On January 14, 2026, following an investigation by the U.S. Secretary of Commerce (Secretary), under Section 232 of the Trade Expansion Act of 1962 (19 U.S.C. 1862) (Section 232), into the effects of imports of processed critical minerals and their derivative products (Critical Minerals) on the national security of the United States. After concurring with the Secretary’s determination that the quantities and circumstances of current Critical Minerals imports “threaten to impair the national security of the United States,” the President has authorized actions to be taken to adjust the imports of Critical Minerals to address the identified threat.

Overview of the Federal Action

The President has officially concurred with findings that the United States lacks a secure and reliable supply chain for Critical Minerals. In making this determination, Section 232 directs the Secretary and the President to consider factors related to national defense (including required domestic production needed for defense requirements, capacity of the domestic industry to meet such production needs, and availability of supplies and raw materials) as well as factors related to the national economy (including impacts of foreign competition and the displacement of U.S. products by “excessive imports”).

Consequently, the administration has initiated the following:

1. Negotiations with Trading Partners and Potential Trade Restrictions: The U.S. Trade Representative and the Secretary are directed to negotiate with foreign nations to adjust imports and mitigate security vulnerabilities. If negotiations are unsuccessful within 180 days, the administration may implement further measures, including tariffs or minimum import prices (price floors) for specific minerals.
2. Additional Regulatory or Deregulatory Actions: The Secretary, U.S. Trade Representative, and the Secretary of Homeland Security are directed to effectuate the proclamation through the issuance, amendment, or temporary suspension of their respective regulations, rules, and guidance.  
3. Supply Chain Monitoring: The Secretary will continue to monitor import levels and review their impact on national security to determine if further executive action is required
4. No Tariffs — Yet: Unlike for several other recent Section 232 investigations, the President has not (at this time) imposed tariffs.

Key Minerals Identified

The Secretary determined that Critical Minerals underpin critical military and economic applications and found that Critical Minerals are essential to each of the 16 critical infrastructure sectors identified by of April 30, 2024 (Critical Infrastructure Security and Resilience), including:

• Chemical Sector: lithium, fluorite, and bromine;
  • Communications Sector: gallium, germanium, indium, and yttrium;
  • Energy Sector: cobalt, nickel, uranium, praseodymium, and terbium.

Why This Matters to Companies with U.S. Mining and Processing Operations

This federal shift is highly relevant to companies mining for Critical Minerals in the United States for several key reasons:

1. Focus on Domestic Capacity: The proclamation explicitly identifies the decline in domestic production and the offshoring of facilities as a strategic weakness. The federal government now views “sufficient domestic mining and processing” as imperative to reducing reliance on foreign actors.
2. Addressing Price Volatility: The Secretary found that extreme price volatility in mineral markets has historically hindered private sector investment and led to the closure of domestic facilities. The administration’s intent to consider “price floors” is a direct attempt to ensure the long-term viability of domestic mining and processing.
3. Bridging the Processing Gap: The proclamation highlights a critical vulnerability — even when minerals are mined domestically, they are often exported for refining due to a lack of domestic processing capacity. For example, while the United States is a major producer of rare earth oxides, it remains nearly 100% reliant on imported rare earth permanent magnets. This indicates a federal push to not only mine but also process materials within the United States.
4. Alignment with Related Administration Trade Initiatives: Under the United States-Japan Framework for Securing the Supply of Critical Minerals and Rare Earths through Mining and Processing, signed October 28, 2025, the United States and Japan jointly committed to work together on investments in critical minerals mapping, mining, and recycling and to arrange for mutually complementary stockpiling. Japan has also announced investment commitments in the United States for critical minerals development, including a $350 million investment in a lithium-iron-phosphate production facility in the United States.  The proclamation potentially provides additional support for these commitments.

Next Steps

If action is taken by the President, Section 232 requires the President to provide a report to Congress within 30 days of the proclamation, explaining the President’s decision to take action under the statute. Moreover, the administration is required to provide an update on the status of trade negotiations within 180 days. We will continue to monitor these negotiations and any potential regulatory changes or guidance issued by the Department of Commerce or Homeland Security that may affect your operations or trade status.

About �鶹��ý’s Energy & Infrastructure Sector

�鶹��ý’s cross-disciplinary Energy & Infrastructure team of more than 200 attorneys regularly represents clients in the traditional and renewable power, oil and gas, nuclear, and infrastructure and energy transition industries. �鶹��ý offers comprehensive legal services for energy and infrastructure companies and projects to guide clients through every phase — from development and site control to investment, commercial contracting and financing. �鶹��ý can also assist companies involved in mining, processing, and disposal to navigate the various state and federal regulations, international agreements, and national security considerations.

Protecting sensitive data has never been more important. In a globalized world of advanced cyber threats, sophisticated espionage techniques, and external data monetization, increased security is crucial to safeguard sensitive information from theft and misuse. The recent implementation of the Department of Justice’s (DOJ) Data Security Program (DSP) demonstrates how seriously the government considers the threat posed by foreign adversary access to such data. U.S. persons and companies who aggregate the personal data of Americans or collect any information linked to U.S. government personnel now face mandatory restrictions and prohibitions when transferring this data to identified countries and persons of concern. With the leniency period for enforcement of the program officially over as of July 8, 2025 failure to come into immediate compliance creates exposure to stiff civil and criminal penalties.

Background

The DSP essentially establishes export control restrictions that prevent foreign adversaries, and those subject to those adversaries’ control and direction, from accessing U.S. government-related data and bulk U.S. sensitive personal data.

The DSP was issued under the International Emergency Economic Powers Act (IEEPA) and in accordance with Executive Order 14117, related to Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern.^[2] Although the effective date for the program was April 8, 2025, the DOJ’s National Security Division (NSD) announced a delay in enforcement efforts for 90 days to allow additional time for U.S. individuals and companies to implement the necessary changes to comply and engage with NSD on DSP-related issues.

Now that the grace period has ended, individuals and entities are expected to be in full compliance, and the NSD may begin to pursue enforcement of potential violations. The DSP is meant to address the continued efforts of foreign adversaries to use commercial activities to access, exploit, and weaponize covered categories of U.S. government and sensitive personal data. As the program is in line with various Trump Administration priorities, U.S. companies should anticipate aggressive enforcement and ensure they are compliant.^[3]

Covered Countries and Persons

The DSP restricts and prohibits U.S. persons and entities from engaging in certain transactions surrounding U.S. government data and the personal data of Americans with “countries of concern” or “covered persons.”

On April 11, 2025, the NSD issued a compliance guide related to the DSP, which identified each of the following countries as a “country of concern”:

• China (including Hong Kong and Macau)
• Cuba
• Iran
• North Korea
• Russia
• Venezuela

These countries were identified as demonstrating an intent and capability to use government-related data and Americans’ sensitive personal data to threaten U.S. national security through various specified means.^[4]

“Covered persons” are described in the Final Rule as (1) foreign entities headquartered in or organized under the laws of a country of concern or majority owned by one or more countries of concern or other covered persons, (2) foreign entities that are majority owned by a country of concern or another covered person, (3) foreign individuals who are employees or contractors of a country of concern or covered person, (4) foreign individuals who are primarily a resident in a country of concern, and (5) those persons the NSD designates and publicly identifies.^[5] As it pertains to subcategory (5), the NSD will designate and add persons to a published Covered Persons list following a determination that such persons meet certain criteria such as being subject to the ownership and control of a country of concern.^[6]

Covered and Exempt Data Transactions

In determining whether the requirements of the DSP apply to a particular U.S. person or entity, it is essential to understand the type of data at issue and the transactions covered by the program. If a company handles data covered under the program, they will be restricted or even prohibited from transferring such information in certain circumstances.

Covered Transactions: Any transaction that involves access by one of the countries of concern or covered persons to any government-related data or bulk U.S. sensitive personal data is subject to DSP restrictions. To be a “covered transaction,” the transaction must also involve (1) data brokerage, (2) a vendor agreement, (3) an employment agreement, or (4) an investment agreement.^[7]

“Government-related Data”: Certain geolocation data related to government activities,^[8] and any sensitive personal data, regardless of volume, that a transacting party markets as linked or linkable to current or recent former employees or contractors of the United States Government, such as a U.S. company that advertises the sale of a set of sensitive personal data as belonging to “government employees.”^[9]

“Bulk U.S. Sensitive Personal Data”: A collection or set of sensitive personal data relating to U.S. persons, in any format.^[10]  “Sensitive personal data” includes (1) covered personal identifiers, (2) precise geolocation data, (3) biometric identifiers, (4) human genomic data, (5) personal health data, and (6) personal financial data or any combination thereof.^[11]

Under the DSP, there are two general categories of covered transactions: 1) Prohibited Transactions and 2) Restricted Transactions.

Prohibited Transactions: Generally involve data brokerage with a country of concern or covered person and prohibit any U.S. person from engaging in a covered transaction subject to certain exemptions, and transactions that involve access by a country of concern or covered person to certain bulk U.S. sensitive data.^[12]

Restricted Transactions: Generally cover data transactions under vendor agreements, employment agreements, or investment agreements, subject to certain exemptions, that are restricted unless the U.S. person complies with specific security requirements.^[13]

Exempt Transactions: Several transactions are exempt from the otherwise applicable prohibitions and restrictions. Such exemptions include but are not limited to:

• Information or informational materials;
• Financial services;
• Corporate group transactions (ordinarily incident to and part of administrative or ancillary business operations);
• Transactions required or authorized by federal law or international agreements;
• Investment agreements subject to a CFIUS action;
• Telecommunications services;
• Drug, biological product, and medical device authorizations; and
• Other clinical investigations and post-market surveillance data (ordinarily incident to and part of clinical investigations regulated by the U.S. Food and Drug Administration or the collection and processing of certain clinical care data or post-marketing surveillance data).^[14]

Licenses

The DOJ, through the NSD, may issue either general or specific licenses to engage in a covered data transaction that would otherwise violate the DSP. A general license will authorize a particular type of transaction, subject to prohibitions or restrictions without the need to apply for a specific license.^[15] A specific license is a document issued by the NSD to a particular person or entity, authorizing a particular transaction.^[16]

DOJ Implementation & Enforcement

The DSP is administered and enforced by the Foreign Investment Review Section (FIRS) of the NSD, which is responsible for the DOJ’s non-prosecutorial efforts to address and manage national security risks to cross-border transactions, business, and technology that are posed by threats such as foreign adversaries. The FIRS also may handle requests for advisory opinions submitted by potentially regulated parties regarding the application of the DSP to specific transactions, which is a mechanism embedded within the Final Rule pertaining to the DSP.^[17]

Any civil or criminal prosecutions related to violations of the DSP likely will be handled by the NSD or will be referred to the appropriate U.S. attorney’s office. U.S. companies should expect enforcement under the DSP to largely mirror traditional export control or sanctions violations actions. Both the DSP and U.S. economic sanctions regimes derive their authority from the IEEPA. Civil and criminal liability under the IEEPA can be significant, with civil penalties of up to the greater of $386,136, or twice the value of each violative transaction, and criminal penalties of up to 20 years in prison, a $1,000,000 fine, or both.^[18] As such, U.S. persons or companies whose activities may fall within the ambit of the DSP should engage with counsel early and often to ensure appropriate compliance and reporting requirements are met.

Key Takeaways and Recommendations

U.S. persons and companies that have not already begun planning for full implementation of the DSP should come into compliance immediately. Such impacted companies may include:

• Cloud service providers

• Virtual service providers

• Data processing centers

• Medical device manufacturers

• Academic institutions

• Data analytics firms and consultants

• Government contractors in the defense or health care sectors

Like export control compliance measures, these U.S. persons and entities should engage counsel experienced in this area to undertake the following:

• Conduct internal reviews and audits to identify potential access to covered data or transactions involving the flow of such data to covered countries or persons.

• Implement policies, procedures, and trainings addressing data security and the transfer or access to any U.S. government-related data or bulk U.S. sensitive personal data.

• Determine the applicability of any general licenses or the need to apply for specific licenses for any prohibited or restricted transactions.

• Implement a compliance program to track transactions, perform regular due diligence, and maintain accurate records.

• Engage counsel to draft or revise vendor contracts as necessary, conduct due diligence, and interface with government agencies such as the DOJ when necessary.

• Adjust employee work locations, roles, or responsibilities depending on proximity or exposure to countries of concern or covered persons.

• Implement the Cybersecurity and Infrastructure Agency (CISA) Security Requirements.

Taking these measures will assist U.S. companies and persons to adequately prepare for enforcement action likely to come.

Affected companies and persons should also take note of October 6, 2025. Starting on that date, entities and individuals must comply with due diligence and audit requirements for restricted transactions, and reporting requirements for restricted transactions and rejected prohibited transactions.

If you have questions about this topic, please feel free to reach out to any of the authors or your �鶹��ý & Lardner attorney. If you would like to see future updates regarding “What Every Multinational Company Should Know” about operating in today’s complicated international trade world, please sign up for our Tariff & International Trade blog —

***

[1] “DATA SECURITY PROGRAM: IMPLEMENTATION AND ENFORCEMENT POLICY THROUGH JULY 8, 2025,” Department of Justice (April 11, 2025),

[2] See 50 U.S.C. § 1705; see also Executive Order 14117, “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern” (February 28, 2024),

[3] The White House, “American First Investment Policy,” (February 21, 2025), ; The White House, “Fact Sheet: President Donald J. Trump Restores Maximum Pressure on Iran,” (February 4, 2025),

[4] “DATA SECURITY PROGRAM: COMPLIANCE GUIDE,” Department of Justice (April 11, 2025),

[5] See §§ 202.211(a)(1)-(5)

[6] See § 202.701

[7] See §§ 202.214, 202.258, 202.217, & 202.228

[8] See § 202.222(a)(1)

[9] See § 202.222(b)

[10] See § 202.206

[11] See § 202.249

[12] See §§ 202.301-303

[13] See § 202.401

[14] See §§ 202.501-511

[15] See § 202.801

[16] See § 202.802

[17] See § 202.901

[18] See § 202.1301; see also 50 U.S.C. § 1705

Our previous article on What Every Multinational Company Should Know About … Customs Enforcement and False Claims Act Risks (Part I) outlined how import-related risks have substantially increased given the combination of the new high-tariff environment, the heightened ability of Customs (and the general public) to data mine import-related data, and the Department of Justice’s (DOJ) stated focus on using the False Claims Act (FCA). In Part II, we laid out how to prepare for the most common False Claims Act (FCA) risks arising from submitting false Form 7501 entry summary information. We now complete the series on “Customs Enforcement and False Claims Act Risks” with Part III, which focuses on preparing for the most common FCA risks arising from improper management of import operations.

Risks Arising from Knowing Failures to Correct Errors

If importers discover a systematic error, the position of Customs is clear: The importer is under an obligation not only to correct the error for future entries but also to use measures like post-summary corrections to update prior entries. This is demonstrated by a DOJ settlement in which an importer paid to settle allegations that it “made no effort to right its wrongs even after acknowledging internally that it had underpaid millions of dollars of duties owed.” This type of knowing error is exactly the type of conduct that can expose importers to reverse FCA liability.

Customs Compliance Response

• Apply Current Knowledge to Unliquidated Entries. Because liquidation takes (approximately) 314 days after entry, Customs grants a 300-day to correct most entry-related information. If you discover an error, Customs requires not only that the error be corrected going forward but also that any non-liquidated entries be corrected as well.

• Consider Making a Voluntary Prior Disclosure. If an importer initiates a voluntary disclosure before Customs begins its own investigation, then Customs may not pursue penalties, assuming the voluntary disclosure is full and accurate, and the importer pays back any tariffs and interest due. This is an especially important advantage for the new Trump tariffs, since many of them direct that Customs should impose maximum penalties for failure to pay all of the new tariffs, without taking into account traditional Customs mitigating factors. Filing a voluntary self-disclosure before Customs initiates an administrative investigation avoids any Customs administrative penalties (provided the importer follows through with a thorough and accurate disclosure). While a self-disclosure is not a free pass to avoid FCA liability, it can reduce the multiplier and penalties assessed in settlement negotiations.

Risks from Failing to Follow Form 28 and 29 Corrections for Prior Entries

Customs commonly issues Form 28 Requests for Information and Form 29 Notices of Action that target a handful of entries (or even a single entry) where it has questions about the accuracy of submitted entry information. If this results in Customs issuing a correction, then the importer is required to correct not only the entry but also any other entries covered by the reasoning. Failure to do so was one of the key elements of the $22.8 million settlement noted above, where DOJ emphasized that although the importer had received Form 29 Notices of Action, it took to correct its ongoing entries (and never corrected prior entries).

Customs Compliance Response

• Set Up ACE Notifications. Importers should set themselves up with ACE access so that they directly are receiving copies of Form 28 Requests for Information, Form 29 Notices of Action, and other communications from Customs rather than relying on customs brokers to provide such information. This will ensure that the importer is aware of all potential corrections to its Form 7501 Entry Summary information and can timely respond to any Customs inquiries.

• Follow Through on Implementing Conforming Changes. When Customs issues a correction to a single entry or set of entries, the importer is required to identify all analogous entries and correct them for any unliquidated entries, because they are not final. Customs also has the authority to open an inquiry into liquidated entries under Section 1592 if the importer does not file a voluntary disclosure.

Risks Arising from Failure to Notice Red Flags from Suppliers

Under Customs regulations, the importer of record has the sole responsibility to pay all tariffs due. There is, however, no such restriction under the FCA, which means that multinationals that receive imported goods from suppliers can still be liable for FCA claims. For example, an importer of garments from China paid to settle allegations that it “repeatedly ignored warning signs that its business partner, which imported garments from China, was engaged in a scheme to underpay customs duties owed on the imported garments it sold to” the importer. Thus, even though the customer was not the importer of record, it settled on the basis it had accepted “responsibility for its failure to take action in response to multiple warning signs that [the importers of record] were undervaluing their imported goods and therefore paying less in import duties than they should have been paying.”

Moreover, in 2016, both the importer and manufacturer of clothing goods agreed to pay to settle claims that they conspired to underpay customs duties using invoices that misrepresented the value of the goods at issue. That same year, a U.S. defense contractor agreed to pay to settle allegations that it used Chinese-imported ultrafine magnesium in flares manufactured and sold to the U.S. Army, in violation of its contract with the military. Though it was the importer who allegedly misrepresented the country of origin, DOJ alleged that the contractor conspired with the importer to sell the nonconforming goods to the government.

Customs Compliance Response

• Monitor Business Partners for Red Flags. In a high-tariff environment, there are more incentives than ever for importers to take steps to try to minimize their tariff liabilities. Educate personnel in Procurement, Accounting, and other relevant areas of the company to be alert to potential underpayments by suppliers, which also is useful for situations where business partners might provide incorrect information where your company acts as the importer of record. Simply put, know your business partners well.

Risks Arising From Avoiding Customs Penalties

In general, any situation in which an importer takes steps to avoid Customs penalties can lead to a potential FCA penalty. Examples include failing to mark the country of origin (10% Customs penalty), providing false or misleading information on entry documents (as we covered in Part II), failing to maintain required records, or noncompliance with forced labor regulations. By way of example, the Third Circuit found that failure to notify Customs of marking violations can support an FCA allegation. 839 F.3d 242 (3rd Cir. 2016), cert. denied, 138 S.Ct. 107 (2017). Illustrating this risk, an importer paid to settle allegations that it had failed to mark imported pharmaceutical products with the appropriate COO and thus violated the FCA by “knowingly avoiding the marking duties owed to the United States for those imports.”

Another example includes a DOJ settlement in which an importer agreed to settle allegations that it falsely labeled tools it imported as “made in Germany” when the tools were, in fact, made in China. According to DOJ, if the products had been described as Chinese products, the importer would have been required to pay a 25% tariff on the goods. Thus, by allegedly falsely describing the tools as “German,” the importer avoided paying these tariffs.

Customs Compliance Response

• Confirm Consistent Marking. Ensure the COO for marking decisions is made in accordance with the correct legal regime, by following the rules of free trade agreements like the USMCA (even in situations where special tariffs may require the use of substantial transformation principles for determining the amount of other tariffs due). Ensure marking is made either directly on the product or, where allowed, on a relevant container or other acceptable fashion to ensure it remains intact for the ultimate purchaser.

• Maintain Required Records. Customs regulations require that, subject to certain exceptions, records must be kept for five years from the date of the activity which required creation of the record. Importers should ensure that they are complying with Customs recordkeeping requirements and that their employees are familiar with recordkeeping requirements. The FCA also requires that documents supporting claims — and the claims documentation itself — be true and accurate.

• Conduct a Supply Chain Integrity Check and Continuous Monitoring. Complying with labor and transparency requirements is integral to tariff management. Importers should know every step in their supply chains and conduct integrity checks or audits of their suppliers. This can help ensure your company stays informed of new developments to comply with laws — especially in the areas of forced labor, human trafficking, environmental regulations, and modern slavery — and thus avoid potential FCA liability pertaining to these types of regulations. Importers also should implement systems to regularly monitor their suppliers’ performance and compliance, and continuously evaluate their supply chain for new potential risks that might arise. For further guidance on how to best monitor your supply chain, check out our white paper on Managing Supply Chain Integrity Risks.

Between the new Trump tariffs, increased Customs attention to tariff underpayments, newly announced DOJ emphasis on tariff payments, and the greater visibility of Customs into importing data, the potential for Customs FCA actions is greater than ever. As demonstrated throughout this three-part series, DOJ has a rich history of using a wide variety of issues to support FCA actions. DOJ’s announced attention to concentrate on Customs compliance and the full payment of tariffs means that future customs-related FCA cases will build on a foundation of existing cases. These previous cases have already given DOJ and whistleblowers the chance to test out a multitude of the factual and legal theories discussed throughout this series, with both DOJ and relators likely to be incentivized by the potential for significantly higher recoveries and the apparent increased enforcement flexibility resulting from the new tariff regime.

Thus, under the Trump administration’s trade agenda, multinationals should expect heightened scrutiny of imports and DOJ’s increased use of the FCA to bring customs-related actions. It is therefore more critical than ever for importers to assess and revamp their Customs compliance programs to address these new risks. Proactively addressing compliance issues, strengthening internal controls, and documenting decision-making processes can reduce exposure and better position multinationals to respond effectively if Customs scrutiny arises. In an environment with increased potential for enforcement and where corresponding penalties are steep, early preparation is both a risk management strategy and a competitive advantage.

If you would like further information about managing Customs and international trade risks, we recommend our white paper on Managing Import and Tariff Risks During a Trade War.

***

The �鶹��ý International Government Enforcement Defense & Investigations Team is monitoring all tariff-related developments, including any modifications, clarifications/guidance, or additional measures introduced by the Trump administration, which we are posting as they occur on our Tariff & International Trade Resources blog. As new information becomes available, we will provide updates and analysis to help importers navigate the evolving international trade paradigm, including for new tariffs.

Our white paper on “Managing Import and Tariff Risks During a Trade War” outlines a 12-step plan to provide practical steps to help importers navigate the tariff and international trade risks in the current tariff and trade environment, while the companion white paper on “Managing Supply Chain Integrity Risks” provides practical advice to deal with heightened supply chain risks pertaining to goods imported into the United States, including the increasing use of detentions by Customs.

If you have questions about this post, please feel free to reach out to any of the authors or your �鶹��ý & Lardner attorney. If you would like to see future updates regarding “What Every Multinational Company Needs to Know” about operating in today’s complicated international trade world, please sign up for our Tariff & International Trade blog —

The U.S. government has increasingly emphasized the importance of supply chain integrity, particularly in relation to eliminating forced labor. U.S. policymakers are actively passing legislation, including the Uyghur Forced Labor Prevention Act (UFLPA), which targets goods sourced from the Xinjiang Uyghur Autonomous Region (XUAR) in China or that use parts and components from that region. Automotive companies must understand these new expectations and be prepared for the developing regulatory landscape aimed at curbing labor exploitation in the supply chain.

The UFLPA is designed to safeguard supply chains from exploitative practices relating to forced labor in the XUAR by creating a presumption that any goods from the XUAR are the product of forced labor practices unless the importer can demonstrate otherwise. Further, UFLPA came about in an era of generally increased attention to forced labor and human trafficking issues. For example, the Office of Foreign Assets Control (OFAC) has brought enforcement actions against companies sourcing from sanctioned countries with poor labor practices, like North Korea. Customs and Border Protection (CBP) also has sharply increased the frequency with which it detains goods suspected to be made with forced labor.

These developments particularly impact the automotive industry, which relies on complex, global supply networks. As the U.S. Senate Finance Committee concluded in its May 2024 investigation report, “Insufficient Diligence: Car Makers Complicit with CCP Forced Labor,” many major automakers have failed to adequately vet their supply chains for Chinese components made with forced labor.[1] This finding prompted Finance Committee Chair Ron Wyden to declare that “automakers’ self-policing is clearly not doing the job” and urge the CBP to “supercharge enforcement and crack down on companies that fuel the shameful use of forced labor in China.”[2] Further, because the focus on supply chain integrity (particularly as it relates to China) is a bipartisan concern, these concerns will continue into the new administration.

CBP appears to be listening. In July and August 2024 alone, the CBP seized more than 120 shipments, worth roughly $18 million, related to the automotive and aerospace industries for potentially violating the UFLPA.[3] The message from the U.S. government is simple: automakers that source from abroad need to take full responsibility for ethical sourcing throughout their supply chains. Further, with all imported goods subject to the scrutiny of CBP—which now has enhanced enforcement resources to find, detain, and reject noncompliant goods—automakers must understand the new enforcement paradigm and fully comprehend their products’ supply chains, right down to the last sub-supplier.

A well-designed supply chain integrity program will address all elements of supply chain risk, including forced labor, human trafficking, UFLPA, transparency, conflict minerals, sanctioned countries, and other supply chain integrity regulations. Regulators expect that automakers will: (i) conduct systematic, regular due diligence; (ii) adopt appropriate risk-based compliance measures and internal controls; (iii) reinforce these compliance requirements and internal controls through regular training; and (iv) proactively gather and maintain information demonstrating compliance with forced labor regulations.

To aid automotive companies in complying with these new expectations, we have created a six-step program for managing supply chain integrity risk. While the steps that make sense for any given importer will vary, companies across the automotive industry should consider the following fundamental compliance and due diligence items:

Step 1: Map Your Supply Chain

Map out your supply chain, including sub-suppliers (and their sub-suppliers), to ensure that you have identified risk points relating to potential sourcing from the XUAR, the use of forced labor, or human trafficking. The review should cover the imported goods origin and any raw materials or components used to manufacture the goods.

When mapping your supply chain, you should identify the identities and locations of suppliers, their sub-suppliers, and their business relationships. You also should identify transactions among entities along the supply chain tied to the specific imported goods.

Use publicly available resources to estimate the probability that raw materials or components originated in the XUAR or that indicate a likelihood that a supplier is using forced labor.

Be cognizant of warning signs that could indicate the use of unauthorized sub-suppliers, such as raw material sourcing, components not from the stated location, or inputs from countries known to lack production capacity.

Ensure that suppliers regularly update you whenever they onboard a new sub-supplier so that you can keep your supply chain map current.

Step 2: Conduct Due Diligence on Key Suppliers

Due diligence is a key component of supply chain compliance. Your supply-chain due diligence strategy should include detailed descriptions of the supply chains for imported goods and their components, including ties to the supply chain maps.

Due diligence should include evidence identifying: (i) how the imported goods were made from raw materials to finished goods; (ii) what entities manufactured the goods and where, including all in-house manufacturing, sub-assembly, and outsourced production operations; (iii) the roles of the entities involved at each stage of the supply chain; and (iv) the relationship between the entities, including whether a supplier also is a manufacturer.

Conduct due diligence for goods originating in China or that rely on Chinese parts and components, which are at higher risk, to verify that there are no links to the XUAR, companies on the UFLPA Entity List, or other forced labor practices associated with the XUAR.

Although CBP primarily detains products under the UFLPA, due diligence should also focus on general indicators of forced labor—including intimidation and threats, movement restriction, isolation, abusive living and/or working conditions, and excessive hours—to ensure that they do not exist or are fully remediated. Such evidence for your due diligence may include:

• The aforementioned supply chain map.
• Information relating to hours worked.
• Information demonstrating how each supplier and sub-supplier pays wages and to whom.
• Information confirming workers’ residency statuses and whether they are from the XUAR.
• Information demonstrating that production of the goods is consistent with the documented workers, including their numbers, materials produced, and output.
• Information showing the supplier and sub-suppliers have controls in place to ensure all workers are recruited voluntarily.
• Information demonstrating that every worker from the XUAR is working voluntarily. This can include evidence that each worker was:
  • Working without coercion.
  • Recruited to work voluntarily.
  • Recruited free of any forced labor indicators, including threatened or actual detention of themselves or their loved ones or forced transfers of land to the government.
  • Transported from the XUAR and transferred to the entity voluntarily and without any forced labor indicators, including government surveillance or movement control.
  • Living and working in conditions free of any forced labor indicators, including government surveillance, government reporting, movement restrictions, or mandatory indoctrination activities such as political, language, or cultural classes.

Step 3: Ensure Due Diligence and Compliance Extend to Sub-Suppliers

Because sub-supplier activity can expose automakers to liability under the UFLPA and other forced labor regulations, it is essential to identify the origins of every component within your products’ supply chains.

Supply-chain mapping should include everything up to the last sub-supplier. This requires working with suppliers to identify sub-suppliers who might not be known to your company.

When possible, use unique identifiers to track raw materials and other inputs through the supply chain. This may require using tracking methodologies to deal with potentially comingled inputs from different suppliers.

Step 4: Develop Legal Protections

Proper forced labor and UFLPA risk management requires a layered approach to compliance. Developing appropriate legal protection is one of the critical layers.

A key first step to establishing adequate legal protection is developing a vendor code of conduct that lays out the legal obligations governing the supplier relationships and requires compliance with all ethical sourcing contractual provisions. You should incorporate the code of conduct into all supplier contracts, whether through explicit contractual provisions or by reference.

The code of conduct should (i) require suppliers to comply with forced labor and UFLPA regulations, (ii) require suppliers to grant auditors and verification organizations necessary access to facilities, (iii) prohibit suppliers from working with any companies on the UFLPA Entity List, and (iv) address the risk of using government labor schemes, such as pairing assistance, poverty alleviation, or other labor transfer programs that involve potential violations of the ULFPA.

Your agreements with suppliers should require that they flow down all forced labor, human trafficking, and UFLPA compliance requirements to their sub-suppliers. The flow-down requirements should mirror the strength of your own code of conduct and should require that your direct supplier (i) ensure that sub-suppliers train employees on detecting forced labor, (ii) conduct self-audits or obtain independent audits (including regarding recruitment of workers and use of government labor programs), (iii) track and report on their performance of these compliance requirements, and (iv) require and monitor subcontractor adherence to the code of conduct.

Step 5: Communicate and Train Across the Supply Chain

Communicate the applicable legal and contractual requirements to suppliers at all tiers of the supply chain.

Provide training to all key suppliers—and sub-suppliers—regarding forced labor, human trafficking, and UFLPA issues or require such training from your own suppliers.

Provide training to employees or agents responsible for selecting suppliers on (i) conducting forced labor/UFLPA risk assessments, (ii) legal restrictions and consequences of importing goods produced with forced labor into the U.S., (iii) the presumption that goods made in the XUAR or by Entity List companies are made using forced labor, (iv) the risks posed by products that incorporate goods using forced or UFLPA labor, (v) the risks of suppliers being included on future additions to the UFLPA Entity List, and (vi) the requirements of the company’s code of conduct.

Step 6: Monitor Compliance & Remediate Compliance Missteps

Monitor supplier compliance with the code of conduct and all legal and contractual provisions requiring supply chain compliance.

Remediate any forced labor conditions or UFLPA violations and terminate the supplier relationship if remediation is not possible or is untimely.

If indicators signifying the presence of forced labor in the supply chain or violations of the UFLPA are identified in a supplier, stop importing impacted goods before remediation. If you intend to continue sourcing inputs from the supplier, you must develop a corrective action plan that specifically addresses all indicators of forced labor or the UFLPA concerns. Consider using, on a risk-adjusted basis, independent third-party verification regarding the effectiveness of an importer’s due diligence system.

* * * * *

The consequences for automakers importing vehicles or components tainted by forced labor or human trafficking, or that violate the UFLPA, can be severe. Companies can have their goods detained at the border, experience production shutdowns due to missing critical components, incur large penalties, suffer reputational damage, and even lose or limit their ability to import products. Accordingly, paying attention to supply chain risks is essential to a company’s regulatory risk management. By working through the six compliance and due diligence steps outlined above, automakers can identify potential risk points, mitigate supply chain integrity risks, and be prepared for any governmental inquiries.  It is only by taking full responsibility of the entire supply chain—right down to the last sub-supplier—that importers can ensure the integrity and smooth functioning of their critical supply chains.

Subscribe to the 2024 Auto Trends Series

For a recap of the past year’s developments and discussion of ongoing trends, we invite you to subscribe to this 2024 Auto Trends Series by clicking .

---

[1] See U.S. Senate Committee on Finance, “Automakers Shipped Cars and Parts Made by Chinese Company Banned for Forced Labor to the United States; Car Companies Are Failing to Police Their Supply Chains For Chinese Components Made with Forced Labor, Finance Committee Majority Staff Investigation Finds,” (May 20, 2024); available .

[2] Id.

[3] See U.S. Customs & Border Protection, “Uyghur Forced Labor Prevention Act Statistics;” available at .

In 2022, �鶹��ý’s International Government Enforcement Defense & Investigations Team produced a set of interactive international compliance and risk-mitigation heat maps, designed to provide an at-a-glance resource for identifying countries around the world that pose potential issues for multinational companies that conduct business in, trade with, or source materials from them. These maps present quick visual indications of relative bribery, sanctions, and human rights compliance risks in every country around the globe.

We have periodically updated these maps since 2022, but we have now conducted a thorough audit of our risk ratings and have fully updated the maps, which are now available below.

Bribery/Corruption Risk Heat Map

This map reflects �鶹��ý’s assessment of bribery and corruption risk presented by conducting business in various countries around the world. Countries in maroon are viewed as highest risk; countries in red as high risk; countries in orange as medium/high risk; countries in yellow as medium risk; countries in light blue as low risk; and countries in dark blue as lowest risk. Companies should tailor their compliance programs and control procedures based in part on the perceived risk of bribery and corruption presented in their respective countries of operation, taking into consideration the types of business activities occurring in those countries and the degree of interaction with government officials.

Contacts: David Simon, Olivia Singelmann, John Turlais, and Nick Covek

U.S. Sanctions Risk Heat Map

This map reflects �鶹��ý’s assessment of U.S. economic sanctions risk presented by conducting business in various countries around the word. Countries in maroon are comprehensively sanctioned, and potential transactions involving these countries should not proceed without thorough legal review and authorization given the extremely high risk of violating U.S. sanctions; countries in red are deemed high risk due to significant list-based sanctions; countries in orange present moderate risk due to some list-based sanctions, coupled with a relatively high diversion risk; countries in yellow are subject to limited list-based sanctions but present some risk due to a moderate diversion risk; and countries in blue are not sanctioned and present a low diversion risk. Companies should implement screening procedures of relevant parties that take into consideration the countries associated with the transaction and with the relevant parties.

Contacts: Gregory Husisian and John Turlais

Forced Labor/Child Labor Risk Heat Map

This map reflects �鶹��ý’s assessment of the pervasiveness of child/forced labor used to produce goods in various countries around the world. Countries in maroon are perceived as having the highest incident rates of products made using child/forced labor; countries in red have high incident rates; countries in orange have medium/high incident rates; countries in yellow have medium incident rates; countries in light blue have low incident rates; and countries in dark blue have the lowest incident rates. Companies should tailor their supply-chain due diligence and monitoring procedures to account for the pervasiveness of child/forced labor in the countries from which they source raw materials and other goods.

Contacts: David Simon, John Turlais, and Nick Covek

If you have questions or concerns concerning this article, please feel free to reach out to any of the authors or your �鶹��ý & Lardner attorney. for our email list to receive future biweekly emails and practical international regulatory compliance tips.

In Part I and Part II of “What Every Multinational Company Needs to Know About … The Uyghur Forced Labor Prevention Act” (UFLPA), we summarized the UFLPA requirements and UFLPA compliance best practices. In this third and final UFLPA post, we provide guidance regarding steps that importers can take if they find that their goods have been detained by U.S. Customs and Border Protection (CBP) for UFLPA concerns and now must go through a UFLPA admissibility review.

As outlined in our first UFLPA update, CBP has provided detailed guidance to the importing community. The new CBP guidance materials signal that (1) CBP is putting significant emphasis on UFLPA enforcement, (2) CBP is looking to help the trade community submit uniform submissions to help CBP quickly finish each investigation, and (3) CBP has no plans to ease enforcement, particularly against sectors that already are receiving high priority. Further, with CBP recently designating new high-priority sectors (PVC and aluminum, on top of already-identified imports of cotton, polysilicon, and tomatoes), it is apparent that CBP will likely be enhancing its enforcement efforts.

Companies that frequently import from Southeast Asia, or that otherwise have imports at a high risk for detention on forced labor, human trafficking, or UFLPA grounds, accordingly should be maintaining information to support the clearance of such goods even before importation. This is especially true for items where a heightened risk of a detention under the UFLPA is concerned.

For these goods, an action plan of response includes the following:

Step 1: Identify Potential UFLPA Issues

One frustration that importers have under the UFLPA is that CBP will not provide the importer with the reason for any given detention. While some detentions may be obvious, such as attempted imports of products made by companies on the UFLPA Entity List, products that are made from non-identified companies with suspected supply chain exposure to the XUAR may not be so obvious. It appears, however, that CBP is targeting imports based mostly on public, open-source information as well as its prior enforcement activity. Thus, research into publicly available sources often is required to determine why a given set of entries is detained, which puts a premium on companies carefully monitoring reports occasionally released by the media, non-governmental organizations, and academic organizations that are focused on forced labor, human trafficking, and the use of labor from the XUAR.

Another useful tool that can help guide due diligence is the , which contains detailed statistics on enforcement. The dashboard provides UFLPA enforcement statistics that can be filtered by dollar value, country of origin, commodity, and the timing of detention. The UFLPA Dashboard currently shows that there have been over 5,500 total detentions, at a value approaching $2 billion, primarily in the electronics, apparel, industrial and manufacturing materials, agricultural, consumer products, pharmaceuticals, base metals, machinery, and automotive and aerospace sectors. Among other surprising facts that would not be immediately relevant, the Dashboard shows that China is not the most common source of detentions — that position belongs to Malaysia, with Vietnam, China, Thailand, and Mexico rounding out the list. The presence of these other countries shows the key role that Chinese-origin components often play as inputs. The fact that most of the detained shipments are from countries other than China shows that importers should not limit their UFLPA risk assessment to suppliers located in just that country. This is consistent with the CBP Best Practices document, which stated that importers should identify “manufacturers in regions and third world countries with a high risk of XUAR inputs.”

Step 2: Promptly Respond to a UFLPA Notice from CBP

• Immediately contact the CBP point of contact listed on the detention notice to establish contact and to begin a dialogue to address all CBP concerns.
• CBP will give the importer 30 days to export the goods or submit documentation to dispute the detention. This is a serious deadline, and you need to comply with it. If you need an extension, CBP will work with you provided that you request it in advance of the due date.
• If your company is a Customs-Trade Partnership Against Terrorism (CTPAT) partner, your admissibility packages will be prioritized for review by the appropriate Center for Excellence and Expertise.

Step 3: Prepare a UFLPA Response Package

Although CBP has stated that it will not provide an authoritative list of documentation and information needed to clear a shipment under the UFLPA (favoring instead a review that examines the “totality of information”), its new guidelines for admissibility packages provide useful starting points for putting together responses to UFLPA detention notices. Following these guidelines is important because it streamlines review. CBP estimates that an admissibility review can take two-to-three weeks, but providing information that is incomplete or poorly organized can extend this timeline as importers engage in extended back-and-forth and collection of additional traceability documentation to allow CBP to clear a given shipment.

In preparing your response packet, you should ensure the documentation is complete, accurate, and that English translations are available for ready comprehension by CBP. If the submission is a follow-up to a previously reviewed supply chain for which the goods were deemed admissible, you should provide a copy of the previous clearance and clearly lay out the similarities with the current admissibility review. This can most easily be done by providing a summary report that includes the previous entry packet and a showing that the suppliers/producers at all stages of production and relevant commercial records support the same conclusion for the current shipment.

It is common for CBP to have follow-up questions. If so, you should provide the requested additional information promptly to avoid significant delays.

The task of putting together a UFLPA response was considerably aided by �����’s publication of a model for a UFLPA Applicability Review Submission. You should provide information that follows this model, supplementing it where needed with information that is tailored to your particular proof. You also should uniformly follow the suggestion that each submission should include an Executive Summary summarizing the documentation. The easier the submission is to follow, the quicker the potential release time by CBP.

To expand on the suggested UFLPA Table of Contents, you should consider providing detailed information regarding the following topics:

Evidence Pertaining to Overall Supply Chain

• A detailed description of the supply chain, including ties to the imported merchandise and components thereof, including all stages of mining, production, and manufacture. If you previously have prepared a supply chain map, this will allow you to put the information together quickly and easily.
• A list of suppliers and sub-suppliers associated with each step of the production process, including names and contact information.
• The roles of the entities in the supply chain, including manufacturers, shippers, and exporters as well as any related persons.
• Affidavits from each entity involved in the production process.
• Items relating to the shipments that tie to the entries, such as purchase orders, packing lists, and shipping records (manifests and bills of lading).
• Invoices and receipts for all suppliers and sub-suppliers.
• Bills of materials and certificates of origin.
• Payment records.
• Buyer and seller inventory records, including dock/warehouse receipts.
• Any other relevant import/export records.

Information on Supply Chain Management Measures

This may include internal controls to prevent or mitigate forced labor risk and any remediation steps used regarding any use of forced labor identified in the mining, production, or manufacture of imported goods. You should include copies of all of your compliance documents, such as your vendor code of conduct and other information relating to compliance with forced labor, human trafficking, and UFLPA compliance. This also would include copies of any UFLPA audits done in the recent past relating to the suppliers/sub-suppliers at issue.

Evidence Pertaining to Miner, Producer, or Manufacturer

• The evidence listed above pertaining to merchandise or components for raw materials applies equally to mined, produced, or manufactured goods. Any production records that will help CBP understand the labor situation, in particular, are often helpful in clearing goods. These can include mining, production, or manufacturing records to allow CBP to trace raw materials to merchandise mined, produced, or manufactured; production orders; and reports regarding factory production capacity for the merchandise.
• Evidence that the volume of inputs of component materials matches the volume of output for the merchandise produced, to show the claimed supplier is in a position to actually have produced the merchandise.
• Reports on factory site visits by the importer, evidence of audits or compliance checks, or a downstream supplier sourcing from the factory or a third party.
• Any other relevant evidence to demonstrate that a good was not mined, produced, or manufactured with forced labor.

In addition, the CBP UFLPA Guidance contains suggested documents for high-risk goods that are under special scrutiny, which currently includes cotton, tomatoes, polysilicon, PVC, and aluminum. These high-risk commodities are treated as high-risk commodities with enhanced risks that they are from the XUAR or used XUAR-related labor in their production. Recommended information for these items includes:

• A supply chain map identifying all entities involved in the production of the goods relating to the entry.
• Information on workers at each entity involved in the production of the goods in China, such as wage payment and production output per worker. If the goods are coming from other countries, they can still implicate the UFLPA if they include parts and components, so you may need to work back through multiple supply chain areas.
• Information that there is no connection to the XUAR or to persons from the XUAR region, or that any such connection or persons are compatible with the UFLPA requirements.
• Information on worker recruitment and internal controls to ensure all workers in China were recruited and are working voluntarily.
• Credible audits and compliance check-ups to identify forced labor indicators and proof that any issues were remediated prior to shipment of the goods at issue.

A final issue that can come up is business proprietary information held by other companies. For example, sometimes information required to clear a shipment is held by suppliers. CBP indicates in its FAQs that, where necessary, suppliers can submit materials directly to CBP if they have concerns about business confidentiality. This position reinforces that CBP is willing to be flexible and to work with importers to clear shipments where it can be shown that there is no link to the XUAR.

Step 4: Prepare for Future Admissibility Reviews

Notably CBP indicated it will continue to detain shipments of goods made by manufacturers with “known or suspected ties to the XUAR,” even if CBP has vetted and released shipments from the same supply chain. According to CBP, while importers can use prior reviews to streamline admissibility reviews, it will continue to conduct admissibility reviews for such goods until CBP has confirmed that the supply chain relationships linked to the XUAR are no longer present.

Needless to say, repeated admissibility reviews involving the same or similar merchandise can become more problematic for frequent importers, particularly if they rely on just-in-time manufacturing or have limited inventories. Fortunately, importers can rely upon, and direct CBP toward, prior clearance of similar goods/supply chains. In addition, some importers are finding they can work pro-actively with Customs, providing supply chain and UFLPA admissibility review information to CBP before the goods arrive and are flagged by Customs, potentially as soon as the goods leave the foreign port. This mechanism can considerably shorten the time to finish the admissibility review, ensuring the goods do not sit at the arrival port for long.

*           *           *

There is no one solution for UFLPA (or forced labor/human trafficking) compliance. Minimizing risk requires a layered approach that encompasses legal and contractual protections, due diligence, compliance policies and internal controls, awareness of  and following up on red flags, and compliance audits. If you need to follow up on any of these topics, please contact the authors or your �鶹��ý relationship attorney for more information.

If you would like to see future updates regarding “What Every Multinational Company Needs to Know” about operating in today’s complicated international trade world, please sign up for our biweekly email list. .

In our previous biweekly update, What Every Multinational Needs to Know About … The Uyghur Forced Labor Prevention Act, Part I, we summarized the UFLPA requirements and the basic expectations that U.S. Customs and Border Protection (CBP) has set forth for importers that are potentially impacted by the Act. In this post, we provide a detailed set of model UFLPA due diligence and risk-management strategies for importers at risk of UFLPA detentions. Although these suggested compliance steps are aimed primarily at minimizing the risk of UFLPA detentions, many of these steps also are useful for minimizing the risk of forced labor and human trafficking violations, which also require intimate knowledge of your supply chain, right down to the last sub-supplier. A well-designed supply chain integrity program will address all elements of supply chain risk, including forced labor, human trafficking, UFLPA, supply chain transparency requirements, conflict minerals, and other potentially applicable regulatory risks.

The following compliance steps will vary for each importer, based on its own, unique risk profile. Nonetheless, the key general compliance and due diligence items to consider include the following steps to consider for importers who are at heightened risk of UFLPA detentions.

Step 1: Map Your Supply Chain

• You should map out your supply chain, including sub-suppliers (and their sub-suppliers), to ensure that you have identified potential risk points relating to potential sourcing from the Xianjiang Uyghur Autonomous Region (XUAR). The review should cover the origin of the imported goods and any raw materials or components in the imported goods. Items to consider in your mapping exercise include:
  • Identifying transactions among entities along the supply chain tied to the specific imported goods.
  • Identifying locations and identities of entities in the supply chain, their sub-suppliers, and their business relationships.
• You should use publicly available resources to estimate the probability that raw materials or components originated in the XUAR.
• You should be alert to red flags that could indicate the use of unauthorized sub-suppliers, such as the sourcing of raw materials or components that do not originate from the stated location or inputs from countries that are known to lack production capacity.

Step 2: Conduct Due Diligence on Key Suppliers

• Due diligence is a key component of UFLPA compliance. Key items to consider in your UFLPA due diligence strategy include a detailed description of the supply chain for the imported good and its components, including ties to the supply chain map.
• Due diligence should include documentation regarding how: (1) the imported good was made from raw materials to finished good; (2) by what entities (and where), including all in-house manufacturing, sub-assembly operations, and outsourced production related to the imported good; (3) the roles of the entities involved at each stage of the supply chain; and (4) the relationship between the entities, including whether a supplier also is a manufacturer.
• For goods originating in China or that rely on Chinese parts and components, which are at higher risk, there should be due diligence conducted to show there are no links to the XUAR, to companies on the UFLPA Entity List, or other links to the use of labor linked to the XUAR.
• Because UFLPA compliance is related to general forced labor and human trafficking concerns, due diligence also should focus on general indicators of forced labor, including intimidation and threats, abuse or vulnerability, restriction of movement, isolation, substandard living and/or working conditions, and excessive hours. Evidence may include the following:
  • The previously mentioned supply chain map.
  • Evidence to demonstrate how and to whom wages are paid at each supplier and sub-supplier.
  • Evidence regarding whether the worker comes from the XUAR and the worker’s residency status.
  • Evidence to demonstrate that production of the goods is consistent with the documented workers, including their number, the total materials produced, and the total volume of output.
  • Information relating to hours worked and the output of the relevant goods.
• Evidence that none of the workers was recruited, transported, transferred, harbored, or received with the involvement of the Chinese government, XPCC, or entities on the UFLPA Entity List.
• Information showing the supplier and sub-suppliers have controls in place to ensure all workers are voluntarily recruited.
• Evidence demonstrating that any worker from the XUAR is working voluntarily and without threat of penalty, including credible evidence that each worker:
  • Was fully voluntarily recruited to work.
  • Was recruited and continued at the job without coercion.
  • Was recruited free of any forced labor indicator, including detention, threats of detention, detention or threats of detention of family members, or forced transfer of land to the government.
  • Was transported from the XUAR voluntarily and free of any forced labor indicator, including government surveillance or control of worker movements.
  • Was transferred to the entity in a voluntary fashion, free of any forced labor indicator, including government surveillance.
  • Was living and working in conditions free of any forced labor indicator, including government surveillance, reporting to the government, restriction of movement, or required indoctrination activities such as political, language, or cultural classes.

Step 3: Ensure Due Diligence and Compliance Extend to Sub-Suppliers

• Because both the UFLPA and forced labor liability under other regulations can arise from activities by sub-suppliers, it is essential to identify the provenance of each component of the imported good.
• Due to this possibility, supply-chain mapping should work through to the last sub-supplier. This requires working with suppliers to identify sub-suppliers who might not be known to your company.
• When possible, you should use unique identifiers to track raw materials and other inputs through the supply chain. This may require the use of tracking methodologies to deal with inputs from different suppliers that might be commingled.

Step 4: Develop Legal Protections

• Appropriate forced labor and UFLPA risk management requires adopting a layered approach to compliance. One of the layers of protection lies in the adoption of appropriate legal protections.
• A key first step is to develop a vendor code of conduct, which lays out the legal obligations that govern the relationship with suppliers as well as the contractual obligations to abide by all ethical sourcing contractual provisions.
• For supply chains that potentially have some kind of link to the XUAR, involve entities that use labor transferred from the XUAR under government labor programs, or source parts and components that may do the same, the code of conduct should specifically address the risk of using such government labor schemes, including pairing assistance, poverty alleviation, or other labor transfer programs that may implicate the ULFPA. The vendor code of conduct should also cover the requirement not to use any companies on the UFLPA Entity List.
• As part of a layered approach to compliance, you should incorporate the code of conduct into all supplier contracts, whether through explicit contractual provisions in long-term agreements and purchase orders or through incorporation of the vendor code of conduct requirements by reference. These provisions should include not only the legal obligation to comply with forced labor and UFLPA regulations but also incorporate such compliance measures as allowing auditors and verification organizations necessary access to facilities.
• Your legal agreement with your suppliers should require that they flow down all forced labor, human trafficking, and UFLPA compliance requirements to all of their suppliers. The flow-down requirements should mirror the strength of your own code of conduct and should require that your direct supplier (1) ensure that sub-suppliers train employees on detecting forced labor, (2) conduct self-audits or obtain independent audits (including regarding recruitment of workers and use of government labor programs), (3) track and report on their performance of these compliance requirements, and (4) require and monitor subcontractor adherence to the code of conduct.

Step 5: Communicate and Train Across the Supply Chain

• You should provide training to employees or agents responsible for selecting suppliers, including regarding (1) the conduct of a forced labor/UFLPA risk assessment, (2) identifying the risks of forced labor identified by risk assessments, (3) the legal restrictions and consequences of importing into the United States goods produced with forced labor, (4) the presumption that goods made in the XUAR or by companies on the Entity List are made using forced labor, (5) the risks posed by products that incorporate goods using forced or UFLPA labor, (6) the risks of suppliers being included on future additions to the UFLPA Entity List, and (7) the requirements of the company’s code of conduct.
• You should communicate the applicable legal and contractual requirements to suppliers at all tiers of the supply chain.
• You should provide training regarding forced labor, human trafficking, and UFLPA issues to all of your key suppliers while also providing such training to sub-suppliers or requiring such training from your own suppliers.

Step 6: Monitor Compliance

• You should monitor supplier compliance with the code of conduct, particularly for those suppliers and subcontractors in the XUAR that source from the XUAR or that are on the UFLPA Entity List.
• You should remediate any forced labor conditions or UFLPA violations and terminate the supplier relationship if remediation is not possible or is not timely completed.

Step 7: Remediate Compliance Missteps

• If indicators signifying the presence of forced labor in the supply chain are identified, or violations of the UFLPA identified, you should cease importing impacted goods prior to remediation. If you intend to continue sourcing inputs from the supplier, you must develop a corrective action plan that specifically addresses all indicators of forced labor or eliminates the UFLPA concerns.
• You should consider using, on a risk-adjusted basis, independent third-party verification regarding the effectiveness of an importer’s due diligence system. Third-party verification also can be helpful in periodically assessing the effectiveness of system components for ensuring that the supply chain is free of forced labor.

Step 8: Be Prepared Before Importation

• You should inform relevant import stakeholders about the importance of due diligence and investigation into potential risky suppliers.
• You should monitor online news sources for possible risks, news, or complaints involving the products or suppliers flagged as high risk.
• You should be ready for a possible CBP detention, including by having all documents for the entire supply chain ready and informing your suppliers of the potential need to quickly respond to CBP inquiries.
• When handling a high-risk import, consider contacting the relevant CBP Center of Excellence and Expertise before the goods arrive at the U.S. port of entry. It is possible to submit a complete documentation package before arrival — and perhaps as early as when the shipment leaves the foreign port — as a means of facilitating �����’s review.

*           *           *

Customs is detaining record amounts of products for UFLPA admissibility review. If you need more information or help regarding setting up a UFLPA or forced labor compliance system, please contact the authors or your �鶹��ý relationship attorney for more information.

If you would like to see future updates regarding “What Every Multinational Company Needs to Know” about operating in today’s complicated international trade world, please sign up for our biweekly email list. .