Enforcement Risk: How U.S. Law Became an Instrument of Geopolitics

Judge’s gavel resting on a world map, representing the global reach of U.S. enforcement risk — U.S. enforcement now reaches companies far beyond U.S. borders. Photo: Envato.

For most of the twentieth century, the instruments of American power that executives worried about were diplomats, aircraft carriers, and trade negotiators. Today the instruments that most often reach a company directly are regulators, prosecutors, and courts. A sanctions designation can cut a firm off from the dollar overnight. An Entity List entry can stop a chip shipment that never touches U.S. soil. A customs detention can strand a container of solar panels at a port for months. Each of these is a legal process. Each is also a move in a strategic contest between states.

This page is the hub for Competitive Futures’ series on enforcement risk. Each of the seven pages below explains one U.S. regime: what it covers, who runs it, how it reaches companies outside the United States, what the major cases teach, and what it means first for companies and second for governments that advise companies operating from their own soil. The pages link every claim to statutes, agency releases, court records, or strong secondary sources. They are general overviews of public law and records, not legal advice; anyone facing a specific question should talk to counsel.

We track how these regimes move, and what the movement means for companies and governments, every quarter in the Systemics Quarterly Brief. The first 2026 edition was titled Enforcement Arrived.

Enforcement risk at a glance

The Enforcement Risk Map: seven U.S. regimes compared by lead agency, what brings a company in, and top exposure — Seven U.S. regimes, compared by who enforces them, what brings a company in, and the top exposure. Chart: Competitive Futures.

Economic sanctions: Treasury’s Office of Foreign Assets Control blocks designated people, companies, and governments and bars most dealings with them. Civil liability is strict. Read U.S. Sanctions Risk: How OFAC Works and What It Means for Companies and Governments.
Export controls: the Commerce Department’s Bureau of Industry and Security controls exports, reexports, and transfers of dual-use goods, software, and technology, including some foreign-made items built with U.S. technology. Read U.S. Export Controls Risk: How the EAR and the Entity List Work and What They Mean for Companies and Governments.
Investment screening: the Committee on Foreign Investment in the United States reviews foreign investment into U.S. businesses and real estate, and Treasury’s outbound rules restrict some U.S. investment into sensitive technologies abroad. Read Investment Screening Risk: How CFIUS and Outbound Rules Work and What They Mean for Companies and Governments.
Foreign agents: the Foreign Agents Registration Act requires people who lobby, advise, or do public relations in the United States for a foreign principal to register and disclose. Read FARA Risk: How the Foreign Agents Registration Act Works and What It Means for Companies and Governments.
Foreign bribery: the Foreign Corrupt Practices Act prohibits bribing foreign officials and requires accurate books for listed companies; the Foreign Extortion Prevention Act reaches the officials who demand bribes. Read Foreign Bribery Risk: How the FCPA and FEPA Work and What They Mean for Companies and Governments.
Forced-labor import bans: Section 307 of the Tariff Act and the Uyghur Forced Labor Prevention Act bar goods made with forced labor from U.S. ports, with a presumption against goods tied to Xinjiang or listed entities. Read Forced Labor Import Ban Risk: How Section 307 and the UFLPA Work and What They Mean for Companies and Governments.
Data security: the Justice Department’s Data Security Program prohibits or restricts transactions that give countries of concern access to bulk sensitive personal data on Americans or to government-related data. Read Data Security Risk: How the Justice Department’s Bulk Data Rule Works and What It Means for Companies and Governments.

Why enforcement became strategy

Our analytical lens at Competitive Futures treats courts, prosecutors, and regulators as primary instruments of geopolitics, with military power often in a supporting role. The reasoning is practical. The United States sits at the center of the systems that global business cannot easily avoid: the dollar and the banks that clear it, the most valuable technology stacks, the largest consumer market, and the capital markets where many foreign companies list. Every one of those dependencies is also a point where U.S. law can attach.

The seven regimes in this series share that design. Sanctions use the dollar and U.S. persons. Export controls use U.S. technology, even inside foreign-made products. Investment screening uses access to U.S. companies and land. FARA uses access to U.S. policymakers and audiences. The FCPA uses U.S. listings, U.S. companies, and conduct on U.S. territory. Forced-labor bans use the U.S. border. The data rule uses Americans’ personal data. In each case, a company outside the United States can be reached because some part of its business runs through something American.

That is why enforcement risk is a strategic intelligence problem, not only a compliance checklist. Compliance asks whether today’s transaction is permitted under today’s rules. Strategy asks which markets, partners, technologies, and supply chains are likely to be pulled into an enforcement regime next year, and what the company will do when that happens.

The seven regimes, briefly

Economic sanctions

Most U.S. sanctions programs rest on the International Emergency Economic Powers Act of 1977. Civil liability is strict, so the government need not prove a company knew it was violating the rules, and the maximum civil penalty is the greater of a set amount or twice the value of the transaction. Non-U.S. companies are most often reached by routing dollar payments through U.S. banks, as in the cases of BNP Paribas in 2014 and Adani Enterprises in 2026. The full page covers the 50 Percent Rule, secondary sanctions, the 10-year statute of limitations, and the EU Blocking Statute: read the sanctions page.

Export controls

The Export Control Reform Act of 2018 is the permanent statute for dual-use items. Its reach abroad comes through U.S.-origin items, de minimis U.S. content, and the foreign direct product rules that follow some foreign-made goods built with U.S. technology. Semiconductors and advanced computing are now at the center of the regime, as the Seagate and Applied Materials penalties show. The full page covers the Entity List, end-use diligence, and allied controls in the Netherlands and Japan: read the export controls page.

Investment screening

CFIUS can review foreign investment in U.S. businesses and in real estate near sensitive sites, require mitigation agreements, and recommend that the President block or unwind a deal. Since January 2, 2025, Treasury’s outbound rules have also restricted some U.S. investment in semiconductors, quantum computing, and artificial intelligence in countries of concern. The full page covers filings, penalties, the Nippon Steel–U.S. Steel review, and allied screening regimes: read the investment screening page.

Foreign agents

FARA dates to 1938 and requires agents of foreign principals who engage in political activities, public relations, or lobbying in the United States to register with the Justice Department. Law firms, public relations agencies, consultants, think tanks, and companies working for state-owned enterprises all have exposure. The full page covers exemptions, enforcement history from Skadden to recent cases, and the foreign-influence registries in Australia, the United Kingdom, and Canada: read the FARA page.

Foreign bribery

The FCPA reaches U.S.-listed companies, U.S. businesses and citizens, and foreign persons acting in U.S. territory, and its accounting provisions reach every issuer. Enforcement priorities shifted in 2025 and 2026, and the Justice Department now emphasizes cartels and transnational criminal organizations, harm to U.S. companies’ competitiveness, and national security. The full page covers intermediaries, self-disclosure, major resolutions from Siemens to Scoular, and the anti-bribery laws of other countries: read the foreign bribery page.

Forced-labor import bans

Section 307 of the Tariff Act of 1930 bars goods made wholly or in part with forced labor, and the Uyghur Forced Labor Prevention Act presumes that goods from Xinjiang or from listed entities are barred unless the importer proves otherwise. Customs and Border Protection enforces shipment by shipment, so the risk sits deep in a company’s supply chain. The full page covers withhold release orders, high-priority sectors, detentions, and the EU and Canadian equivalents: read the forced-labor page.

Data security

The Justice Department’s rule at 28 C.F.R. Part 202, in force since April 8, 2025, prohibits some data transactions with countries of concern and restricts others unless security requirements are met. It treats Americans’ genomic, biometric, location, health, and financial data as national security assets. The full page covers thresholds, covered persons, the TikTok litigation, the connected-vehicle rule, and data-transfer regimes abroad: read the data security page.

What the regimes have in common

Nexus decides exposure. Each regime attaches through a specific connection to the United States. A company that maps its dollar flows, U.S. technology content, U.S. investors and customers, U.S. listings, and U.S. data holdings knows where enforcement can reach it.
Third parties carry the risk to you. Intermediaries, distributors, freight forwarders, sub-suppliers, consultants, and lobbyists appear again and again in the cases. A company answers for the people who act for it.
Lists move faster than contracts. Designation lists, entity lists, and priority-sector lists change by notice, often with immediate effect. A partner that was clean when the contract was signed may not be clean at delivery.
Self-disclosure matters. Most of these regimes reward voluntary disclosure, cooperation, and remediation with lower penalties or declinations, which makes early detection a financial question as well as a legal one.
Allies overlap but do not match. European, British, Canadian, Japanese, and Australian equivalents exist for most of these regimes, but their lists, thresholds, and timelines differ. A company that is compliant in one jurisdiction can be exposed in another.

How to forecast enforcement risk

Enforcement rarely arrives without warning. The signposts are public, and most of them can be watched systematically:

Executive orders, national security memoranda, and agency enforcement guidelines that announce new priorities.
Proposed rules and comment periods in the Federal Register, which often precede final rules by months.
Congressional bills, hearings, and committee reports that signal where Congress wants agencies to go.
Additions to designation lists and entity lists in a company’s sectors, markets, or supply base.
Enforcement actions against peers, which show which conduct the agencies are pursuing now.
Moves by allied governments, which can either align with U.S. measures or open gaps between them.

From those signposts, a company can build scenarios: which of its markets, partners, products, or data flows could be pulled into a regime in the next one to three years, and what it would do in each case. That is the same discipline we apply to strategic foresight and competitive intelligence generally, pointed at the government as one of the most consequential actors in a company’s environment.

For governments advising their companies

Trade ministries, investment agencies, export-promotion bodies, and embassy commercial sections increasingly field one question from their companies: does U.S. law apply to us? The honest answer is often yes, through a specific nexus. Useful briefings are concrete. They identify which U.S. regimes matter for the country’s main export sectors, where the dollar, technology, investment, data, and border nexus points are, where the home country’s own rules and allied regimes diverge from U.S. rules, and how companies can seek licenses, guidance, or home-country authorizations. That service is valuable whatever view a government takes of any particular U.S. policy.

Frequently asked questions

What is enforcement risk?

Enforcement risk is the chance that a government will use legal and regulatory tools, such as sanctions, export controls, investment reviews, prosecutions, or customs detentions, in ways that disrupt a company’s transactions, supply chain, investments, or reputation. This series covers seven U.S. regimes that reach companies inside and outside the United States.

Can U.S. enforcement reach companies outside the United States?

Yes. Each regime attaches through a connection to the United States: dollar payments through U.S. banks, U.S.-origin technology, U.S. persons, U.S. listings, access to U.S. companies or land, the U.S. border, or Americans’ data. The individual pages explain each nexus in detail.

Is enforcement risk a legal question or a strategic one?

Both. Lawyers determine whether a specific transaction is permitted. Strategic intelligence asks which markets, partners, and technologies are likely to be pulled into an enforcement regime next, using public signposts and scenarios, so that a company can adjust before the rules change rather than after.

Which regime matters most for my company?

It depends on the business. Banks and commodity traders usually start with sanctions; technology and industrial companies with export controls; investors with CFIUS and outbound rules; consumer goods and solar companies with forced-labor bans; companies holding personal data with the data rule; and firms that lobby or advise foreign governments with FARA. Most multinationals face several at once.

Do other countries have similar regimes?

Yes. The European Union, the United Kingdom, Canada, Japan, Australia, and others run their own sanctions, export controls, investment screening, foreign-influence registries, anti-bribery laws, forced-labor measures, and data-transfer rules. Each page in this series compares the U.S. regime with its main allied counterparts.

Official sources

Each regime’s administering agency publishes its rules, lists, guidance, and enforcement actions: