-10-17-turkiye-hit-ai-cloud-infrastructure-call`), a USD 1.5 billion "HIT-Data Centre" call (see `2025-10-17-turkiye-hit-data-centre-call`), and a USD 1 billion "HIT-Industrial Robot" call (see `2025-10-17-turkiye-hit-industrial-robot-call`). Global Trade Alert logs this single government call as three separate "interventions" (financial grant, state loan, and tax/social-insurance relief) under state act 95017.

On 1 July 2025, the U.S. Treasury's Office of Foreign Assets Control (OFAC) designated Aeza Group, a St. Petersburg, Russia-based "bulletproof hosting" (BPH) provider, along with two affiliated companies and four Aeza Group leaders (Arsenii Penzev, Yuri Bozoyan, Vladimir Gast, Igor Knyazev), for supplying server infrastructure that shielded ransomware operators, infostealer groups, and darknet drug marketplaces from law-enforcement takedown. In coordination with the UK's National Crime Agency, OFAC also designated Aeza International Ltd., a UK front company Aeza used to lease IP addresses to cybercriminals. The action was taken under Executive Order 13694 (as amended by E.O. 14144 and E.O. 14306) and builds on OFAC's February 2025 designation of BPH provider ZServers.

The National Assembly of Vietnam passed the Personal Data Protection Law (Luật Bảo vệ dữ liệu cá nhân), Law No. 91/2025/QH15, on 26 June 2025; it enters into force on 1 January 2026. The PDPL is Vietnam's first statutory (rather than decree-level) personal-data-protection framework, elevating the prior Decree 13/2023/ND-CP (PDPD) regime into a 5-chapter, 39-article primary statute and adding revenue-based administrative penalties of up to 5% of prior-year annual revenue for cross-border data-transfer violations and up to 10x illegal gains for unlawful data trading. The law is implemented by Decree 356/2025/ND-CP (issued 31 December 2025, effective 1 January 2026) and applies extraterritorially to foreign organisations offering services to or processing the personal data of Vietnam residents.

Japan's National Diet enacted the Cyber Response Capability Enhancement Act (重要電子計算機に対する不正な行為による被害の防止に関する法律, Law No. 42 of 2025) on 16 May 2025, together with companion arrangement legislation. Commonly known as the Active Cyber Defense (ACD) Law, the statute authorises (i) government monitoring of foreign-origin internet traffic transiting designated Japanese communication infrastructure for national-security threat indicators, (ii) pre-emptive access and neutralisation operations against attacker infrastructure abroad by the National Police Agency and the Self-Defense Forces under unified command, and (iii) mandatory cyber-incident reporting and government cooperation duties on critical-infrastructure operators. Implementation is phased through November 2027, with the NISC reorganised into the National Cybersecurity Office (NCO) under the Cabinet Secretariat from July 2025.

The National Assembly of Vietnam passed the Law on Data (Luật Dữ liệu), No. 60/2024/QH15, on 30 November 2024; it enters into force on 1 July 2025. The Law is Vietnam's first comprehensive horizontal data-governance statute, extending regulation beyond personal data (already covered by Decree 13/2023/ND-CP) to all digital data — public, private, and sectoral. It introduces statutory categories of "important data" (dữ liệu quan trọng) and "core data" (dữ liệu cốt lõi) tied to national-defence and national-security review for cross-border transfer, and establishes the National Data Centre under the Ministry of Public Security plus a statutory data-broker / data-services licensing framework.