As detailed in Part I of this risk-assessment self-check series, we are publishing a series of self-check assessment guides covering the key regulatory and contractual risk areas for multinational companies. This article provides Part IV, which is a self-check assessment for conducting a supply chain contracts review. Previous self-check risks assessments are found in Part I (general compliance), Part II (buy-side contracts review), Part III (sell-side contracts review), and Part IV (supply chain integrity compliance self-check).

Antiboycott compliance presents a specialized but important risk for multinational companies engaged in cross-border trade. Unlike many trade controls that focus on what a company ships or where it ships, antiboycott exposure often arises from what a company is asked to say, certify, or agree to in the course of ordinary business. Prohibited requests can appear in contracts, purchase orders, letters of credit, tender documents, shipping instructions, or routine customer questionnaires, and may require a company to refuse to do business with certain countries or parties, furnish boycott-related information, or make certifications about origin, ownership, or business relationships.

In practice, the vast majority of antiboycott compliance issues encountered by U.S. companies involve requests associated with the Arab League boycott of Israel. Since the 1970s, various Arab League member states have maintained a multilateral boycott targeting Israel, and participants in this boycott have required foreign companies to furnish certifications, negative origin statements, or other assurances as a condition of doing business in the region. These requests — which may appear in letters of credit, shipping documents, or contract clauses — remain the most commonly reported category of boycott-related activity under both the Export Administration Regulations administered by the Bureau of Industry and Security and the antiboycott provisions of the Internal Revenue Code enforced by the Office of Antiboycott Compliance within the Internal Revenue Service (IRS).

These risks are often overlooked because the underlying transaction may otherwise appear commercially routine. Enforcement authorities increasingly focus on whether companies have practical controls to identify, escalate, and respond to boycott-related requests before they are accepted or acted upon.

This self-test is designed to help companies assess whether they have a functioning, risk-aligned antiboycott compliance framework. It focuses on governance, risk assessment, contract and document review, training, escalation, and response mechanisms, with an emphasis on whether boycott-related controls are embedded in day-to-day business activity. A “no” answer does not automatically indicate a violation, but it may signal a program gap that warrants further review or compliance enhancement.

I.          Risk Assessment & Program Design

• Has your company conducted a documented antiboycott risk assessment tailored to its products, services, customers, and geographic footprint?
• Does the assessment consider relevant antiboycott risk factors, including: (1) business in or involving jurisdictions where boycott-related requests may be more common; (2) use of distributors, agents, freight forwarders, or other intermediaries; (3) customer contracts, tenders, purchase orders, and letters of credit; (4) requests for certifications relating to country of origin, vessel calls, ownership, nationality, or business relationships; and (5) business functions most likely to encounter boycott language, such as sales, contracting, shipping, finance, and customer service?
• Are antiboycott risks reassessed when the business changes, including: (1) entry into new markets; (2) expansion of distributor or channel relationships; (3) new customer segments or government-related business; or (4) changes in applicable law, guidance, or enforcement activity?

II.         Policies & Practical Guidance

• Does your company maintain clear, accessible antiboycott policies tailored to its business model and transaction flows?
• Do policies go beyond general prohibitions and provide practical guidance on: (1) identifying boycott-related requests; (2) reviewing contracts, letters of credit, and shipping documents; (3) escalating questionable language; (4) handling prohibited certifications or questionnaires; and (5) reporting obligations where applicable?
• Are policies reviewed and updated periodically to reflect changes in law, guidance, business practices, and transaction risk?

III.        Contracting, Documentation & Transaction Controls

• Are contracts, tenders, purchase orders, letters of credit, shipping instructions, and other transaction documents reviewed on a risk-based basis for boycott-related language?
• Are employees equipped to identify problematic requests involving: (1) agreements not to do business with certain countries or blacklisted parties; (2) certifications regarding business relationships with certain countries or persons; (3) requests to disclose ownership, management, nationality, religion, or similar information for boycott-related purposes; and (4) shipping or routing instructions designed to support a boycott?
• Are procedures in place to reject, strike, or revise prohibited boycott-related terms before the company proceeds with the transaction?
• Are boycott-related requests and their disposition documented and retained in accordance with company procedures and legal requirements?

IV.        Training & Awareness

• Is antiboycott training provided on a risk-based basis, with enhanced focus for sales, contract management, legal, trade compliance, logistics, finance, procurement, and customer-facing personnel?
• Does training include realistic scenarios relevant to your company’s operations (e.g., boycott clauses in purchase orders, problematic letter-of-credit terms, end-customer certifications, or routing instructions tied to restricted destinations)?
• Is training tracked and documented?

V.         Escalation, Reporting & Oversight

• Do employees know when antiboycott review is required and how to escalate suspect language or requests to compliance personnel, legal counsel, or senior management?
• Is there a defined process for reviewing boycott-related requests promptly so that business teams can address them before shipment, payment, or contract execution?
• Does your company have a process for identifying and meeting applicable antiboycott reporting obligations when reportable requests are received?
• Does the company periodically test or review whether antiboycott controls are functioning in practice, including through audits or spot checks of relevant documents and transactions?

VI.        Incident Response & Continuous Improvement

• Are potential antiboycott issues investigated promptly, with appropriate documentation of the request, response, business impact, and remediation?
• Are control failures, missed escalations, or improper responses addressed through corrective action, retraining, and process improvements?
• Are lessons learned from incidents, audits, business changes, or enforcement developments fed back into risk assessments, training, and program design?
• Does the company periodically evaluate whether its antiboycott compliance framework remains aligned with its current markets, customers, and transaction patterns?

If you would like help analyzing the results of your compliance self-check, please reach out to the authors or your �鶹ֱ�� relationship attorney.

Would you like more practical compliance tips like these? The �鶹ֱ�� International Trade & National Security Team is monitoring all international trade, enforcement, and compliance developments, which we post as they occur on our Tariff & International Trade Resources blog. for our email list to receive future emails and practical international regulatory compliance tips, including our weekly Tariff-ied! This Week in International Trade and What Every Multinational Should Know articles.

Our white paper on Managing Import and Tariff Risks During a Trade War outlines a 12-step plan to provide practical steps to help importers navigate the tariff and international trade risks in the current tariff and trade environment, while the companion white paper on Managing Supply Chain Integrity Risks provides practical advice to deal with heightened supply chain risks pertaining to goods imported into the United States, including the increasing use of detentions by Customs.

This month’s by the United States Department of Justice (DOJ) of another False Claims Act (FCA) settlement with a federal contractor offers further proof that the government continues to prioritize cybersecurity enforcement. According to DOJ’s press release, government contractor Honeywell Aerospace Inc. (Honeywell Aerospace) agreed to pay over $2 million to settle an FCA matter, which arose from allegations related to the company’s cybersecurity practices with respect to its Department of Defense contracts.

The Honeywell Settlement

Honeywell Aerospace is an Arizona-based company that provides aerospace products and solutions to government and commercial customers. A former IT employee filed a qui tam complaint after she was allegedly constructively discharged by the company for raising cybersecurity concerns related to the company’s contracts with the Department of Defense.

According to the complaint, pursuant to the contracts, Honeywell Aerospace provided the government with quantum computing services. Federal defense contractors like Honeywell Aerospace are required to implement certain cybersecurity controls outlined in the National Institute of Standards and Technology Special Publication 800-171 (). But, according to this lawsuit, Honeywell Aerospace failed to meet these requirements in connection with its work on the Quantum Contracts.

The complaint alleged myriad cybersecurity failings by Honeywell Aerospace with respect to the Quantum Contracts from April 2020 through December 2023, particularly as to the company’s treatment of controlled unclassified information (CUI) hosted on its “Gray Network,” an electronic network used for its work on the Quantum Contracts. The relator alleged that Honeywell Aerospace relied on a firewall to protect the Gray Network that was simply “a smokescreen to hide its inadequate security practices,” and that the company employed inadequate malicious code protection, access control, incident testing and response, and oversight of suspicious activity. Further, the complaint alleged that the company failed to report suspected cyber incidents or breaches as required by the Quantum Contracts and federal cybersecurity requirements.

Honeywell Aerospace did not admit these allegations but agreed to pay over $2 million to settle the claims, of which the qui tam relator will receive $375,823.

Implications of the Honeywell Aerospace Settlement

This settlement serves as a reminder that the government’s enforcement work on cybersecurity issues under the FCA is alive and well. As noted by Assistant Attorney General Brett A. Shumate of the Justice Department’s Civil Division in connection with the Honeywell Aerospace settlement: “The Justice Department will continue to investigate potential violations of these cybersecurity requirements to protect this critical information.”

This case fits a pattern of other recent cybersecurity FCA settlements that involve federal defense contractors whose contracts have contractual clauses requiring compliance with the NIST SP 800-171 requirements for handling CUI. Defining what constitutes CUI and mapping the boundaries of information systems that hold CUI is notoriously challenging. The threat of FCA enforcement raises the stakes for confronting that challenge even more. 

In addition, this also highlights the risk of FCA suits arising from insiders, as the FCA is a rare statute that allows private individuals to file suit on behalf of the United States. Just like multiple other recent cyber FCA settlements, the relator in this case was an IT employee of the company who allegedly had raised concerns about the company’s cybersecurity compliance.  

Recommendations

Government contractors and other recipients of federal funds should consider the following steps to enhance cybersecurity compliance and reduce FCA risk:

1. Catalogue and monitor compliance with all government-imposed cybersecurity standards. Ensure your organization has a comprehensive list of all cybersecurity requirements and covered systems in your organization. These requirements may come not only from prime government contracts but also subcontracts, grants, or other federal programs. This includes not only ongoing knowledge of the organization’s contracts but also diligently classifying the types of information the organization handles (such as CUI) and which systems process that information. This also includes continuously monitoring and assessing the organization’s cybersecurity program to identify and patch vulnerabilities and to assess compliance with those contractual cybersecurity standards. This assessment should also consider third-party relationships, including vendors and service providers.

• Develop and maintain a robust and effective compliance program that addresses cybersecurity issues. In many companies, the compliance program and information security functions are not well integrated. An effective compliance program will address cybersecurity concerns and encourage employees to report such concerns. When concerns are identified, it is critical to escalate and investigate them promptly — the allegations in the Honeywell Aerospace complaint serve as a cautionary tale highlighting the potential consequences of not effectively responding to employees’ concerns. And companies should take care to ensure that there is no retaliation against employees who report concerns in good faith. It may often be beneficial to involve counsel in the investigation of concerns as early intervention is key to assessing and minimizing risk.

• Where non-compliance with cybersecurity standards is identified, organizations should evaluate potential next steps. This includes whether to disclose the matter to the government and cooperate with government investigators. Organizations should work with experienced counsel in this regard. Proactively mapping out a strategy for investigating and responding to potential non-compliance can instill discipline to the process and streamline the organization’s approach. And a proactive approach may mitigate the impact of consequences down the line.

If you have questions about cybersecurity or the False Claims Act, reach out to the authors or your �鶹ֱ�� & Lardner attorney.

The recent Department of Justice (DOJ) outlining the National Fraud Enforcement Division’s priorities signals a strategic shift in how DOJ intends to investigate and prosecute fraud. As discussed in our prior article on the memo’s health care implications, the memo shows that DOJ will concentrate its resources on fraud that threatens the “health, safety, security, and prosperity of Americans,” with emphasis on five priority areas: public trust and financial integrity, health care, internal revenue, global trade and commerce, and corporate misconduct.

This article focuses on what the memo means for companies engaged in global trade and commerce — particularly U.S.-based importers. The takeaway for these companies is that customs and trade fraud enforcement has entered a new and far more aggressive phase, and importers who are not accustomed to this level of government scrutiny need to get up to speed.

Trade and Customs Fraud Is a DOJ Priority

The Fraud Division memo explicitly identifies “Global Trade and Commerce” as one of its five principal enforcement priorities. According to the memo, the Division will “lead the Department’s coordinated criminal enforcement strategy, targeting trade and customs violations and supply chains polluted by forced labor.” The memo further states that prosecutors will focus on “systemic, high-impact noncompliance that threatens our economic and national security,” including “illicit transshipment schemes, country-of-origin fraud, the undervaluation of imported goods designed to evade duties, sanctions evasion, and foreign forced labor schemes.”

DOJ Has Established Tools for Enforcement

• The Fraud Division memo is not the first indicator of the administration’s crackdown on trade violations. Over the past year, DOJ has been developing several other related initiatives:
• The Trade Fraud Task Force. In August 2025, DOJ and the Department of Homeland Security launched a cross-agency Trade Fraud Task Force, combining prosecutors and investigators from multiple agencies — including Customs and Border Protection (CBP), Homeland Security Investigations, Internal Revenue Service (IRS) Criminal Investigation, and more than 30 U.S. Attorney’s Offices. By July 2026, the Task Force had surpassed $1 billion in civil and criminal recoveries, penalties, forfeitures, and publicly charged losses in less than one year.
• The Global Trade & Commerce Enforcement Section. In conjunction with the Task Force’s $1 billion milestone, DOJ announced the creation of a permanent Global Trade & Commerce Enforcement Section within the National Fraud Enforcement Division itself — signaling that heightened trade enforcement is a long-term institutional priority.
• A Resource Guide to Trade Fraud Enforcement. In July 2026, DOJ published detailing the statutes, enforcement mechanisms, and interagency partnerships it intends to leverage — essentially a roadmap for the trade community.
• Technology-Enabled Detection. The memo describes a Division backed by data scientists, automated litigation support, and a new National Fraud Detection Center, which DOJ launched on August 24, 2026, as a multiagency hub for generating criminal leads across all fraud types. On the customs side, CBP is developing an artificial intelligence-enabled (AI) “Detective Border” that integrates shipment data, routing histories, ownership relationships, production-capacity indicators, and other information to identify suspicious transshipment and country-of-origin claims. These are capabilities that did not exist at this scale even a few years ago. DOJ officials have said openly that they plan to borrow from the Health Care Fraud Unit’s data-driven playbook, which used algorithmic detection and AI tools to charge multiple defendants in a 2026 health care fraud takedown.¹ Importers should expect similar techniques applied to tariff classification, valuation, and country-of-origin data.

The False Claims Act Is Driving the DOJ Enforcement Wave

The primary DOJ enforcement vehicle in this new push has been — and will likely continue to be — the False Claims Act (FCA). For decades, the FCA was the government’s tool of choice in health care fraud and defense procurement cases. While health care companies know it well, many importers may not.

The FCA’s “reverse false claims” theory imposes liability for knowingly avoiding an obligation to pay money to the government — which maps directly onto customs duty evasion. The FCA also carries treble damages and allows private individuals known as “relators” to initiate qui tam suits, which means the financial exposure for importers can be enormous. Relators can be anyone — a former employee, a competitor, a customs broker — and they stand to collect a share of whatever the government recovers, often millions of dollars.

Recent cases illustrate the scale:

• Perfectus Aluminum ($549.5 million). In May 2026, DOJ announced the largest customs-related FCA settlement in history. Perfectus Aluminum and affiliated companies agreed to pay $549.5 million to resolve allegations that they evaded antidumping and countervailing duties on aluminum extrusions imported from China by disguising them as finished “pallets” not subject to applicable duties. The case involved over 2.2 million aluminum products and more than $880 million in imports. The relators received approximately $96 million — roughly 17.5% of the settlement — underscoring just how lucrative these cases can be for insiders willing to come forward.
• Ceratizit USA ($54.4 million). In December 2025, Ceratizit USA settled FCA allegations that it routed Chinese-origin tungsten carbide products through Taiwan and falsely declared Taiwan as the country of origin to avoid Section 301 tariffs. At the time, this was itself a record — Perfectus eclipsed it five months later.
• MGI International (criminal + civil resolution). Also in December 2025, DOJ announced a criminal resolution involving MGI International, whose chief operating officer pleaded guilty to conspiracy to smuggle goods into the United States for directing subordinates to misrepresent the country of origin of plastic resin on customs entry summaries.

These cases show that DOJ now views customs evasion the same way it views health care fraud or procurement fraud — as a form of stealing from the federal government that warrants aggressive, multi-tool enforcement.

What This Means for Importers and Trade-Facing Companies

DOJ is building a more centralized, technologically enabled trade fraud enforcement model. For importers and companies with global supply chains, that makes customs compliance an enterprise-level legal risk. And unlike the health care industry, which has had decades to develop compliance programs in response to FCA enforcement, the import community is largely encountering this level of enforcement intensity for the first time.

In light of these developments, companies should consider several practical steps:

1. Elevate customs compliance to an enterprise risk. Customs and trade compliance should not be siloed in the logistics or operations department. It should be integrated into enterprise risk management, internal audit, and legal oversight — the same way health care companies treat billing compliance and anti-kickback programs. Boards and senior leadership should have visibility into import compliance risks.

2. Audit your customs data before the government does. With DOJ leaning into data analytics, importers should do the same. Review import entry data, tariff classifications, country-of-origin declarations, valuation methodologies, and free trade agreement claims for outliers and unexplained anomalies.

3. Scrutinize your supply chain. Companies should understand the actual production flow and country of origin for their imports, retain supporting documentation, and ensure that third-party partners are not creating compliance exposure. Pay attention to customs brokers, freight forwarders, warehouse operators, and foreign suppliers.

4. Take forced labor risk seriously. The memo specifically calls out “supply chains polluted by forced labor.” The Uyghur Forced Labor Prevention Act creates a rebuttable presumption that goods from the Xinjiang region of China are made with forced labor and are barred from entry. In addition, CBP has long enforced trade restrictions on the importation of goods that use forced labor or human trafficking in the supply chain; the DOJ could get involved in these issues as well. The DOJ has signaled that forced labor violations in trade may also carry criminal consequences under 18 U.S.C. § 1589 and related provisions.

5. Integrate tax into trade investigations. The Fraud Division memo makes clear that tax enforcement is a cross-cutting priority. Potential trade fraud matters should be evaluated for tax implications early. If a company uncovers questionable import activity, counsel should evaluate whether there are corresponding tax reporting obligations or exposure.

6. Prepare for overlapping enforcement theories. Importers should assume that a single compliance issue may be framed simultaneously as civil FCA fraud, criminal customs smuggling (18 U.S.C. § 545), false statements (18 U.S.C. § 542), Tariff Act violations, and potentially sanctions or forced labor violations. The Perfectus case is a prime example — it involved parallel criminal convictions, a $1.8 billion restitution order, and a $549.5 million civil FCA settlement arising from the same underlying conduct.

7. Understand the insider dynamic. The FCA’s qui tam provisions allow private individuals — including employees, competitors, customs brokers, and other supply chain participants — to file suit on the government’s behalf and share in any recovery (up to 30%). DOJ has expanded its Corporate Whistleblower Awards Pilot Program to cover trade, tariff, and customs fraud, and CBP reported more than 1,200 investigations into revenue-focused allegations made through its e-Allegations portal. Companies should consider implementing internal reporting mechanisms and response protocols.

8. Consider voluntary self-disclosure. The memo reiterates DOJ’s commitment to hold “accountable organizations that flout the law and reward[] those that voluntarily self-disclose, cooperate, and remediate.” DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy and the Civil Division’s longstanding FCA settlement credit policies provide meaningful incentives for companies that come forward proactively. While numerous factors must be weighed when determining whether self-disclosure is appropriate, the memorandum underscores DOJ’s intent to meaningfully reward companies that take a proactive approach.

Conclusion

DOJ’s memo is a blueprint for a more integrated fraud enforcement regime — larger, more technologically sophisticated, and willing to combine multiple theories in a single case. The enforcement playbook that has shaped health care and defense procurement compliance for decades is now being applied to customs and trade. Companies that import goods into the United States — particularly those dealing with goods from China or other high-tariff jurisdictions — face a fundamentally different risk environment than they did even two years ago.

In this environment, proactive compliance, coordinated risk assessment, and early investigative discipline are more important than ever.

If you have questions about how your company can best follow the compliance requirements discussed in this article, please contact the authors or your �鶹ֱ�� attorney.

You’re Invited

�鶹ֱ�� invites you to an exclusive afternoon forum examining the global legal, compliance, and business risks shaping strategic decision-making for multinational companies.

The global operating environment is being redrawn in real time. Geopolitical shifts, regulatory change, trade tensions, supply chain disruption, and regional instability are creating new challenges and opportunities for companies operating across borders. For one day in Milwaukee, �鶹ֱ�� is bringing together leading practitioners from key markets around the world to share what they are seeing on the ground before it becomes conventional wisdom.

This timely program is designed for in-house counsel and business leaders seeking practical, forward-looking insights into the decisions multinational organizations are making today: where to invest, how to restructure supply chains, how to assess geopolitical and regulatory exposure, and where disruption may create opportunity. Few programs offer this breadth of international perspective and informed judgment in a single forum.

What can you expect from this program?

Private consultations on live business issues
Prior to the formal program, attendees may reserve a confidential, 20-minute consultation with and other �鶹ֱ�� legal professionals. These focused discussions provide direct access to practitioners from specific jurisdictions and subject-matter areas to address current or emerging business issues, including cross-border investments, transactions, investigations, disputes, compliance challenges, supply chain concerns, market-entry questions, and other areas of global risk. Advance registration is required, and availability is limited.

Strategic discussions grounded in real-world experience
Hear candid, forward-looking perspectives on the forces reshaping global business, including evolving geopolitical dynamics, regional regulatory developments, operating in conflict-affected markets, and the growing influence of emerging and non-aligned economies. Sessions will focus on actionable takeaways that help legal and business leaders identify risks, advise stakeholders, and prepare their organizations for what lies ahead.

Direct access to a global network of trusted advisers
Connect with international lawyers, risk professionals, and business advisers from across the Concilium network during the program and networking reception, providing a unique opportunity to build relationships with professionals who understand the legal and commercial realities of their local markets.

Please note that the afternoon educational sessions are CLE-eligible for attendees seeking Wisconsin CLE credit.

Click the Register Now button to reserve your place today. We look forward to welcoming you for an engaging and insightful afternoon of discussion, strategy, and global perspective.

As detailed in Parts I, II, and III of this risk-assessment self-check series, we are publishing a series of self-check assessment guides covering the key regulatory and contractual risk areas for multinational companies. This article provides Part IV, which is a self-check assessment for companies to self-assess the status of their supply chain compliance. Part III provided a self-check assessment for conducting a sell-side contracts review; Part II covered the topic of conducting a buy-side contracts review; and Part I provided a self-check for general compliance.

Governments all around the world are sending a consistent message: multinational companies need to take responsibility for ethical sourcing throughout their supply chains. As a result, companies with international supply chains need to be aware of how the interlocking web of regulations, including prohibitions of the use of forced labor or human trafficking, restrictions on using Uyghur forced labor (as covered by the Uyghur Forced Labor Prevention Act), economic sanctions restrictions on sourcing of products from sanctioned countries, regions, and persons, conflict minerals restrictions, and supply-chain transparency rules all communicate a uniform message: companies need to be proactive and take responsibility for their supply chain, right down to the last sub-supplier. To comply, multinational companies need to know (and be able to prove) who made what, where, with which inputs, and under what conditions.

To help multinational companies deal with this reality, we are providing this checklist to allow companies self-assess the status of their supply chain compliance. A “no” answer doesn’t automatically mean noncompliance, but it should indicate a potential red flag and a potential gap for remediation.

I.          Supply-Chain Mapping & Transparency

• Does your company have an up-to-date map of all direct upstream suppliers?
• Does your supply chain map extend to all sub-suppliers?
• Does your company know the actual manufacturing site(s) for each product/SKU (not just the vendor’s HQ address)?
• Has your company identified raw-material and component origins for high-risk inputs (cotton, polysilicon, seafood, critical minerals, etc.)?
• Do your company’s contracts with suppliers require consent to, or disclosure of, changes in manufacturing location, subcontracting, or sourcing?
• Does your company have a documented process to validate supplier claims (audits, data checks, document testing), not just collect certifications?

II.        Supplier Onboarding & Ongoing Due Diligence

• Is there a risk-tiered supplier onboarding process tied to country, sector, and product risk?
• Are suppliers screened at onboarding and periodically for: (1) OFAC/economic sanctions/restricted parties risk; (2) forced-labor risk indicators; (3) human trafficking/labor broker/UFLPA risk; and (4) adverse media/supply chain integrity red flags?
• Does your company require suppliers to identify: (1) beneficial ownership; (2) labor brokers and recruitment practices; and (3) sourcing of key raw materials?

III.      Forced Labor & Human Trafficking Controls

• Does your company have a written forced-labor compliance policy and supplier code of conduct with audit rights and remedies?
• Does your company prohibit recruitment fees and require evidence of: (1) worker contracts in native language; (2) proof of wage payments; (3) identity retention policies (no document confiscation); and (4) freedom of movement and voluntary overtime?
• Does your company assess labor-broker usage and high-risk indicators (debt bondage, withheld wages, coercion)?
• Does your company have a process to respond to forced-labor allegations with: (1) rapid internal investigation steps; (2) documentation preservation; (3) shipment holds (when necessary); and (4) corrective action plans with deadlines?

IV.       UFLPA Readiness (Detention/Withhold Release Orders)

• Does your company maintain a UFLPA playbook that addresses who does what when contacted by CBP regarding a potential detention?
• Can your company produce traceability evidence quickly for imported products, including: (1) purchase orders and invoices by tier; (2) production records; (3) bills of materials; (4) shipping docs and container records; (5) supplier affidavits tied to specific shipments; and (6) transaction-level traceability for key inputs?
• Does your company maintain a “high-risk input” list (e.g., cotton, tomatoes, polysilicon, certain minerals) with enhanced documentation rules?
• Does your company have a documented approach for suppliers operating in or sourcing from high-risk regions, up to and including exclusion where risk cannot be mitigated?

V.         OFAC/Sanctions Compliance & Restricted Parties Screening

• Does your company screen suppliers, intermediaries, freight forwarders, and financial institutions against restricted-party lists at onboarding and periodically?
• Does your company screen beneficial owners and not just the immediate counterparty?
• Are countries of concern flagged in procurement and logistics workflows (including transshipment points)?
• Does your company have controls to prevent indirect dealings (e.g., sales routed through distributors) from creating sanctions exposure?
• Does your company maintain auditable logs of: (1) screening results; (2) potential match resolution; and (3) approvals and exceptions?
• Is there a documented escalation process for: (1) clearing potential matches/false positives; (2) dealing with blocked or rejected transaction decisions; and (3) contract termination or wind-down steps (where required)?

VI.       Conflict Minerals & Critical Raw Materials

• Does your company have a current scoping determination to identify products that contain tin, tantalum, tungsten, or gold (3TG)?
• Does your company identify 3TG smelters/refiners and assess whether they are recognized/validated programs and whether they are located in or sourcing from high-risk areas?
• Does your company maintain internal records supporting conflict minerals due diligence steps taken?

VII.     Data, Documentation & Auditability

• Does your company have a process to annually update supply chain integrity certifications?
• Does your company have a process to address non-responsive suppliers (deadlines, escalation, disqualification)?
• Does your company maintain a centralized repository for supply-chain integrity evidence, accessible for rapid response?
• Are supplier certifications tied to specific products, facilities, time periods, and shipments?
• Does your company periodically test documentation quality (spot checks)?
• Does your company periodically conduct on-site audits of vendor locations?

VIII.    Governance, Training & “Stop-Hold-Release” Authority

• Does your company have a named compliance owner for supply-chain integrity with authority across procurement, logistics, and compliance?
• Are procurement and sourcing teams trained on: (1)             forced-labor red flags; (2) UFLPA detention response basics; (3) sanctions risk indicators; and (4) when to escalate?
• Does your company have clear “stop-hold-release” authority and defined triggers (e.g., missing traceability, sanctions match, forced-labor allegations)?
• Does your company track issues to closure with corrective action plans, deadlines, and repeat-offender controls?

---

If you would like to help analyzing the results of your compliance self-check, please reach out to the authors or your �鶹ֱ�� relationship attorney.

Would you like more practical compliance tips like these? Sign up to receive updates on �鶹ֱ��’s Supply Chain page.

The �鶹ֱ�� International Trade & National Security Team is monitoring all international trade, enforcement, and compliance developments, which we post as they occur on our Tariff & International Trade Resources blog. for our email list to receive future emails and practical international regulatory compliance tips, including our Tariff-ied! and What Every Multinational Should Know articles.

Our white paper on Managing Import and Tariff Risks During a Trade War outlines a 12-step plan to provide practical steps to help importers navigate the tariff and international trade risks in the current tariff and trade environment, while the companion white paper on Managing Supply Chain Integrity Risks provides practical advice to deal with heightened supply chain risks pertaining to goods imported into the United States, including the increasing use of detentions by Customs.

Acquisitions are among the highest-stakes decisions a board will face. Studies consistently show that 70-90% of corporate mergers and acquisitions fail to achieve their stated goals. With deal activity accelerating — driven by market forces, megadeals, artificial intelligence (AI), and shifting regulation — governance discipline matters more than ever. This post offers a practical framework for directors overseeing a significant acquisition.

1. The Board’s Oversight Role

When evaluating an acquisition, two fiduciary duties frame the board’s obligations:

• the duty of care – requires the board to undertake an informed, deliberative process when analyzing proposed acquisitions, including ensuring that management identifies and adequately addresses all “mission-critical” risks associated with the acquisition from both a strategic and operational perspective; and
• the duty of loyalty – requires the board to act free from conflicts and in stockholders’ best interests.

The board’s job is not to run the deal — it is to oversee and approve or reject the decision: pressure-test the acquisition thesis, manage conflicts, and demand adequate information from management. Directors may rely on management and advisors selected with reasonable care, but reliance is not abdication.

2. Key Questions Directors Must Answer

Before approving a significant acquisition, the board should have clear, satisfying answers to:

• Strategy: What problem does this solve? Why buy vs. build/partner? What alternatives were considered?
• Valuation: What is stand-alone vs. synergy value? Are projections realistic under downside cases? What assumptions matter most?
• Synergies/Anticipated Financial Benefits: Are cost and revenue synergies independently tested? What are the integration costs and timeline to achieve?
• Financing: What is the impact on leverage, liquidity, covenants, ratings, and dilution? Are commitments firm?
• Regulatory: What approvals may be required (antitrust/Hart-Scott-Rodino (HSR) Antitrust Improvements Act, Committee on Foreign Investment in the United States (CFIUS), sector-specific)? How would denials undermine the deal thesis?
• Liabilities: What litigation, compliance, environmental, tax, and intellectual property (IP) risks survive closing?
• Cultural Integration: What are the culture, talent, and customer risks?
• Technology/Cyber/AI: What is the target’s AI strategy, cyber posture, technology debt, and data governance? What significant issues are expected to arise during the integration of the target’s IT infrastructure and controls with the company’s current environment? 
• Management Bandwidth: Does the acquirer have sufficient management bandwidth to devote the necessary time and attention to both due diligence and integration without jeopardizing existing operations and related risk mitigation.

3.  What Directors Should Request from Management

Large transactions typically unfold across multiple board meetings. Directors should understand what information to expect at each stage:

Initial Meeting(s) — Evaluating the Opportunity

At early meetings, the board assesses whether to pursue the transaction. Expect to receive:

• Transaction summary and strategic rationale (why this target, why now)
• Preliminary valuation range and key value drivers
• Overview of alternatives considered (build, partner, other targets)
• High-level regulatory pathway (antitrust, CFIUS, sector-specific) and timeline
• Preliminary financing approach and impact on capital structure
• Known material risks and open diligence items
• Conflicts disclosure (director, management, and advisor relationships)

Final Meeting(s) — Approving the Transaction

Before final approval, the board should have received and reviewed:

• Management projections (base/upside/downside) with key assumptions and sensitivity analysis
• Fairness opinion (with advisor methodology, conflicts, fee structure, and limitations)
• Quality-of-earnings report and working capital/debt-like item analysis
• Completed due diligence reports: legal, financial, tax, human resources (HR), environmental, regulatory, cyber/privacy, AI/tech, IP, and commercial
• Risk register with mitigation plan for all material identified risks
• Regulatory/antitrust/CFIUS analysis with updated timeline and potential remedies
• Financing commitments (not just term sheets), pro forma capital structure, and covenant/ratings impact
• Integration plan: Day One readiness, 100-day plan, synergy tracker, talent retention, culture assessment, and communications plan
• Draft transaction agreement with key terms summary and negotiation status
• Insurance/R&W/indemnity analysis

Duty to ask probing questions. Directors should actively challenge management’s assumptions and conclusions to ensure they are comfortable with them. A board that accepts management’s recommendations without independent inquiry does not satisfy its duty of care. Press on the most favorable assumptions, stress-test projections, and demand candid assessments of what could go wrong.

Insist on Adequate Time to Review Materials. Avoid compressing the decision timeline unnecessarily — adequate time to review materials and deliberate is essential to demonstrate an informed process. Where timing is tight, ensure that directors have advance access to key documents and that follow-up sessions are available to address outstanding questions.

4.  Common Issues Missed by Directors

• Cultural integration and disruption. A leading cause of value destruction yet is rarely given the same rigor as financial diligence. It is critical that management have a plan for integrating new employees and dealing with the disruptions caused by any resulting employee displacements.
• Earnout disputes. Poorly structured milestones and ambiguous accounting rules are “fertile ground for post-closing disputes.” Agree on measurement conventions upfront.
• Regulatory remedies. Boards focus on clearing antitrust but not on what divestitures or behavioral conditions may be imposed — and how those alter deal economics.
• Synergy cost assumptions. Revenue synergies in particular tend to be optimistic; requires management to disclose costs to achieve as well as realistic timelines.
• Technology and AI risk. AI due diligence is now essential. System integration costs, cyber exposure, and data governance gaps are frequently underestimated.
• Hidden liabilities. Representations & Warranties (R&W) insurance does not eliminate diligence obligations — underwriting exclusions often mirror uninvestigated risks.
• Management bandwidth. A major acquisition strains leadership capacity; ask whether the organization can execute integration without degrading the base business.

5.  Ensure a Thorough Consideration of Potential Conflicts of Interest

When a conflicted director participates in a vote, the board’s decision-making process is placed at risk. Consequences include heightened judicial scrutiny (entire fairness review rather than business judgment deference), breach of fiduciary duty exposing directors to personal liability, potential voidability of the transaction, reputational harm, and stockholder litigation.

Crucially, the threshold determination of “independence” under applicable stock exchange listing standards does not guarantee that a director is free from all conflicts of interest. Before any vote, the board should examine each director’s financial relationships, personal ties, prior dealings, and other circumstances that could have the appearance of impairing objectivity — even where technical independence under NYSE or Nasdaq rules is satisfied.

Examples of conflicts include: financial interest in the target; personal relationships with counterparty principals; competing business interests; prior employment with the target; personal benefits not shared by stockholders (e.g., post-closing employment); and ties to the company’s or the counter-party advisors.

6.  Role of Board Committees

Standing committees bring specialized expertise to transaction evaluation:

Governance Committee. The governance committee oversees and ensures the adequacy of the board’s process for evaluating the acquisition.

Audit Committee: Oversees management’s assessment of the target’s financial integrity, internal controls, and post-closing integration requirements — including financial due diligence, ICFR assessment, red flags (material weaknesses, restatements, aggressive accounting), and integration planning (gap assessment, remediation needs, Sarbanes-Oxley Act (SOX) compliance timelines).

Compensation Committee. The compensation committee evaluates human capital aspects affecting deal economics and retention. Key tasks include: reviewing executive compensation arrangements (salary, bonus, LTI, deferred compensation); quantifying change-in-control payments and golden parachutes; analyzing equity plan treatment (acceleration, rollover, dilution); and assessing retention needs for critical talent.

7.  When to Form a Special Independent Committee

Not every deal requires a special committee, but for highly significant transactions or whenever a meaningful conflict exists, the board should form one.

Triggers include: management-led buyouts; controlling-stockholder or going-private transactions; related-party acquisitions; special compensation or post-closing employment interests; or any situation where board neutrality could reasonably be questioned.

Effective committee features: independent, disinterested members; written charter with authority to negotiate, evaluate alternatives, and reject the deal; independent legal and financial advisors; full information access; executive sessions without management; and careful minutes. The power to say “no” is essential — a committee without genuine veto authority will not receive court deference.

8.  Engaging Outside Experts

A robust board process often involves engagement of independent advisors whose interests are aligned with the board and stockholders — not management or the counterparty. Depending on the significance of the transaction, Boards should consider engaging:

• Financial advisors to provide a fairness opinion – understand the scope, limitations, assumptions, and any conflicts or contingent fee arrangements.
• Legal counsel – transaction counsel for deal structure and documentation; independent board counsel where conflicts or heightened fiduciary exposure exist.
• Industry and technical experts where the target operates in a specialized sector outside management’s core expertise.
• Accounting and tax advisors to evaluate financial representations, quality of earnings, and tax implications.
• The board should satisfy itself that each advisor is independent from management and the counterparty. Review engagement letters and conflicts disclosures; where an advisor has material relationships with the other side, consider supplemental advice.

9.  Process Documentation and Timing

The board should maintain contemporaneous records of its deliberations, including meeting minutes, presentations, and written consents. Minutes should not function as a verbatim transcript — rather, they should create a clear record establishing the board followed a deliberate process.

At minimum, minutes should document that: the board held dedicated meetings with appropriate quorum and meaningful deliberation; directors received adequate information (presentations, advisor reports, fairness opinions); significant risks were identified and addressed; the board met in executive session without management present to discuss the acquisition; and the board’s decision was informed, including vote tally and any recusals.

Practical guidance:

• Summarize topics and key points rather than transcribing every exchange.
• Focus on process, not conclusions — avoid language that could be read as an admission of doubt.
• Reference materials by title, not content.
• Note recusals and conflicts.
• Have counsel review draft minutes before finalization.

Directors who approach acquisitions with independence, curiosity, and discipline — asking hard questions and demanding complete answers — fulfill their fiduciary obligations and protect their companies and stockholders.

For multinational companies, sell-side contracts — customer, distributor, reseller, licensing, and service agreements — often define the company’s front-line regulatory exposure. These agreements govern how products are sold, priced, shipped, supported, and represented in the market, and they frequently determine who bears responsibility for regulatory compliance, trade costs, and downstream conduct. Yet sell-side contracts are often negotiated primarily around revenue, margins, and speed to close, with compliance considerations addressed inconsistently or late in the process.

As detailed in Parts I and II of this risk-assessment self-check series, we are publishing a series of self-check assessment guides covering the key regulatory and contractual risk areas for multinational companies. This article provides Part III, which is a self-check assessment for conducting a sell-side contracts review. Part II covered the topic of conducting a buy-side contracts review; Part I provided a self-check for general compliance.

Regulators increasingly look to customer-facing arrangements to assess whether compliance expectations are embedded in commercial reality. Sell-side contracts shape pricing behavior, market access, use of intermediaries, data flows, export and sanctions exposure, tariff pass-through, and post-sale obligations. Weak or inconsistent sell-side contracting practices can undermine broader compliance programs, particularly where distributors or customers act on the company’s behalf in higher-risk markets.

This self-check is designed to help companies assess whether they have a structured, risk-based approach to managing sell-side contracts, rather than a fragmented or purely sales-driven one. It focuses on governance, risk assessment, contracting standards, trade-cost allocation, and lifecycle management — not on specific regulatory regimes or boilerplate clauses. A “no” answer does not automatically indicate a legal violation, but it may signal a systemic gap that warrants attention based on the company’s markets, customers, and distribution model.

I.          Governance & Ownership

• Is there clear ownership for sell-side contracting standards across legal, compliance, sales, and finance functions?
• Are roles and responsibilities defined for: (1) contract drafting and negotiation; (2) compliance review and approval; (3) pricing and discount authority; and (4) ongoing contract oversight?
• Are escalation paths clearly defined when sales teams seek deviations from standard compliance or risk-allocation terms?

II.         Risk Assessment & Contract Scoping

• Does the company apply a risk-based framework to determine which sell-side contracts require enhanced review?
• Does the risk assessment consider: (1) customer type and location; (2) sales channels (direct, distributor, reseller, online); (3) use of intermediaries or agents; (4) government or state-owned customers; and (5) cross-border delivery of goods, services, or data?
• Are contracting requirements scaled to risk, rather than applied uniformly or inconsistently?

III.        Contract Standards & Consistency

• Does the company maintain baseline sell-side contract standards or templates aligned with its business models?
• Are compliance-related provisions: (1) consistent across regions and customer types; (2) commercially workable and understood by sales teams; and (3) updated periodically to reflect evolving risks and enforcement trends?
• Is there a documented process for approving deviations from standard sell-side terms?
• Are relevant sales personnel trained in best practices for compliance and contracting?

IV.        Integration with Compliance Programs

• Do sell-side contracts reinforce the company’s broader compliance framework, including: (1) codes of conduct or ethical standards; (2) restrictions on improper conduct by distributors or resellers; and (3) audit, cooperation, and termination rights?
• Are customers or intermediaries contractually required to comply with applicable laws relevant to the transaction?
• Are expectations clearly communicated to counterparties, not just embedded in legal language?

V.         Pricing, Discounts & Fair Dealing Controls

• Are pricing, discounts, rebates, and incentives subject to defined approval and documentation processes?
• Do contracts align with internal pricing authority and discount controls?
• Are sales practices monitored to ensure consistency with contractual terms and compliance expectations?

VI.        Tariff & Trade Risk Allocation

• Do sell-side contracts clearly address responsibility for customs duties, tariffs, taxes, and import-related charges and how to handle potential refunds?
• Are Incoterms® expressly specified, current, and consistent with the company’s logistics and delivery practices?
• Do contracts clearly allocate responsibility for: (1) importer of record status; (2) customs clearance; and (3) payment of duties and tariffs?
• Do contracts address unexpected or newly imposed tariffs, including: (1) changes in tariff rates or classifications; (2) new trade remedies or retaliatory tariffs; and (3) shifts in country-of-origin treatment or enforcement posture?
• Is there a defined mechanism for price adjustments, renegotiation, or termination in response to significant trade-cost changes?
• Are limitations placed on retroactive or unilateral tariff pass-throughs?
• Are customers required to cooperate in documenting and resolving tariff disputes where trade costs are contested?

VII.       Contract Lifecycle & Change Management

• Is there a process to ensure sell-side contracts are reviewed and updated when business or regulatory risks change?
• Are contracts revisited following: (1) entry into new markets; (2) changes in sales channels or distribution models; and (3) significant regulatory or tariff developments?
• Are any legacy obligations from expired contracts identified and addressed?

VIII.      Monitoring, Enforcement & Remediation

• Are there mechanisms to monitor compliance with sell-side contractual obligations?
• Is there a defined process for addressing: (1) customer or distributor non-compliance (2) repeated breaches or circumvention of controls; (3) misalignment between contract terms and actual practices?
• Are contractual remedies — such as remediation, suspension, or termination — used in practice when warranted?

If you would like to help analyzing the results of your compliance self-check, please reach out to the authors or your �鶹ֱ�� relationship attorney.

Would you like more practical compliance tips like these? Sign up to receive updates on �鶹ֱ��’s Supply Chain page.

Would you like more practical compliance tips like these? The �鶹ֱ�� International Trade & National Security Team is monitoring all international trade, enforcement, and compliance developments, which we post as they occur on our Tariff & International Trade Resources blog. for our email list to receive future emails and practical international regulatory compliance tips, including our Tariff-ied! and What Every Multinational Should Know articles.

Our white paper on Managing Import and Tariff Risks During a Trade War outlines a 12-step plan to provide practical steps to help importers navigate the tariff and international trade risks in the current tariff and trade environment, while the companion white paper on Managing Supply Chain Integrity Risks provides practical advice to deal with heightened supply chain risks pertaining to goods imported into the United States, including the increasing use of detentions by Customs.

As detailed in Part I of this risk-assessment self-check series, we are publishing self-check assessment guides covering the key regulatory and contractual risk areas for multinational companies. This article provides Part II, which is a self-check assessment for conducting a buy-side contracts review. Part I, which provides a general compliance self-check, is found here.

For multinational companies, buy-side contracts are one of the most consequential — and least systematically reviewed — sources of compliance risk. Vendor, supplier, manufacturing, and logistics agreements often determine who controls data, who bears regulatory risk, who makes representations to government authorities, and who is responsible when something goes wrong. Yet in many organizations, these contracts are negotiated primarily for price, delivery, and commercial flexibility, with compliance considerations addressed late in the process or inconsistently across regions.

Regulators increasingly assess not only whether companies have compliance programs, but whether those programs are embedded in contractual relationships that shape real-world behavior. Buy-side contracts are a key mechanism for operationalizing compliance expectations, allocating risk, and enforcing standards across complex global supply chains. Weak or inconsistent contracting practices can undermine even well-designed compliance programs — particularly where third parties control manufacturing, sourcing, logistics, data processing, or regulatory interactions.

This self-check is designed to help companies assess whether they have a structured, risk-based approach to managing buy-side contracts, rather than a fragmented or purely commercial one. It focuses on governance, risk assessment, contracting processes, oversight, and remediation — not on specific regulatory clauses or legal doctrines. A “no” answer does not automatically indicate a contractual failure or compliance breach, but it may signal a systemic gap that warrants attention, particularly where suppliers operate in higher-risk jurisdictions or perform compliance-critical functions.

I.          Governance & Ownership

• Is there clear ownership for buy-side contracting standards across legal, compliance, procurement, and business teams?
• Are roles and responsibilities defined for: (1) contract drafting and negotiation; (2) compliance review and approval; and (3) ongoing contract oversight?
• Are escalation paths clearly defined when a supplier resists compliance-related terms?

II.        Risk Assessment & Contract Scoping

• Does the company apply a risk-based approach to determining which buy-side contracts require enhanced compliance review?
• Does the risk assessment consider: (1) supplier location and jurisdictional risk; (2) nature of goods or services provided; (3) access to data, systems, or regulated activities; (4) use of sub-suppliers or subcontractors.
• Are contract requirements scaled to risk, rather than applied uniformly or inconsistently?

III.      Contract Standards & Consistency

• Does the company maintain baseline contracting standards or templates for buy-side agreements?
• Are compliance-related provisions: (1) clearly drafted and commercially workable; (2) consistent across regions and business units; (3) updated periodically to reflect evolving risks?
• Is there a defined process for approving deviations from standard compliance terms?

IV.       Integration with Compliance Programs

• Do buy-side contracts reinforce the company’s broader compliance framework, including: (1) codes of conduct or supplier standards; (2) audit and access rights; (3) information-sharing and cooperation obligations.
• Are suppliers contractually required to flow down relevant obligations to sub-suppliers where appropriate?
• Are compliance expectations clearly communicated to suppliers, not just embedded in legal text?

V.        Contract Lifecycle Management

• Is there a process to ensure contracts are reviewed, updated, or renegotiated when risk profiles change?
• Are contracts revisited following: (1) regulatory changes; (2) changes in supplier operations; (3) Incidents, regulator audits, or enforcement actions?
• Are any ongoing obligations from expired or legacy contracts identified and addressed?

VI.       Tariff & Trade Cost Risk Allocation

• Do buy-side contracts clearly allocate responsibility for tariffs and import-related charges, including how such costs are calculated and invoiced?
• Are Incoterms® expressly specified, current, and used consistently with the parties’ actual logistics and commercial practices?
• Do contracting teams understand how selected Incoterms affect: (1) importer of record designation; (2) responsibility for customs clearance; and (3) exposure to duties, tariffs, and taxes?
• Do contracts address unexpected or newly imposed tariffs, including: (1) changes in tariff rates or classifications; (2) new trade remedies (e.g., safeguard, antidumping, or retaliatory tariffs); and (3) country-of-origin rule changes or enforcement shifts.
• Is there a defined contractual mechanism for price adjustments, cost sharing, or renegotiation in response to significant tariff changes? Are there provisions relating to how to handle any tariff refunds?
• Do contracts prohibit or restrict unilateral pass-through of tariffs without notice or substantiation?
• Are suppliers required to provide accurate and timely information necessary to manage tariff exposure, such as: (1) country of origin; (2) production locations and processes; (3) and tariff classifications and valuation data?
• Are suppliers contractually obligated to notify the company of changes that could affect tariff treatment, including changes in sourcing, manufacturing, or routing?
• Are audit, cooperation, and information-access rights sufficient to verify tariff-related representations?
• Is there a defined process for addressing tariff disputes, including documentation, escalation, and potential recovery of overpaid duties?

VII.     Monitoring, Enforcement & Remediation

• Are there mechanisms to monitor supplier compliance with contractual obligations?
• Do your contracts require that the suppliers submit annual questionnaires?
• Is there a defined process for addressing: (1) suspected breaches; (2) non-cooperation; (3) repeated compliance failures?
• Are contractual remedies — such as remediation plans, suspension, or termination — used in practice when warranted?

---

If you would like to help analyzing the results of your compliance self-check, please reach out to the authors or your �鶹ֱ�� relationship attorney.

Would you like more practical compliance tips like these? Sign up to receive updates on �鶹ֱ��’s Supply Chain page.

The �鶹ֱ�� International Trade & National Security Team also is monitoring all international trade, enforcement, and compliance developments, which we post as they occur on our Tariff & International Trade Resources blog. for our email list to receive future emails and practical international regulatory compliance tips, including our Tariff-ied! and What Every Multinational Should Know articles.

Our white paper on Managing Import and Tariff Risks During a Trade War outlines a 12-step plan to provide practical steps to help importers navigate the tariff and international trade risks in the current tariff and trade environment, while the companion white paper on Managing Supply Chain Integrity Risks provides practical advice to deal with heightened supply chain risks pertaining to goods imported into the United States, including the increasing use of detentions by Customs.

Recent Chinese government measures suggest that China is entering a new phase in the development of its counter-sanctions and anti-extraterritoriality framework. For several years, multinational companies have tracked China’s Anti-Foreign Sanctions Law, Blocking Rules, Unreliable Entity List regime, data laws, export control rules, and related measures as part of a growing — though only intermittently enforced — legal architecture. What now appears to be changing is not only the breadth of that framework but the extent to which Chinese authorities may be prepared to formalize and operationalize it in concrete commercial and regulatory settings.

Two new State Council decrees are central to that shift. State Council Decree No. 834 addresses industrial and supply-chain security and creates a broader framework for identifying, monitoring, and responding to risks affecting China’s industrial and supply chains. State Council Decree No. 835 establishes a more formal mechanism for identifying and countering what China characterizes as improper or unjustifiable foreign extraterritorial measures. As State Council regulations, these measures appear to elevate and further institutionalize China’s response toolkit beyond earlier Ministry of Commerce of the People’s Republic of China-level (MOFCOM) rules.

Taken together, the decrees may materially affect how multinationals conduct supplier diligence, sanctions compliance, export-control screening, internal investigations, regulatory responses, data handling, and relationship-management decisions involving Chinese entities. They also reinforce a broader People’s Republic of China (PRC) policy approach in which industrial security, supply-chain resilience, and opposition to foreign extraterritorial measures are treated as interconnected elements of national security and economic governance.

For companies operating in or selling to China, the practical significance is not that China-facing diligence, trade compliance, or regulatory-response work should cease. Rather, these developments strengthen the case for more deliberate conflict-of-laws analysis, tighter governance over China-related information collection and data handling, and more carefully designed escalation protocols when global compliance processes intersect with PRC law.

The Emerging Structure: From Framework-Building to Application

Until recently, many companies treated China’s counter-sanctions, blocking, and anti-extraterritoriality regime as important but not yet fully operationalized. That view is becoming harder to maintain.

China already had several relevant legal tools on the books, including the 2021 Blocking Rules, the Anti-Foreign Sanctions Law, the Unreliable Entity List regime, the Data Security Law, the Personal Information Protection Law, and restrictions on providing documents or data to foreign authorities without approval in certain sectors or circumstances. The new decrees appear to push this architecture further in at least two ways.

First, they appear to formalize institutional mechanisms for identifying and responding to conduct that China views as harmful to its national security, development interests, or legitimate commercial interests. Decree No. 835 reportedly establishes a State Council “working mechanism” involving multiple departments, with the Ministry of Justice playing a central role in identifying foreign measures that China considers unlawful or unjustifiable extraterritorial assertions of jurisdiction. Decree No. 834 likewise appears to establish a coordinated, whole-of-government framework for monitoring, assessing, and responding to risks affecting key industrial and supply chains.

Second, the decrees appear aimed at the mechanics of how foreign legal and compliance demands are implemented in China — particularly where those demands require local information gathering, local cooperation, local remediation, suspension of transactions, or adverse action against Chinese counterparties. In that sense, the measures are not merely symbolic objections to foreign sanctions or investigations. They create more explicit legal hooks for Chinese authorities to characterize foreign trade, sanctions, subsidy, export-control, or investigative measures as objectionable and to restrict implementation or assistance within China.

That matters because many multinational compliance processes are built on assumptions of global consistency. If a counterparty is sanctioned, flagged for export-control or anti-corruption concerns, implicated in forced-labor risk, or subject to an external regulatory investigation, legal or compliance teams of multinationals may assume they can require subsidiaries, affiliates, suppliers, or employees worldwide to collect data, stop transactions, remediate relationships, or respond to regulators in a standardized way. The new PRC measures raise the possibility that those assumptions may no longer hold where China is involved.

The result is not simply a new layer of “China compliance,” but a more direct conflict-of-laws problem. A foreign parent’s global compliance decision may be lawful — or even required — in one jurisdiction, while the local implementation of that decision by a PRC affiliate, employee, or supplier may create separate risk under PRC law. That distinction — between global policy and China-based execution — may become increasingly important in practice.

Decree No. 834: Supply-Chain Security and Limits on Investigative or Information-Gathering Activity

Decree No. 834 reportedly focuses on industrial and supply-chain security and appears intended to create a broader framework for identifying, monitoring, and responding to risks affecting important Chinese industrial and supply chains. In that sense, it appears to do more than regulate discrete corporate conduct. It also establishes a basis for a coordinated governmental approach to supply-chain resilience, including risk monitoring, early warning, and potential intervention where foreign measures or commercial conduct are viewed as disruptive, discriminatory, or harmful to China’s supply-chain interests.

A key implication, however, is that the measure may affect a wide range of supply-chain-related investigations or requests for information conducted in China or directed at China-based actors, especially where those activities are linked to foreign legal mandates or where the collection and transfer of information could implicate PRC restrictions. Commentary on the decree suggests that it reinforces existing PRC limits on unlawful “information collection activities” in the supply-chain context and may increase scrutiny of certain audit or diligence exercises carried out for foreign compliance purposes.

For multinational companies, the activities potentially affected may include:

• supplier audits and supplier questionnaires;
• supply-chain mapping and traceability exercises;
• origin verification;
• sanctions and restricted-party diligence;
• export-control screening and end-use/end-user checks;
• forced-labor, modern slavery, and human-rights diligence;
• Environmental, Social, and Governance (ESG) and sustainability reviews;
• anti-diversion and anti-circumvention inquiries;
• internal investigations involving China-based transactions or personnel; and
• foreign regulator-driven document collection or fact development.

The concern is not necessarily that each of these activities is prohibited as such. Rather, the concern is that the decree appears to add another source of legal risk where the activity is perceived to undermine PRC supply-chain security interests, violate domestic legal requirements, or facilitate foreign measures that China considers objectionable. That risk may be especially acute where the request seeks detailed information about sub-tier suppliers, sourcing relationships, production locations, labor conditions, customer networks, logistics channels, shipment histories, or politically sensitive geographies.

This is particularly relevant for companies that rely on detailed supplier certifications, origin declarations, customer and shipment tracing, raw material disclosures, transaction histories, or factory-level information to satisfy foreign forced-labor laws, sanctions obligations, customs rules, procurement restrictions, or ESG commitments. If obtaining or transferring that information in China is considered inconsistent with PRC requirements, legal exposure could arise not only from the outbound transfer of data but also from the request itself and from the local collection process.

At the same time, Decree No. 834 appears to extend beyond information gathering alone. It may also provide a basis for investigation or countermeasures where foreign persons or entities are seen as interrupting normal market transactions with Chinese parties, discriminating against Chinese parties in supply chains, or otherwise taking actions that materially harm China’s industrial or supply-chain interests. That could have implications not only for diligence programs, but also for certain de-risking, supplier-remediation, refusal-to-deal, or export-control-driven decisions involving Chinese counterparties.

For that reason, companies should be cautious about treating Decree No. 834 as only a data-collection issue. It may also affect how businesses structure supply-chain diversification, communicate sourcing changes, and implement compliance-driven restrictions involving Chinese suppliers or customers.

Decree No. 835: Countering “Unjustifiable” Extraterritorial Measures

Decree No. 835 appears to be the more explicit anti-extraterritoriality instrument of the two. As a State Council regulation, it appears to elevate and formalize China’s anti-extraterritoriality framework beyond the earlier MOFCOM-level Blocking Rules and Unreliable Entity List regime. The decree reportedly establishes a formal State Council working mechanism involving multiple departments, with the Ministry of Justice playing a central role in identifying foreign laws, regulations, or other measures that China considers to constitute unjustifiable or improper extraterritorial jurisdiction.

Once such a determination is made, Chinese authorities may publicly identify the foreign measure and prohibit organizations or individuals from implementing, complying with, or assisting in its implementation. Commentary on the decree also suggests that authorities may issue prohibition or enforcement orders — potentially on an entity-specific or activity-specific basis — directing particular parties to refrain from implementing identified foreign measures.

The decree also reportedly includes a mechanism under which Chinese citizens and organizations may apply for approval or a waiver in special circumstances to implement otherwise prohibited measures, although it remains unclear how workable or frequently used that process will be in practice. For multinational groups, that may be relevant where PRC subsidiaries are asked to carry out sanctions, export-control, or investigation-related actions required by global policy.

Another notable feature is the creation of a new Malicious Entity List, distinct from China’s existing Unreliable Entity List regime. The Malicious Entity List reportedly targets foreign organizations and individuals that implement, assist in implementing, participate in, or promote the implementation of unjustifiable extraterritorial measures. Depending on how this authority is used, the concept of “promoting” such measures could extend beyond direct compliance activity and potentially capture advocacy or support for the underlying foreign action.

This is a meaningful development because it appears to move beyond abstract policy objections toward a more operational system for identifying specific foreign actions and constraining local compliance with them. It therefore increases the legal and practical tension for companies whose global compliance programs require uniform adherence to:

• U.S. sanctions;
• EU or UK sanctions;
• export-control restrictions;
• anti-boycott requirements;
• restricted-party screening results;
• procurement exclusions;
• foreign forced-labor and supply-chain due diligence mandates; and
• foreign competition, subsidy, customs, antitrust, anti-bribery, anti-corruption, data-protection, or enforcement investigations.

The legal friction becomes especially sharp where a foreign parent or headquarters function instructs a China subsidiary, branch, affiliate, employee, or supplier to take concrete action because of a foreign law or regulatory demand. That action might include collecting information, producing documents, blocking a customer, declining a shipment, suspending payment, terminating a distributor, delisting a supplier, or answering a regulator’s questionnaire. Under Decree No. 835, the implementation of that step may itself become the relevant issue under PRC law.

The decree may also increase litigation risk. Commentary indicates that Chinese individuals or entities harmed by implementation of an identified foreign extraterritorial measure may have a private right of action against the implementing party. For multinationals, that raises the possibility that a decision taken to comply with foreign legal requirements could create not only regulatory exposure in China but also civil claims from affected Chinese counterparties.

In that sense, the decree raises not just sanctions risk, but governance risk. Many multinational systems are not built to isolate China-facing implementation steps from globally triggered compliance decisions. If a foreign measure is identified as unjustifiable under PRC law, routine internal operating processes may inadvertently place China entities or personnel in the position of executing a prohibited instruction.

How These Decrees Interact with the Existing PRC Framework

The importance of Decrees 834 and 835 is magnified when viewed together with China’s broader legal architecture.

Several existing PRC regimes are already relevant to cross-border compliance activity:

• the 2021 Blocking Rules;
• the Anti-Foreign Sanctions Law;
• the Data Security Law;
• the Personal Information Protection Law;
• export-control restrictions;
• state secrets and commercial secrets rules;
• sector-specific rules on data, archives, mapping, finance, and statistics; and
• restrictions on providing evidence or information to foreign authorities without approval in certain contexts.

The new decrees appear to sit on top of that architecture and provide additional grounds to challenge foreign-facing information collection and compliance implementation. In practical terms, this means that a single corporate action may trigger multiple PRC issues at once. For example:

• a supplier questionnaire may raise supply-chain security concerns;
• transmitting the response abroad may raise data transfer issues;
• using the information to terminate the supplier based on foreign sanctions may raise anti-extraterritoriality issues; and
• cooperation with a foreign regulator using China-located documents may raise evidence-transfer or regulatory cooperation restrictions.

This layering effect is important for clients because legal risk may no longer be manageable through a single workstream. Trade compliance, internal investigations, data privacy, employment, procurement, and local regulatory teams may all need to be involved.

Concrete Signs of Enforcement

The clearest reason these developments matter is that Chinese authorities appear to have begun applying them in identifiable cases.

MOFCOM’s May 2, 2026, Blocking Order

On May 2, 2026, MOFCOM reportedly issued a blocking order prohibiting recognition, enforcement, or compliance with certain U.S. sanctions imposed on five Chinese companies allegedly involved in Iranian petroleum transactions.

If widely understood correctly as the first formal invocation of China’s 2021 Blocking Rules, the order is a major development. For years, many companies understood the Blocking Rules to be part of a latent legal toolkit that may or may not be used. A formal blocking order changes the analysis. It gives companies a live example of a situation in which PRC law may expressly prohibit compliance with foreign sanctions.

That creates immediate practical problems for any party dealing with the named entities, including:

• financial institutions deciding whether to process payments;
• insurers and reinsurers assessing coverage;
• commodity traders evaluating cargo exposure;
• shipping and logistics companies deciding whether to carry or service goods;
• suppliers and customers assessing contract performance; and
• multinational groups deciding how sanctions controls should be applied across affiliates.

The dilemma is straightforward but serious: continuing to deal with a named Chinese company may raise foreign sanctions concerns, while refusing to deal or taking restrictive action because of those sanctions may raise PRC blocking or anti-extraterritoriality concerns.

Ministry of Justice Announcement on the EU FSR Investigation of Nuctech

On May 15, 2026, the Ministry of Justice reportedly issued an announcement regarding the EU Foreign Subsidies Regulation (FSR) investigation of Nuctech. The announcement concluded that certain EU investigative practices constituted improper extraterritorial jurisdiction measures under Decree No. 835 and stated that organizations and individuals may not execute or assist in executing those measures.

This development is significant beyond the Nuctech matter itself. It signals that China may use Decree No. 835 not only against sanctions-related measures but also against foreign regulatory investigations that seek information or cooperation from within China.

That has potentially wide implications for regulatory response work. Foreign agencies increasingly seek information that is operationally or physically located in China, including accounting data, procurement files, subsidy-related information, internal communications, source data, emails, pricing materials, supply-chain records, and witness access. If complying with those requests is characterized by PRC authorities as assisting improper extraterritorial measures, companies may face a direct legal conflict between foreign cooperation expectations and Chinese prohibitions.

Operational Risk Areas for Multinational Companies

These developments are likely to affect several recurring business processes.

• Supplier diligence and traceability. Programs aimed at identifying forced labor, sanctions exposure, diversion risks, ESG failures, or prohibited sourcing often rely on deep supply-chain visibility. Where China suppliers are asked to disclose sub-tier suppliers, production locations, labor arrangements, customer lists, shipment paths, raw material origins, or ownership information, PRC legal issues may arise, particularly if the request is framed as necessary to satisfy foreign legal restrictions.
• Global sanctions-screening and restricted-party controls. Many companies run centralized screening tools that automatically block, pause, or escalate transactions once a sanctions-related hit is identified. If a Chinese counterparty is affected and the basis for the action is a foreign measure that China has opposed or blocked, there may be risk in implementing that result automatically within China or through China personnel.
• Export-control and end-use diligence. End-user and end-use checks involving Chinese customers, distributors, and downstream users may require information collection that becomes legally sensitive if tied to foreign control regimes. This may be especially true where the inquiry seeks granular operational, customer, technical, or shipment information.
• Internal investigations. Cross-border investigations often require local employees or affiliates to collect emails, transaction records, shipping data, and communications, then provide them to outside counsel or headquarters. If the underlying investigation is connected to sanctions, forced labor, trade diversion, foreign subsidy inquiries, or other foreign legal demands, companies should not assume that standard investigation protocols can simply be extended into China without modification.
• Regulatory inquiries and dawn-raid response support. Where a foreign regulator asks a multinational to produce China-located information, interview China-based personnel, or explain China-based commercial arrangements, the company may need to analyze not only data transfer restrictions but also whether local cooperation could be viewed as implementing an improper extraterritorial measure.
• Contract suspension and termination decisions. Suspending or terminating a Chinese supplier, customer, distributor, or service provider based expressly on foreign sanctions, foreign subsidy concerns, or foreign political-risk criteria may create local-law exposure, especially if local affiliates are involved in executing the decision or communicating the rationale.

What Companies With International Supply Chains in China Should Do Now

The answer is not to stop diligence, trade compliance, or regulatory-response work involving China. It is to make those processes more deliberate and more legally segmented.

Companies with China exposure should consider reviewing the following:

• China-facing diligence protocols. Audit questionnaires, mapping requests, on-site review procedures, and certification demands should be reviewed to assess whether they seek information that may be sensitive under PRC law and whether the request can be narrowed, localized, sequenced, or otherwise redesigned.
• Conflict-of-laws screening. Companies should consider introducing an explicit conflict-of-laws check before implementing foreign sanctions, export-control, due-diligence, or regulatory-response measures that require action by China entities or personnel.
• Data and information-transfer procedures. Requests for China-origin data should be assessed not only under privacy and data-export rules but also in light of supply-chain security, anti-extraterritoriality, secrecy, archives, and industry-specific rules.
• Decision architecture for sanctions and terminations. Rather than relying on automatic global controls, companies may need a more nuanced process for China-related counterparties, including legal review before blocking, suspending, or terminating business and careful consideration of how the rationale is documented.
• Regulatory-response playbooks. Companies should ensure that they have China-specific protocols for responding to foreign government requests, subpoenas, questionnaires, and investigative demands that may touch China-based documents, employees, or operational information.
• Internal communications and documentation. The way decisions are described matters. Internal instructions that explicitly direct a China team or supplier to act “because of U.S. sanctions,” “to comply with EU investigative demands,” or “to satisfy forced-labor restrictions” may create avoidable PRC-law sensitivity. Communications should be carefully reviewed.
• Escalation and governance. Trade compliance, disputes, investigations, privacy, procurement, HR, public policy, and local China counsel should have a clear path for rapid escalation when a China-related issue involves foreign sanctions, export controls, supply-chain diligence, or regulator requests. Some items to consider here include:
  • a trigger list for high-risk China-related requests;
  • mandatory legal review of China-facing diligence tied to sanctions, forced labor, export controls, or ESG obligations;
  • local review before collecting or transmitting certain categories of supply-chain information;
  • controls on who may instruct China personnel or suppliers to respond to foreign legal demands;
  • protocols for handling blocked or sensitive counterparties in screening systems;
  • a review requirement for China-related suspensions and terminations;
  • pre-approved messaging templates for counterparties and affiliates; and
  • training for legal, compliance, procurement, and investigation teams on PRC anti-extraterritoriality and supply-chain security risks.

---

China’s new decrees, together with the reported MOFCOM blocking order and the Ministry of Justice’s Nuctech-related announcement, suggest that PRC authorities are increasingly prepared to use counter-sanctions and anti-extraterritoriality tools in concrete settings. For multinational companies, the result is a more immediate and operational conflict-of-laws problem.

The main lesson is not that China-related diligence or compliance must stop. It is that many routine global practices – supplier audits, sanctions implementation, export-control checks, internal investigations, foreign regulator responses, and termination decisions — now require a more tailored China-specific legal analysis than many organizations have historically applied.

If you have questions about this topic, please feel free to reach out to any of the authors or your �鶹ֱ�� & Lardner attorney. If you would like to see future updates regarding “What Every Multinational Company Should Know” about operating in today’s complicated international trade world, please sign up for our Tariff & International Trade blog —