Insights

On March 23, 2026, the Federal Communications Commission (FCC) updated its Covered List—a list of communications equipment and services deemed to pose an unacceptable risk to U.S. national security or the safety and security of U.S. persons—to include consumer-grade routers produced in a foreign country, absent an exemption granted by the U.S. Departments of War (DoW) or Homeland Security (DHS). This designation effectively prohibits the import of all consumer routers that are not produced in the United States.

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) issued six new general licenses, and updated a seventh that allow for many activities related to: the export of Venezuelan oil and petrochemical products from Venezuela; the exploration, development, and production of oil, gas, and petrochemical products in Venezuela; the generation, transmission, storage, or distribution of electricity in Venezuela; the export to Venezuela of U.S.-origin diluents; negotiating for investment in the oil, gas, petrochemical, and electricity sectors in Venezuela; and the export of Venezuelan gold.

The United States, European Union, and United Kingdom have significantly escalated Russia-related sanctions the past month, including the Trump Administration’s first sanctions directly imposed on Russia. These coordinated actions—which particularly target the Russian energy sector—indicate that Russia sanctions remain on the geopolitical agenda and require multinational companies to remain vigilant in their compliance with those sanctions.

On September 29, 2025, the U.S. Department of Commerce Bureau of Industry and Security (BIS) announced a sweeping Interim Final Rule (IFR), (the “Affiliates Rule”) expanding which entities qualify as Entity List or Military End-User entities, thereby subjecting those entities to elevated export control restrictions under the Export Administration Regulations (EAR). U.S. export restrictions applicable to entities on the Entity List, Military End-User (MEU) List, and Specially Designated Nationals and Blocked Persons (SDN List) now apply to foreign affiliates that are, in the aggregate, owned 50% or more by one or more of the aforementioned entities. An entity that becomes subject to these restrictions because of its ownership structure will be subject to the most restrictive controls that attach to any of its parent entities, regardless of ownership stakes.

On August 28, 2025, France, Germany, and the UK (the E3) initiated the process to reinstate (or snapback) UN sanctions on Iran. The snapback mechanism (which was set to expire on October 18, 2025) is outlined in UN Security Council Resolution 2231 (UNSCR 2231).

On August 28, the U.S. Department of Commerce Bureau of Industry and Security (BIS) published a final rule that modifies the Export Administration Regulations (EAR) to reduce the number of export control restrictions on Syria, in alignment with Executive Order 14312, Providing For The Revocation of Syria Sanctions. The key adjustments made by this rule include the addition of new or expanded license exception eligibility for exports and reexports to Syria (which significantly broadens the number of items that can be exported or reexported to Syria) and the adoption of more permissive license review policies for exports and reexports to Syria.

On July 28, 2025, Cadence Design Systems Inc. (“Cadence” or “the Company”), a global electronic design automation (“EDA”) technology company based in San Jose, California, agreed to plead guilty in a settlement with the U.S. Department of Justice’s National Security Division (“NSD”) and the U.S. Attorney’s Office for the Northern District of California. Through its guilty plea, Cadence agreed to resolve charges that it committed criminal violations of export controls by selling EDA hardware, software, and semiconductor design intellectual property (“IP”) technology to the National University of Defense Technology (“NUDT”), a Chinese military university on the U.S. Entity List since 2015 due to its involvement in military and nuclear simulation activities. In addition, Cadence simultaneously resolved a civil enforcement action brought by the U.S. Department of Commerce, Bureau of Industry and Security (“BIS”) related to the same underlying conduct.

On July 23, 2025, the White House released Winning the Race: America’s AI Action Plan (“the Plan”) the Trump Administration’s most significant policy statement on artificial intelligence to date.

On June 30, 2025, President Trump issued Executive Order 14312 effectively lifting (or beginning the process of lifting) most of the sanctions on Syria. Executive Order 14312 cites the leadership changes and the policies of the new Syrian government under President Ahmed al-Sharaa as the reasons for the removal of sanctions. On the same day, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) and the Department of State took steps to implement the termination of the program by, among other actions, delisting appropriate individuals and entities from the List of Specially Designated Nationals and Blocked Persons (SDN List). These actions followed the initial sanctions relief provided on May 23, 2025 by OFAC, the Financial Crimes Enforcement Network (FinCEN), and the State Department.

On May 23, 2025, the U.S. Departments of State (“State”) and the Treasury (“Treasury”) took actions that resulted in immediate sanctions relief for Syria. Specifically, Treasury’s Office of Foreign Assets Control (“OFAC”) issued General License 25 (“GL 25”) pursuant to the Syrian Sanctions Regulations (“SySR”), the Weapons of Mass Destruction Proliferators Sanctions Regulations (“NPWMD”), the Iranian Financial Sanctions Regulations (“IFSR”), the Global Terrorism Sanctions Regulations (“GTSR”), and the Foreign Terrorist Organization Sanctions Regulations (“FTOSR”). In parallel, Treasury’s Financial Crimes Enforcement Network (“FinCEN”) and State took supporting actions outlined below.

On May 13, 2025, the Department of Commerce’s Bureau of Industry and Security (BIS) formally rescinded the Framework for Artificial Intelligence Diffusion interim final rule published by the Biden Administration, on the basis that it stifled innovation, was overly complex, and undermined U.S. diplomatic relations.

The new Trump administration is focusing intensely on “cartels” and other transnational criminal organizations, particularly in the Western Hemisphere. Many of the entities designated as FTOs today are active in Latin America and the United States, and sometimes seek to extort money or have other dealings with legitimate businesses operating in their territories. The State Department’s designation of eight such entities will not only raise the pressure on the entities designated, but also will create new risks and pressures for companies operating in areas where these FTOs are active. Below, we summarize the recent developments and the ramifications of these designations for businesses.

On February 4, 2025, President Trump issued a National Security Presidential Memorandum (NSPM-2) on “Imposing Maximum Pressure on the Government of the Islamic Republic of Iran, Denying Iran All Paths to a Nuclear Weapon, and Countering Iran’s Malign Influence.” NSPM-2 directs U.S. government agencies to take a range of measures to reimpose “maximum pressure” sanctions on Iran. 

On January 2, 2025, the U.S. Department of Defense (DoD) updated the 1260H List of entities identified as “Chinese military companies” (CMC) operating in the United States, as required by section 1260H of the National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2021 (Section 1260H), adding new entities and removing others.  The updated 1260H List now includes 76 entities. 

The U.S. Department of Commerce’s Bureau of Industry and Security (“BIS”) issued new guidance (“BIS Guidance”) for financial institutions (“FIs”) on October 9, 2024, recommending that FIs undertake specific compliance practices to minimize their risk of violating General Prohibition (“GP”) 10 of BIS’s Export Administration Regulations (“EAR”).  GP 10 prohibits any person (U.S. or otherwise) from selling, transferring, exporting, reexporting, financing, ordering, buying, removing, concealing, storing, using, loaning, disposing of, transporting, forwarding, or otherwise servicing an item “subject to the EAR” with knowledge that that item was, or will be, exported, reexported, or transferred in violation of the EAR.  Knowledge in this context goes beyond actual knowledge, and can be inferred from circumstances surrounding a transaction; in other words, a “known or should have known” standard.  Although BIS has published several joint alerts with FinCEN encouraging financial institutions to look for potential red flags of evasion of export controls, this guidance goes further in establishing specific export compliance best practices for financial institutions and suggests that financial institutions that finance or otherwise service prohibited exports risk liability under the EAR.

In response to the ongoing conflict in Ukraine and to exert further pressure on Russia, the EU enacted its 14thsanctions package against Russia on June 24, 2024. The new package comes after months of negotiations between Member States, and follow, but in many ways expand upon, those passed by the United States and the UK last week (see Crowell’s Alert on those developments here). 

On June 20, 2024, the U.S. Department of Commerce’s Bureau of Industry and Security (BIS) announced a Final Determination, pursuant to the Securing the Information and Communications Technology and Services Supply Chain (ICTS) regulations, prohibiting Kaspersky Lab, Inc., the U.S. subsidiary of a Russia-based anti-virus software and cybersecurity company, from providing anti-virus software and cybersecurity products or services in the United States or to U.S. persons (wherever located) because it poses undue and unacceptable risk to U.S. national security. The prohibition also applies to Kaspersky Lab, Inc.’s affiliates, subsidiaries and parent companies (collectively Kaspersky). This is the first time that BIS’s Office of Information and Communications Technology and Services (OICTS) has issued a determination pursuant to the ICTS regulations.

On June 12, 2024, the U.S. Department of the Treasury’s Office of Foreign Asset Control (OFAC) and the U.S. Department of Commerce’s Bureau of Industry and Security (BIS) announced additional sanctions and export restrictions in response to Russia’s continued aggression in Ukraine. The next day, the UK announced additional sanctions designations.

On May 22, 2024, the U.S. Department of Justice’s National Security Division (NSD) announced its first declination to prosecute a company under its Enforcement Policy for Business Organizations (Enforcement Policy).

On April 24, 2024, President Biden signed into law the National Security Supplemental fiscal package, which includes significant new sanctions and export controls authorities. Although the U.S. foreign aid commitments for Ukraine, Israel, and Taiwan headline the new law, it also (1) expands the statute of limitations for U.S. sanctions violations; (2) includes new authorities for the President to coordinate sanctions efforts with the European Union and the United Kingdom; (3) expands sanctions and export controls on Iran (including some targeted at Chinese financial institutions); and (4) includes new sanctions authorities targeting terror groups.