In this new year, global businesses already are contending with considerable turbulence impacted by rapidly evolving U.S. national security threats and related cross-border compliance risks. The result has been much-loathed uncertainty for global businesses, which has been exacerbated by the longest-ever, modern-era U.S. government shutdown. More integrated, holistic compliance strategies, thinking across historical compliance silos, will help address these risks.

The following provides insights from Washington, D.C., on three overlapping spheres of risk that global companies' compliance and risk mitigation strategies likely should address, taking a “cross-fit,” rather than traditionalist approach.

U.S. – China relations

• The so-called U.S.-China “trade war” that erupted forcefully last year is creating significant uncertainty for U.S. businesses' import and export activities. Affected companies that understand and adapt as events unfold will be the least negatively impacted.
• In a best-case scenario, a few areas of business will experience some relief, while many others while face significantly increased challenges. U.S. import tariffs and other punitive measures will ease somewhat, while risks related to exports and investments involving the U.S. and China are increasing for the foreseeable future.
• Arrests in multiple countries of Chinese executives and a U.S. criminal probe of monolith Huawei Technologies related to espionage and U.S. export violation charges will have significant spillover effects into all areas of the bilateral relationship.
• Even U.S. actions that intend to ease some of the pain will create compliance complications. U.S. businesses reliant on imports struggle to keep up with constant changes. (https://ustr.gov/sites/default/files/enforcement/301Investigations/2018-28277.pdf)

Foreign investment and new technology export regulatory requirements

• Investments inbound into the U.S. involving non-U.S. entities, and exports outbound from the U.S., both will confront a new and evolving regulatory landscape. This year will be key for to how new “pilot program” requirements, launched last November by the Committee on Foreign Investment in the U.S. (CFIUS) and due to be finalized by February 2020, will be implemented and enforced.
• Following enactment of the Foreign Investment Risk Review Modernization Act (FIRRMA) into law, CFIUS mandatory notices, including for non-controlling “foreign” investors, will significantly expand the number of investments impacted by national security restrictions. (https://home.treasury.gov/news/press-releases/sm506)
• Further expanded CFIUS and export control requirements are anticipated this year, as the U.S. Department of Commerce defines “emerging technologies” that will be subject to higher scrutiny by the U.S. government. (https://www.govinfo.gov/content/pkg/FR-2018-12-14/pdf/2018-27148.pdf)

Convergence of cybersecurity, economic sanctions and anti-money laundering risk and regulations

• The irony of the recent U.S. Securities and Exchange Commission (SEC) public admission that it had been victimized over two years ago by cyberattacks and data theft sums up the rapidly converging regulatory and compliance risks of the modern technological age (https://www.sec.gov/news/public-statement/statement-clayton-011519). The SEC has been increasing its enforcement against companies for failures related to cybersecurity breaches.
• At the end of last year, the SamSam cyberattackers network, whose ransomware attacks the U.S. Department of Justice (DOJ) Criminal Division head termed “an extreme form of 21st-century digital blackmail,” were targeted by DOJ and the U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC) for money laundering and Iran sanctions violations. For the first time, companies' compliance programs will have to contend with “digital currency addresses” included on OFAC sanctions lists.
• Meanwhile, multinational companies headquartered outside the U.S. are grappling with divided EU and U.S. sanctions strategies targeting Iran, the outcome of which in turn will be affected by Iran's response to international demands to address known money laundering problems in the country. (http://www.fatf-gafi.org/countries/d-i/iran/documents/public-statement-october-2018.html)

Global companies face increasingly complex compliance challenges as risks related to imports, exports, economic sanctions, money laundering and cybersecurity evolve and converge.  Getting ahead of the compliance curve this year necessitates understanding the interrelated nature of U.S. government actions and enforcement to address these challenges that will impact important legal requirements.

Jo Ritcey-Donohue is the founder of JRD Law PLLC in Washington, D.C.  The firm represents the largest and most sophisticated sovereign and multinational corporate clients in matters relating to complex cross-border risk, corporate governance and compliance legal counseling.