Session 1: Tariff Developments in Focus: Where Are Tariffs Going and What Should Companies Be Doing Now to Prepare for Trump Tariffs 2.0? | 12:00 p.m. – 1:00 p.m. CT

Now that the IEEPA tariffs have been invalidated, the new focus of the Trump administration is coming into view: new Section 301 tariffs, expanded Section 232 tariffs, and enhanced enforcement. Trump Tariffs 2.0 will bring major changes to tariff rates, product coverage, and the prospect of sharply different tariffs on different countries. In this session, we will provide an update on the IEEPA tariff refunds and our latest insights into where tariff policy appears to be heading, and what practical steps you should be taking now to assess your exposure and prepare for fast-moving trade policy changes.

Session 2: Life After IEEPA: What Companies Should Be Doing Now on Refund Claims, Commercial Disputes, and Supply Chain Strategy | 1:00 p.m. – 2:00 p.m. CT

With the IEEPA tariffs now invalidated, companies face two urgent and overlapping challenges. First, they must prepare for disputes over tariff refunds, including who may claim them, who may retain them, and how to respond to demands from customers, distributors, and other counterparties. Second, despite the invalidation of the IEEPA tariffs, the broader tariff environment remains volatile, meaning that shifting country-specific exposure continuing to reshape sourcing decisions. In this session, we will provide practical guidance on the steps companies should be taking now to protect their positions on refund-related disputes while also building more flexible and resilient supply chains through better sourcing strategies, improved trade data visibility, and stress-testing of key assumptions.

To register for this two-part webinar, please click on the RSVP button.

As detailed in Part I of this risk-assessment self-check series, we are publishing self-check assessment guides covering the key regulatory and contractual risk areas for multinational companies. This article provides Part II, which is a self-check assessment for conducting a buy-side contracts review. Part I, which provides a general compliance self-check, is found here.

For multinational companies, buy-side contracts are one of the most consequential — and least systematically reviewed — sources of compliance risk. Vendor, supplier, manufacturing, and logistics agreements often determine who controls data, who bears regulatory risk, who makes representations to government authorities, and who is responsible when something goes wrong. Yet in many organizations, these contracts are negotiated primarily for price, delivery, and commercial flexibility, with compliance considerations addressed late in the process or inconsistently across regions.

Regulators increasingly assess not only whether companies have compliance programs, but whether those programs are embedded in contractual relationships that shape real-world behavior. Buy-side contracts are a key mechanism for operationalizing compliance expectations, allocating risk, and enforcing standards across complex global supply chains. Weak or inconsistent contracting practices can undermine even well-designed compliance programs — particularly where third parties control manufacturing, sourcing, logistics, data processing, or regulatory interactions.

This self-check is designed to help companies assess whether they have a structured, risk-based approach to managing buy-side contracts, rather than a fragmented or purely commercial one. It focuses on governance, risk assessment, contracting processes, oversight, and remediation — not on specific regulatory clauses or legal doctrines. A “no” answer does not automatically indicate a contractual failure or compliance breach, but it may signal a systemic gap that warrants attention, particularly where suppliers operate in higher-risk jurisdictions or perform compliance-critical functions.

I.          Governance & Ownership

• Is there clear ownership for buy-side contracting standards across legal, compliance, procurement, and business teams?
• Are roles and responsibilities defined for: (1) contract drafting and negotiation; (2) compliance review and approval; and (3) ongoing contract oversight?
• Are escalation paths clearly defined when a supplier resists compliance-related terms?

II.        Risk Assessment & Contract Scoping

• Does the company apply a risk-based approach to determining which buy-side contracts require enhanced compliance review?
• Does the risk assessment consider: (1) supplier location and jurisdictional risk; (2) nature of goods or services provided; (3) access to data, systems, or regulated activities; (4) use of sub-suppliers or subcontractors.
• Are contract requirements scaled to risk, rather than applied uniformly or inconsistently?

III.      Contract Standards & Consistency

• Does the company maintain baseline contracting standards or templates for buy-side agreements?
• Are compliance-related provisions: (1) clearly drafted and commercially workable; (2) consistent across regions and business units; (3) updated periodically to reflect evolving risks?
• Is there a defined process for approving deviations from standard compliance terms?

IV.       Integration with Compliance Programs

• Do buy-side contracts reinforce the company’s broader compliance framework, including: (1) codes of conduct or supplier standards; (2) audit and access rights; (3) information-sharing and cooperation obligations.
• Are suppliers contractually required to flow down relevant obligations to sub-suppliers where appropriate?
• Are compliance expectations clearly communicated to suppliers, not just embedded in legal text?

V.        Contract Lifecycle Management

• Is there a process to ensure contracts are reviewed, updated, or renegotiated when risk profiles change?
• Are contracts revisited following: (1) regulatory changes; (2) changes in supplier operations; (3) Incidents, regulator audits, or enforcement actions?
• Are any ongoing obligations from expired or legacy contracts identified and addressed?

VI.       Tariff & Trade Cost Risk Allocation

• Do buy-side contracts clearly allocate responsibility for tariffs and import-related charges, including how such costs are calculated and invoiced?
• Are Incoterms® expressly specified, current, and used consistently with the parties’ actual logistics and commercial practices?
• Do contracting teams understand how selected Incoterms affect: (1) importer of record designation; (2) responsibility for customs clearance; and (3) exposure to duties, tariffs, and taxes?
• Do contracts address unexpected or newly imposed tariffs, including: (1) changes in tariff rates or classifications; (2) new trade remedies (e.g., safeguard, antidumping, or retaliatory tariffs); and (3) country-of-origin rule changes or enforcement shifts.
• Is there a defined contractual mechanism for price adjustments, cost sharing, or renegotiation in response to significant tariff changes? Are there provisions relating to how to handle any tariff refunds?
• Do contracts prohibit or restrict unilateral pass-through of tariffs without notice or substantiation?
• Are suppliers required to provide accurate and timely information necessary to manage tariff exposure, such as: (1) country of origin; (2) production locations and processes; (3) and tariff classifications and valuation data?
• Are suppliers contractually obligated to notify the company of changes that could affect tariff treatment, including changes in sourcing, manufacturing, or routing?
• Are audit, cooperation, and information-access rights sufficient to verify tariff-related representations?
• Is there a defined process for addressing tariff disputes, including documentation, escalation, and potential recovery of overpaid duties?

VII.     Monitoring, Enforcement & Remediation

• Are there mechanisms to monitor supplier compliance with contractual obligations?
• Do your contracts require that the suppliers submit annual questionnaires?
• Is there a defined process for addressing: (1) suspected breaches; (2) non-cooperation; (3) repeated compliance failures?
• Are contractual remedies — such as remediation plans, suspension, or termination — used in practice when warranted?

---

If you would like to help analyzing the results of your compliance self-check, please reach out to the authors or your �鶹ֱ�� relationship attorney.

Would you like more practical compliance tips like these? Sign up to receive updates on �鶹ֱ��’s Supply Chain page.

The �鶹ֱ�� International Trade & National Security Team also is monitoring all international trade, enforcement, and compliance developments, which we post as they occur on our Tariff & International Trade Resources blog. for our email list to receive future emails and practical international regulatory compliance tips, including our Tariff-ied! and What Every Multinational Should Know articles.

Our white paper on Managing Import and Tariff Risks During a Trade War outlines a 12-step plan to provide practical steps to help importers navigate the tariff and international trade risks in the current tariff and trade environment, while the companion white paper on Managing Supply Chain Integrity Risks provides practical advice to deal with heightened supply chain risks pertaining to goods imported into the United States, including the increasing use of detentions by Customs.

Recent Chinese government measures suggest that China is entering a new phase in the development of its counter-sanctions and anti-extraterritoriality framework. For several years, multinational companies have tracked China’s Anti-Foreign Sanctions Law, Blocking Rules, Unreliable Entity List regime, data laws, export control rules, and related measures as part of a growing — though only intermittently enforced — legal architecture. What now appears to be changing is not only the breadth of that framework but the extent to which Chinese authorities may be prepared to formalize and operationalize it in concrete commercial and regulatory settings.

Two new State Council decrees are central to that shift. State Council Decree No. 834 addresses industrial and supply-chain security and creates a broader framework for identifying, monitoring, and responding to risks affecting China’s industrial and supply chains. State Council Decree No. 835 establishes a more formal mechanism for identifying and countering what China characterizes as improper or unjustifiable foreign extraterritorial measures. As State Council regulations, these measures appear to elevate and further institutionalize China’s response toolkit beyond earlier Ministry of Commerce of the People’s Republic of China-level (MOFCOM) rules.

Taken together, the decrees may materially affect how multinationals conduct supplier diligence, sanctions compliance, export-control screening, internal investigations, regulatory responses, data handling, and relationship-management decisions involving Chinese entities. They also reinforce a broader People’s Republic of China (PRC) policy approach in which industrial security, supply-chain resilience, and opposition to foreign extraterritorial measures are treated as interconnected elements of national security and economic governance.

For companies operating in or selling to China, the practical significance is not that China-facing diligence, trade compliance, or regulatory-response work should cease. Rather, these developments strengthen the case for more deliberate conflict-of-laws analysis, tighter governance over China-related information collection and data handling, and more carefully designed escalation protocols when global compliance processes intersect with PRC law.

The Emerging Structure: From Framework-Building to Application

Until recently, many companies treated China’s counter-sanctions, blocking, and anti-extraterritoriality regime as important but not yet fully operationalized. That view is becoming harder to maintain.

China already had several relevant legal tools on the books, including the 2021 Blocking Rules, the Anti-Foreign Sanctions Law, the Unreliable Entity List regime, the Data Security Law, the Personal Information Protection Law, and restrictions on providing documents or data to foreign authorities without approval in certain sectors or circumstances. The new decrees appear to push this architecture further in at least two ways.

First, they appear to formalize institutional mechanisms for identifying and responding to conduct that China views as harmful to its national security, development interests, or legitimate commercial interests. Decree No. 835 reportedly establishes a State Council “working mechanism” involving multiple departments, with the Ministry of Justice playing a central role in identifying foreign measures that China considers unlawful or unjustifiable extraterritorial assertions of jurisdiction. Decree No. 834 likewise appears to establish a coordinated, whole-of-government framework for monitoring, assessing, and responding to risks affecting key industrial and supply chains.

Second, the decrees appear aimed at the mechanics of how foreign legal and compliance demands are implemented in China — particularly where those demands require local information gathering, local cooperation, local remediation, suspension of transactions, or adverse action against Chinese counterparties. In that sense, the measures are not merely symbolic objections to foreign sanctions or investigations. They create more explicit legal hooks for Chinese authorities to characterize foreign trade, sanctions, subsidy, export-control, or investigative measures as objectionable and to restrict implementation or assistance within China.

That matters because many multinational compliance processes are built on assumptions of global consistency. If a counterparty is sanctioned, flagged for export-control or anti-corruption concerns, implicated in forced-labor risk, or subject to an external regulatory investigation, legal or compliance teams of multinationals may assume they can require subsidiaries, affiliates, suppliers, or employees worldwide to collect data, stop transactions, remediate relationships, or respond to regulators in a standardized way. The new PRC measures raise the possibility that those assumptions may no longer hold where China is involved.

The result is not simply a new layer of “China compliance,” but a more direct conflict-of-laws problem. A foreign parent’s global compliance decision may be lawful — or even required — in one jurisdiction, while the local implementation of that decision by a PRC affiliate, employee, or supplier may create separate risk under PRC law. That distinction — between global policy and China-based execution — may become increasingly important in practice.

Decree No. 834: Supply-Chain Security and Limits on Investigative or Information-Gathering Activity

Decree No. 834 reportedly focuses on industrial and supply-chain security and appears intended to create a broader framework for identifying, monitoring, and responding to risks affecting important Chinese industrial and supply chains. In that sense, it appears to do more than regulate discrete corporate conduct. It also establishes a basis for a coordinated governmental approach to supply-chain resilience, including risk monitoring, early warning, and potential intervention where foreign measures or commercial conduct are viewed as disruptive, discriminatory, or harmful to China’s supply-chain interests.

A key implication, however, is that the measure may affect a wide range of supply-chain-related investigations or requests for information conducted in China or directed at China-based actors, especially where those activities are linked to foreign legal mandates or where the collection and transfer of information could implicate PRC restrictions. Commentary on the decree suggests that it reinforces existing PRC limits on unlawful “information collection activities” in the supply-chain context and may increase scrutiny of certain audit or diligence exercises carried out for foreign compliance purposes.

For multinational companies, the activities potentially affected may include:

• supplier audits and supplier questionnaires;
• supply-chain mapping and traceability exercises;
• origin verification;
• sanctions and restricted-party diligence;
• export-control screening and end-use/end-user checks;
• forced-labor, modern slavery, and human-rights diligence;
• Environmental, Social, and Governance (ESG) and sustainability reviews;
• anti-diversion and anti-circumvention inquiries;
• internal investigations involving China-based transactions or personnel; and
• foreign regulator-driven document collection or fact development.

The concern is not necessarily that each of these activities is prohibited as such. Rather, the concern is that the decree appears to add another source of legal risk where the activity is perceived to undermine PRC supply-chain security interests, violate domestic legal requirements, or facilitate foreign measures that China considers objectionable. That risk may be especially acute where the request seeks detailed information about sub-tier suppliers, sourcing relationships, production locations, labor conditions, customer networks, logistics channels, shipment histories, or politically sensitive geographies.

This is particularly relevant for companies that rely on detailed supplier certifications, origin declarations, customer and shipment tracing, raw material disclosures, transaction histories, or factory-level information to satisfy foreign forced-labor laws, sanctions obligations, customs rules, procurement restrictions, or ESG commitments. If obtaining or transferring that information in China is considered inconsistent with PRC requirements, legal exposure could arise not only from the outbound transfer of data but also from the request itself and from the local collection process.

At the same time, Decree No. 834 appears to extend beyond information gathering alone. It may also provide a basis for investigation or countermeasures where foreign persons or entities are seen as interrupting normal market transactions with Chinese parties, discriminating against Chinese parties in supply chains, or otherwise taking actions that materially harm China’s industrial or supply-chain interests. That could have implications not only for diligence programs, but also for certain de-risking, supplier-remediation, refusal-to-deal, or export-control-driven decisions involving Chinese counterparties.

For that reason, companies should be cautious about treating Decree No. 834 as only a data-collection issue. It may also affect how businesses structure supply-chain diversification, communicate sourcing changes, and implement compliance-driven restrictions involving Chinese suppliers or customers.

Decree No. 835: Countering “Unjustifiable” Extraterritorial Measures

Decree No. 835 appears to be the more explicit anti-extraterritoriality instrument of the two. As a State Council regulation, it appears to elevate and formalize China’s anti-extraterritoriality framework beyond the earlier MOFCOM-level Blocking Rules and Unreliable Entity List regime. The decree reportedly establishes a formal State Council working mechanism involving multiple departments, with the Ministry of Justice playing a central role in identifying foreign laws, regulations, or other measures that China considers to constitute unjustifiable or improper extraterritorial jurisdiction.

Once such a determination is made, Chinese authorities may publicly identify the foreign measure and prohibit organizations or individuals from implementing, complying with, or assisting in its implementation. Commentary on the decree also suggests that authorities may issue prohibition or enforcement orders — potentially on an entity-specific or activity-specific basis — directing particular parties to refrain from implementing identified foreign measures.

The decree also reportedly includes a mechanism under which Chinese citizens and organizations may apply for approval or a waiver in special circumstances to implement otherwise prohibited measures, although it remains unclear how workable or frequently used that process will be in practice. For multinational groups, that may be relevant where PRC subsidiaries are asked to carry out sanctions, export-control, or investigation-related actions required by global policy.

Another notable feature is the creation of a new Malicious Entity List, distinct from China’s existing Unreliable Entity List regime. The Malicious Entity List reportedly targets foreign organizations and individuals that implement, assist in implementing, participate in, or promote the implementation of unjustifiable extraterritorial measures. Depending on how this authority is used, the concept of “promoting” such measures could extend beyond direct compliance activity and potentially capture advocacy or support for the underlying foreign action.

This is a meaningful development because it appears to move beyond abstract policy objections toward a more operational system for identifying specific foreign actions and constraining local compliance with them. It therefore increases the legal and practical tension for companies whose global compliance programs require uniform adherence to:

• U.S. sanctions;
• EU or UK sanctions;
• export-control restrictions;
• anti-boycott requirements;
• restricted-party screening results;
• procurement exclusions;
• foreign forced-labor and supply-chain due diligence mandates; and
• foreign competition, subsidy, customs, antitrust, anti-bribery, anti-corruption, data-protection, or enforcement investigations.

The legal friction becomes especially sharp where a foreign parent or headquarters function instructs a China subsidiary, branch, affiliate, employee, or supplier to take concrete action because of a foreign law or regulatory demand. That action might include collecting information, producing documents, blocking a customer, declining a shipment, suspending payment, terminating a distributor, delisting a supplier, or answering a regulator’s questionnaire. Under Decree No. 835, the implementation of that step may itself become the relevant issue under PRC law.

The decree may also increase litigation risk. Commentary indicates that Chinese individuals or entities harmed by implementation of an identified foreign extraterritorial measure may have a private right of action against the implementing party. For multinationals, that raises the possibility that a decision taken to comply with foreign legal requirements could create not only regulatory exposure in China but also civil claims from affected Chinese counterparties.

In that sense, the decree raises not just sanctions risk, but governance risk. Many multinational systems are not built to isolate China-facing implementation steps from globally triggered compliance decisions. If a foreign measure is identified as unjustifiable under PRC law, routine internal operating processes may inadvertently place China entities or personnel in the position of executing a prohibited instruction.

How These Decrees Interact with the Existing PRC Framework

The importance of Decrees 834 and 835 is magnified when viewed together with China’s broader legal architecture.

Several existing PRC regimes are already relevant to cross-border compliance activity:

• the 2021 Blocking Rules;
• the Anti-Foreign Sanctions Law;
• the Data Security Law;
• the Personal Information Protection Law;
• export-control restrictions;
• state secrets and commercial secrets rules;
• sector-specific rules on data, archives, mapping, finance, and statistics; and
• restrictions on providing evidence or information to foreign authorities without approval in certain contexts.

The new decrees appear to sit on top of that architecture and provide additional grounds to challenge foreign-facing information collection and compliance implementation. In practical terms, this means that a single corporate action may trigger multiple PRC issues at once. For example:

• a supplier questionnaire may raise supply-chain security concerns;
• transmitting the response abroad may raise data transfer issues;
• using the information to terminate the supplier based on foreign sanctions may raise anti-extraterritoriality issues; and
• cooperation with a foreign regulator using China-located documents may raise evidence-transfer or regulatory cooperation restrictions.

This layering effect is important for clients because legal risk may no longer be manageable through a single workstream. Trade compliance, internal investigations, data privacy, employment, procurement, and local regulatory teams may all need to be involved.

Concrete Signs of Enforcement

The clearest reason these developments matter is that Chinese authorities appear to have begun applying them in identifiable cases.

MOFCOM’s May 2, 2026, Blocking Order

On May 2, 2026, MOFCOM reportedly issued a blocking order prohibiting recognition, enforcement, or compliance with certain U.S. sanctions imposed on five Chinese companies allegedly involved in Iranian petroleum transactions.

If widely understood correctly as the first formal invocation of China’s 2021 Blocking Rules, the order is a major development. For years, many companies understood the Blocking Rules to be part of a latent legal toolkit that may or may not be used. A formal blocking order changes the analysis. It gives companies a live example of a situation in which PRC law may expressly prohibit compliance with foreign sanctions.

That creates immediate practical problems for any party dealing with the named entities, including:

• financial institutions deciding whether to process payments;
• insurers and reinsurers assessing coverage;
• commodity traders evaluating cargo exposure;
• shipping and logistics companies deciding whether to carry or service goods;
• suppliers and customers assessing contract performance; and
• multinational groups deciding how sanctions controls should be applied across affiliates.

The dilemma is straightforward but serious: continuing to deal with a named Chinese company may raise foreign sanctions concerns, while refusing to deal or taking restrictive action because of those sanctions may raise PRC blocking or anti-extraterritoriality concerns.

Ministry of Justice Announcement on the EU FSR Investigation of Nuctech

On May 15, 2026, the Ministry of Justice reportedly issued an announcement regarding the EU Foreign Subsidies Regulation (FSR) investigation of Nuctech. The announcement concluded that certain EU investigative practices constituted improper extraterritorial jurisdiction measures under Decree No. 835 and stated that organizations and individuals may not execute or assist in executing those measures.

This development is significant beyond the Nuctech matter itself. It signals that China may use Decree No. 835 not only against sanctions-related measures but also against foreign regulatory investigations that seek information or cooperation from within China.

That has potentially wide implications for regulatory response work. Foreign agencies increasingly seek information that is operationally or physically located in China, including accounting data, procurement files, subsidy-related information, internal communications, source data, emails, pricing materials, supply-chain records, and witness access. If complying with those requests is characterized by PRC authorities as assisting improper extraterritorial measures, companies may face a direct legal conflict between foreign cooperation expectations and Chinese prohibitions.

Operational Risk Areas for Multinational Companies

These developments are likely to affect several recurring business processes.

• Supplier diligence and traceability. Programs aimed at identifying forced labor, sanctions exposure, diversion risks, ESG failures, or prohibited sourcing often rely on deep supply-chain visibility. Where China suppliers are asked to disclose sub-tier suppliers, production locations, labor arrangements, customer lists, shipment paths, raw material origins, or ownership information, PRC legal issues may arise, particularly if the request is framed as necessary to satisfy foreign legal restrictions.
• Global sanctions-screening and restricted-party controls. Many companies run centralized screening tools that automatically block, pause, or escalate transactions once a sanctions-related hit is identified. If a Chinese counterparty is affected and the basis for the action is a foreign measure that China has opposed or blocked, there may be risk in implementing that result automatically within China or through China personnel.
• Export-control and end-use diligence. End-user and end-use checks involving Chinese customers, distributors, and downstream users may require information collection that becomes legally sensitive if tied to foreign control regimes. This may be especially true where the inquiry seeks granular operational, customer, technical, or shipment information.
• Internal investigations. Cross-border investigations often require local employees or affiliates to collect emails, transaction records, shipping data, and communications, then provide them to outside counsel or headquarters. If the underlying investigation is connected to sanctions, forced labor, trade diversion, foreign subsidy inquiries, or other foreign legal demands, companies should not assume that standard investigation protocols can simply be extended into China without modification.
• Regulatory inquiries and dawn-raid response support. Where a foreign regulator asks a multinational to produce China-located information, interview China-based personnel, or explain China-based commercial arrangements, the company may need to analyze not only data transfer restrictions but also whether local cooperation could be viewed as implementing an improper extraterritorial measure.
• Contract suspension and termination decisions. Suspending or terminating a Chinese supplier, customer, distributor, or service provider based expressly on foreign sanctions, foreign subsidy concerns, or foreign political-risk criteria may create local-law exposure, especially if local affiliates are involved in executing the decision or communicating the rationale.

What Companies With International Supply Chains in China Should Do Now

The answer is not to stop diligence, trade compliance, or regulatory-response work involving China. It is to make those processes more deliberate and more legally segmented.

Companies with China exposure should consider reviewing the following:

• China-facing diligence protocols. Audit questionnaires, mapping requests, on-site review procedures, and certification demands should be reviewed to assess whether they seek information that may be sensitive under PRC law and whether the request can be narrowed, localized, sequenced, or otherwise redesigned.
• Conflict-of-laws screening. Companies should consider introducing an explicit conflict-of-laws check before implementing foreign sanctions, export-control, due-diligence, or regulatory-response measures that require action by China entities or personnel.
• Data and information-transfer procedures. Requests for China-origin data should be assessed not only under privacy and data-export rules but also in light of supply-chain security, anti-extraterritoriality, secrecy, archives, and industry-specific rules.
• Decision architecture for sanctions and terminations. Rather than relying on automatic global controls, companies may need a more nuanced process for China-related counterparties, including legal review before blocking, suspending, or terminating business and careful consideration of how the rationale is documented.
• Regulatory-response playbooks. Companies should ensure that they have China-specific protocols for responding to foreign government requests, subpoenas, questionnaires, and investigative demands that may touch China-based documents, employees, or operational information.
• Internal communications and documentation. The way decisions are described matters. Internal instructions that explicitly direct a China team or supplier to act “because of U.S. sanctions,” “to comply with EU investigative demands,” or “to satisfy forced-labor restrictions” may create avoidable PRC-law sensitivity. Communications should be carefully reviewed.
• Escalation and governance. Trade compliance, disputes, investigations, privacy, procurement, HR, public policy, and local China counsel should have a clear path for rapid escalation when a China-related issue involves foreign sanctions, export controls, supply-chain diligence, or regulator requests. Some items to consider here include:
  • a trigger list for high-risk China-related requests;
  • mandatory legal review of China-facing diligence tied to sanctions, forced labor, export controls, or ESG obligations;
  • local review before collecting or transmitting certain categories of supply-chain information;
  • controls on who may instruct China personnel or suppliers to respond to foreign legal demands;
  • protocols for handling blocked or sensitive counterparties in screening systems;
  • a review requirement for China-related suspensions and terminations;
  • pre-approved messaging templates for counterparties and affiliates; and
  • training for legal, compliance, procurement, and investigation teams on PRC anti-extraterritoriality and supply-chain security risks.

---

China’s new decrees, together with the reported MOFCOM blocking order and the Ministry of Justice’s Nuctech-related announcement, suggest that PRC authorities are increasingly prepared to use counter-sanctions and anti-extraterritoriality tools in concrete settings. For multinational companies, the result is a more immediate and operational conflict-of-laws problem.

The main lesson is not that China-related diligence or compliance must stop. It is that many routine global practices – supplier audits, sanctions implementation, export-control checks, internal investigations, foreign regulator responses, and termination decisions — now require a more tailored China-specific legal analysis than many organizations have historically applied.

If you have questions about this topic, please feel free to reach out to any of the authors or your �鶹ֱ�� & Lardner attorney. If you would like to see future updates regarding “What Every Multinational Company Should Know” about operating in today’s complicated international trade world, please sign up for our Tariff & International Trade blog —

For multinational companies, today’s compliance challenge is not merely the number of applicable regulations but the pace of regulatory change, geographic fragmentation, and rising expectations from regulators, investors, financial institutions, and business partners. Enforcement authorities are increasingly aligned in looking beyond the existence of written policies to examine how companies identify and prioritize risk, allocate resources, train personnel, oversee third parties, and respond when issues arise. As a result, an effective compliance program must be dynamic, defensible, and embedded in day-to-day business operations — rather than a static set of documents maintained in isolation.

To help companies navigate this environment, this checklist is offered as a practical self-assessment tool for evaluating corporate governance and overall compliance infrastructure. It is designed to help organizations assess whether they have a functioning, risk-based compliance program, regardless of industry, business model, or jurisdiction. Rather than cataloging obligations under specific laws or regulatory regimes, the checklist focuses on the core building blocks of effective compliance — governance, risk assessment, training, oversight, escalation, and continuous improvement. In short, it asks not simply, “Do we have policies?” but “Does our compliance program work in practice?”

The checklist is intended for internal use by legal, compliance, audit, and business leadership to identify strengths, surface blind spots, and prioritize remediation efforts. A “no” response does not, by itself, indicate noncompliance or a legal violation. Instead, it should be viewed as a potential program gap — an area that may warrant further analysis, enhancement, or documentation based on the company’s specific risk profile.

I.          Tone-at-the-Top, Ownership, and Governance

• Do senior management and the board of directors demonstrate a strong commitment to compliance by promoting ethical conduct, supporting compliance personnel, and ensuring adherence to applicable laws, regulations, and policies?
• Is there clear executive-level ownership of compliance (e.g., a designated compliance leader with defined authority and responsibility)?
• Does the compliance function have direct access to the Board or an appropriate Board committee, with regular, substantive reporting?
• Does the compliance leader have sufficient independence from commercial pressures to escalate issues and raise concerns without interference?
• Does the compliance function have the authority to pause or halt activities when material compliance risks are identified?
• Are compliance responsibilities formally assigned across business units, regions, and functions, including clearly defined lines of accountability?
• Is the compliance function adequately resourced (i.e., personnel, budget, tools) in light of the company’s size, geographic footprint, and risk profile?
• Are compliance expectations reflected in job descriptions, performance evaluations, and management incentives, rather than treated as an informal obligation?
• Are compliance failures addressed through consistent disciplinary processes, regardless of seniority or revenue impact?
• Is compliance viewed internally as a business enabler and risk manager, not solely as a legal or audit backstop?
• Does the organization maintain written governance documents describing compliance roles, escalation paths, reporting lines, and decision-making authority?
• Do Board or committee discussions address not only metrics but also emerging risks, significant incidents, and program effectiveness?
• Is compliance meaningfully integrated with legal, audit, finance, HR, and enterprise risk functions, with defined coordination mechanisms?
• Are compliance considerations embedded in strategic business decisions, such as market entry, restructuring, acquisitions, or changes in business model?

II.         Risk Assessment and Program Design

• Has the company conducted a documented, enterprise-wide compliance risk assessment?
• Is there a defined and repeatable methodology for how compliance risks are identified, evaluated, and prioritized?
• Does the risk assessment involve meaningful input from relevant business units, regions, and functions, rather than being limited to legal or compliance?
• Is the risk assessment updated periodically, and refreshed after major events such as acquisitions, new market entry, changes in business model, or significant regulatory developments?
• Does the risk assessment consider key structural risk drivers, including: (1) geographic footprint; (2) business model and sales channels; (3) reliance on third parties; (4) government touchpoints; and (5) supply-chain complexity?
• Are risks prioritized using consistent criteria (e.g., likelihood and potential impact), rather than treated as equal?
• Are compliance resources, controls, and monitoring activities aligned to the prioritized risks identified in the assessment?
• Can the company clearly explain and defend its risk prioritization and program design choices to senior management, the Board, auditors, or regulators?

III.        Policies, Procedures, and Practical Guidance

• Are core compliance policies written, current, and accessible to relevant employees?
• Are policies supported by practical procedures, playbooks, examples, or FAQs that explain how compliance works in real scenarios?
• Are policies: (1) tailored to the company’s business (not generic templates); (2) reviewed on a regular cadence; and (3) regularly updated to reflect regulatory and operational changes?
• Is there a documented process for policy exceptions, approvals, and interpretations?

IV.        Training and Awareness

• Does the company provide regular compliance training, not just onboarding training?
• Is training risk-based, with enhanced focus for higher-risk roles, regions, or functions?
• Is training: (1) tracked and documented; (2) updated periodically; and (3) delivered in formats employees can realistically absorb?
• Are employees periodically reminded of: (1) where to get compliance guidance; (2) how to raise concerns; and (3) that retaliation is prohibited?

V.         Reporting, Escalation, and Response

• Are there clear, confidential channels for employees and third parties to raise concerns?
• Do employees understand when and how to escalate issues?
• Is there a documented investigation and response protocol for compliance concerns?
• Are issues tracked to resolution, with corrective actions identified and implemented?
• Does the company analyze issues for root causes and systemic weaknesses, not just individual errors?

VI.        Monitoring, Testing, and Continuous Improvement

• Does the company conduct periodic testing or monitoring of compliance controls?
• Are audits or reviews used to assess whether controls actually work in practice?
• Are compliance failures, near-misses, or enforcement actions used as inputs for program improvement?

VII.       Third-Party and Business Partner Oversight

• Does the company maintain a risk-based process for identifying, onboarding, and managing third parties and business partners?
• Has the company clearly defined the scope of third parties subject to oversight (e.g., agents, distributors, suppliers, contractors, consultants, intermediaries)?
• Are third parties risk-ranked using consistent criteria, with due diligence scaled to the level of risk?
• Are third parties subject to: (1) due diligence proportional to risk; (2) contractual compliance commitments; and (3) ongoing monitoring or periodic refresh where appropriate?
• Are red flags, adverse findings, or changes in risk escalated through a defined review and approval process?
• Is responsibility for third-party oversight clearly assigned, including ownership for onboarding, monitoring, and issue resolution?
• Are relevant third parties provided with appropriate compliance training, guidance, or certifications, where risk warrants?
• Are compliance failures by third parties addressed through documented remediation steps or enforcement actions, including suspension or termination when necessary?

VIII.      M&A, Growth, and Change Management

• Are compliance risks identified and assessed early when entering new markets, launching new products or services, or changing business models?
• Is there a defined process to involve legal and compliance in strategic initiatives at the planning stage, rather than after commercial decisions are finalized?
• Is compliance meaningfully integrated into: (1) M&A due diligence; (2) post-acquisition integration planning and execution; (3) joint ventures, strategic partnerships, and minority investments; and (4) major restructuring, outsourcing, or supply-chain redesign decisions?
• Are compliance risks evaluated as part of deal structuring, including allocation of risk, representations and warranties, and post-closing remediation planning?
• Is there a post-transaction roadmap to address identified compliance gaps, including timelines, ownership, and resource allocation?
• Are acquired or newly integrated entities brought into the company’s compliance framework within a defined period, including policies, training, reporting mechanisms, and controls?
• Are changes in geographic footprint, customer base, third-party relationships, or government touchpoints fed back into the enterprise risk assessment?
• Is there a process to track, test, and validate that compliance controls remain effective as the organization grows or changes?
• Are lessons learned from prior integrations, expansions, or restructurings captured and used to improve future change-management processes?

IX.        Documentation and Defensibility

• Can the company demonstrate its compliance efforts with contemporaneous documentation?
• Is there a clear record of: (1) risk assessments; (2) training offerings and completion; (3) policy approvals; and (4) Board or management reporting?

If you would like to help analyzing the results of your compliance self-check, please reach out to the authors or your �鶹ֱ�� relationship attorney.

Would you like more practical compliance tips like these? The �鶹ֱ�� International Trade & National Security Team is monitoring all international trade, enforcement, and compliance developments, which we post as they occur on our Tariff & International Trade Resources blog. for our email list to receive future emails and practical international regulatory compliance tips, including our Tariff-ied! and What Every Multinational Should Know articles.

Our white paper on Managing Import and Tariff Risks During a Trade War outlines a 12-step plan to provide practical steps to help importers navigate the tariff and international trade risks in the current tariff and trade environment, while the companion white paper on Managing Supply Chain Integrity Risks provides practical advice to deal with heightened supply chain risks pertaining to goods imported into the United States, including the increasing use of detentions by Customs.

On June 12, 2026, U.S. Customs and Border Protection (CBP) published a new guide intended to help the importing community understand the three principal authorities used to enforce U.S. forced labor import restrictions: 19 U.S.C. § 1307, the Uyghur Forced Labor Prevention Act (UFLPA), and the Countering America’s Adversaries Through Sanctions Act (CAATSA). The . It also explains the steps importers should take before importing merchandise into the United States, the types of documentation that may be needed to establish admissibility, and the procedures for seeking release of detained shipments.

This publication reflects a significant shift in CBP’s expectations for importers. Supply chain review for forced labor exposure is no longer merely a best practice for risk mitigation; CBP now makes clear that failure to conduct adequate diligence may constitute a failure to exercise the “reasonable care” required under U.S. customs law, with potentially significant consequences.

At the same time, the updated guidance gives importers greater visibility into CBP’s enforcement framework by consolidating process maps for UFLPA, Withhold Release Order (WRO), Finding, and CAATSA actions into a single resource, providing step-by-step instructions for responding to detentions and exclusions, as well as including expanded appendices with recommended supply chain documentation, practical due diligence examples, and sample enforcement notices. In that respect, noncompliance with this “guidance” may be cited as evidence that an importer failed to meet reasonable standards for preventing forced labor, human trafficking, or the exploitation of Uyghur labor within its supply chain. CBP’s guide therefore serves as both a warning and a roadmap — and a strong signal of where forced labor enforcement is headed.

The updated guidance has been followed by the Department of Justice’s (DOJ) announcement on July 14, 2026, of the creation of a new global trade enforcement section within its National Fraud Division, which is tasked with investigating and prosecuting criminal import, trade and customs fraud offenses.  The trade enforcement section will focus specifically on criminal schemes to import goods illegally that violate anti-forced labor laws or misreport values and other information to evade tariffs.

To help importers navigate these heightened compliance expectations and enforcement priorities, we provide below a summary of CBP’s new guidance, along with practical best practices for strengthening forced labor compliance programs. For companies sourcing globally, the message is unmistakable: CBP expects importers to know their supply chains, document them thoroughly, and be prepared to demonstrate that their goods were not made, wholly or in part, with forced labor.

Why This Matters

CBP’s new guidance is significant because it expands both the scope and the reach of the agency’s prior forced labor compliance materials. It replaces the June 13, 2022, UFLPA Operational Guidance for Importers and extends beyond a UFLPA-only focus to address the full range of forced labor authorities enforced by CBP. As a result, importers must now understand not only the UFLPA but also how CBP administers WROs, Findings, and CAATSA-related exclusions.

For multinational importers, this has important implications:

• First, the legal standard is expansive. U.S. law prohibits the importation of goods mined, produced, or manufactured, wholly or in part, with forced labor, convict labor, or indentured labor. The phrase “wholly or in part” is critical: even a minor input, raw material, or upstream component linked to forced labor can render an entire shipment inadmissible.
• Second, CBP now presents all three of its principal forced labor enforcement authorities in a single framework, but each authority operates differently. Under 19 U.S.C. § 1307, CBP may issue a WRO when it has reasonable suspicion that goods were made with forced labor, resulting in detention of the merchandise. If CBP develops probable cause and the Secretary of Homeland Security approves, it may issue a Finding, which can lead to seizure and forfeiture. Under the UFLPA, goods produced wholly or in part in the Xinjiang Uyghur Autonomous Region (XUAR) or by entities on the UFLPA Entity List are subject to a rebuttable presumption that they are prohibited from entry. Under CAATSA, goods produced wholly or in part by North Korean nationals or citizens, anywhere in the world, are likewise presumed to be made with forced labor and may be excluded from entry. Importers therefore must understand not only the substantive prohibitions but also the distinct evidentiary thresholds, procedures, and consequences associated with each authority.
• Third, rebutting these presumptions or overcoming CBP action can be demanding. In the UFLPA context, importers seeking release must satisfy a clear and convincing evidence standard and demonstrate compliance with the UFLPA Strategy. In WRO and Finding matters, importers may need to provide documentation sufficient to establish that the goods were not made with forced labor or are otherwise admissible. The practical result is that forced labor compliance requires robust supply chain mapping, traceability, and documentation well before goods reach a U.S. port.
• Fourth, the response timelines are short. For UFLPA detentions, importers generally have 30 days to respond, although limited extensions may be available. For WRO detentions, importers generally have three months to establish admissibility. For exclusions, importers generally have 180 days to file a protest. If a company begins assembling supply chain evidence only after receiving a detention or exclusion notice, it may already be at a significant disadvantage.

To help with understanding the overall process, one of the most practical additions in CBP’s updated guidance is a set of process maps that walk importers through the agency’s principal forced labor enforcement pathways step by step. Rather than describing the authorities only at a high level, the guidance lays out what type of information may trigger CBP action; whether the likely result is detention, exclusion, or seizure; what deadlines govern an importer’s response; and what procedural options may remain available.

In total, the document maps five distinct processes: UFLPA potential input, UFLPA direct input, CAATSA, WRO, and Finding actions. These process maps are important because they highlight that not all forced labor cases follow the same procedural path. In some cases, CBP may detain goods and allow a short period for the importer to submit evidence supporting admissibility. In others, CBP may exclude goods outright or seize them, leaving the importer with more limited and more time-sensitive options. The guidance also clarifies that different CBP offices play different roles in these cases, including the Forced Labor Division, Ports of Entry, Centers of Excellence and Expertise, and the Forced Labor Portal, through which certain requests must be submitted.

Updating Supply Chain Best Practices in Light of the New CBP Guidance

CBP’s updated guidance demonstrates that forced labor compliance cannot rest on a policy statement alone. It requires a functioning, documented, and auditable compliance system capable of identifying risk, tracing supply chains, preserving evidence, and responding quickly when questions arise. For multinational importers, best practices should include the following:

1. Establish Clear Internal Governance and Escalation Procedures

Forced labor compliance should have defined internal ownership. Companies should assign responsibility across legal, customs compliance, procurement, logistics, supply chain, and social compliance functions, and ensure that those teams understand when and how to escalate concerns.

A workable governance structure should address:

• who is responsible for supplier onboarding and risk review;
• who evaluates documentation supporting country of origin and supply chain traceability;
• who has authority to approve higher-risk sourcing decisions;
• when outside counsel, customs brokers, or other advisors are engaged; and
• how potential forced labor concerns are elevated before goods are shipped or entered.

This is especially important because CBP now frames forced labor diligence as part of the importer’s obligation to exercise reasonable care.

2. Map the Supply Chain to the Raw Material Level

CBP expects importers to understand the full supply chain for imported goods, including components, subcomponents, and raw materials. This means identifying:

• all suppliers and sub-suppliers;
• manufacturers, processors, miners, farms, mills, smelters, refiners, and assembly facilities;
• the role each entity plays;
• the location of each production stage;
• the movement of materials through the supply chain; and
• any corporate or operational relationship among entities in the chain.

For companies sourcing globally, this is critical because risk often enters through indirect suppliers. A low-risk final assembly location does not eliminate exposure if an upstream input was sourced from a prohibited region, listed entity, or high-risk labor program.

3. Screen Suppliers, Facilities, and Inputs for Forced Labor, Human Trafficking, and UFLPA Risk

Importers should implement a screening process that goes beyond the immediate vendor. Suppliers, sub-suppliers, production sites, labor brokers, and key inputs should be reviewed against the UFLPA Entity List, CBP’s WROs and Findings, and other relevant government restrictions, advisories, or forced labor indicators.

Screening should also account for:

• aliases and affiliated entities;
• changes in ownership or sourcing patterns;
• known high-risk geographies or labor transfer programs; and
• inconsistencies between claimed origin and available commercial records.

Because supply chains evolve, screening should be repeated periodically and updated when suppliers, manufacturing locations, or source materials change.

4. Maintain Complete Transaction, Production, and Transportation Records

CBP repeatedly emphasizes that importers should be able to support their claims with ordinary-course business records. The specific documents required will vary by product and industry, but common and useful records may include:

• purchase orders and invoices;
• bills of materials and bills of lading;
• shipping, production, and inventory records;
• proofs of payment;
• certificates of origin;
• supplier affidavits and declarations;
• manufacturing flowcharts showing each production step and the responsible entity;
• factory capacity and production records; and
• import and export records.

These records should connect logically from raw material to finished good. Gaps, inconsistencies, or unexplained breaks in the paper trail can undermine an admissibility submission, even where much of the supply chain is otherwise documented.

5. Apply Enhanced Diligence to High-Risk �鶹ֱ�� and Products

CBP applies a risk-based approach, and the guidance includes sector-specific documentation expectations for UFLPA high-priority sectors such as apparel, cotton, tomatoes, polysilicon, aluminum, steel, copper, lithium, PVC, caustic soda, red dates, and seafood.

If a company imports goods in these sectors (or products containing these materials) it should expect a higher level of scrutiny and deeper traceability requirements. For example:

• cotton products may require tracing to the bale level;
• apparel may require records from fiber sourcing through garment assembly;
• solar or silica-based products may require tracing back to quartzite or polysilicon inputs;
• metals may require documentation of mining, smelting, refining, casting, and finishing; and
• seafood may require records showing where it was caught, processed, packed, and exported.

The practical lesson is that generic supplier certifications are unlikely to be enough. CBP expects product-specific, transaction-linked, and traceable evidence.

6. Strengthen Supplier Controls and Contractual Protections

The guidance encourages importers to maintain a meaningful social compliance and due diligence system. At a minimum, that system should include:

• supplier codes of conduct prohibiting forced labor;
• contractual representations regarding compliance with U.S. forced labor laws;
• contractual rights to obtain supply chain records and supporting documentation;
• audit rights, including rights to review sub-tier sourcing where appropriate;
• employee and supplier training on forced labor risks and documentation expectations;
• remediation procedures for identified concerns; and
• termination rights where remediation is not possible or suppliers fail to cooperate.

CBP also makes clear that audits must be meaningful. Financial audits, environmental audits, or social audits that do not specifically assess forced labor indicators will generally carry limited value in demonstrating effective risk mitigation.

7. Identify Red Flags and Monitor the Supply Chain on an Ongoing Basis

Forced labor compliance is not a one-time exercise completed at onboarding. Companies should continuously monitor their supply chains for warning signs, including:

• incomplete or inconsistent origin information;
• supplier reluctance to identify sub-suppliers or production sites;
• sudden changes in sourcing routes or manufacturing locations;
• production volumes that appear inconsistent with facility capacity;
• documentation gaps or conflicting records; and
• indications of labor transfer programs, third-party recruitment risks, or unusual workforce arrangements.

When red flags arise, companies should have a documented process for investigation, follow-up, remediation, and, where necessary, suspension or termination of sourcing relationships.

8. Prepare a Detention Response Before a Detention Happens

A multinational importer should have a response plan in place before cargo is stopped. That plan should identify:

• who internally owns the response and communicates with CBP;
• which outside counsel, customs broker, or consultant will assist;
• where supply chain records are stored and how they can be retrieved quickly;
• which suppliers must provide supporting records on short notice;
• whether the company may seek applicability review, exception review, export, or destruction;
• how business confidential information will be identified and protected; and
• how translations will be obtained and validated.

CBP specifically recommends organized submissions, searchable PDFs, English translations, numbered exhibits, and clear labeling. These details may seem administrative, but they can materially affect the speed and effectiveness of CBP’s review.

9. Plan for Post-Entry Risk, Including Redelivery and Prior Disclosure

The guidance also addresses what may happen when forced labor concerns arise after goods have already entered the United States. CBP may issue a Notice of Redelivery requiring the goods to be returned to the port. Failure to comply can lead to liquidated damages and other enforcement consequences, and in more serious cases may expose the goods to seizure-related action.

The guidance also discusses prior disclosure, which may mitigate penalties if an importer voluntarily discloses a violation before the government discovers it. For multinational companies, this underscores the importance of internal reporting channels, prompt investigation of potential issues, and coordination among legal, compliance, and trade functions when supply chain concerns are identified.

---

For multinational importers, CBP’s new guidance is more than a procedural reference — it is a statement of enforcement priorities and a clear articulation of what the agency now expects as a matter of reasonable care. Companies that import into the United States should view it as a practical compliance framework for identifying forced labor risk, strengthening supply chain due diligence, and preparing to respond quickly and effectively if CBP detains, excludes, or seizes merchandise.

The central takeaway is that forced labor compliance can no longer be treated as a reactive customs issue addressed only when a shipment is stopped at the border. It must be integrated into sourcing, contracting, supplier onboarding, audit practices, recordkeeping, logistics, and entry procedures. Knowing only the immediate seller or manufacturer is no longer enough; CBP expects importers to understand the upstream supply chain, document it in the ordinary course of business, and be able to substantiate admissibility with credible, transaction-specific evidence.

Importers best positioned under this framework will be those that act before enforcement begins, including by mapping supply chains to the raw material level, implementing meaningful supplier controls, maintaining organized documentation, and establishing clear internal escalation and response procedures. In short, CBP has made plain that importers must be prepared not only to manage forced labor risk but to prove that they have done so.

The Trump administration’s new tariff initiatives are reshaping the customs compliance landscape. As discussed in the prior articles in this series, higher tariff rates and new customs requirements are increasing customs bond requirements, new executive actions are signaling a more aggressive enforcement posture, and importers face a growing likelihood of audits, investigations, and other enforcement activity. Together, these developments are creating what may be described as the new customs enforcement reality.

Against this backdrop, many importers are understandably searching for opportunities to reduce tariff exposure and manage landed costs. There is nothing inherently problematic about such efforts. Indeed, customs law provides a variety of legitimate planning opportunities that may reduce duty liability when implemented correctly.

The challenge, however, is distinguishing between lawful tariff-planning strategies and positions that create significant compliance and enforcement risks. As tariff exposure increases, so too does the incentive for companies to adopt aggressive customs positions. At the same time, U.S. Customs and Border Protection (CBP) is expected to devote greater attention to classification, valuation, country-of-origin determinations, and other customs issues that directly affect duty liability.

As a result, some strategies that may appear attractive in the current environment can create substantial legal and financial exposure when pursued beyond what the law permits. In some cases, these approaches are based on misunderstandings of customs law. In others, they involve theories that have little support in existing statutes, regulations, or CBP guidance. And in still others, they may create risks that far outweigh any potential duty savings.

This final article in our series examines ten dubious tariff-saving “opportunities” that importers should approach with caution and explains why seemingly creative customs strategies can sometimes become the starting point for significant enforcement problems.

Classification and Tariff Scope Fallacies

Fallacy #1: “Come on, Customs processes millions of entries. They will never connect the dots!”

Many customs compliance strategies are built upon a surprisingly outdated assumption: that CBP reviews transactions one entry at a time and evaluates each filing in isolation.

That assumption is increasingly incorrect.

Modern customs enforcement is heavily data-driven. Through ACE and other enforcement tools, CBP has access to enormous amounts of import data and routinely employs sophisticated analytics to identify anomalies, trends, and potential compliance risks. Rather than beginning with a single problematic entry, CBP frequently begins with a pattern and then works backward to determine whether that pattern reflects a legitimate business change or a potential compliance issue.

This reality has become particularly important in the current tariff environment. CBP understands that importers have strong incentives to reduce exposure to Section 232 duties, Section 301 tariffs, antidumping and countervailing duty liability, and other trade restrictions. As a result, the agency is increasingly focused on identifying data patterns that may suggest aggressive tariff-avoidance strategies.

Classification changes are a good example. A sudden shift from one tariff provision to another shortly after a new tariff measure takes effect may attract attention, particularly where the products appear unchanged. The same is true of significant changes in declared value, abrupt country-of-origin shifts, unusual pricing trends, or sourcing changes that coincide with the implementation of new trade restrictions.

CBP also has the ability to compare importers against their peers. If one importer is declaring dramatically different values, classifications, duty rates, countries of origin, or sourcing patterns than similarly situated competitors importing comparable products, those differences may become visible through data analysis.

Importers should not assume that a questionable position will escape scrutiny simply because it appears reasonable on a single entry. Customs enforcement increasingly focuses on patterns, trends, and anomalies that become apparent only when transactions are viewed across products, suppliers, countries, and time periods.

The most effective compliance programs operate on the assumption that CBP will eventually connect the dots.

Fallacy #2: “Come on, there are at least three HTS codes that could apply. Why not use the cheapest one?”

For many importers, tariff classification is the first place they look when tariff costs increase. That is entirely understandable. A single classification decision may determine whether a product is subject only to ordinary customs duties or also faces substantial additional duties under Section 232, Section 301, antidumping and countervailing duty orders, or other trade restrictions.

In the current tariff environment, companies should be reviewing classifications. Many classifications were established years ago, when the duty consequences of a particular tariff provision were relatively modest. Today, however, the difference between two potentially applicable tariff provisions may result in dramatically different duty outcomes.

The challenge is ensuring that the analysis begins with the product rather than the desired tariff result. The proper question is not, “Which classification produces the lowest duty rate?” Rather, it is, “Which classification is supported by the terms of the Harmonized Tariff Schedule, the Explanatory Notes, CBP rulings, and applicable judicial precedent?”

CBP generally has little concern when importers undertake thoughtful classification reviews supported by sound legal and technical analysis. Problems arise, however, when classifications appear to have been selected primarily to avoid tariffs rather than to accurately describe the imported merchandise.

Importers should also recognize that classification changes are often highly visible to CBP. A sudden change in classification for the same product, or a classification change affecting products that appear substantially similar to merchandise previously entered under a different tariff provision, can be an obvious red flag. Likewise, if a significant number of importers begin shifting products into lower-duty classifications shortly after a new tariff measure takes effect, CBP is likely to notice.

A classification change that can be explained and defended is a legitimate compliance decision. A classification change that exists only because the tariff rate is lower is far more likely to attract scrutiny.

Fallacy #3: “These Section 232 tariffs are so unfair! Just pick a reasonably close alternative that is not covered and call it a day.”

Few customs issues have attracted more attention in recent years than Section 232 tariffs. As tariff rates on steel, aluminum, copper, and derivative products have increased, importers have devoted significant resources to evaluating whether particular products actually fall within the scope of the applicable measures.

There is nothing improper about undertaking that analysis. Indeed, importers should periodically revisit whether their products remain properly subject to Section 232 duties.

The challenge is that Section 232 reviews often begin with a legitimate question but can quickly become outcome driven. Once a company realizes that a particular classification or scope determination carries a significant tariff consequence, the temptation naturally arises to search for an alternative interpretation that places the product outside the scope of the applicable measures.

For numerous products, Section 232 applicability turns directly on tariff classification. A change in classification may therefore have the effect of moving a product from a tariff-bearing provision to one that falls outside the scope of the applicable Section 232 measures.

CBP is acutely aware of these incentives. Classification changes, revised product descriptions, and newly adopted scope interpretations that coincide with the imposition or expansion of Section 232 duties are likely to receive heightened scrutiny.

Importers should therefore approach Section 232 reviews with the same discipline that they would apply to any other customs analysis. The relevant question is whether the product’s physical characteristics, technical specifications, and legal classification support the conclusion being advanced.

Valuation Fallacies

Fallacy #4: “If we don’t put it on the invoice, how would Customs even know about it?”

As tariff rates have increased, customs valuation has become an increasingly important area of focus for importers seeking to manage landed costs.

Not surprisingly, many companies have begun scrutinizing whether royalties, license fees, engineering payments, software fees, tooling charges, product development costs, molds, dies, technical assistance, prototypes, and other contributions must be included in customs value.

A common misconception is that a cost somehow falls outside the customs valuation analysis simply because it does not appear on the commercial invoice. Customs valuation, however, focuses on the economic reality of a transaction rather than the accounting treatment chosen by the parties.

This issue has become particularly important as companies pursue China+1 sourcing strategies and establish relationships with new manufacturers. In many cases, importers provide substantial support to overseas producers in the form of engineering assistance, tooling, product specifications, testing protocols, software, prototypes, manufacturing know-how, and other valuable inputs. While these contributions are often necessary to establish production capability, they may also create “assist” obligations that must be reflected in customs value.

One reason royalties and assists remain recurring compliance issues is that the relevant information frequently resides outside the customs department. Engineering teams, procurement personnel, product development groups, legal departments, tax departments, and sourcing teams may each possess pieces of relevant information.

Whether a royalty must be included in customs value, or whether a particular contribution constitutes a dutiable assist, depends on a highly fact-specific analysis. As tariff exposure has increased, CBP has devoted greater attention to arrangements that appear designed to remove otherwise dutiable amounts from customs value or that fail to account for significant contributions provided to foreign manufacturers.

An assist that is overlooked does not cease to be an assist simply because no one informed the customs department that it existed.

Fallacy #5: “What’s the harm in unbundling a few costs? The supplier gets paid the same amount.”

Closely related to the assists and royalties issue is another common misconception: that a cost becomes non-dutiable simply because it appears somewhere other than the commercial invoice.

As tariff rates have increased, so has the incentive to reduce the value declared to CBP. Not surprisingly, some companies begin exploring whether costs associated with imported merchandise can be moved into separate contracts, invoices, entities, or payment streams.

Engineering services may be invoiced separately. Tooling charges may be placed in a side agreement. Royalties may be reflected in a licensing arrangement rather than a purchase order. Software fees, commissions, development costs, technical assistance charges, and other payments may be carved out from the primary purchase transaction.

The compliance risk arises when the structure is driven primarily by the desire to remove otherwise dutiable amounts from customs value.

CBP generally looks beyond invoice labels, accounting treatment, and contractual terminology to evaluate the substance of the transaction. The key question is not whether a payment appears on a separate invoice. The key question is whether the payment is sufficiently connected to the imported merchandise that it must be included in customs value under the applicable valuation rules.

Separating a payment from the commercial invoice may change the paperwork. It does not necessarily change the customs treatment.

Fallacy #6: “If our transfer pricing study is good enough for the IRS, it’s good enough for Customs!”

As tariff rates have increased, customs valuation has become an increasingly important component of overall trade compliance.

Many multinational enterprises already maintain extensive transfer pricing documentation for income tax purposes. Faced with the cost and complexity of customs valuation compliance, some companies naturally wonder whether those existing transfer pricing studies can simply be repurposed to support customs value.

Unfortunately, the answer is not always that simple.

Although tax and customs authorities both examine related-party transactions, they often do so from different perspectives and for different purposes. Transfer pricing analyses prepared for the IRS typically focus on whether profits are allocated appropriately among related parties and whether the pricing is consistent with the arm’s-length standard. CBP, by contrast, focuses on whether the declared customs value satisfies the requirements of the customs valuation statute and whether the relationship between the parties influenced the price paid for the imported merchandise.

The overlap between tax and customs is significant. The rules, however, are not identical.

Fallacy #7: “If there are three invoices, why aren’t we using the cheapest one?”

As tariff rates have increased, many importers have begun exploring First Sale programs as a means of reducing customs value and lowering duty liability.

Unlike many of the strategies discussed in this alert, First Sale is not a loophole or an aggressive compliance position. When properly implemented, it is a well-established customs valuation methodology recognized by CBP and the courts.

One of the most common misconceptions, however, is that First Sale simply permits the importer to use the lowest invoice in a multi-tier supply chain as the basis for customs value.

To qualify for First Sale treatment, importers generally must establish that there was a bona fide sale for export to the United States, that the relevant parties dealt with one another at arm’s length, and that the transaction satisfies the requirements established through CBP rulings and judicial precedent. Equally important, the importer must possess sufficient documentation to demonstrate that those requirements have been satisfied.

Simply selecting the lowest invoice in the transaction chain is not a First Sale program. It is merely a lower number.

Origin Fallacies

Fallacy #8: “If we assemble the product in Vietnam, doesn’t it become a product of Vietnam?”

Few customs concepts have become more important in recent years than country of origin.

Not surprisingly, many importers have pursued China+1 sourcing strategies, relocating production or portions of their supply chains to countries such as Vietnam, Thailand, Malaysia, India, and Mexico.

The challenge is that not every supply-chain change results in a new origin.

One of the most persistent misconceptions in international trade is the belief that country of origin changes simply because merchandise is subject to some processing in another country. It does not. Minor assembly operations, repackaging, relabeling, testing, inspection, sorting, or other limited processing activities generally do not change origin if they do not result in a substantial transformation of the product.

Because China+1 strategies have become so widespread, country-of-origin claims associated with third-country manufacturing have become a major enforcement focus. CBP is well aware that importers have strong incentives to reduce exposure to Section 301 duties and other trade restrictions.

Country-of-origin determinations should be driven by the facts of the production process and the substantial transformation analysis, not by the tariff result the importer hopes to achieve.

Compliance Fallacies

Fallacy #9: “Just let the customs broker handle everything; it’s what we pay them for.”

As customs compliance becomes increasingly complex, many importers rely heavily on their customs brokers to help navigate classification, entry filing, admissibility requirements, tariff programs, and a growing array of trade restrictions.

The challenge is that importers sometimes assume that the broker’s involvement means that someone else is responsible for evaluating all customs compliance issues.

More importantly, many of the customs issues discussed in this alert involve facts that the broker may never see.

A broker can review the commercial invoice and entry documentation that it receives. What the broker often cannot see are royalty agreements negotiated by the legal department, transfer pricing policies developed by the tax department, engineering services provided by product development teams, tooling supplied by procurement personnel, or sourcing decisions made months earlier as part of a China+1 initiative.

Many customs disputes arise not because anyone intentionally ignored a compliance issue but because the importer assumed that someone else was evaluating it. The logistics department assumed the broker was handling it. The broker assumed the importer had already analyzed it. Meanwhile, the underlying issue was never reviewed by anyone.

A customs broker is an important part of a compliance program. It is not a substitute for one.

Fallacy #10: “if everyone else in the industry is doing it, why should we be the only saps who are paying the highest tariff rate?”

As tariff rates have increased and customs compliance has become more consequential, importers have devoted significant attention to understanding how competitors classify products, determine country of origin, value merchandise, and address other customs issues.

The challenge arises when industry practice becomes a substitute for legal analysis.

One of the more common justifications for an aggressive customs position is the belief that the position must be acceptable because it is widely used throughout the industry. Whether that belief is accurate or not, it generally misses the point. CBP does not determine compliance based on the number of companies taking a particular position. Rather, the agency evaluates whether a specific importer’s customs treatment is consistent with the applicable legal requirements.

Moreover, widespread adoption of a particular practice does not necessarily reduce enforcement risk. In some circumstances, it may increase it. When CBP identifies a potential issue affecting a particular product category or industry sector, it is not uncommon for multiple importers of similar merchandise to receive CF-28 Requests for Information or become part of a broader enforcement initiative.

In those situations, the fact that everyone is doing it may simply mean that everyone receives the same questionnaire.

If a company genuinely believes that a competitor is obtaining an unfair advantage through customs violations, CBP maintains mechanisms, including its e-Allegations program, through which suspected customs violations may be reported. The appropriate response to suspected noncompliance is to evaluate available legal remedies, not to assume that another company’s conduct creates a safe harbor for everyone else.

Ultimately, customs compliance is determined by the correctness of an importer’s own entries, not by whether its competitors are making the same decisions.

---

The common theme running through all ten of these fallacies is that they begin with the desired tariff result and work backward. Customs compliance works best when the process runs in the opposite direction.

There is nothing improper about reducing tariff exposure. In fact, importers should continuously evaluate legitimate opportunities to improve classifications, optimize supply chains, implement First Sale programs, review valuation methodologies, and qualify for preferential tariff treatment where appropriate. Many of the most effective tariff-saving strategies are entirely lawful and have been recognized by CBP and the courts for decades.

The challenge is ensuring that the facts and the law support the result.

As tariff rates increase, so too do the incentives for aggressive customs positions. CBP understands those incentives and has increasingly focused its enforcement efforts on classification changes, valuation adjustments, country-of-origin claims, and other positions that materially affect duty liability. In today’s data-driven enforcement environment, assumptions, industry practices, and undocumented conclusions are becoming increasingly difficult to defend.

Ultimately, the best tariff-planning strategy is not the most creative one. It is the one that remains supportable when CBP asks a simple question:

“Please provide the documentation supporting your position.”

In 2022, �鶹ֱ��’s Government Enforcement Defense & Investigations International Team first produced a set of interactive international compliance heat maps designed to provide an at-a-glance resource for identifying countries around the world that may present heightened bribery, sanctions, or human rights compliance risks for multinational companies that conduct business in, trade with, or source materials from them.

The maps have been updated in 2024 and again in 2026, with the underlying risk ratings reviewed and revised to reflect relevant legal, regulatory, enforcement, and geopolitical developments. The updated 2026 maps are available below.

Although the maps use a structured methodology to compare risk across jurisdictions, the ratings necessarily involve professional judgment and should be understood as relative risk indicators rather than definitive country assessments. Additional information regarding the methodology is available on request.

Bribery/Corruption Risk Heat Map

This map reflects �鶹ֱ��’s assessment of bribery and corruption risk presented by conducting business in various countries around the world. Countries in maroon are viewed as highest risk; countries in red as high risk; countries in orange as medium/high risk; countries in yellow as medium risk; countries in light blue as low risk; and countries in dark blue as lowest risk. Companies should tailor their compliance programs and control procedures based in part on the perceived risk of bribery and corruption presented in their respective countries of operation, taking into consideration the types of business activities occurring in those countries and the degree of interaction with government officials.

Contacts: David Simon, Olivia Singelmann, John Turlais, and Nick Covek

U.S. Sanctions Risk Heat Map

This map reflects �鶹ֱ��’s assessment of U.S. economic sanctions risk presented by conducting business in various countries around the word. Countries in maroon are comprehensively sanctioned, and potential transactions involving these countries should not proceed without thorough legal review and authorization given the extremely high risk of violating U.S. sanctions; countries in red are deemed high risk due to significant list-based sanctions; countries in orange present moderate risk due to some list-based sanctions, coupled with a relatively high diversion risk; countries in yellow are subject to limited list-based sanctions but present some risk due to a moderate diversion risk; and countries in blue are not sanctioned and present a low diversion risk. Companies should implement screening procedures of relevant parties that take into consideration the countries associated with the transaction and with the relevant parties.

Contacts: Gregory Husisian and John Turlais

Forced Labor/Child Labor Risk Heat Map

This map reflects �鶹ֱ��’s assessment of the pervasiveness of child/forced labor used to produce goods in various countries around the world. Countries in maroon are perceived as having the highest incident rates of products made using child/forced labor; countries in red have high incident rates; countries in orange have medium/high incident rates; countries in yellow have medium incident rates; countries in light blue have low incident rates; and countries in dark blue have the lowest incident rates. Companies should tailor their supply-chain due diligence and monitoring procedures to account for the pervasiveness of child/forced labor in the countries from which they source raw materials and other goods.

Contacts: David Simon, John Turlais, and Nick Covek

If you have questions or concerns concerning this article, please feel free to reach out to any of the authors or your �鶹ֱ�� & Lardner attorney.  for our email list to receive future biweekly emails and practical international regulatory compliance tips.

On January 14, 2026, following an investigation by the U.S. Secretary of Commerce (Secretary), under Section 232 of the Trade Expansion Act of 1962 (19 U.S.C. 1862) (Section 232), into the effects of imports of processed critical minerals and their derivative products (Critical Minerals) on the national security of the United States. After concurring with the Secretary’s determination that the quantities and circumstances of current Critical Minerals imports “threaten to impair the national security of the United States,” the President has authorized actions to be taken to adjust the imports of Critical Minerals to address the identified threat.

Overview of the Federal Action

The President has officially concurred with findings that the United States lacks a secure and reliable supply chain for Critical Minerals. In making this determination, Section 232 directs the Secretary and the President to consider factors related to national defense (including required domestic production needed for defense requirements, capacity of the domestic industry to meet such production needs, and availability of supplies and raw materials) as well as factors related to the national economy (including impacts of foreign competition and the displacement of U.S. products by “excessive imports”).

Consequently, the administration has initiated the following:

1. Negotiations with Trading Partners and Potential Trade Restrictions: The U.S. Trade Representative and the Secretary are directed to negotiate with foreign nations to adjust imports and mitigate security vulnerabilities. If negotiations are unsuccessful within 180 days, the administration may implement further measures, including tariffs or minimum import prices (price floors) for specific minerals.
2. Additional Regulatory or Deregulatory Actions: The Secretary, U.S. Trade Representative, and the Secretary of Homeland Security are directed to effectuate the proclamation through the issuance, amendment, or temporary suspension of their respective regulations, rules, and guidance.  
3. Supply Chain Monitoring: The Secretary will continue to monitor import levels and review their impact on national security to determine if further executive action is required
4. No Tariffs — Yet: Unlike for several other recent Section 232 investigations, the President has not (at this time) imposed tariffs.

Key Minerals Identified

The Secretary determined that Critical Minerals underpin critical military and economic applications and found that Critical Minerals are essential to each of the 16 critical infrastructure sectors identified by of April 30, 2024 (Critical Infrastructure Security and Resilience), including:

• Chemical Sector: lithium, fluorite, and bromine;
  • Communications Sector: gallium, germanium, indium, and yttrium;
  • Energy Sector: cobalt, nickel, uranium, praseodymium, and terbium.

Why This Matters to Companies with U.S. Mining and Processing Operations

This federal shift is highly relevant to companies mining for Critical Minerals in the United States for several key reasons:

1. Focus on Domestic Capacity: The proclamation explicitly identifies the decline in domestic production and the offshoring of facilities as a strategic weakness. The federal government now views “sufficient domestic mining and processing” as imperative to reducing reliance on foreign actors.
2. Addressing Price Volatility: The Secretary found that extreme price volatility in mineral markets has historically hindered private sector investment and led to the closure of domestic facilities. The administration’s intent to consider “price floors” is a direct attempt to ensure the long-term viability of domestic mining and processing.
3. Bridging the Processing Gap: The proclamation highlights a critical vulnerability — even when minerals are mined domestically, they are often exported for refining due to a lack of domestic processing capacity. For example, while the United States is a major producer of rare earth oxides, it remains nearly 100% reliant on imported rare earth permanent magnets. This indicates a federal push to not only mine but also process materials within the United States.
4. Alignment with Related Administration Trade Initiatives: Under the United States-Japan Framework for Securing the Supply of Critical Minerals and Rare Earths through Mining and Processing, signed October 28, 2025, the United States and Japan jointly committed to work together on investments in critical minerals mapping, mining, and recycling and to arrange for mutually complementary stockpiling. Japan has also announced investment commitments in the United States for critical minerals development, including a $350 million investment in a lithium-iron-phosphate production facility in the United States.  The proclamation potentially provides additional support for these commitments.

Next Steps

If action is taken by the President, Section 232 requires the President to provide a report to Congress within 30 days of the proclamation, explaining the President’s decision to take action under the statute. Moreover, the administration is required to provide an update on the status of trade negotiations within 180 days. We will continue to monitor these negotiations and any potential regulatory changes or guidance issued by the Department of Commerce or Homeland Security that may affect your operations or trade status.

About �鶹ֱ��’s Energy & Infrastructure Sector

�鶹ֱ��’s cross-disciplinary Energy & Infrastructure team of more than 200 attorneys regularly represents clients in the traditional and renewable power, oil and gas, nuclear, and infrastructure and energy transition industries. �鶹ֱ�� offers comprehensive legal services for energy and infrastructure companies and projects to guide clients through every phase — from development and site control to investment, commercial contracting and financing. �鶹ֱ�� can also assist companies involved in mining, processing, and disposal to navigate the various state and federal regulations, international agreements, and national security considerations.

Protecting sensitive data has never been more important. In a globalized world of advanced cyber threats, sophisticated espionage techniques, and external data monetization, increased security is crucial to safeguard sensitive information from theft and misuse. The recent implementation of the Department of Justice’s (DOJ) Data Security Program (DSP) demonstrates how seriously the government considers the threat posed by foreign adversary access to such data. U.S. persons and companies who aggregate the personal data of Americans or collect any information linked to U.S. government personnel now face mandatory restrictions and prohibitions when transferring this data to identified countries and persons of concern. With the leniency period for enforcement of the program officially over as of July 8, 2025 failure to come into immediate compliance creates exposure to stiff civil and criminal penalties.

Background

The DSP essentially establishes export control restrictions that prevent foreign adversaries, and those subject to those adversaries’ control and direction, from accessing U.S. government-related data and bulk U.S. sensitive personal data.

The DSP was issued under the International Emergency Economic Powers Act (IEEPA) and in accordance with Executive Order 14117, related to Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern.^[2] Although the effective date for the program was April 8, 2025, the DOJ’s National Security Division (NSD) announced a delay in enforcement efforts for 90 days to allow additional time for U.S. individuals and companies to implement the necessary changes to comply and engage with NSD on DSP-related issues.

Now that the grace period has ended, individuals and entities are expected to be in full compliance, and the NSD may begin to pursue enforcement of potential violations. The DSP is meant to address the continued efforts of foreign adversaries to use commercial activities to access, exploit, and weaponize covered categories of U.S. government and sensitive personal data. As the program is in line with various Trump Administration priorities, U.S. companies should anticipate aggressive enforcement and ensure they are compliant.^[3]

Covered Countries and Persons

The DSP restricts and prohibits U.S. persons and entities from engaging in certain transactions surrounding U.S. government data and the personal data of Americans with “countries of concern” or “covered persons.”

On April 11, 2025, the NSD issued a compliance guide related to the DSP, which identified each of the following countries as a “country of concern”:

• China (including Hong Kong and Macau)
• Cuba
• Iran
• North Korea
• Russia
• Venezuela

These countries were identified as demonstrating an intent and capability to use government-related data and Americans’ sensitive personal data to threaten U.S. national security through various specified means.^[4]

“Covered persons” are described in the Final Rule as (1) foreign entities headquartered in or organized under the laws of a country of concern or majority owned by one or more countries of concern or other covered persons, (2) foreign entities that are majority owned by a country of concern or another covered person, (3) foreign individuals who are employees or contractors of a country of concern or covered person, (4) foreign individuals who are primarily a resident in a country of concern, and (5) those persons the NSD designates and publicly identifies.^[5] As it pertains to subcategory (5), the NSD will designate and add persons to a published Covered Persons list following a determination that such persons meet certain criteria such as being subject to the ownership and control of a country of concern.^[6]

Covered and Exempt Data Transactions

In determining whether the requirements of the DSP apply to a particular U.S. person or entity, it is essential to understand the type of data at issue and the transactions covered by the program. If a company handles data covered under the program, they will be restricted or even prohibited from transferring such information in certain circumstances.

Covered Transactions: Any transaction that involves access by one of the countries of concern or covered persons to any government-related data or bulk U.S. sensitive personal data is subject to DSP restrictions. To be a “covered transaction,” the transaction must also involve (1) data brokerage, (2) a vendor agreement, (3) an employment agreement, or (4) an investment agreement.^[7]

“Government-related Data”: Certain geolocation data related to government activities,^[8] and any sensitive personal data, regardless of volume, that a transacting party markets as linked or linkable to current or recent former employees or contractors of the United States Government, such as a U.S. company that advertises the sale of a set of sensitive personal data as belonging to “government employees.”^[9]

“Bulk U.S. Sensitive Personal Data”: A collection or set of sensitive personal data relating to U.S. persons, in any format.^[10]  “Sensitive personal data” includes (1) covered personal identifiers, (2) precise geolocation data, (3) biometric identifiers, (4) human genomic data, (5) personal health data, and (6) personal financial data or any combination thereof.^[11]

Under the DSP, there are two general categories of covered transactions: 1) Prohibited Transactions and 2) Restricted Transactions.

Prohibited Transactions: Generally involve data brokerage with a country of concern or covered person and prohibit any U.S. person from engaging in a covered transaction subject to certain exemptions, and transactions that involve access by a country of concern or covered person to certain bulk U.S. sensitive data.^[12]

Restricted Transactions: Generally cover data transactions under vendor agreements, employment agreements, or investment agreements, subject to certain exemptions, that are restricted unless the U.S. person complies with specific security requirements.^[13]

Exempt Transactions: Several transactions are exempt from the otherwise applicable prohibitions and restrictions. Such exemptions include but are not limited to:

• Information or informational materials;
• Financial services;
• Corporate group transactions (ordinarily incident to and part of administrative or ancillary business operations);
• Transactions required or authorized by federal law or international agreements;
• Investment agreements subject to a CFIUS action;
• Telecommunications services;
• Drug, biological product, and medical device authorizations; and
• Other clinical investigations and post-market surveillance data (ordinarily incident to and part of clinical investigations regulated by the U.S. Food and Drug Administration or the collection and processing of certain clinical care data or post-marketing surveillance data).^[14]

Licenses

The DOJ, through the NSD, may issue either general or specific licenses to engage in a covered data transaction that would otherwise violate the DSP. A general license will authorize a particular type of transaction, subject to prohibitions or restrictions without the need to apply for a specific license.^[15] A specific license is a document issued by the NSD to a particular person or entity, authorizing a particular transaction.^[16]

DOJ Implementation & Enforcement

The DSP is administered and enforced by the Foreign Investment Review Section (FIRS) of the NSD, which is responsible for the DOJ’s non-prosecutorial efforts to address and manage national security risks to cross-border transactions, business, and technology that are posed by threats such as foreign adversaries. The FIRS also may handle requests for advisory opinions submitted by potentially regulated parties regarding the application of the DSP to specific transactions, which is a mechanism embedded within the Final Rule pertaining to the DSP.^[17]

Any civil or criminal prosecutions related to violations of the DSP likely will be handled by the NSD or will be referred to the appropriate U.S. attorney’s office. U.S. companies should expect enforcement under the DSP to largely mirror traditional export control or sanctions violations actions. Both the DSP and U.S. economic sanctions regimes derive their authority from the IEEPA. Civil and criminal liability under the IEEPA can be significant, with civil penalties of up to the greater of $386,136, or twice the value of each violative transaction, and criminal penalties of up to 20 years in prison, a $1,000,000 fine, or both.^[18] As such, U.S. persons or companies whose activities may fall within the ambit of the DSP should engage with counsel early and often to ensure appropriate compliance and reporting requirements are met.

Key Takeaways and Recommendations

U.S. persons and companies that have not already begun planning for full implementation of the DSP should come into compliance immediately. Such impacted companies may include:

• Cloud service providers

• Virtual service providers

• Data processing centers

• Medical device manufacturers

• Academic institutions

• Data analytics firms and consultants

• Government contractors in the defense or health care sectors

Like export control compliance measures, these U.S. persons and entities should engage counsel experienced in this area to undertake the following:

• Conduct internal reviews and audits to identify potential access to covered data or transactions involving the flow of such data to covered countries or persons.

• Implement policies, procedures, and trainings addressing data security and the transfer or access to any U.S. government-related data or bulk U.S. sensitive personal data.

• Determine the applicability of any general licenses or the need to apply for specific licenses for any prohibited or restricted transactions.

• Implement a compliance program to track transactions, perform regular due diligence, and maintain accurate records.

• Engage counsel to draft or revise vendor contracts as necessary, conduct due diligence, and interface with government agencies such as the DOJ when necessary.

• Adjust employee work locations, roles, or responsibilities depending on proximity or exposure to countries of concern or covered persons.

• Implement the Cybersecurity and Infrastructure Agency (CISA) Security Requirements.

Taking these measures will assist U.S. companies and persons to adequately prepare for enforcement action likely to come.

Affected companies and persons should also take note of October 6, 2025. Starting on that date, entities and individuals must comply with due diligence and audit requirements for restricted transactions, and reporting requirements for restricted transactions and rejected prohibited transactions.

If you have questions about this topic, please feel free to reach out to any of the authors or your �鶹ֱ�� & Lardner attorney. If you would like to see future updates regarding “What Every Multinational Company Should Know” about operating in today’s complicated international trade world, please sign up for our Tariff & International Trade blog —

***

[1] “DATA SECURITY PROGRAM: IMPLEMENTATION AND ENFORCEMENT POLICY THROUGH JULY 8, 2025,” Department of Justice (April 11, 2025),

[2] See 50 U.S.C. § 1705; see also Executive Order 14117, “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern” (February 28, 2024),

[3] The White House, “American First Investment Policy,” (February 21, 2025), ; The White House, “Fact Sheet: President Donald J. Trump Restores Maximum Pressure on Iran,” (February 4, 2025),

[4] “DATA SECURITY PROGRAM: COMPLIANCE GUIDE,” Department of Justice (April 11, 2025),

[5] See §§ 202.211(a)(1)-(5)

[6] See § 202.701

[7] See §§ 202.214, 202.258, 202.217, & 202.228

[8] See § 202.222(a)(1)

[9] See § 202.222(b)

[10] See § 202.206

[11] See § 202.249

[12] See §§ 202.301-303

[13] See § 202.401

[14] See §§ 202.501-511

[15] See § 202.801

[16] See § 202.802

[17] See § 202.901

[18] See § 202.1301; see also 50 U.S.C. § 1705

Our previous article on What Every Multinational Company Should Know About … Customs Enforcement and False Claims Act Risks (Part I) outlined how import-related risks have substantially increased given the combination of the new high-tariff environment, the heightened ability of Customs (and the general public) to data mine import-related data, and the Department of Justice’s (DOJ) stated focus on using the False Claims Act (FCA). In Part II, we laid out how to prepare for the most common False Claims Act (FCA) risks arising from submitting false Form 7501 entry summary information. We now complete the series on “Customs Enforcement and False Claims Act Risks” with Part III, which focuses on preparing for the most common FCA risks arising from improper management of import operations.

Risks Arising from Knowing Failures to Correct Errors

If importers discover a systematic error, the position of Customs is clear: The importer is under an obligation not only to correct the error for future entries but also to use measures like post-summary corrections to update prior entries. This is demonstrated by a DOJ settlement in which an importer paid to settle allegations that it “made no effort to right its wrongs even after acknowledging internally that it had underpaid millions of dollars of duties owed.” This type of knowing error is exactly the type of conduct that can expose importers to reverse FCA liability.

Customs Compliance Response

• Apply Current Knowledge to Unliquidated Entries. Because liquidation takes (approximately) 314 days after entry, Customs grants a 300-day to correct most entry-related information. If you discover an error, Customs requires not only that the error be corrected going forward but also that any non-liquidated entries be corrected as well.

• Consider Making a Voluntary Prior Disclosure. If an importer initiates a voluntary disclosure before Customs begins its own investigation, then Customs may not pursue penalties, assuming the voluntary disclosure is full and accurate, and the importer pays back any tariffs and interest due. This is an especially important advantage for the new Trump tariffs, since many of them direct that Customs should impose maximum penalties for failure to pay all of the new tariffs, without taking into account traditional Customs mitigating factors. Filing a voluntary self-disclosure before Customs initiates an administrative investigation avoids any Customs administrative penalties (provided the importer follows through with a thorough and accurate disclosure). While a self-disclosure is not a free pass to avoid FCA liability, it can reduce the multiplier and penalties assessed in settlement negotiations.

Risks from Failing to Follow Form 28 and 29 Corrections for Prior Entries

Customs commonly issues Form 28 Requests for Information and Form 29 Notices of Action that target a handful of entries (or even a single entry) where it has questions about the accuracy of submitted entry information. If this results in Customs issuing a correction, then the importer is required to correct not only the entry but also any other entries covered by the reasoning. Failure to do so was one of the key elements of the $22.8 million settlement noted above, where DOJ emphasized that although the importer had received Form 29 Notices of Action, it took to correct its ongoing entries (and never corrected prior entries).

Customs Compliance Response

• Set Up ACE Notifications. Importers should set themselves up with ACE access so that they directly are receiving copies of Form 28 Requests for Information, Form 29 Notices of Action, and other communications from Customs rather than relying on customs brokers to provide such information. This will ensure that the importer is aware of all potential corrections to its Form 7501 Entry Summary information and can timely respond to any Customs inquiries.

• Follow Through on Implementing Conforming Changes. When Customs issues a correction to a single entry or set of entries, the importer is required to identify all analogous entries and correct them for any unliquidated entries, because they are not final. Customs also has the authority to open an inquiry into liquidated entries under Section 1592 if the importer does not file a voluntary disclosure.

Risks Arising from Failure to Notice Red Flags from Suppliers

Under Customs regulations, the importer of record has the sole responsibility to pay all tariffs due. There is, however, no such restriction under the FCA, which means that multinationals that receive imported goods from suppliers can still be liable for FCA claims. For example, an importer of garments from China paid to settle allegations that it “repeatedly ignored warning signs that its business partner, which imported garments from China, was engaged in a scheme to underpay customs duties owed on the imported garments it sold to” the importer. Thus, even though the customer was not the importer of record, it settled on the basis it had accepted “responsibility for its failure to take action in response to multiple warning signs that [the importers of record] were undervaluing their imported goods and therefore paying less in import duties than they should have been paying.”

Moreover, in 2016, both the importer and manufacturer of clothing goods agreed to pay to settle claims that they conspired to underpay customs duties using invoices that misrepresented the value of the goods at issue. That same year, a U.S. defense contractor agreed to pay to settle allegations that it used Chinese-imported ultrafine magnesium in flares manufactured and sold to the U.S. Army, in violation of its contract with the military. Though it was the importer who allegedly misrepresented the country of origin, DOJ alleged that the contractor conspired with the importer to sell the nonconforming goods to the government.

Customs Compliance Response

• Monitor Business Partners for Red Flags. In a high-tariff environment, there are more incentives than ever for importers to take steps to try to minimize their tariff liabilities. Educate personnel in Procurement, Accounting, and other relevant areas of the company to be alert to potential underpayments by suppliers, which also is useful for situations where business partners might provide incorrect information where your company acts as the importer of record. Simply put, know your business partners well.

Risks Arising From Avoiding Customs Penalties

In general, any situation in which an importer takes steps to avoid Customs penalties can lead to a potential FCA penalty. Examples include failing to mark the country of origin (10% Customs penalty), providing false or misleading information on entry documents (as we covered in Part II), failing to maintain required records, or noncompliance with forced labor regulations. By way of example, the Third Circuit found that failure to notify Customs of marking violations can support an FCA allegation. 839 F.3d 242 (3rd Cir. 2016), cert. denied, 138 S.Ct. 107 (2017). Illustrating this risk, an importer paid to settle allegations that it had failed to mark imported pharmaceutical products with the appropriate COO and thus violated the FCA by “knowingly avoiding the marking duties owed to the United States for those imports.”

Another example includes a DOJ settlement in which an importer agreed to settle allegations that it falsely labeled tools it imported as “made in Germany” when the tools were, in fact, made in China. According to DOJ, if the products had been described as Chinese products, the importer would have been required to pay a 25% tariff on the goods. Thus, by allegedly falsely describing the tools as “German,” the importer avoided paying these tariffs.

Customs Compliance Response

• Confirm Consistent Marking. Ensure the COO for marking decisions is made in accordance with the correct legal regime, by following the rules of free trade agreements like the USMCA (even in situations where special tariffs may require the use of substantial transformation principles for determining the amount of other tariffs due). Ensure marking is made either directly on the product or, where allowed, on a relevant container or other acceptable fashion to ensure it remains intact for the ultimate purchaser.

• Maintain Required Records. Customs regulations require that, subject to certain exceptions, records must be kept for five years from the date of the activity which required creation of the record. Importers should ensure that they are complying with Customs recordkeeping requirements and that their employees are familiar with recordkeeping requirements. The FCA also requires that documents supporting claims — and the claims documentation itself — be true and accurate.

• Conduct a Supply Chain Integrity Check and Continuous Monitoring. Complying with labor and transparency requirements is integral to tariff management. Importers should know every step in their supply chains and conduct integrity checks or audits of their suppliers. This can help ensure your company stays informed of new developments to comply with laws — especially in the areas of forced labor, human trafficking, environmental regulations, and modern slavery — and thus avoid potential FCA liability pertaining to these types of regulations. Importers also should implement systems to regularly monitor their suppliers’ performance and compliance, and continuously evaluate their supply chain for new potential risks that might arise. For further guidance on how to best monitor your supply chain, check out our white paper on Managing Supply Chain Integrity Risks.

Between the new Trump tariffs, increased Customs attention to tariff underpayments, newly announced DOJ emphasis on tariff payments, and the greater visibility of Customs into importing data, the potential for Customs FCA actions is greater than ever. As demonstrated throughout this three-part series, DOJ has a rich history of using a wide variety of issues to support FCA actions. DOJ’s announced attention to concentrate on Customs compliance and the full payment of tariffs means that future customs-related FCA cases will build on a foundation of existing cases. These previous cases have already given DOJ and whistleblowers the chance to test out a multitude of the factual and legal theories discussed throughout this series, with both DOJ and relators likely to be incentivized by the potential for significantly higher recoveries and the apparent increased enforcement flexibility resulting from the new tariff regime.

Thus, under the Trump administration’s trade agenda, multinationals should expect heightened scrutiny of imports and DOJ’s increased use of the FCA to bring customs-related actions. It is therefore more critical than ever for importers to assess and revamp their Customs compliance programs to address these new risks. Proactively addressing compliance issues, strengthening internal controls, and documenting decision-making processes can reduce exposure and better position multinationals to respond effectively if Customs scrutiny arises. In an environment with increased potential for enforcement and where corresponding penalties are steep, early preparation is both a risk management strategy and a competitive advantage.

If you would like further information about managing Customs and international trade risks, we recommend our white paper on Managing Import and Tariff Risks During a Trade War.

***

The �鶹ֱ�� International Government Enforcement Defense & Investigations Team is monitoring all tariff-related developments, including any modifications, clarifications/guidance, or additional measures introduced by the Trump administration, which we are posting as they occur on our Tariff & International Trade Resources blog. As new information becomes available, we will provide updates and analysis to help importers navigate the evolving international trade paradigm, including for new tariffs.

Our white paper on “Managing Import and Tariff Risks During a Trade War” outlines a 12-step plan to provide practical steps to help importers navigate the tariff and international trade risks in the current tariff and trade environment, while the companion white paper on “Managing Supply Chain Integrity Risks” provides practical advice to deal with heightened supply chain risks pertaining to goods imported into the United States, including the increasing use of detentions by Customs.

If you have questions about this post, please feel free to reach out to any of the authors or your �鶹ֱ�� & Lardner attorney. If you would like to see future updates regarding “What Every Multinational Company Needs to Know” about operating in today’s complicated international trade world, please sign up for our Tariff & International Trade blog —