Industrial Policy & Trade Monitor· 2667 actions· ✨ 89 recent

The Republic of Korea's National Assembly passed the Framework Act on the Development of Artificial Intelligence and the Establishment of a Foundation for Trustworthiness ("AI Basic Act") in plenary session on 26 December 2024, consolidating 19 separate AI bills tabled in the 22nd National Assembly. The statute was promulgated on 21 January 2025 and takes effect on 22 January 2026 after a one-year preparation period. Korea becomes the second jurisdiction worldwide — after the EU AI Act — to enact a comprehensive horizontal AI law, and the first in the Asia-Pacific. The Act establishes a risk-tiered regime targeting "high-impact" AI in healthcare, energy, public services, employment decisions, and generative-AI labelling, with extraterritorial reach over foreign providers whose systems affect the Korean market or users (mandatory local representative). It creates an AI Safety Institute, a national AI policy "control tower," and R&D / standardisation programmes under MSIT. Penalties are modest by international comparison — fines up to KRW 30 million plus a one-year grace period before full enforcement.

Malaysia's Personal Data Protection (Amendment) Act 2024 (Act A1727), gazetted 17 October 2024, enters its third and final commencement phase on 1 June 2025 per commencement order P.U.(B) 522/2024. Phase 3 activates sections 6 and 9 of the amending Act, which impose mandatory Data Protection Officer (DPO) appointment thresholds, a 72-hour breach-notification duty to the Commissioner, and a statutory data-portability right, bringing Malaysia's PDPA broadly into alignment with GDPR and the ASEAN Model AI Governance Framework.

The Office of Foreign Assets Control (OFAC) issued a final rule on 19 December 2024 amending 32 parts of 31 CFR chapter V to modernize the general licenses authorizing payments for legal services from funds originating outside the United States. The rule replaces the annual reporting requirement that had applied to such payments with a 10-year recordkeeping requirement, aligning the legal-services general licenses with the new 10-year statute of limitations for IEEPA/TWEA violations and OFAC's parallel 5→10-year recordkeeping extension (31 CFR 501). The rule also standardises legal-services general-license language across programs — removing legacy letter-of-engagement prerequisites in certain parts (e.g., 31 CFR 594, 597), updating 31 CFR 549 (Lebanon) and 31 CFR 576 (Iraq Stabilization and Insurgency) to remove the requirement that payments for authorised legal services be separately specifically licensed, and harmonising the 31 CFR 591 (Venezuela-related) authorisation language. The rule was effective 19 December 2024 with an applicability date of 12 March 2025.

UAE Cabinet Decision No. 142 of 2024, announced 9 December 2024 and formally gazetted 11 February 2025, introduces a Domestic Minimum Top-Up Tax (DMTT) on UAE constituent entities of Multinational Enterprise (MNE) groups with consolidated annual revenues ≥ EUR 750 million in at least two of the four preceding fiscal years. The DMTT ensures a 15% minimum effective tax rate (ETR) on UAE-source profits, functioning as a Qualified Domestic Minimum Top-up Tax (QDMTT) under the OECD/G20 Pillar Two GloBE framework, thereby giving the UAE first-priority taxing right before any IIR top-up by a parent-jurisdiction authority. The measure applies to fiscal years beginning on or after 1 January 2025. The UAE deliberately excluded the Income Inclusion Rule (IIR) and Under-Taxed Profits Rule (UTPR) from this primary instrument, deferring those to subsequent Cabinet Decisions; the QDMTT-only architecture mirrors Singapore's MEMTA and Switzerland's MindStV as the first-mover design choice for established low-tax financial hubs.

The National Assembly of Vietnam passed the Law on Data (Luật Dữ liệu), No. 60/2024/QH15, on 30 November 2024; it enters into force on 1 July 2025. The Law is Vietnam's first comprehensive horizontal data-governance statute, extending regulation beyond personal data (already covered by Decree 13/2023/ND-CP) to all digital data — public, private, and sectoral. It introduces statutory categories of "important data" (dữ liệu quan trọng) and "core data" (dữ liệu cốt lõi) tied to national-defence and national-security review for cross-border transfer, and establishes the National Data Centre under the Ministry of Public Security plus a statutory data-broker / data-services licensing framework.

The U.S. Treasury's Office of Foreign Assets Control (OFAC) published in the Federal Register (89 FR 84472–84474, FR Doc 2024-24524) three general licenses issued under the Western Balkans Stabilization Regulations (31 CFR Part 588): GL 3A, GL 4, and GL 5. All three were originally issued on 18 June 2024 concurrent with OFAC's expansion of Republika Srpska / Dodik-network designations; the 23 October 2024 Federal Register notice formalises them per the Administrative Procedure Act notice requirements. GL 3A (which superseded GL 3 of 16 November 2023) authorises transactions involving certain WBSR-blocked entities that are ordinarily incident and necessary to the exportation or re-exportation of agricultural commodities, medicine, medical devices, replacement parts and components, software updates, or activities involving medical prevention, diagnosis, treatment, or clinical trials. GL 4 authorises wind-down transactions with entities blocked on 18 June 2024 through a defined cutoff. GL 5 authorises transactions ordinarily incident and necessary to the manufacture, distribution, operation, installation, or maintenance/repair of drinking-water pumps manufactured or distributed by the WBSR-blocked Bosnian Serb entity Kaldera Company EL PGP d.o.o. (and 50%-or-more-owned subsidiaries), preserving municipal water supply continuity.

FinCEN published a final rule (FR Doc 2024-23920, 89 FR 83782, effective on publication October 18, 2024) clarifying the public-utility exemption to the Corporate Transparency Act's beneficial ownership information (BOI) reporting rule. The amendment to 31 CFR 1010.380(c)(2)(xv) corrects a drafting cross-reference so the exemption explicitly covers any regulated public utility under 26 U.S.C. 7701(a)(33)(A) *or* (D) that provides telecommunications services, electrical power, natural gas, or water and sewer services within the United States. The change codifies FinCEN's June 10, 2024 telecommunications-provider guidance and is effective immediately upon publication; it neither expands nor restricts the underlying universe of reporting companies beyond aligning the rule text with the CTA statute.

Regulation (EU) 2024/2747, adopted on 9 October 2024 and published in the Official Journal on 8 November 2024, establishes the EU's first dedicated framework to anticipate, prepare for and respond to crises affecting the internal market. IMERA creates a two-tier "vigilance" / "emergency" mode architecture, sets up the Internal Market Emergency and Resilience Board (IMERB) to coordinate Member States and advise the Commission, and equips the Commission with last-resort powers including mandatory information requests to economic operators, priority-rated orders for crisis-relevant goods, fast-track conformity-assessment procedures, and rules to safeguard free movement of goods, services and persons. The regulation amends Council Regulation (EC) No 2679/98 (the "Strawberries Regulation") and becomes applicable on 29 May 2026.

Australia's first standalone cyber-security statute (Act No. 98 of 2024), passed by Parliament on 25 November 2024 and granted Royal Assent on 29 November 2024, with provisions commencing in tranches through 30 May 2025. The Act creates four binding regimes: (i) mandatory security-of-things standards for connected and IoT products supplied in Australia under regulations administered by the Department of Home Affairs; (ii) a mandatory ransomware / cyber-extortion payment disclosure regime requiring reporting business entities with annual turnover above AUD 3 million to notify the Australian Signals Directorate within 72 hours of any ransom payment made by or on behalf of the entity; (iii) a statutory Cyber Incident Review Board to conduct no-blame post-incident reviews of significant cyber incidents; and (iv) a "limited use" protection restricting how information voluntarily shared with the National Cyber Security Coordinator may be used by Commonwealth agencies. The Act implements core initiatives from the 2023-2030 Australian Cyber Security Strategy and affects every firm selling connected devices into Australia or operating above the turnover threshold in Australia.

The Office of Foreign Assets Control (OFAC) issued a final rule on 8 October 2024 amending the Reporting, Procedures and Penalties Regulations (RPPR) at 31 CFR Part 501. The rule finalises portions of OFAC's 10 May 2024 interim final rule and adds three exceptions to the requirement to file a report with OFAC concerning blocked property that is unblocked or transferred. It also implements other technical clarifications to OFAC's reporting framework. The rule takes effect on 7 November 2024.

On 6 September 2024 China's National Development and Reform Commission (NDRC) and Ministry of Commerce (MOFCOM) jointly issued Order No. 23, the Special Administrative Measures (Negative List) for Foreign Investment Access (2024 Edition), effective 1 November 2024. The 2024 list reduces nationwide restrictions from 31 to 29 entries, removing the last two manufacturing- sector restrictions (publication printing must be Chinese-controlled; investment in TCM-decoction steaming/roasting/calcination processes and confidential-formula proprietary Chinese-medicine production prohibited). Restrictions remain in services (telecommunications value-added, healthcare, education) and in 21 prohibited categories (news publishing, postal monopoly, fishing, gene therapy, tobacco). The 2021 edition is repealed on the same date.

FinCEN issued a final rule (89 FR 70258, FR Doc 2024-19198) requiring certain real-estate-closing and settlement professionals to file a new "Real Estate Report" and maintain records on non-financed (i.e., all-cash) transfers of U.S. residential real property to specified legal entities and trusts, on a nationwide basis. The rule uses a "reporting cascade" to designate one filer per transaction (settlement agent, title-insurance underwriter, escrow agent, or attorney, depending on which is present), replacing the long-running geographic-targeting-order (GTO) regime with a permanent nationwide framework. The original effective date of December 1, 2025 was subsequently postponed to March 1, 2026 via a FinCEN exemptive-relief order issued September 30, 2025.

FinCEN issued a final rule (published September 4, 2024 at 89 FR 72156; FR Doc 2024-19260) including most SEC-registered investment advisers (RIAs) and Exempt Reporting Advisers (ERAs) within the Bank Secrecy Act definition of "financial institution." Covered firms must implement a risk-based AML/CFT compliance program, appoint a compliance officer, train staff, obtain independent testing, file Suspicious Activity Reports (SARs) and Currency Transaction Reports (CTRs), and participate in §314(a)/(b) information sharing. The original compliance date was January 1, 2026; FinCEN subsequently delayed the effective date to January 1, 2028 by final rule published 2026-01-02 (FR Doc 2025-24184).

India's Finance (No. 2) Act, 2024 (Act No. 15 of 2024) repeals the 2% Equalisation Levy on e-commerce supplies and services by non-resident operators (§165A of the Finance Act 2016, introduced 2020), with effect from 1 August 2024. The repeal removes a long-standing US trade irritant — the USTR had found the 2% levy unreasonable under a Section 301 investigation, and India agreed in October 2021 to remove it as part of a multilateral OECD Pillar 1 commitment, formally implemented here three years later. The residual 6% Equalisation Levy on digital advertising under §165 (in force since 2016) was not touched by this Act and remained in force until its own repeal effective 1 April 2025 via a subsequent Finance Act.

The Department of Commerce published a final rule redesignating the regulations implementing Executive Order 13873 (Securing the Information and Communications Technology and Services Supply Chain) from 15 CFR subtitle A, part 7 (Office of the Secretary of Commerce) to 15 CFR subtitle B, chapter VII, part 791, under the Bureau of Industry and Security (BIS). The redesignation reflects the formal transfer of ICTS-transaction review authority from the Secretary of Commerce to BIS's new Office of Information and Communications Technology and Services (OICTS). The rule is non-substantive — it relocates the existing regulatory text without altering the scope of covered ICTS transactions, the foreign-adversary list, the review procedures, or any substantive obligations on parties. Effective on publication (18 July 2024) without notice and comment because it is an internal agency reorganization.

The Ethiopian Capital Market Authority (ECMA) issued Directive No. 1009/2024 on 16 July 2024, establishing the comprehensive licensing, operational, and supervisory framework for securities exchanges, derivatives exchanges, and the over-the-counter (OTC) market under the authority of Article 108 of the Capital Market Proclamation No. 1248/2021. The directive consolidates Ethiopia's previously fragmented securities-trading architecture into a single, licensed, and regulated market structure and provided the statutory pathway for the Ethiopian Securities Exchange (ESX) to receive the country's first securities-exchange licence. This is the first capital-markets architecture filing for Ethiopia on the IPTM register, forming the operating- licence layer alongside the banking-sector liberalisation enacted under Proclamation 1360/2025.

The European Union's Artificial Intelligence Act, Regulation (EU) 2024/1689, was published in the Official Journal on 12 July 2024 and entered into force on 1 August 2024. It establishes the world's first horizontal, risk-tiered legal framework for the development, market placement, and use of AI systems — covering prohibited practices, high-risk systems, general-purpose AI models, and minimal-risk applications — with extraterritorial reach over any provider placing an AI system on the EU market or whose output is used in the EU. Penalties reach up to EUR 35 million or 7% of global annual turnover. Application is staged: prohibitions from 2 February 2025, GPAI and governance from 2 August 2025, the bulk of high-risk obligations from 2 August 2026, and product-safety-embedded high-risk systems from 2 August 2027.

FinCEN issued a final rule under Section 311 of the USA PATRIOT Act (31 U.S.C. § 5318A) prohibiting US covered financial institutions from opening or maintaining a correspondent account for, or on behalf of, Iraq-based Al-Huda Bank, a foreign financial institution found to be of primary money-laundering concern. Treasury determined that Al-Huda Bank exploited its access to US dollars to support designated Foreign Terrorist Organizations including Iran's Islamic Revolutionary Guard Corps (IRGC) and IRGC-Quds Force, as well as Iran-aligned Iraqi militias Kata'ib Hizballah and Asa'ib Ahl al-Haq. The rule also imposes a special-due-diligence requirement on US covered institutions to guard against indirect access via foreign correspondent accounts. Published in the Federal Register on July 3, 2024; effective August 2, 2024.

The Office of Foreign Assets Control (OFAC) issued an interim final rule (IFR) on 10 May 2024 (FR Doc 2024-10033, 89 FR) amending the Reporting, Procedures and Penalties Regulations (RPPR) at 31 CFR Part 501. The IFR overhauls OFAC's reporting framework by requiring electronic submission of certain reports through the OFAC Reporting System (ORS), expanding the rejected-transaction reporting obligation to all U.S. persons (not only U.S. financial institutions), modifying blocked-property reporting procedures, updating procedures for petitions for administrative reconsideration and property-blocked-in-error requests, and revising FOIA-availability provisions. The IFR took effect on 8 August 2024 and was subsequently finalised — with three new exceptions to the blocked-property reporting requirement — by the 8 October 2024 final rule (FR Doc 2024-23217, effective 7 November 2024).

Loi n° 2024-449 of 21 May 2024, known as the SREN law (Sécuriser et Réguler l'Espace Numérique), was definitively adopted by the French Parliament on 10 April 2024, validated in part by the Conseil Constitutionnel on 17 May 2024 (Decision n° 2024-866 DC), promulgated by the President on 21 May 2024, and published in the Journal Officiel on 22 May 2024. SREN is France's digital-sovereignty omnibus statute: it transposes parts of the EU Digital Services Act (Regulation 2022/2065), Digital Markets Act (Regulation 2022/1925), and Data Governance Act (Regulation 2022/868) into French law and layers national-level instruments on top — most consequentially a data-localisation hook for sensitive public-sector data tied to the ANSSI SecNumCloud sovereign-cloud certification scheme, an ARCOM-enforced age-verification regime for adult-content sites (with €250k or 2%-of-turnover fines and account-closure powers), an "anti-scam" cybersecurity filter requiring browsers and DNS resolvers to block ANSSI-designated fraudulent domains, a jeux-en-ligne (JONUM) regime for cryptoasset-adjacent gaming, and a coordination framework between CSA, CNIL, ARCOM, and the Autorité de la concurrence. SREN is one of the first EU member-state digital omnibus statutes anchoring national public-sector data-hosting rules to a sovereign-cloud certification scheme.

The Cyberspace Administration of China (CAC) issued the Provisions on Promoting and Regulating Cross-Border Data Flows (《促进和规范数据跨境流动规定》) on 22 March 2024, effective immediately. The rules substantially raise the thresholds at which CAC security assessment, Standard Contractual Clauses (SCC), or Personal Information Protection Certification are required for outbound data transfers, and create categorical exemptions for contract performance, HR management, intra-group transfers below a volume threshold, and transit data processed in China with no domestic personal information introduced. A Free Trade Zone pilot mechanism allows designated FTZs (Shanghai Lingang, Tianjin, Beijing) to publish their own negative lists defining which data categories still require prior approval, easing conditions for multinationals with operations in those zones.

Three Commission Delegated Regulations (CDR 2024/1772, 1773, 1774) adopted 13 March 2024 and published in the EU Official Journal on 25 June 2024 constitute the first batch of binding Level 2 implementing rules under DORA (Regulation (EU) 2022/2554). CDR 2024/1772 sets ICT incident classification criteria and materiality thresholds for mandatory reporting; CDR 2024/1773 specifies the required content of contractual policies for ICT third-party services supporting critical or important functions; CDR 2024/1774 defines the ICT risk management tools, methods, processes, and policies — including a simplified framework for smaller in-scope entities. All three apply from 17 January 2025 alongside the parent DORA regulation, covering approximately 22,000 EU regulated financial entities.

OFAC amended and reissued the Global Magnitsky Sanctions Regulations (31 CFR Part 583) in their entirety on 12 March 2024, to implement the Global Magnitsky Human Rights Accountability Act and EO 13818 (20 December 2017) more fully. The reissuance adds expanded interpretive guidance, new definitions (agricultural commodities, medicines, medical devices), new statutory authority (Uyghur Human Rights Policy Act of 2020), and several new general licenses covering blocked-account management, legal services, personal-use medical/food transactions, and emergency services. No new SDN designations or country-level targeting; the action is a compliance-architecture update that clarifies permissible conduct and tightens procedural standards across the global human-rights-and-corruption sanctions program.

The U.S. Treasury's Office of Foreign Assets Control (OFAC) published in the Federal Register (89 FR 16400, FR Doc 2024-04856) two general licenses issued under the Western Balkans Stabilization Regulations (31 CFR Part 588): GL 2 and GL 3. Both were originally issued on 16 November 2023 concurrent with OFAC's initial round of Republika Srpska / Dodik-network designations; the 7 March 2024 Federal Register notice formalises them per the Administrative Procedure Act notice requirements. GL 2 authorises wind-down transactions with newly blocked WBSR entities through 15 March 2024. GL 3 authorises exports and re-exports of agricultural commodities, medicine, medical devices, replacement parts, and services for medical prevention and treatment to WBSR-blocked persons; GL 3 was subsequently superseded by GL 3A on 18 June 2024.

The U.S. Treasury's Office of Foreign Assets Control (OFAC) published a final rule in the Federal Register (89 FR 15769, FR Doc 2024-04500) renaming the Darfur Sanctions Regulations (31 CFR Part 546) to the Sudan Stabilization Sanctions Regulations and amending them to implement Executive Order 14098 of May 4, 2023. E.O. 14098 broadened US sanctions authority beyond the Darfur-specific frame to cover all persons destabilising Sudan and undermining democratic transition, responding to the SAF–RSF armed conflict that erupted in April 2023. The rule adds new general licenses covering legal-service payments (§ 546.508), African Union transactions (§ 546.511), and agricultural/medical exports (§ 546.513), and introduces an interpretative provision clarifying that entities are not automatically blocked solely because a blocked individual holds a leadership position.

A joint advisory issued January 26, 2024 by six US agencies (USTR, State, Treasury, Commerce, DHS, and Labor) updating businesses on supply-chain risks associated with Burma's post-coup military regime (SAC). The advisory warns of reputational, economic, and legal exposure for entities operating in or sourcing from Burma and specifically flags heightened due-diligence requirements for metal importers, the SAC's opaque network of corporate affiliates in Thailand, Singapore, India, and the UAE that complicate traceability, and cross-border reporting gaps for goods and funds transfers. Targeted sectors include rare earths (dysprosium, terbium), base metals and gold mining, timber, aviation services and jet fuel, computer chips and ICT equipment, and small arms components.

FinCEN published a final rule on January 25, 2024 adjusting the maximum civil monetary penalties (CMPs) for Bank Secrecy Act (BSA) violations as mandated by the Federal Civil Penalties Inflation Adjustment Act of 1990, as amended by the 2015 Improvements Act. Adjustments are calculated using the CPI-U percent change between October 2022 and October 2023 and are codified in 31 CFR § 1010.821. The update covers 12 BSA statutory penalty provisions, ranging from per-day recordkeeping violations to wilful correspondent-account and special-measures infractions, with the largest single-penalty ceiling rising to $1,731,383.

OFAC published a final rule on January 12, 2024 adjusting the maximum civil monetary penalty (CMP) ceiling amounts across five statutory authorities as mandated by the Federal Civil Penalties Inflation Adjustment Act of 1990 (as amended by the 2015 Improvements Act). The 2024 adjustment multiplier is 1.03241 (reflecting the October 2022–October 2023 CPI-U change). Penalties under IEEPA rise from $356,579 to $368,136; TWEA penalties from $105,083 to $108,489; and the Narcotics Kingpin Act maximum from $1,771,754 to $1,829,177. The rule is issued as a final rule effective on publication without prior notice and comment under the non-discretionary "good cause" exemption.