As detailed in Part I of this risk-assessment self-check series, we are publishing a series of self-check assessment guides covering the key regulatory and contractual risk areas for multinational companies. This article provides Part IV, which is a self-check assessment for conducting an antiboycott self-check. Previous self-check risks assessments are found in Part I (general compliance), Part II (buy-side contracts review), Part III (sell-side contracts review), and Part IV (supply chain integrity compliance self-check).

Antiboycott compliance presents a specialized but important risk for multinational companies engaged in cross-border trade. Unlike many trade controls that focus on what a company ships or where it ships, antiboycott exposure often arises from what a company is asked to say, certify, or agree to in the course of ordinary business. Prohibited requests can appear in contracts, purchase orders, letters of credit, tender documents, shipping instructions, or routine customer questionnaires, and may require a company to refuse to do business with certain countries or parties, furnish boycott-related information, or make certifications about origin, ownership, or business relationships.

In practice, the vast majority of antiboycott compliance issues encountered by U.S. companies involve requests associated with the Arab League boycott of Israel. Since the 1970s, various Arab League member states have maintained a multilateral boycott targeting Israel, and participants in this boycott have required foreign companies to furnish certifications, negative origin statements, or other assurances as a condition of doing business in the region. These requests — which may appear in letters of credit, shipping documents, or contract clauses — remain the most commonly reported category of boycott-related activity under both the Export Administration Regulations administered by the Bureau of Industry and Security and the antiboycott provisions of the Internal Revenue Code enforced by the Office of Antiboycott Compliance within the Internal Revenue Service (IRS).

These risks are often overlooked because the underlying transaction may otherwise appear commercially routine. Enforcement authorities increasingly focus on whether companies have practical controls to identify, escalate, and respond to boycott-related requests before they are accepted or acted upon.

This self-test is designed to help companies assess whether they have a functioning, risk-aligned antiboycott compliance framework. It focuses on governance, risk assessment, contract and document review, training, escalation, and response mechanisms, with an emphasis on whether boycott-related controls are embedded in day-to-day business activity. A “no” answer does not automatically indicate a violation, but it may signal a program gap that warrants further review or compliance enhancement.

I.          Risk Assessment & Program Design

• Has your company conducted a documented antiboycott risk assessment tailored to its products, services, customers, and geographic footprint?
• Does the assessment consider relevant antiboycott risk factors, including: (1) business in or involving jurisdictions where boycott-related requests may be more common; (2) use of distributors, agents, freight forwarders, or other intermediaries; (3) customer contracts, tenders, purchase orders, and letters of credit; (4) requests for certifications relating to country of origin, vessel calls, ownership, nationality, or business relationships; and (5) business functions most likely to encounter boycott language, such as sales, contracting, shipping, finance, and customer service?
• Are antiboycott risks reassessed when the business changes, including: (1) entry into new markets; (2) expansion of distributor or channel relationships; (3) new customer segments or government-related business; or (4) changes in applicable law, guidance, or enforcement activity?

II.         Policies & Practical Guidance

• Does your company maintain clear, accessible antiboycott policies tailored to its business model and transaction flows?
• Do policies go beyond general prohibitions and provide practical guidance on: (1) identifying boycott-related requests; (2) reviewing contracts, letters of credit, and shipping documents; (3) escalating questionable language; (4) handling prohibited certifications or questionnaires; and (5) reporting obligations where applicable?
• Are policies reviewed and updated periodically to reflect changes in law, guidance, business practices, and transaction risk?

III.        Contracting, Documentation & Transaction Controls

• Are contracts, tenders, purchase orders, letters of credit, shipping instructions, and other transaction documents reviewed on a risk-based basis for boycott-related language?
• Are employees equipped to identify problematic requests involving: (1) agreements not to do business with certain countries or blacklisted parties; (2) certifications regarding business relationships with certain countries or persons; (3) requests to disclose ownership, management, nationality, religion, or similar information for boycott-related purposes; and (4) shipping or routing instructions designed to support a boycott?
• Are procedures in place to reject, strike, or revise prohibited boycott-related terms before the company proceeds with the transaction?
• Are boycott-related requests and their disposition documented and retained in accordance with company procedures and legal requirements?

IV.        Training & Awareness

• Is antiboycott training provided on a risk-based basis, with enhanced focus for sales, contract management, legal, trade compliance, logistics, finance, procurement, and customer-facing personnel?
• Does training include realistic scenarios relevant to your company’s operations (e.g., boycott clauses in purchase orders, problematic letter-of-credit terms, end-customer certifications, or routing instructions tied to restricted destinations)?
• Is training tracked and documented?

V.         Escalation, Reporting & Oversight

• Do employees know when antiboycott review is required and how to escalate suspect language or requests to compliance personnel, legal counsel, or senior management?
• Is there a defined process for reviewing boycott-related requests promptly so that business teams can address them before shipment, payment, or contract execution?
• Does your company have a process for identifying and meeting applicable antiboycott reporting obligations when reportable requests are received?
• Does the company periodically test or review whether antiboycott controls are functioning in practice, including through audits or spot checks of relevant documents and transactions?

VI.        Incident Response & Continuous Improvement

• Are potential antiboycott issues investigated promptly, with appropriate documentation of the request, response, business impact, and remediation?
• Are control failures, missed escalations, or improper responses addressed through corrective action, retraining, and process improvements?
• Are lessons learned from incidents, audits, business changes, or enforcement developments fed back into risk assessments, training, and program design?
• Does the company periodically evaluate whether its antiboycott compliance framework remains aligned with its current markets, customers, and transaction patterns?

If you would like help analyzing the results of your compliance self-check, please reach out to the authors or your Â鶹ֱ˛Ą relationship attorney.

Would you like more practical compliance tips like these? The Â鶹ֱ˛Ą International Trade & National Security Team is monitoring all international trade, enforcement, and compliance developments, which we post as they occur on our Tariff & International Trade Resources blog. for our email list to receive future emails and practical international regulatory compliance tips, including our weekly Tariff-ied! This Week in International Trade and What Every Multinational Should Know articles.

Our white paper on Managing Import and Tariff Risks During a Trade War outlines a 12-step plan to provide practical steps to help importers navigate the tariff and international trade risks in the current tariff and trade environment, while the companion white paper on Managing Supply Chain Integrity Risks provides practical advice to deal with heightened supply chain risks pertaining to goods imported into the United States, including the increasing use of detentions by Customs.

Recent Chinese government measures suggest that China is entering a new phase in the development of its counter-sanctions and anti-extraterritoriality framework. For several years, multinational companies have tracked China’s Anti-Foreign Sanctions Law, Blocking Rules, Unreliable Entity List regime, data laws, export control rules, and related measures as part of a growing — though only intermittently enforced — legal architecture. What now appears to be changing is not only the breadth of that framework but the extent to which Chinese authorities may be prepared to formalize and operationalize it in concrete commercial and regulatory settings.

Two new State Council decrees are central to that shift. State Council Decree No. 834 addresses industrial and supply-chain security and creates a broader framework for identifying, monitoring, and responding to risks affecting China’s industrial and supply chains. State Council Decree No. 835 establishes a more formal mechanism for identifying and countering what China characterizes as improper or unjustifiable foreign extraterritorial measures. As State Council regulations, these measures appear to elevate and further institutionalize China’s response toolkit beyond earlier Ministry of Commerce of the People’s Republic of China-level (MOFCOM) rules.

Taken together, the decrees may materially affect how multinationals conduct supplier diligence, sanctions compliance, export-control screening, internal investigations, regulatory responses, data handling, and relationship-management decisions involving Chinese entities. They also reinforce a broader People’s Republic of China (PRC) policy approach in which industrial security, supply-chain resilience, and opposition to foreign extraterritorial measures are treated as interconnected elements of national security and economic governance.

For companies operating in or selling to China, the practical significance is not that China-facing diligence, trade compliance, or regulatory-response work should cease. Rather, these developments strengthen the case for more deliberate conflict-of-laws analysis, tighter governance over China-related information collection and data handling, and more carefully designed escalation protocols when global compliance processes intersect with PRC law.

The Emerging Structure: From Framework-Building to Application

Until recently, many companies treated China’s counter-sanctions, blocking, and anti-extraterritoriality regime as important but not yet fully operationalized. That view is becoming harder to maintain.

China already had several relevant legal tools on the books, including the 2021 Blocking Rules, the Anti-Foreign Sanctions Law, the Unreliable Entity List regime, the Data Security Law, the Personal Information Protection Law, and restrictions on providing documents or data to foreign authorities without approval in certain sectors or circumstances. The new decrees appear to push this architecture further in at least two ways.

First, they appear to formalize institutional mechanisms for identifying and responding to conduct that China views as harmful to its national security, development interests, or legitimate commercial interests. Decree No. 835 reportedly establishes a State Council “working mechanism” involving multiple departments, with the Ministry of Justice playing a central role in identifying foreign measures that China considers unlawful or unjustifiable extraterritorial assertions of jurisdiction. Decree No. 834 likewise appears to establish a coordinated, whole-of-government framework for monitoring, assessing, and responding to risks affecting key industrial and supply chains.

Second, the decrees appear aimed at the mechanics of how foreign legal and compliance demands are implemented in China — particularly where those demands require local information gathering, local cooperation, local remediation, suspension of transactions, or adverse action against Chinese counterparties. In that sense, the measures are not merely symbolic objections to foreign sanctions or investigations. They create more explicit legal hooks for Chinese authorities to characterize foreign trade, sanctions, subsidy, export-control, or investigative measures as objectionable and to restrict implementation or assistance within China.

That matters because many multinational compliance processes are built on assumptions of global consistency. If a counterparty is sanctioned, flagged for export-control or anti-corruption concerns, implicated in forced-labor risk, or subject to an external regulatory investigation, legal or compliance teams of multinationals may assume they can require subsidiaries, affiliates, suppliers, or employees worldwide to collect data, stop transactions, remediate relationships, or respond to regulators in a standardized way. The new PRC measures raise the possibility that those assumptions may no longer hold where China is involved.

The result is not simply a new layer of “China compliance,” but a more direct conflict-of-laws problem. A foreign parent’s global compliance decision may be lawful — or even required — in one jurisdiction, while the local implementation of that decision by a PRC affiliate, employee, or supplier may create separate risk under PRC law. That distinction — between global policy and China-based execution — may become increasingly important in practice.

Decree No. 834: Supply-Chain Security and Limits on Investigative or Information-Gathering Activity

Decree No. 834 reportedly focuses on industrial and supply-chain security and appears intended to create a broader framework for identifying, monitoring, and responding to risks affecting important Chinese industrial and supply chains. In that sense, it appears to do more than regulate discrete corporate conduct. It also establishes a basis for a coordinated governmental approach to supply-chain resilience, including risk monitoring, early warning, and potential intervention where foreign measures or commercial conduct are viewed as disruptive, discriminatory, or harmful to China’s supply-chain interests.

A key implication, however, is that the measure may affect a wide range of supply-chain-related investigations or requests for information conducted in China or directed at China-based actors, especially where those activities are linked to foreign legal mandates or where the collection and transfer of information could implicate PRC restrictions. Commentary on the decree suggests that it reinforces existing PRC limits on unlawful “information collection activities” in the supply-chain context and may increase scrutiny of certain audit or diligence exercises carried out for foreign compliance purposes.

For multinational companies, the activities potentially affected may include:

• supplier audits and supplier questionnaires;
• supply-chain mapping and traceability exercises;
• origin verification;
• sanctions and restricted-party diligence;
• export-control screening and end-use/end-user checks;
• forced-labor, modern slavery, and human-rights diligence;
• Environmental, Social, and Governance (ESG) and sustainability reviews;
• anti-diversion and anti-circumvention inquiries;
• internal investigations involving China-based transactions or personnel; and
• foreign regulator-driven document collection or fact development.

The concern is not necessarily that each of these activities is prohibited as such. Rather, the concern is that the decree appears to add another source of legal risk where the activity is perceived to undermine PRC supply-chain security interests, violate domestic legal requirements, or facilitate foreign measures that China considers objectionable. That risk may be especially acute where the request seeks detailed information about sub-tier suppliers, sourcing relationships, production locations, labor conditions, customer networks, logistics channels, shipment histories, or politically sensitive geographies.

This is particularly relevant for companies that rely on detailed supplier certifications, origin declarations, customer and shipment tracing, raw material disclosures, transaction histories, or factory-level information to satisfy foreign forced-labor laws, sanctions obligations, customs rules, procurement restrictions, or ESG commitments. If obtaining or transferring that information in China is considered inconsistent with PRC requirements, legal exposure could arise not only from the outbound transfer of data but also from the request itself and from the local collection process.

At the same time, Decree No. 834 appears to extend beyond information gathering alone. It may also provide a basis for investigation or countermeasures where foreign persons or entities are seen as interrupting normal market transactions with Chinese parties, discriminating against Chinese parties in supply chains, or otherwise taking actions that materially harm China’s industrial or supply-chain interests. That could have implications not only for diligence programs, but also for certain de-risking, supplier-remediation, refusal-to-deal, or export-control-driven decisions involving Chinese counterparties.

For that reason, companies should be cautious about treating Decree No. 834 as only a data-collection issue. It may also affect how businesses structure supply-chain diversification, communicate sourcing changes, and implement compliance-driven restrictions involving Chinese suppliers or customers.

Decree No. 835: Countering “Unjustifiable” Extraterritorial Measures

Decree No. 835 appears to be the more explicit anti-extraterritoriality instrument of the two. As a State Council regulation, it appears to elevate and formalize China’s anti-extraterritoriality framework beyond the earlier MOFCOM-level Blocking Rules and Unreliable Entity List regime. The decree reportedly establishes a formal State Council working mechanism involving multiple departments, with the Ministry of Justice playing a central role in identifying foreign laws, regulations, or other measures that China considers to constitute unjustifiable or improper extraterritorial jurisdiction.

Once such a determination is made, Chinese authorities may publicly identify the foreign measure and prohibit organizations or individuals from implementing, complying with, or assisting in its implementation. Commentary on the decree also suggests that authorities may issue prohibition or enforcement orders — potentially on an entity-specific or activity-specific basis — directing particular parties to refrain from implementing identified foreign measures.

The decree also reportedly includes a mechanism under which Chinese citizens and organizations may apply for approval or a waiver in special circumstances to implement otherwise prohibited measures, although it remains unclear how workable or frequently used that process will be in practice. For multinational groups, that may be relevant where PRC subsidiaries are asked to carry out sanctions, export-control, or investigation-related actions required by global policy.

Another notable feature is the creation of a new Malicious Entity List, distinct from China’s existing Unreliable Entity List regime. The Malicious Entity List reportedly targets foreign organizations and individuals that implement, assist in implementing, participate in, or promote the implementation of unjustifiable extraterritorial measures. Depending on how this authority is used, the concept of “promoting” such measures could extend beyond direct compliance activity and potentially capture advocacy or support for the underlying foreign action.

This is a meaningful development because it appears to move beyond abstract policy objections toward a more operational system for identifying specific foreign actions and constraining local compliance with them. It therefore increases the legal and practical tension for companies whose global compliance programs require uniform adherence to:

• U.S. sanctions;
• EU or UK sanctions;
• export-control restrictions;
• anti-boycott requirements;
• restricted-party screening results;
• procurement exclusions;
• foreign forced-labor and supply-chain due diligence mandates; and
• foreign competition, subsidy, customs, antitrust, anti-bribery, anti-corruption, data-protection, or enforcement investigations.

The legal friction becomes especially sharp where a foreign parent or headquarters function instructs a China subsidiary, branch, affiliate, employee, or supplier to take concrete action because of a foreign law or regulatory demand. That action might include collecting information, producing documents, blocking a customer, declining a shipment, suspending payment, terminating a distributor, delisting a supplier, or answering a regulator’s questionnaire. Under Decree No. 835, the implementation of that step may itself become the relevant issue under PRC law.

The decree may also increase litigation risk. Commentary indicates that Chinese individuals or entities harmed by implementation of an identified foreign extraterritorial measure may have a private right of action against the implementing party. For multinationals, that raises the possibility that a decision taken to comply with foreign legal requirements could create not only regulatory exposure in China but also civil claims from affected Chinese counterparties.

In that sense, the decree raises not just sanctions risk, but governance risk. Many multinational systems are not built to isolate China-facing implementation steps from globally triggered compliance decisions. If a foreign measure is identified as unjustifiable under PRC law, routine internal operating processes may inadvertently place China entities or personnel in the position of executing a prohibited instruction.

How These Decrees Interact with the Existing PRC Framework

The importance of Decrees 834 and 835 is magnified when viewed together with China’s broader legal architecture.

Several existing PRC regimes are already relevant to cross-border compliance activity:

• the 2021 Blocking Rules;
• the Anti-Foreign Sanctions Law;
• the Data Security Law;
• the Personal Information Protection Law;
• export-control restrictions;
• state secrets and commercial secrets rules;
• sector-specific rules on data, archives, mapping, finance, and statistics; and
• restrictions on providing evidence or information to foreign authorities without approval in certain contexts.

The new decrees appear to sit on top of that architecture and provide additional grounds to challenge foreign-facing information collection and compliance implementation. In practical terms, this means that a single corporate action may trigger multiple PRC issues at once. For example:

• a supplier questionnaire may raise supply-chain security concerns;
• transmitting the response abroad may raise data transfer issues;
• using the information to terminate the supplier based on foreign sanctions may raise anti-extraterritoriality issues; and
• cooperation with a foreign regulator using China-located documents may raise evidence-transfer or regulatory cooperation restrictions.

This layering effect is important for clients because legal risk may no longer be manageable through a single workstream. Trade compliance, internal investigations, data privacy, employment, procurement, and local regulatory teams may all need to be involved.

Concrete Signs of Enforcement

The clearest reason these developments matter is that Chinese authorities appear to have begun applying them in identifiable cases.

MOFCOM’s May 2, 2026, Blocking Order

On May 2, 2026, MOFCOM reportedly issued a blocking order prohibiting recognition, enforcement, or compliance with certain U.S. sanctions imposed on five Chinese companies allegedly involved in Iranian petroleum transactions.

If widely understood correctly as the first formal invocation of China’s 2021 Blocking Rules, the order is a major development. For years, many companies understood the Blocking Rules to be part of a latent legal toolkit that may or may not be used. A formal blocking order changes the analysis. It gives companies a live example of a situation in which PRC law may expressly prohibit compliance with foreign sanctions.

That creates immediate practical problems for any party dealing with the named entities, including:

• financial institutions deciding whether to process payments;
• insurers and reinsurers assessing coverage;
• commodity traders evaluating cargo exposure;
• shipping and logistics companies deciding whether to carry or service goods;
• suppliers and customers assessing contract performance; and
• multinational groups deciding how sanctions controls should be applied across affiliates.

The dilemma is straightforward but serious: continuing to deal with a named Chinese company may raise foreign sanctions concerns, while refusing to deal or taking restrictive action because of those sanctions may raise PRC blocking or anti-extraterritoriality concerns.

Ministry of Justice Announcement on the EU FSR Investigation of Nuctech

On May 15, 2026, the Ministry of Justice reportedly issued an announcement regarding the EU Foreign Subsidies Regulation (FSR) investigation of Nuctech. The announcement concluded that certain EU investigative practices constituted improper extraterritorial jurisdiction measures under Decree No. 835 and stated that organizations and individuals may not execute or assist in executing those measures.

This development is significant beyond the Nuctech matter itself. It signals that China may use Decree No. 835 not only against sanctions-related measures but also against foreign regulatory investigations that seek information or cooperation from within China.

That has potentially wide implications for regulatory response work. Foreign agencies increasingly seek information that is operationally or physically located in China, including accounting data, procurement files, subsidy-related information, internal communications, source data, emails, pricing materials, supply-chain records, and witness access. If complying with those requests is characterized by PRC authorities as assisting improper extraterritorial measures, companies may face a direct legal conflict between foreign cooperation expectations and Chinese prohibitions.

Operational Risk Areas for Multinational Companies

These developments are likely to affect several recurring business processes.

• Supplier diligence and traceability. Programs aimed at identifying forced labor, sanctions exposure, diversion risks, ESG failures, or prohibited sourcing often rely on deep supply-chain visibility. Where China suppliers are asked to disclose sub-tier suppliers, production locations, labor arrangements, customer lists, shipment paths, raw material origins, or ownership information, PRC legal issues may arise, particularly if the request is framed as necessary to satisfy foreign legal restrictions.
• Global sanctions-screening and restricted-party controls. Many companies run centralized screening tools that automatically block, pause, or escalate transactions once a sanctions-related hit is identified. If a Chinese counterparty is affected and the basis for the action is a foreign measure that China has opposed or blocked, there may be risk in implementing that result automatically within China or through China personnel.
• Export-control and end-use diligence. End-user and end-use checks involving Chinese customers, distributors, and downstream users may require information collection that becomes legally sensitive if tied to foreign control regimes. This may be especially true where the inquiry seeks granular operational, customer, technical, or shipment information.
• Internal investigations. Cross-border investigations often require local employees or affiliates to collect emails, transaction records, shipping data, and communications, then provide them to outside counsel or headquarters. If the underlying investigation is connected to sanctions, forced labor, trade diversion, foreign subsidy inquiries, or other foreign legal demands, companies should not assume that standard investigation protocols can simply be extended into China without modification.
• Regulatory inquiries and dawn-raid response support. Where a foreign regulator asks a multinational to produce China-located information, interview China-based personnel, or explain China-based commercial arrangements, the company may need to analyze not only data transfer restrictions but also whether local cooperation could be viewed as implementing an improper extraterritorial measure.
• Contract suspension and termination decisions. Suspending or terminating a Chinese supplier, customer, distributor, or service provider based expressly on foreign sanctions, foreign subsidy concerns, or foreign political-risk criteria may create local-law exposure, especially if local affiliates are involved in executing the decision or communicating the rationale.

What Companies With International Supply Chains in China Should Do Now

The answer is not to stop diligence, trade compliance, or regulatory-response work involving China. It is to make those processes more deliberate and more legally segmented.

Companies with China exposure should consider reviewing the following:

• China-facing diligence protocols. Audit questionnaires, mapping requests, on-site review procedures, and certification demands should be reviewed to assess whether they seek information that may be sensitive under PRC law and whether the request can be narrowed, localized, sequenced, or otherwise redesigned.
• Conflict-of-laws screening. Companies should consider introducing an explicit conflict-of-laws check before implementing foreign sanctions, export-control, due-diligence, or regulatory-response measures that require action by China entities or personnel.
• Data and information-transfer procedures. Requests for China-origin data should be assessed not only under privacy and data-export rules but also in light of supply-chain security, anti-extraterritoriality, secrecy, archives, and industry-specific rules.
• Decision architecture for sanctions and terminations. Rather than relying on automatic global controls, companies may need a more nuanced process for China-related counterparties, including legal review before blocking, suspending, or terminating business and careful consideration of how the rationale is documented.
• Regulatory-response playbooks. Companies should ensure that they have China-specific protocols for responding to foreign government requests, subpoenas, questionnaires, and investigative demands that may touch China-based documents, employees, or operational information.
• Internal communications and documentation. The way decisions are described matters. Internal instructions that explicitly direct a China team or supplier to act “because of U.S. sanctions,” “to comply with EU investigative demands,” or “to satisfy forced-labor restrictions” may create avoidable PRC-law sensitivity. Communications should be carefully reviewed.
• Escalation and governance. Trade compliance, disputes, investigations, privacy, procurement, HR, public policy, and local China counsel should have a clear path for rapid escalation when a China-related issue involves foreign sanctions, export controls, supply-chain diligence, or regulator requests. Some items to consider here include:
  • a trigger list for high-risk China-related requests;
  • mandatory legal review of China-facing diligence tied to sanctions, forced labor, export controls, or ESG obligations;
  • local review before collecting or transmitting certain categories of supply-chain information;
  • controls on who may instruct China personnel or suppliers to respond to foreign legal demands;
  • protocols for handling blocked or sensitive counterparties in screening systems;
  • a review requirement for China-related suspensions and terminations;
  • pre-approved messaging templates for counterparties and affiliates; and
  • training for legal, compliance, procurement, and investigation teams on PRC anti-extraterritoriality and supply-chain security risks.

---

China’s new decrees, together with the reported MOFCOM blocking order and the Ministry of Justice’s Nuctech-related announcement, suggest that PRC authorities are increasingly prepared to use counter-sanctions and anti-extraterritoriality tools in concrete settings. For multinational companies, the result is a more immediate and operational conflict-of-laws problem.

The main lesson is not that China-related diligence or compliance must stop. It is that many routine global practices – supplier audits, sanctions implementation, export-control checks, internal investigations, foreign regulator responses, and termination decisions — now require a more tailored China-specific legal analysis than many organizations have historically applied.

If you have questions about this topic, please feel free to reach out to any of the authors or your Â鶹ֱ˛Ą & Lardner attorney. If you would like to see future updates regarding “What Every Multinational Company Should Know” about operating in today’s complicated international trade world, please sign up for our Tariff & International Trade blog —

In 2022, Â鶹ֱ˛Ąâ€™s Government Enforcement Defense & Investigations International Team first produced a set of interactive international compliance heat maps designed to provide an at-a-glance resource for identifying countries around the world that may present heightened bribery, sanctions, or human rights compliance risks for multinational companies that conduct business in, trade with, or source materials from them.

The maps have been updated in 2024 and again in 2026, with the underlying risk ratings reviewed and revised to reflect relevant legal, regulatory, enforcement, and geopolitical developments. The updated 2026 maps are available below.

Although the maps use a structured methodology to compare risk across jurisdictions, the ratings necessarily involve professional judgment and should be understood as relative risk indicators rather than definitive country assessments. Additional information regarding the methodology is available on request.

Bribery/Corruption Risk Heat Map

This map reflects Â鶹ֱ˛Ąâ€™s assessment of bribery and corruption risk presented by conducting business in various countries around the world. Countries in maroon are viewed as highest risk; countries in red as high risk; countries in orange as medium/high risk; countries in yellow as medium risk; countries in light blue as low risk; and countries in dark blue as lowest risk. Companies should tailor their compliance programs and control procedures based in part on the perceived risk of bribery and corruption presented in their respective countries of operation, taking into consideration the types of business activities occurring in those countries and the degree of interaction with government officials.

Contacts: David Simon, Olivia Singelmann, John Turlais, and Nick Covek

U.S. Sanctions Risk Heat Map

This map reflects Â鶹ֱ˛Ąâ€™s assessment of U.S. economic sanctions risk presented by conducting business in various countries around the word. Countries in maroon are comprehensively sanctioned, and potential transactions involving these countries should not proceed without thorough legal review and authorization given the extremely high risk of violating U.S. sanctions; countries in red are deemed high risk due to significant list-based sanctions; countries in orange present moderate risk due to some list-based sanctions, coupled with a relatively high diversion risk; countries in yellow are subject to limited list-based sanctions but present some risk due to a moderate diversion risk; and countries in blue are not sanctioned and present a low diversion risk. Companies should implement screening procedures of relevant parties that take into consideration the countries associated with the transaction and with the relevant parties.

Contacts: Gregory Husisian and John Turlais

Forced Labor/Child Labor Risk Heat Map

This map reflects Â鶹ֱ˛Ąâ€™s assessment of the pervasiveness of child/forced labor used to produce goods in various countries around the world. Countries in maroon are perceived as having the highest incident rates of products made using child/forced labor; countries in red have high incident rates; countries in orange have medium/high incident rates; countries in yellow have medium incident rates; countries in light blue have low incident rates; and countries in dark blue have the lowest incident rates. Companies should tailor their supply-chain due diligence and monitoring procedures to account for the pervasiveness of child/forced labor in the countries from which they source raw materials and other goods.

Contacts: David Simon, John Turlais, and Nick Covek

If you have questions or concerns concerning this article, please feel free to reach out to any of the authors or your Â鶹ֱ˛Ą & Lardner attorney.  for our email list to receive future biweekly emails and practical international regulatory compliance tips.

On January 14, 2026, following an investigation by the U.S. Secretary of Commerce (Secretary), under Section 232 of the Trade Expansion Act of 1962 (19 U.S.C. 1862) (Section 232), into the effects of imports of processed critical minerals and their derivative products (Critical Minerals) on the national security of the United States. After concurring with the Secretary’s determination that the quantities and circumstances of current Critical Minerals imports “threaten to impair the national security of the United States,” the President has authorized actions to be taken to adjust the imports of Critical Minerals to address the identified threat.

Overview of the Federal Action

The President has officially concurred with findings that the United States lacks a secure and reliable supply chain for Critical Minerals. In making this determination, Section 232 directs the Secretary and the President to consider factors related to national defense (including required domestic production needed for defense requirements, capacity of the domestic industry to meet such production needs, and availability of supplies and raw materials) as well as factors related to the national economy (including impacts of foreign competition and the displacement of U.S. products by “excessive imports”).

Consequently, the administration has initiated the following:

1. Negotiations with Trading Partners and Potential Trade Restrictions: The U.S. Trade Representative and the Secretary are directed to negotiate with foreign nations to adjust imports and mitigate security vulnerabilities. If negotiations are unsuccessful within 180 days, the administration may implement further measures, including tariffs or minimum import prices (price floors) for specific minerals.
2. Additional Regulatory or Deregulatory Actions: The Secretary, U.S. Trade Representative, and the Secretary of Homeland Security are directed to effectuate the proclamation through the issuance, amendment, or temporary suspension of their respective regulations, rules, and guidance.  
3. Supply Chain Monitoring: The Secretary will continue to monitor import levels and review their impact on national security to determine if further executive action is required
4. No Tariffs — Yet: Unlike for several other recent Section 232 investigations, the President has not (at this time) imposed tariffs.

Key Minerals Identified

The Secretary determined that Critical Minerals underpin critical military and economic applications and found that Critical Minerals are essential to each of the 16 critical infrastructure sectors identified by of April 30, 2024 (Critical Infrastructure Security and Resilience), including:

• Chemical Sector: lithium, fluorite, and bromine;
  • Communications Sector: gallium, germanium, indium, and yttrium;
  • Energy Sector: cobalt, nickel, uranium, praseodymium, and terbium.

Why This Matters to Companies with U.S. Mining and Processing Operations

This federal shift is highly relevant to companies mining for Critical Minerals in the United States for several key reasons:

1. Focus on Domestic Capacity: The proclamation explicitly identifies the decline in domestic production and the offshoring of facilities as a strategic weakness. The federal government now views “sufficient domestic mining and processing” as imperative to reducing reliance on foreign actors.
2. Addressing Price Volatility: The Secretary found that extreme price volatility in mineral markets has historically hindered private sector investment and led to the closure of domestic facilities. The administration’s intent to consider “price floors” is a direct attempt to ensure the long-term viability of domestic mining and processing.
3. Bridging the Processing Gap: The proclamation highlights a critical vulnerability — even when minerals are mined domestically, they are often exported for refining due to a lack of domestic processing capacity. For example, while the United States is a major producer of rare earth oxides, it remains nearly 100% reliant on imported rare earth permanent magnets. This indicates a federal push to not only mine but also process materials within the United States.
4. Alignment with Related Administration Trade Initiatives: Under the United States-Japan Framework for Securing the Supply of Critical Minerals and Rare Earths through Mining and Processing, signed October 28, 2025, the United States and Japan jointly committed to work together on investments in critical minerals mapping, mining, and recycling and to arrange for mutually complementary stockpiling. Japan has also announced investment commitments in the United States for critical minerals development, including a $350 million investment in a lithium-iron-phosphate production facility in the United States.  The proclamation potentially provides additional support for these commitments.

Next Steps

If action is taken by the President, Section 232 requires the President to provide a report to Congress within 30 days of the proclamation, explaining the President’s decision to take action under the statute. Moreover, the administration is required to provide an update on the status of trade negotiations within 180 days. We will continue to monitor these negotiations and any potential regulatory changes or guidance issued by the Department of Commerce or Homeland Security that may affect your operations or trade status.

About Â鶹ֱ˛Ąâ€™s Energy & Infrastructure Sector

Â鶹ֱ˛Ąâ€™s cross-disciplinary Energy & Infrastructure team of more than 200 attorneys regularly represents clients in the traditional and renewable power, oil and gas, nuclear, and infrastructure and energy transition industries. Â鶹ֱ˛Ą offers comprehensive legal services for energy and infrastructure companies and projects to guide clients through every phase — from development and site control to investment, commercial contracting and financing. Â鶹ֱ˛Ą can also assist companies involved in mining, processing, and disposal to navigate the various state and federal regulations, international agreements, and national security considerations.

Protecting sensitive data has never been more important. In a globalized world of advanced cyber threats, sophisticated espionage techniques, and external data monetization, increased security is crucial to safeguard sensitive information from theft and misuse. The recent implementation of the Department of Justice’s (DOJ) Data Security Program (DSP) demonstrates how seriously the government considers the threat posed by foreign adversary access to such data. U.S. persons and companies who aggregate the personal data of Americans or collect any information linked to U.S. government personnel now face mandatory restrictions and prohibitions when transferring this data to identified countries and persons of concern. With the leniency period for enforcement of the program officially over as of July 8, 2025 failure to come into immediate compliance creates exposure to stiff civil and criminal penalties.

Background

The DSP essentially establishes export control restrictions that prevent foreign adversaries, and those subject to those adversaries’ control and direction, from accessing U.S. government-related data and bulk U.S. sensitive personal data.

The DSP was issued under the International Emergency Economic Powers Act (IEEPA) and in accordance with Executive Order 14117, related to Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern.^[2] Although the effective date for the program was April 8, 2025, the DOJ’s National Security Division (NSD) announced a delay in enforcement efforts for 90 days to allow additional time for U.S. individuals and companies to implement the necessary changes to comply and engage with NSD on DSP-related issues.

Now that the grace period has ended, individuals and entities are expected to be in full compliance, and the NSD may begin to pursue enforcement of potential violations. The DSP is meant to address the continued efforts of foreign adversaries to use commercial activities to access, exploit, and weaponize covered categories of U.S. government and sensitive personal data. As the program is in line with various Trump Administration priorities, U.S. companies should anticipate aggressive enforcement and ensure they are compliant.^[3]

Covered Countries and Persons

The DSP restricts and prohibits U.S. persons and entities from engaging in certain transactions surrounding U.S. government data and the personal data of Americans with “countries of concern” or “covered persons.”

On April 11, 2025, the NSD issued a compliance guide related to the DSP, which identified each of the following countries as a “country of concern”:

• China (including Hong Kong and Macau)
• Cuba
• Iran
• North Korea
• Russia
• Venezuela

These countries were identified as demonstrating an intent and capability to use government-related data and Americans’ sensitive personal data to threaten U.S. national security through various specified means.^[4]

“Covered persons” are described in the Final Rule as (1) foreign entities headquartered in or organized under the laws of a country of concern or majority owned by one or more countries of concern or other covered persons, (2) foreign entities that are majority owned by a country of concern or another covered person, (3) foreign individuals who are employees or contractors of a country of concern or covered person, (4) foreign individuals who are primarily a resident in a country of concern, and (5) those persons the NSD designates and publicly identifies.^[5] As it pertains to subcategory (5), the NSD will designate and add persons to a published Covered Persons list following a determination that such persons meet certain criteria such as being subject to the ownership and control of a country of concern.^[6]

Covered and Exempt Data Transactions

In determining whether the requirements of the DSP apply to a particular U.S. person or entity, it is essential to understand the type of data at issue and the transactions covered by the program. If a company handles data covered under the program, they will be restricted or even prohibited from transferring such information in certain circumstances.

Covered Transactions: Any transaction that involves access by one of the countries of concern or covered persons to any government-related data or bulk U.S. sensitive personal data is subject to DSP restrictions. To be a “covered transaction,” the transaction must also involve (1) data brokerage, (2) a vendor agreement, (3) an employment agreement, or (4) an investment agreement.^[7]

“Government-related Data”: Certain geolocation data related to government activities,^[8] and any sensitive personal data, regardless of volume, that a transacting party markets as linked or linkable to current or recent former employees or contractors of the United States Government, such as a U.S. company that advertises the sale of a set of sensitive personal data as belonging to “government employees.”^[9]

“Bulk U.S. Sensitive Personal Data”: A collection or set of sensitive personal data relating to U.S. persons, in any format.^[10]  â€śSensitive personal data” includes (1) covered personal identifiers, (2) precise geolocation data, (3) biometric identifiers, (4) human genomic data, (5) personal health data, and (6) personal financial data or any combination thereof.^[11]

Under the DSP, there are two general categories of covered transactions: 1) Prohibited Transactions and 2) Restricted Transactions.

Prohibited Transactions: Generally involve data brokerage with a country of concern or covered person and prohibit any U.S. person from engaging in a covered transaction subject to certain exemptions, and transactions that involve access by a country of concern or covered person to certain bulk U.S. sensitive data.^[12]

Restricted Transactions: Generally cover data transactions under vendor agreements, employment agreements, or investment agreements, subject to certain exemptions, that are restricted unless the U.S. person complies with specific security requirements.^[13]

Exempt Transactions: Several transactions are exempt from the otherwise applicable prohibitions and restrictions. Such exemptions include but are not limited to:

• Information or informational materials;
• Financial services;
• Corporate group transactions (ordinarily incident to and part of administrative or ancillary business operations);
• Transactions required or authorized by federal law or international agreements;
• Investment agreements subject to a CFIUS action;
• Telecommunications services;
• Drug, biological product, and medical device authorizations; and
• Other clinical investigations and post-market surveillance data (ordinarily incident to and part of clinical investigations regulated by the U.S. Food and Drug Administration or the collection and processing of certain clinical care data or post-marketing surveillance data).^[14]

Licenses

The DOJ, through the NSD, may issue either general or specific licenses to engage in a covered data transaction that would otherwise violate the DSP. A general license will authorize a particular type of transaction, subject to prohibitions or restrictions without the need to apply for a specific license.^[15] A specific license is a document issued by the NSD to a particular person or entity, authorizing a particular transaction.^[16]

DOJ Implementation & Enforcement

The DSP is administered and enforced by the Foreign Investment Review Section (FIRS) of the NSD, which is responsible for the DOJ’s non-prosecutorial efforts to address and manage national security risks to cross-border transactions, business, and technology that are posed by threats such as foreign adversaries. The FIRS also may handle requests for advisory opinions submitted by potentially regulated parties regarding the application of the DSP to specific transactions, which is a mechanism embedded within the Final Rule pertaining to the DSP.^[17]

Any civil or criminal prosecutions related to violations of the DSP likely will be handled by the NSD or will be referred to the appropriate U.S. attorney’s office. U.S. companies should expect enforcement under the DSP to largely mirror traditional export control or sanctions violations actions. Both the DSP and U.S. economic sanctions regimes derive their authority from the IEEPA. Civil and criminal liability under the IEEPA can be significant, with civil penalties of up to the greater of $386,136, or twice the value of each violative transaction, and criminal penalties of up to 20 years in prison, a $1,000,000 fine, or both.^[18] As such, U.S. persons or companies whose activities may fall within the ambit of the DSP should engage with counsel early and often to ensure appropriate compliance and reporting requirements are met.

Key Takeaways and Recommendations

U.S. persons and companies that have not already begun planning for full implementation of the DSP should come into compliance immediately. Such impacted companies may include:

• Cloud service providers

• Virtual service providers

• Data processing centers

• Medical device manufacturers

• Academic institutions

• Data analytics firms and consultants

• Government contractors in the defense or health care sectors

Like export control compliance measures, these U.S. persons and entities should engage counsel experienced in this area to undertake the following:

• Conduct internal reviews and audits to identify potential access to covered data or transactions involving the flow of such data to covered countries or persons.

• Implement policies, procedures, and trainings addressing data security and the transfer or access to any U.S. government-related data or bulk U.S. sensitive personal data.

• Determine the applicability of any general licenses or the need to apply for specific licenses for any prohibited or restricted transactions.

• Implement a compliance program to track transactions, perform regular due diligence, and maintain accurate records.

• Engage counsel to draft or revise vendor contracts as necessary, conduct due diligence, and interface with government agencies such as the DOJ when necessary.

• Adjust employee work locations, roles, or responsibilities depending on proximity or exposure to countries of concern or covered persons.

• Implement the Cybersecurity and Infrastructure Agency (CISA) Security Requirements.

Taking these measures will assist U.S. companies and persons to adequately prepare for enforcement action likely to come.

Affected companies and persons should also take note of October 6, 2025. Starting on that date, entities and individuals must comply with due diligence and audit requirements for restricted transactions, and reporting requirements for restricted transactions and rejected prohibited transactions.

If you have questions about this topic, please feel free to reach out to any of the authors or your Â鶹ֱ˛Ą & Lardner attorney. If you would like to see future updates regarding “What Every Multinational Company Should Know” about operating in today’s complicated international trade world, please sign up for our Tariff & International Trade blog —

***

[1] “DATA SECURITY PROGRAM: IMPLEMENTATION AND ENFORCEMENT POLICY THROUGH JULY 8, 2025,” Department of Justice (April 11, 2025),

[2] See 50 U.S.C. § 1705; see also Executive Order 14117, “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern” (February 28, 2024),

[3] The White House, “American First Investment Policy,” (February 21, 2025), ; The White House, “Fact Sheet: President Donald J. Trump Restores Maximum Pressure on Iran,” (February 4, 2025),

[4] “DATA SECURITY PROGRAM: COMPLIANCE GUIDE,” Department of Justice (April 11, 2025),

[5] See §§ 202.211(a)(1)-(5)

[6] See § 202.701

[7] See §§ 202.214, 202.258, 202.217, & 202.228

[8] See § 202.222(a)(1)

[9] See § 202.222(b)

[10] See § 202.206

[11] See § 202.249

[12] See §§ 202.301-303

[13] See § 202.401

[14] See §§ 202.501-511

[15] See § 202.801

[16] See § 202.802

[17] See § 202.901

[18] See § 202.1301; see also 50 U.S.C. § 1705

On June 25, 2025, the Financial Crimes Enforcement Network (FinCEN) at the U.S. Department of the Treasury designated three Mexico-based financial institutions as primary money laundering concerns under Section 311 of the USA PATRIOT Act.[1] In the short term, this means that domestic and U.S.-located foreign financial institutions and agents will now have until September 4, 2025 to implement the orders’ prohibitions on certain transmittals of funds involving the designated institutions.[2]

Orders Pursuant to the Declared Fentanyl-Trafficking Emergency

FinCEN’s orders, made pursuant to the Fentanyl Sanctions Act and the FEND Off Fentanyl Act, designate the following three financial institutions on the basis that they are facilitating payments related to the production of fentanyl:

• CIBanco S.A., InstituciĂłn de Banca MĂşltiple (CIBanco)[3]
• Intercam Banco S.A., InstituciĂłn de Banca MĂşltiple (Intercam)[4]
• Vector Casa de Bolsa, S.A. de C.V. (Vector)[5]

FinCEN based its designations on findings indicating that these institutions facilitated transactions between Chinese entities that sell fentanyl precursors and Mexico-based drug cartels that make and market finished fentanyl products. The institutions therefore fall under the ambit of the Fentanyl Sanctions Act of 2019 and the FEND Off Fentanyl Act of 2024.[6]

With these orders FinCEN aims to sever any illicit financial channels supported by money laundering conducted through CIBanco, Intercam, and Vector. The orders will prohibit domestic and U.S.-located foreign financial institutions and agents from engaging in transmittals of funds from or to the three institutions, or from or to any account or convertible virtual currency address administered by or on behalf of them. In practice, however, the orders have already incentivized broader compliance with FinCEN in the form of entities taking proactive steps to distance themselves from these financial institutions. For example, following the FinCEN designations, Visa suspended all international transactions made with CIBanco bank cards.[7] And the Government of Mexico has begun the process of separating the fiduciary units of CIBanco and Intercam and temporarily transferring them to state-owned banks.[8]

Signs of a Broader Shift in Federal Enforcement Priorities

This FinCEN enforcement action likely reflects a broader shift in U.S. federal enforcement priorities, with multiple agencies now intensifying focus on the international narcotics trade, particularly targeting Mexico-based fentanyl traffickers.[9] Shortly after taking office in 2025, President Trump announced an aggressive stance against drug cartels and transnational criminal organizations (TCOs), in part through Executive Order 14157 that directed the State Department and Treasury Department to take related enforcement actions.[10] Following this, the Office of the Attorney General announced its goal of totally eliminating cartels and transnational criminal organizations,[11] the Secretary of State designatedeight Mexican cartels as Foreign Terrorist Organizations (FTOs) and Specially Designated Global Terrorists (SDGTs),[12] and the Criminal Division of the Department of Justice published a memorandum identifying a prioritization of cartel- and TCO-activity within its white-collar enforcement approach.[13]

In the coming months, this enforcement trend may continue and evolve. For example, the Office of Foreign Assets Control (OFAC) at the Treasury Department may begin to issue Specially Designated Nationals (SDN) designations targeting persons and entities involved with such cartels and TCOs, especially in activities relating to fentanyl trafficking. Certain entities, including the following, may be at a heightened risk of receiving such designations:

• Financial institutions, especially those that facilitate foreign transactions requiring U.S. correspondent banks, and/or those involved in facilitating transactions between Chinese and Mexican parties;
• Chemical manufacturers, especially those involved in the manufacture of precursor chemicals used to produce fentanyl or other illicit narcotics, many of which are based in China (including Hong Kong), India, and Germany;
• Customs brokers facilitating the clearance of goods from countries that will be faced with increased scrutiny; and
• Logistics companies, especially those involved in shipping products into, out of, and within Mexico.

Upon designation, an SDN’s assets are blocked and transactions with U.S. persons, on U.S. territory, or involving U.S. currency are prohibited. For non-U.S. entities that do business with cartels and TCOs, OFAC might even issue secondary sanctions, effectively severing from the U.S. market not only the cartels and TCOs themselves, but also anyone who does not comply with U.S. sanctions on them. OFAC can pursue civil penalties for any violation of SDN sanctions.

The Justice Department’s National Security Division may also begin to initiate enforcement actions, including the following:

• Prosecutions under the Anti-Terrorism Act (ATA),[14] for knowingly providing, or attempting or conspiring to provide, “material support or resources” to an FTO.[15] The Justice Department has already brought ATA charges against Mexican and Venezuelan nationals—individuals alleged to be members of the Jalisco New Generation Cartel[16] and Tren de Aragua,[17] respectively. The Justice Department has even indicted two Americans on grounds of conspiring “to provide material support” to a Mexican cartel “in the form of U.S. currency” through the operation of a crude oil company based in Texas.[18]
• Prosecutions under the International Emergency Economic Powers Act (IEEPA) against persons or entities who violate SDN or SDGT sanctions willfully or egregiously.
• Prosecutions related to international money laundering charges that criminalize financial transactions involving the proceeds of unlawful activity, or under the Bank Secrecy Act (BSA), 31 U.S.C. § 5322, which criminalizes failure by a financial institution to meet certain reporting and recordkeeping requirements designed to prevent money laundering. Such prosecutions expose defendants to asset forfeiture and government seizures.[19] In 2024, TD Bank N.A. pleaded guilty and agreed to pay nearly US$2 billion in penalties—about a quarter of which were in forfeitures—following the Justice Department’s investigation of anti-money laundering and BSA violations that “allowed hundreds of millions of dollars from money laundering networks to flow through the bank, including for international drug traffickers.”[20]

This kind of shift in the federal government’s enforcement approach has precedent. In fact, the current Trump Administration’s emerging enforcement approach toward Mexican cartels and TCOs appears to resemble the first Trump Administration’s enforcement escalation against North Korea that began in 2017. That strategy also involved layered and coordinated actions—including FTO/SDGT designations, FinCEN orders, OFAC SDN designations, and DOJ prosecutions—culminating in a robust sanctions and enforcement regime. And, perhaps coincidentally, the U.S. enforcement actions on North Korea in 2017, similar to its enforcement actions on cartels and TCOs today, involved targeting Chinese facilitators.

Heightened Legal and Reputational Risks Within Certain Industries and Regions

The Trump Administration’s strategic realignment of the federal government’s enforcement mechanisms against fentanyl traffickers appears poised to create heightened legal and reputational risks for certain companies and individuals. Vulnerable industries include, as stated, financial services, chemical manufacturing, customs-clearance, and logistics and shipping. Key risks include liability for transacting with sanctioned individuals under IEEPA, for materially supporting terrorism under the ATA, for engaging in money laundering, or failing to comply with the BSA. Companies and individuals even risk becoming designated as SDNs themselves and having their assets blocked by the U.S. financial system.

To respond to such risks, companies should implement a comprehensive compliance regime and take steps such as: employing a comprehensive risk assessment that identifies exposure to indirectly or unwillingly aiding drug trafficking and advanced money laundering techniques;  enhancing due diligence protocols, especially for counterparties in high-risk jurisdictions to include China (and Hong Kong), Germany, and India; training employees on internal reporting and escalation procedures; and engaging in the other risk-mitigating steps identified by Â鶹ֱ˛Ą, such as here.

If you have questions or concerns about the compliance issues raised in this article, please reach out to any of the authors or your Â鶹ֱ˛Ą & Lardner attorney.

The Â鶹ֱ˛ĄÂ International Government Enforcement Defense & Investigations Team is monitoring all international trade and regulatory developments, which we are posting as they occur on our Tariff & International Trade Resources blog. Our white paper on “Managing Import and Tariff Risks During a Trade War” outlines a 12-step plan to provide practical steps to help importers navigate the tariff and international trade risks in the current tariff and trade environment, while the companion white paper on “Managing Supply Chain Integrity Risks” provides practical advice to deal with heightened supply chain risks pertaining to goods imported into the United States, including the increasing use of detentions by Customs. If you would like to see future updates regarding “What Every Multinational Company Needs to Know” about operating in today’s complicated international trade world, please sign up for our Tariff & International Trade blog — 

---

[1] “Treasury Issues Historic Orders under Powerful New Authority to Counter Fentanyl,” U.S. Treasury Dep’t (June 25, 2025), .

[2] “Treasury Extends Effective Dates of Orders Issued Under New Authority to Counter Fentanyl,” Financial Crimes Enforcement Network (July 9, 2025), .

[3] Imposition of Special Measure Prohibiting Certain Transmittals of Funds Involving CIBanco S.A., Institución de Banca Multiple, 90 Fed. Reg. 27770 (June 30, 2025).

[4] Imposition of Special Measure Prohibiting Certain Transmittals of Funds Involving Intercam Banco S.A., Institución de Banca Multiple, 90 Fed. Reg. 27777 (June 30, 2025).

[5] Imposition of Special Measure Prohibiting Certain Transmittals of Funds Involving Vector Casa de Bolsa, S.A. de C.V., 90 Fed. Reg. 27764 (June 30, 2025).

[6] 21 U.S.C. § 2313a; Public Law 118–50 (H.R. 815), Division E (“FEND Off Fentanyl Act”), Title I, Subtitle A, enacted April 24, 2024.

[7] “Visa suspends international transactions made with CIBanco cards,” Mexico Daily News (July 1, 2025), .

[8] “Mexico Shifts CIBanco, Intercam Trusts to State Banks,” Mexico Business News (July 8, 2025), .

[9] Â鶹ֱ˛Ą has been following and analyzing the Trump Administration’s actions: “What Every Multinational Company (Doing Business in Mexico) Should Know About . . . Mitigating Risks From ATA Scrutiny in a New Enforcement Regime” (March 6, 2025), /insights/publications/2025/03/multinational-company-business-mexico-mitigating-risks-ata-scrutiny/; “What Every Multinational Company Should Know About . . . Mitigating Risks Posed by the New Trump Administration Focus on Drug Cartels and TCOs” (June 17, 2025), /insights/publications/2025/06/multinational-company-mitigating-risk-focus-drug-cartels-tco/.

[10] Executive Order 14157, “Designating Cartels and Other Organizations As Foreign Terrorist Organizations And Specially Designated Global Terrorists” (Jan. 20, 2025), .

[11] “Total Elimination of Cartels and Transnational Criminal Organizations,” Office of the Attorney General (Feb. 5, 2025), .

[12] “Designation of International Cartels,” Office of the Spokesperson of the U.S. State Dep’t (Feb. 20, 2025), .

[13] “Focus, Fairness, and Efficiency in the Fight Against White-Collar Crime,” Criminal Division of U.S. Dep’t of State  (May 12, 2025), .

[14] There is also a risk of civil liability under the ATA. The statute allows for U.S. national victims and their estates or heirs to bring claims against defendants alleged to have aided and abetted an “injury arising from an act of international terrorism committed, planned, or authorized by an organization that had been designated as a foreign terrorist organization.” 18 U.S.C. § 2333(a).

[15] 18 U.S.C. § 2333 (2024).

[16] “Mexican Indicted in US in First After Cartel Designated as Terrorist Group,” Reuters (May 16, 2025), .

[17] “Justice Department brings first terrorism case against alleged high-ranking TdA gang member,” AP News (April 23, 2025), .

[18] “Father and Son indicted for Providing Material Support to Mexican Cartel Engaged in Terrorism,” U.S. Drug Enforcement Administration (May 30, 2025), .  

[19] See 18 U.S.C. §§ 981–82; 31 U.S.C. § 5317(c).

[20] “TD Bank Pleads Guilty to Bank Secrecy Act and Money Laundering Conspiracy Violations in $1.8B Resolution,” U.S. Dep’t of Justice (Oct. 10, 2024).

On May 23, 2025, approximately five months after the Assad regime was overthrown, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) officially issued Syria General License (GL) 25, which lifted the sanctions initially placed on Syria through a series of U.S. executive orders.[1] On June 30, 2025, President Trump further issued a new executive order (E.O.) — “Providing for the Revocation of Syria Sanctions” — terminating the Syria Sanctions Program and the national emergency with respect to Syria, effective July 1, 2025.[2]

The lifting of these sanctions marks the beginning of increased economic engagement between Syria and the United States, as well as a significant shift in U.S. foreign policy. The changes reflect improved conditions under Syria’s new president, Ahmed al-Sharaa, and aims to support a peaceful, unified, and stable Syria while holding accountable those responsible for past abuses.

These changes may additionally introduce multinational businesses into Syria that have long avoided the country in order to comply with U.S. law. But businesses should remain cautious and continue to conduct intensive due diligence related to any new business in the region. While the sanction program is changing, sanctions still remain in effect for individuals and entities related to Bashar al-Assad and his affiliates linked to Syria’s past proliferation activities, ISIS and Al-Qa’ida affiliates, Iran, and its proxies. Further, due to the historical links between Syria and many Syrian entities with Iran, due diligence also must address potential economic sanctions issues that could arise from indirect dealings with Iran or Iranian entities.

Background

Since 1979, the United States has designated Syria as a state sponsor of terrorism, leading to decades of U.S. restrictions on foreign assistance, bans on defense exports and sales, export controls of dual-use items, and other financial restrictions.[3] In 2004, pursuant to a series of executive orders beginning with E.O. 13338, OFAC designated certain individual Syrian persons and entities as Specially Designated Nationals (SDNs) based on determinations regarding terrorism, human rights violations, and other activities opposed to U.S. interests.[4]

Also in 2004, pursuant to E.O. 13338, the U.S. issued export controls prohibiting the export and reexport to Syria of certain products pursuant to the Export Administration Regulations (EAR) and the International Traffic in Arms Regulations (ITAR).[5] Exports of goods to Syria that are subject to EAR require a license, while defense articles subject to ITAR controls, like missiles, generally cannot be exported to Syria at all.[6]

In 2005, OFAC created the official Syrian Sanctions Regulations program, which implements all the U.S. legal authorities sanctioning Syria, including executive orders.[7] From 2006 to 2012, E.O.s 13399, 13460, 13572, 13573, 13582, 13606, and 13608 added more Syrian individuals to the sanctions program and to the SDN list.[8]

In April 2011, after the Syrian civil war began, E.O. 13582 focused sanctions on the entire Government of Syria, blocking the property of Syrian officials whom the U.S. State Department concluded to be responsible for human rights abuses, especially against Syrian citizens.[9] By blocking the property and assets of these officials, E.O. 13582 prohibited new U.S. investments in Syria and all approvals, financing, facilitation, and guarantees by U.S. persons with Syria. Additionally, it added further export controls on all exportations, reexportations, sales, and supplies of services to Syria by U.S. persons or anyone subject to U.S. jurisdiction to Syria, all importations of Syrian petroleum products, and all petroleum product transactions between U.S. persons and Syria.[10]

In May 2011, E.O. 13573 expanded sanctions to directly include then-President Bashar al-Assad and any senior officials of the Government of Syria, as determined by the Secretaries of the Treasury and State.[11]

In 2019, Congress passed the Caesar Syria Civilian Protection Act, which placed a secondary set of statutory sanctions on foreign persons and countries connected to the Assad regime’s import of certain goods, services, and technologies such as those related to the military, aviation, and natural resource industries.[12]

Since 2011, U.S. sanctions on Syria have shrunk Syria’s economy by over 60%, according to some estimates.[13]

Lifting Sanctions

A. General License 25 (GL 25)

To ease U.S. sanctions on Syria, OFAC and the U.S. State Department separately issued a license and waiver allowing transactions with Syrian businesses. OFAC’s GL 25 is a general license that lifts sanctions on Syria but simultaneously allows the U.S. to reauthorize those sanctions at any time.[14] Through GL 25, the U.S. has lifted the sanctions imposed by E.O.s 13338, and other executive orders from 2006 to 2012, and granted a general license to transact with certain Syrian individuals and businesses.[15] At the same time as GL 25’s issuance, the U.S. Department of State issued a waiver of the Caesar Syria Civilian Protection Act for 180 days, lifting the secondary set of statutory sanctions with revisitation after the 180 days.[16]

With the implementation of GL 25 and the Caesar Syria Civilian Protection Act Waiver, and continuing EAR/ITAR controls on certain goods sent to Syria, U.S. companies’ abilities to associate with Syrian businesses changed.

GL 25 allows U.S. companies to:

• Make investments in Syria.[17]
• Export services to Syria.[18]
• Import Syrian petroleum products.[19]
• Conduct petroleum product transactions with certain Syrians, including those in the Annex in GL 25.[20]

But GL 25 still prohibits U.S. companies from:

• Conducting transactions with blocked persons on the Specially Designated Nationals List.[21]
• Conducting transactions with entities which have ownership percentages of at least 50% by blocked persons on the Specially Designated Nationals List.[22]
• Conducting transactions with Syria that involve Russia, Iran, and North Korea.[23]

B. Executive Order Providing for the Revocation of Syria Sanctions

Additionally, effective July 1, 2025, President Trump, through his executive order “Providing for the Revocation of Syria Sanctions” (issued on June 30, 2025), terminated the following:

• The national emergency declared in Executive Order 13338 of May 11, 2004 (Blocking Property of Certain Persons and Prohibiting the Export of Certain Goods to Syria), and revoked that order;[24]

• Executive Order 13399 of April 25, 2006 (Blocking Property of Additional Persons in Connection With the National Emergency With Respect to Syria);[25]

• Executive Order 13460 of February 13, 2008 (Blocking Property of Additional Persons in Connection With the National Emergency With Respect to Syria);[26]

• Executive Order 13572 of April 29, 2011 (Blocking Property of Certain Persons with Respect to Human Rights Abuses in Syria);[27]

• Executive Order 13573 of May 18, 2011 (Blocking Property of Senior Officials of the Government of Syria),[28] and

• Executive Order 13582 of August 17, 2011 (Blocking Property of the Government of Syria and Prohibiting Certain Transactions with Respect to Syria).[29]

OFAC also removed over 500 individuals and entities from the Specially Designated Nationals and Block Persons list who were previously sanctioned. The full list is available and includes Syriatel Mobile Telecom, the Commercial Bank of Syria, the Syrian Petroleum Company, and the Syria International Islamic Bank.[30] Notably, all Syrian financial institutions, including the Central Bank of Syria, have been removed from OFAC’s List of Specially Designated Nationals and Blocked Persons (SDN List).[31]

Therefore, effective July 1, 2025, U.S. persons are no longer prohibited from providing financial services to Syria, processing payments on behalf of third-country financial institutions involving Syrian financial institutions, or conducting transactions with the new Government of Syria and Syrian financial institutions, provided that none of the involved parties are on the SDN List.[32] This includes establishing correspondent banking relationships with Syrian financial institutions.[33] In line with the lifting of Syria sanctions, the Financial Crimes Enforcement Network issued exceptive relief, in late May 2025, to permit U.S. financial institutions to open and maintain correspondent accounts for the Commercial Bank of Syria.[34]

OFAC also removed the Syrian Sanctions Regulations, 31 CFR Part 542 (SySR) from the Code of Federal Regulations following the July 1, 2025, revocation. The OFAC Syria-related sanctions program has now become the Promoting Accountability for Assad and Regional Stabilization Sanctions (PAARSS) program.[35] The Executive Order also now allows the export of U.S.-origin food and medicine to Syria without a license from OFAC.[36] Previously, only U.S.-origin food and medicine classified as EAR99 could be exported to Syria, pursuant to specific procedures.

The Department of State separately announced that it will examine the potential full suspension of the temporarily suspended Caesar Act and that while the sanctions program is ending, sanctions remain in effect for individuals and entities related to the Bashar al-Assad regime.[37]

The order also authorizes waivers under the Syria Accountability Act, and the Chemical and Biological Weapons Control and Warfare Elimination Act, contingent on continued reform. It further directs agencies to review Syria’s designation as a State Sponsor of Terrorism and encourages coordinated action at the United Nations.

On July 7, 2025, the U.S. revoked the designation of al-Nusrah Front, also known as Hay’at Tahrir al-Sham (and other aliases), as a Foreign Terrorist Organization pursuant to section 219 (a)(6)(A) of the Immigration and Nationality Act (8 U.S.C. 1189(a)(6)(A)) and set the related notice for publication on July 8, 2025.[38]

What Companies Should Know

While the order opens the door for U.S. commercial engagement, it maintains restrictions against bad actors and affirms a policy of conditional engagement based on continued accountability and reform. In light of these requirements, companies looking to reengage with Syria or Syrian entities should keep in mind the following:

1. Continue to Screen Transactions for Compliance with Remaining Sanctions

While the lifting of sanctions in Syria may improve Syria’s economy through foreign engagement, U.S. companies should recognize the potential risk and ensure compliance with sanctions that remain in effect. Companies should vet all potential Syrian partners, counterparties, and intermediaries for past ties to the Assad regime, human rights abuses, terrorism, or narcotics trafficking (with a focus on Captagon drug trade connections) and run sanctions screening on all persons involved in any potential transaction.

2. Conduct Due Diligence for Potential Transshipments through Syria to Sanctioned Countries or Persons

Additionally, given historic ties to Iran, Syria-based transaction still need to undergo appropriate due diligence, as the country remains a potential transshipment point to Iran, which is under comprehensive sanctions.

Despite sanctions relief, many restrictions remain, including prohibitions on dealings with designated terrorist organizations, export controls for sensitive technologies (e.g., dual-use goods), and restrictions on certain financial transactions, banking access, and support for individuals tied to the former Assad regime.

3. Ensure Compliance Integrity

Maintain a robust compliance program. Be sure to perform due diligence on upstream suppliers and vendors if conducting business in Syria and implement traceability protocols and audit programs. The penalties for violating sanctions still exist and will be enforced. Document due diligence reports, maintain effective screening protocols for third parties, keep up to date on internal training on export control laws, anti-money laundering, and FCPA/anti-bribery laws. All of these steps will help keep you prepared for possible audits or inquiries by U.S. regulators

If you have questions about Syria, OFAC, or compliance with the current U.S. administration’s sanctions, reach out to the authors or your Â鶹ֱ˛Ą & Lardner attorney.

2025 Â鶹ֱ˛Ą Summer Associate Emily March contributed to the research and drafting of this article.

---

[1] Press Release, U.S. Dep’t of the Treasury, Treasury Issues Immediate Sanctions Relief for Syria (May 23, 2025), .

[2] Press Release, U.S. State Dept, Ending the Syria Sanctions Program for the Benefit of the Syrian People (June 30, 2025), .

[3] State Sponsors of Terrorism, Bureau of Counterterrorism, .

[4] Brochure, U.S. Dep’t of the Treasury, Off. of Foreign Assets Control, Syria Sanctions Program (Aug. 2, 2013).

[5] Exec. Order No. 13338, 3 C.F.R. 13338 (2004).

[6] 15 C.F.R. § 742.9 (2025).

[9] Syria Sanctions, U.S. Dep’t of State, .

[10] Id.

[11] Id.

[12] Fact Sheet from the Office of the Spokesperson, U.S. Dep’t of State (June 17, 2020), .

[13] Abdulkader Husrieh, By Invitation, The Economist, May 17-23, 2025, at 14.

[15] Id.

[16] Fact Sheet from the Office of the Spokesperson, U.S. Dep’t of State (June 17, 2020), .

[17] Id.

[18] Id.

[19] Id.

[20] Id.

[21] Id.

[22] Id.

[23] Id.

[24] The White House, “PROVIDING FOR THE REVOCATION OF SYRIA SANCTIONS”, (June 30, 2025), .

[25] Id.

[26] Id.

[27] Id.

[28] Id.

[29] Id.

[32] Id.

[33] Id.

[34] Id.

[35] U.S. Dept’ of Treasury, Office of Foreign Assets Control, Promoting Accountability for Assad and Regional Stabilization Sanctions (PAARSS) CHANGES TO OFAC’S SYRIA SANCTIONS PROGRAM AS OF JUNE 30, 2025, (June 30, 2025).

[36] U.S. Dep’t of Treasury, Office of Foreign Assets Control, #1222. Do I need a specific license from OFAC to export or reexport food or medicine to Syria?, Office of Foreign Assets Control (June 30, 2025).

[37] Press Release, U.S. State Dept, Ending the Syria Sanctions Program for the Benefit of the Syrian People (June 30, 2025), .

[38] U.S. Department of State, Public Notice 12762, Revocation of the Foreign Terrorist Organization Designation of al-Nusrah Front, also known as Hay’at Tahrir al-Sham (July 7, 2025), chrome-extension://efaidnbmnnnibpcajpcglclefindmkaj/https://public-inspection.federalregister.gov/2025-12720.pdf.

Mexican cartels dominate large swaths of the Mexico-United States border and the Bajío region (an area encompassing relevant parts of Queretaro, Guanajuato, Aguascalientes, San Luis Potosí, Jalisco, and Michoacán), and they control significant economic segments/activities in these territories. These are the same areas in which multinational companies maintain significant manufacturing operations.

In an Executive Order issued on January 20, 2025[1], the White House announced a shift toward increased enforcement of the Immigration and Nationality Act (INA) and International Emergency Economic Powers Act (IEEPA), which are key statutes in the United States’ fight against terrorism. Though these statutes are not new, the Trump Administration plans to broaden U.S. enforcement activity to cartels and transnational criminal organizations (TCOs) by allowing for the designation of cartels or TCOs as Foreign Terrorist Organizations and/or Specially Designated Global Terrorists. This new focus of enforcement resources, along with the expansive inclusion of cartels or TCOs within the purview of the INA and IEEPA, creates a heightened risk for multinational companies doing business in Mexico and other areas where cartels operate, as the companies can be perceived as — and then prosecuted for — engaging in terrorism or aiding terrorists, as explained below.

Under the INA, the Secretary of State can designate groups as Foreign Terrorist Organizations (FTOs)[2] based on an assessment of the State Department’s Bureau of Counterterrorism regarding the group’s terrorist activity. Once a group has received an FTO designation, multinationals subject to U.S. jurisdiction — which is interpreted very broadly by U.S. regulators — may face strict criminal and civil penalties under 18 U.S.C. § 2339B (the Antiterrorism Act or ATA) if they knowingly provide, or attempt or conspire to provide, “material support or resources” to the FTO.[3]

The State Department currently designates more than 60 organizations as FTOs. Trump’s January 20, 2025, Executive Order directs the State Department to scrutinize drug cartels — especially Mexico-based drug cartels and two cartels mentioned by name, Tren de Aragua (TdA) and La Mara Salvatrucha (MS-13) — for designation as FTOs. Since the order, Secretary of State Marco Rubio already has designated eight cartels as FTOs, most of which have operations in Mexico. We anticipate this number will sharply rise as the administration works together with OFAC to identify additional cartels and TCOs. This raises a number of concerns for companies that operate in areas known to have cartel or TCO activities, because the following types of regularly conducted business activities may be viewed through the lens of providing material support or resources to an FTO:

• Making payments to secure employee safety or the ongoing operation of a physical plant;
• Engaging in business dealings with local companies that themselves are in business with cartels or that are making such payments; and
• Recording payments to said local companies or to cartels in the books and records of publicly traded companies.

The expansion of enforcement scrutiny also may expand the types of risks facing companies, including:

• Combined OFAC and DOJ investigations of conduct that potentially violates both the INA and OFAC regulations;
• Matters that formerly would have been dealt with as civil matters by OFAC can become criminal matters pursued by DOJ;
• New designations can be combined with anti-money laundering laws to expand the potential violations of U.S. laws; and
• The expansion of the reach of OFAC designations to non-U.S. companies, since the material support statute has extraterritorial effect.

The January 20 Executive Order also heightens the risk of private civil litigation for multinationals doing business in Mexico. The ATA creates a civil remedy for U.S. national victims and their estates or heirs against defendants alleged to have caused an “injury arising from an act of international terrorism committed, planned, or authorized by an organization that had been designated as a foreign terrorist organization under section 219 of the [INA]” where “liability may be asserted as to any person who aids and abets, by knowingly providing substantial assistance, or who conspires with the person who committed such an act of international terrorism” (emphasis added). Under the ATA, “[a]ny national of the United States injured in his or her person, property, or business by reason of an act of international terrorism, or his or her estate, survivors, or heirs, may sue therefor in any appropriate district court of the United States and shall recover threefold the damages he or she sustains and the cost of the suit, including attorney’s fees.” 18 U.S.C. § 2333(a). The line of culpability under this section remains unsettled, as lower courts attempt to apply recent Supreme Court precedent regarding the “knowing” provision of “substantial assistance” to FTOs.[4] But the designation of cartels and TCOs as FTOs exposes companies that operate in countries with heightened cartel activity to litigation under the ATA.

For several years, Mexican cartels have shifted revenue sources from drug smuggling into the United States to racketeering in Mexico. The latter typically consists of Mexican cartels extorting regular payments from small-to-medium-sized businesses, many of which provide goods or services to larger companies such as the multinationals operating in Mexico. In addition to direct extortion, cartels engage in behaviors such as forcing suppliers on companies that in turn do business with multinational companies, establishing “front” entities to provide miscellaneous services, selling protection against rival organizations, establishing prices for goods or services, and receiving payments for not carrying out threatened violence.

Multinational companies in Mexico are thus in constant risk of having indirect contacts with these cartel FTOs within their local supply chain and, even if they are unaware of such touch points, multinationals must guard against being seen as actively complicit or willfully blind if they fail to take reasonable precautions.

To safeguard against these risks, multinationals subject to U.S. jurisdiction that do business in Mexico should take precautions such as:

• Conducting due diligence on all business counterparties, especially when onboarding new suppliers or other new business partners;
• Updating due diligence and requiring certifications of compliance with the laws prohibiting conducting business activities with TCOs and FTOs;
• Conducting routine OFAC and FTO screenings to assess the company’s risk profile with respect to potential touchpoints with cartels and TCOs;
• Mapping supply chains, including for sub-suppliers, to confirm zero contact with cartel or TCO activities throughout the supply chain;
• Based on risk assessments, following up and conducting audits to ensure the company’s supply chain is in compliance with the updated legal requirements;
• Implementing and maintaining vendor management systems for payments to suppliers and other business partners;
• Conducting financial audits on suppliers or other business partners to identify potential payments to cartels or TCOs;

• Alerting suppliers or other business partners regarding their potential connections to cartels or TCOs and help monitor to avoid risk; and
• Incorporating prohibitions on cartel and TCO connections, in addition to FTO restrictions, into agreements with third parties.

If you have questions or concerns about this article, please feel free to reach out to any of the authors or your Â鶹ֱ˛Ą & Lardner attorney. If you would like to see future updates regarding “What Every Multinational Company Needs to Know” about operating in today’s complicated international trade world, please sign up for our biweekly email list. .

To view all articles in our “What Every Multinational Company Needs to Know” series, click here.

---

[1] “Designating Cartels and Other Organizations as Foreign Terrorist Organizations and Specially Designated Global Terrorists,” Executive Order (Jan. 20, 2025) available at .

[2] Though this article focuses on the FTO designation under the INA, the Specially Designated Global Terrorist designation under IEEPA creates a separate set of enforcement issues for multinationals, as well as additional sanctions under IEEPA for FTOs. IEEPA is the governing authority for most economic sanctions overseen by the Office of Foreign Assets Control (OFAC), which has long maintained robust restrictions on U.S. persons, or any other person subject to U.S. law, to the primary U.S. economic sanctions. OFAC has sanctioned numerous drug cartels, as well as companies and individuals, using its authorities under its Significant Narcotics Traffickers program pursuant to Executive Order 12978 and the Kingpin Act. Because OFAC uses an expansive definition of U.S. jurisdiction, restrictions under these designations include the activities of non-U.S. persons that take place on U.S. territory, use the U.S. financial system, or otherwise trigger U.S. jurisdiction. Proper compliance requires that any persons with a U.S. jurisdictional nexus take into account all the potential ways U.S. law can apply to them, including both the new emphasis on the INA/IEEPA and the longstanding OFAC regulations.

[3] 18 U.S.C. § 2339A defines “material support or resources” to include “any property, tangible or intangible, or service, including currency or monetary instruments or financial securities, financial services, lodging, training, expert advice or assistance, safehouses, false documentation or identification, communications equipment, facilities, weapons, lethal substances, explosives, personnel . . . and transportation, except medicine or religious materials.”

[4] See Twitter, Inc. v. Taamneh 598 U.S. 471 (2023).