Insights

On September 29, 2025, the U.S. Department of Commerce Bureau of Industry and Security (BIS) announced a sweeping Interim Final Rule (IFR), (the “Affiliates Rule”) expanding which entities qualify as Entity List or Military End-User entities, thereby subjecting those entities to elevated export control restrictions under the Export Administration Regulations (EAR). U.S. export restrictions applicable to entities on the Entity List, Military End-User (MEU) List, and Specially Designated Nationals and Blocked Persons (SDN List) now apply to foreign affiliates that are, in the aggregate, owned 50% or more by one or more of the aforementioned entities. An entity that becomes subject to these restrictions because of its ownership structure will be subject to the most restrictive controls that attach to any of its parent entities, regardless of ownership stakes.

On August 28, 2025, France, Germany, and the UK (the E3) initiated the process to reinstate (or snapback) UN sanctions on Iran. The snapback mechanism (which was set to expire on October 18, 2025) is outlined in UN Security Council Resolution 2231 (UNSCR 2231).

On August 28, the U.S. Department of Commerce Bureau of Industry and Security (BIS) published a final rule that modifies the Export Administration Regulations (EAR) to reduce the number of export control restrictions on Syria, in alignment with Executive Order 14312, Providing For The Revocation of Syria Sanctions. The key adjustments made by this rule include the addition of new or expanded license exception eligibility for exports and reexports to Syria (which significantly broadens the number of items that can be exported or reexported to Syria) and the adoption of more permissive license review policies for exports and reexports to Syria.

On July 28, 2025, Cadence Design Systems Inc. (“Cadence” or “the Company”), a global electronic design automation (“EDA”) technology company based in San Jose, California, agreed to plead guilty in a settlement with the U.S. Department of Justice’s National Security Division (“NSD”) and the U.S. Attorney’s Office for the Northern District of California. Through its guilty plea, Cadence agreed to resolve charges that it committed criminal violations of export controls by selling EDA hardware, software, and semiconductor design intellectual property (“IP”) technology to the National University of Defense Technology (“NUDT”), a Chinese military university on the U.S. Entity List since 2015 due to its involvement in military and nuclear simulation activities. In addition, Cadence simultaneously resolved a civil enforcement action brought by the U.S. Department of Commerce, Bureau of Industry and Security (“BIS”) related to the same underlying conduct.

On July 23, 2025, the White House released Winning the Race: America’s AI Action Plan (“the Plan”) the Trump Administration’s most significant policy statement on artificial intelligence to date.

On June 30, 2025, President Trump issued Executive Order 14312 effectively lifting (or beginning the process of lifting) most of the sanctions on Syria. Executive Order 14312 cites the leadership changes and the policies of the new Syrian government under President Ahmed al-Sharaa as the reasons for the removal of sanctions. On the same day, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) and the Department of State took steps to implement the termination of the program by, among other actions, delisting appropriate individuals and entities from the List of Specially Designated Nationals and Blocked Persons (SDN List). These actions followed the initial sanctions relief provided on May 23, 2025 by OFAC, the Financial Crimes Enforcement Network (FinCEN), and the State Department.

On May 23, 2025, the U.S. Departments of State (“State”) and the Treasury (“Treasury”) took actions that resulted in immediate sanctions relief for Syria. Specifically, Treasury’s Office of Foreign Assets Control (“OFAC”) issued General License 25 (“GL 25”) pursuant to the Syrian Sanctions Regulations (“SySR”), the Weapons of Mass Destruction Proliferators Sanctions Regulations (“NPWMD”), the Iranian Financial Sanctions Regulations (“IFSR”), the Global Terrorism Sanctions Regulations (“GTSR”), and the Foreign Terrorist Organization Sanctions Regulations (“FTOSR”). In parallel, Treasury’s Financial Crimes Enforcement Network (“FinCEN”) and State took supporting actions outlined below.

On May 13, 2025, the Department of Commerce’s Bureau of Industry and Security (BIS) formally rescinded the Framework for Artificial Intelligence Diffusion interim final rule published by the Biden Administration, on the basis that it stifled innovation, was overly complex, and undermined U.S. diplomatic relations.

The new Trump administration is focusing intensely on “cartels” and other transnational criminal organizations, particularly in the Western Hemisphere. Many of the entities designated as FTOs today are active in Latin America and the United States, and sometimes seek to extort money or have other dealings with legitimate businesses operating in their territories. The State Department’s designation of eight such entities will not only raise the pressure on the entities designated, but also will create new risks and pressures for companies operating in areas where these FTOs are active. Below, we summarize the recent developments and the ramifications of these designations for businesses.

On February 4, 2025, President Trump issued a National Security Presidential Memorandum (NSPM-2) on “Imposing Maximum Pressure on the Government of the Islamic Republic of Iran, Denying Iran All Paths to a Nuclear Weapon, and Countering Iran’s Malign Influence.” NSPM-2 directs U.S. government agencies to take a range of measures to reimpose “maximum pressure” sanctions on Iran. 

On January 2, 2025, the U.S. Department of Defense (DoD) updated the 1260H List of entities identified as “Chinese military companies” (CMC) operating in the United States, as required by section 1260H of the National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2021 (Section 1260H), adding new entities and removing others.  The updated 1260H List now includes 76 entities. 

The U.S. Department of Commerce’s Bureau of Industry and Security (“BIS”) issued new guidance (“BIS Guidance”) for financial institutions (“FIs”) on October 9, 2024, recommending that FIs undertake specific compliance practices to minimize their risk of violating General Prohibition (“GP”) 10 of BIS’s Export Administration Regulations (“EAR”).  GP 10 prohibits any person (U.S. or otherwise) from selling, transferring, exporting, reexporting, financing, ordering, buying, removing, concealing, storing, using, loaning, disposing of, transporting, forwarding, or otherwise servicing an item “subject to the EAR” with knowledge that that item was, or will be, exported, reexported, or transferred in violation of the EAR.  Knowledge in this context goes beyond actual knowledge, and can be inferred from circumstances surrounding a transaction; in other words, a “known or should have known” standard.  Although BIS has published several joint alerts with FinCEN encouraging financial institutions to look for potential red flags of evasion of export controls, this guidance goes further in establishing specific export compliance best practices for financial institutions and suggests that financial institutions that finance or otherwise service prohibited exports risk liability under the EAR.

In response to the ongoing conflict in Ukraine and to exert further pressure on Russia, the EU enacted its 14thsanctions package against Russia on June 24, 2024. The new package comes after months of negotiations between Member States, and follow, but in many ways expand upon, those passed by the United States and the UK last week (see Crowell’s Alert on those developments here). 

On June 20, 2024, the U.S. Department of Commerce’s Bureau of Industry and Security (BIS) announced a Final Determination, pursuant to the Securing the Information and Communications Technology and Services Supply Chain (ICTS) regulations, prohibiting Kaspersky Lab, Inc., the U.S. subsidiary of a Russia-based anti-virus software and cybersecurity company, from providing anti-virus software and cybersecurity products or services in the United States or to U.S. persons (wherever located) because it poses undue and unacceptable risk to U.S. national security. The prohibition also applies to Kaspersky Lab, Inc.’s affiliates, subsidiaries and parent companies (collectively Kaspersky). This is the first time that BIS’s Office of Information and Communications Technology and Services (OICTS) has issued a determination pursuant to the ICTS regulations.

On June 12, 2024, the U.S. Department of the Treasury’s Office of Foreign Asset Control (OFAC) and the U.S. Department of Commerce’s Bureau of Industry and Security (BIS) announced additional sanctions and export restrictions in response to Russia’s continued aggression in Ukraine. The next day, the UK announced additional sanctions designations.

On May 22, 2024, the U.S. Department of Justice’s National Security Division (NSD) announced its first declination to prosecute a company under its Enforcement Policy for Business Organizations (Enforcement Policy).

On April 24, 2024, President Biden signed into law the National Security Supplemental fiscal package, which includes significant new sanctions and export controls authorities. Although the U.S. foreign aid commitments for Ukraine, Israel, and Taiwan headline the new law, it also (1) expands the statute of limitations for U.S. sanctions violations; (2) includes new authorities for the President to coordinate sanctions efforts with the European Union and the United Kingdom; (3) expands sanctions and export controls on Iran (including some targeted at Chinese financial institutions); and (4) includes new sanctions authorities targeting terror groups.

On September 11, 2023, the U.S. Department of Justice (“DOJ”)’s National Security Division (“NSD”) announced the appointment of its first-ever Chief Counsel and Deputy Chief Counsel for Corporate Enforcement, fulfilling a commitment made by DOJ in March 2023. Both appointees are prosecutors with significant experience prosecuting large-scale, international corporate crimes, commensurate with DOJ’s recent emphasis on holding accountable corporate actors that violate national security laws, including sanctions and export controls.

After publishing a proposed rule in March 2023 on how it will implement the national security guardrails for the CHIPS and Science Act of 2022 (“CHIPS Act”) (the “Proposed Rule”), which all funding recipients are required to follow, the U.S. Department of Commerce (“Commerce”) published the corresponding final rule, (the “Final Rule”). The Final Rule will come into effect on November 24, 2023.

The Outbound Investment Program will be implemented through regulations issued by Treasury that will require notification for, or will otherwise prohibit U.S. persons from undertaking, certain transactions involving “covered national security products or technologies” and entities connected to a “country of concern.” Accordingly – concurrent with the Executive Order – Treasury released an Advance Notice of Proposed Rulemaking that provides some potential definitions of these terms, but the exact definitions and the details of the regulations will be developed through public notice and comment that concludes on September 28, 2023. Treasury also published a Fact Sheet that provides additional information on the proposed details and scope of the outbound investment prohibitions and notification requirements, which will likely not be finalized until 2024 sometime after Treasury has published draft regulations and gathered another round of public comments.