Stacy Mitchell, Author at Gibson Dunn

The rule change is intended to bring greater transparency and predictability to the Second Request modification process during premerger review.

On September 24, 2026, the Federal Trade Commission published a final rule in the Federal Register amending its Rules of Practice to clarify the procedures governing modifications to Second Requests during premerger review. The amended rule, which took effect immediately upon publication, enumerates specific factors that FTC Staff may consider when determining whether to modify a Second Request. The rule change is intended to bring greater transparency and predictability to the Second Request modification process.

Background: The Second Request Process

Transactions subject to reporting under the Hart-Scott-Rodino (HSR) Antitrust Improvements Act of 1976 cannot close until 30 days after the parties file an HSR form notifying the DOJ and FTC of the transaction. The reviewing agency may ask the parties to voluntarily pull and refile their HSR form, giving the agency an additional 30 days to evaluate the transaction. If at the end of the statutory waiting period, the reviewing agency is unable to resolve its competition concerns, it may issue a broad and extensive request for additional documents and information known as a “Second Request.” The transaction cannot close until 30 days after both parties have substantially complied. Substantially complying with a Second Request typically takes several months and comes at significant expense to the parties, requiring the production of large volumes of documents and data, as well as detailed narrative responses.

Timing agreements are one of the avenues by which parties receiving a Second Request may seek modifications. Parties may enter into a timing agreement with the reviewing agency to modify or limit compliance obligations in exchange for extending the waiting period following substantial compliance beyond the statutory 30 days, thereby giving the agency more time to evaluate the transaction.

FTC’s Clarifications of Procedures for Modifications of Second Requests

The amended rule revises 16 CFR § 2.20, which sets forth procedures for Second Requests, to clarify the factors FTC Staff may consider in determining whether to modify a Second Request. Previously, § 2.20 provided only that the FTC’s authorized representative could modify or recommend modifying the Second Request upon a determination “that a less burdensome request would be consistent with the needs of the investigation.” Under the amended rule, the authorized representative may now consider “all relevant factors,” including: (1) timing agreement negotiations, (2) the competitive issues involved, (3) the manner in which information and documents are maintained by the recipient, (4) the type of information available to the recipient, (5) the relative burdens to the recipient(s) of producing the requested information, and (6) whether a less burdensome request would be consistent with the needs of the investigation.

Key Takeaways for Dealmakers

Greater Transparency in Second Request Negotiations. The amended rule codifies factors FTC Staff may consider when negotiating Second Request modifications, providing parties with a clearer framework for engaging with Staff on scope and burden. Notably, the amended rule now expressly states the linkage between modifications and timing agreements—a concept that has long been applied by FTC Staff but had not been codified until now. Parties and their counsel can now point to the enumerated factors—including the relative burden of production and timing agreement negotiations—when advocating for modifications that narrow the scope of a Second Request.

Proactive Engagement with FTC Staff Remains Critical. Parties receiving Second Requests should engage FTC Staff early and proactively regarding the scope of production. The codified factors, particularly those relating to how information and documents are maintained and the relative burdens of production, may provide avenues for productive dialogue about narrowing or tailoring requests.

The Amended Rule Took Effect Immediately. Because the amendments concern agency procedure and practice only, the FTC was not required to provide notice and comment. The rule took effect upon publication in the Federal Register on September 24, 2026, and the FTC may apply the amended rule in investigations pending on the date of publication and going forward.

The Amended Rule Applies Only to FTC Investigations But Is a Continuation of Updates to Second Request Procedure by Both Agencies. The amended rule revises the FTC’s own rules of practice (16 CFR § 2.20), which govern only FTC-issued Second Requests. Parties whose transaction is under DOJ review should not assume the same framework applies when negotiating modifications to a DOJ Second Request. Relatedly, however, DOJ recently announced a “targeted” Second Request procedure, whereby the transacting parties would have the opportunity to enter into a timing agreement with DOJ that prioritizes the submission of certain information and documents that could resolve DOJ’s questions prior to full compliance or modify the Second Request to reduce burden. And this week, FTC Bureau of Competition Director Dan Guarnera nodded to a similar “phased” Second Request process, allowing transacting parties in suitable cases to prioritize potentially dispositive information and documents and avoid full compliance when those materials resolve the agency’s competition concerns.

The Substantive Standard Has Not Changed. The amended rule clarifies what factors FTC Staff may consider in the modification process, but it does not expand or alter the scope of information the FTC may seek through Second Requests. The underlying statutory authority under the HSR Act remains unchanged.

Gibson Dunn attorneys are closely monitoring these developments and are available to discuss the implications. For further details, see our previous Client Alerts and related resources on the firm’s Antitrust and Competition page here.

The following Gibson Dunn lawyers prepared this update: Jeffrey Wall, Rachel Brass, Jamie France, Kristen Limarzi, Judson Littleton, Bradley Smith, Caroline Black, and Logan Billman.

Gibson Dunn lawyers are available to assist in addressing any questions you may have regarding the issues discussed in this update. Please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any leader or member of the firm’s Antitrust and Competition, Appellate and Constitutional Law, Private Equity, or Mergers and Acquisitions practice groups:

Antitrust and Competition:
Rachel S. Brass – San Francisco (+1 415.393.8293, rbrass@gibsondunn.com)
Jamie E. France – Washington, D.C. (+1 202.955.8218, jfrance@gibsondunn.com)
Sophia A. Hansell – Washington, D.C. (+1 202.887.3625, shansell@gibsondunn.com)
Caeli A. Higney – San Francisco (+1 415.393.8248, chigney@gibsondunn.com)
Julian W. Kleinbrodt – San Francisco (+1 415.393.8382, jkleinbrodt@gibsondunn.com)
Kristen C. Limarzi – Washington, D.C. (+1 202.887.3518, klimarzi@gibsondunn.com)
Samuel G. Liversidge – Los Angeles (+1 213.229.7420, sliversidge@gibsondunn.com)
Michael J. Perry – Washinton, D.C. (+1 202.887.3558, mjperry@gibsondunn.com)
Cynthia Richman – Washington, D.C. (+1 202.955.8234, crichman@gibsondunn.com)
Bradley P. Smith – New York (+1 212.351.5376, bpsmith@gibsondunn.com)
Daniel G. Swanson – Los Angeles (+1 213.229.7430, dswanson@gibsondunn.com)
Stephen Weissman – Washington, D.C. (+1 202.955.8678, sweissman@gibsondunn.com)

Appellate and Constitutional Law:
Thomas H. Dupree Jr. – Washington, D.C. (+1 202.955.8547, tdupree@gibsondunn.com)
Allyson N. Ho – Dallas (+1 214.698.3233, aho@gibsondunn.com)
Judson O. Littleton – Washington, D.C. (+1 202.955.8531, jlittleton@gibsondunn.com)
Julian W. Poon – Los Angeles (+ 213.229.7758, jpoon@gibsondunn.com)
Jeffrey B. Wall – Washington, D.C. (+1 202.955.8533,jwall@gibsondunn.com)

Private Equity:
Richard J. Birns – New York (+1 212.351.4032, rbirns@gibsondunn.com)
Ari Lanin – Los Angeles (+1 310.552.8581, alanin@gibsondunn.com)
Michael Piazza – Houston (+1 346.718.6670, mpiazza@gibsondunn.com)
John M. Pollack – New York (+1 212.351.3903, jpollack@gibsondunn.com)

Mergers and Acquisitions:
Robert B. Little – Dallas (+1 214.698.3260, rlittle@gibsondunn.com)
Saee Muzumdar – New York (+1 212.351.3966, smuzumdar@gibsondunn.com)
George Sampas – New York (+1 212.351.6300, gsampas@gibsondunn.com)

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials. The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel. Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

Though distinct, all of these measures have one thing in common—they put the burden of actually implementing these regulations, and the concurrent risk of non-compliance, on the private sector.

While the Trump Administration has been relying on economic coercive tools (tariffs, sanctions, export controls, outbound investment restrictions, FDI controls) since it came to office, the last month has been unprecedented in the pace, diversity, and target set of the White House’s deployment of such measures. In the space of about 30 days, the Trump Administration deployed an array of economic tools (some with grand names—Operation Economic Outcast—and others with mere numerical references to some infrequently used regulations—311, 338, 232, 301) to pursue various and vastly different geopolitical and national security objectives. These actions pull in markedly different directions: they tighten the Iran sanctions program to its most restrictive posture in the program’s history, dismantle what remains of the Syria program, and commence a trade war against Canada, the United States’ closest trading partner. Added to the clamoring Congress passed and the President signed the Lindsey O. Graham Sanctioning Russia and Iran Act of 2026 which has started a clock towards potentially new sanctions on parties engaged in Russia’s energy sector and new tariffs of up to 100 percent on goods from countries that continue to purchase Russian energy.

Though distinct, all of these measures have one thing in common—they put the burden of actually implementing these regulations, and the concurrent risk of non-compliance, on the private sector.

To begin the month, the Administration removed Syria from the list of State Sponsors of Terrorism (where Syria had been listed for nearly 47 years). This was the last meaningful easing measure to finally open Syria to international banking and business and a continuation of steps initiated last summer.

The same day, the Administration announced the commencement of “Operation Economic Outcast,” described as a whole-of-government economic campaign against the Islamic Republic of Iran and its “enablers.” The announcement marks a decisive reversal from the diplomatic posture reflected in the June 17, 2026, U.S.-Iran Memorandum of Understanding (MOU) covered in a prior Gibson Dunn client alert, which had contemplated the termination of “all types of sanctions” against Iran and the release of restricted Iranian assets. The MOU’s 60-day negotiating window has lapsed without an agreement, and the authorization that implemented the MOU’s initial oil-sector relief—Iran General License X—was revoked by OFAC on July 7, 2026, following renewed tensions, and replaced with Iran General License X1 to mandate an immediate wind-down of all authorized transactions through July 17, 2026. Treasury frames Operation Economic Outcast as the beginning of a sustained campaign to close every financial channel available to the Iranian regime and the Islamic Revolutionary Guard Corps (IRGC) and presenting the choice for third countries as one between partnership with the United States and shared isolation with Iran.

Earlier in the week, the Administration wielded a different economic instrument—tariffs, this time focused on Canada under the never-before-used Section 338 of the Trade Act of 1930. This was in addition to the Administration’s July 24, 2026, imposition of nearly global Section 301 tariffs based on alleged failures by trading partners to take adequate steps to prevent the importation of goods produced with forced labor.

Clearly, the second Trump Administration is doubling down on economic statecraft with no letup in sight. The implementation of the recently-passed Lindsey O. Graham Sanctioning Russia and Iran Act of 2026, which includes both sanctions and tariff authorities, is another escalation in the Administration’s reliance on economic instruments—and thus the private sector—to further national security aims. Consequently, it is increasingly important for industries engaged in global trade to track frenetic developments and reassess their risk profile in light of ever-changing geopolitical realities.

I. The U.S. Treasury Department’s Operation Economic Outcast Targets Third-Country Financial Institutions Involved in Iran and Other Economic Lifelines

The launch of Operation Economic Outcast was preceded by a coordinated public messaging campaign from the Trump Administration, with President Trump first using the phrase “economic D-Day” on August 19, 2026, warning that countries doing business with Iran would face “TREMENDOUS economic consequences.” In an August 20 CNBC interview, Secretary Bessent said, “We are going to collapse [the Iranian] regime,” referencing a combination of the naval blockade and expanded sanctions. On August 23, Secretary Bessent published an op-ed in the Financial Times declaring that the United States had entered the “endgame” and that an economic D-Day would begin at dawn.

The announcement on August 24 comprised five new sectoral determinations under Executive Order 13902; the indefinite suspension of five Iran-related general licenses; updated guidance on Strait of Hormuz transit demands; and the designation of over 60 entities, individuals, and vessels by Treasury and the Department of State. Treasury also stated that teams from the Departments of the Treasury, State, and War are engaging foreign counterparts directly, and that every country will be given a “defined timeline” to shut down identified Iran-related activity, after which Treasury will act unilaterally.

a. Treasury’s Five Sectoral Determinations under E.O. 13902

Effective August 24, 2026, OFAC issued a determination expanding the application of E.O. 13902 to the aviation, digital asset, gold, shipping, and technology sectors of the Iranian economy. Executive Order 13902 authorizes OFAC to designate any person, wherever located, that is determined to operate in one or more of the covered sectors or that has knowingly engaged in a significant transaction for the sale, supply, or transfer to or from Iran of significant goods or services used in connection with such a sector. Separately, a foreign financial institution that knowingly conducts or facilitates a significant financial transaction in support of an identified sector risks the imposition of restrictive measures, which could take the form of a prohibition on opening or maintaining, or imposing strict conditions on, a U.S. correspondent or payable-through account. These sectors join the construction, mining, manufacturing, and textiles sectors already subject to E.O. 13902 as well as the financial, petroleum, and petrochemical sectors previously targeted.

The practical effect is to put third-country parties on notice that Iran-related activity in these five areas can now support an OFAC designation even where the conduct has no U.S. touchpoint at all: no U.S. persons, no U.S.-origin goods or services, and no use of U.S. correspondent bank accounts or other U.S. dollar clearing mechanisms.

b. Indefinite Suspension of Certain Iran General Licenses & New Restrictive Statement of Licensing Policy

Concurrent with the announcement, OFAC issued a rule indefinitely suspending five general licenses issued under the Iranian Transactions and Sanctions Regulations (ITSR), 31 C.F.R. Part 560. The suspended authorizations are:

31 C.F.R. § 560.544 (certain educational activities by U.S. persons in third countries);
31 C.F.R. § 560.550 (certain noncommercial, personal remittances to or from Iran);
31 C.F.R. § 560.554 (importation and exportation of services related to conferences in the United States or third countries);
Iran General License F (services supporting professional and amateur sports activities and exchanges), published at 79 Fed. Reg. 11,180 (Feb. 27, 2014); and
Iran General License G (certain academic exchanges and the exportation or importation of certain educational services), published at 79 Fed. Reg. 49,157 (Aug. 19, 2014).

Per the Federal Register notice, the suspensions are intended to align the regulations with changes in U.S. foreign policy toward Iran, reciting as justification Iran’s continued disruptions to global energy markets, attacks on partners and allies in the Middle East, reconstitution of its conventional and nuclear weapons programs, efforts to monetize the Strait of Hormuz, and continued support to terrorist proxies.

The practical burden of these suspensions appears to fall disproportionately on individuals rather than on commercial enterprises, as Section 560.550 of the ITSR was one of the principal lawful channels for noncommercial personal remittances between the United States and Iran, and General Licenses F and G supported academic, cultural, and athletic exchange. The effect on the testing and education sector has been immediate: the U.S.-based Educational Testing Service paused TOEFL and GRE administration inside Iran within days, citing the suspension of General License G, and the Duolingo English Test promptly became unavailable to candidates in Iran. On or around September 9, 2026, the Law School Admission Council (LSAC) also reportedly suspended the accounts of Iranian nationals, including some dual U.S. and Canadian citizens, citing the revocation of OFAC General License G and requiring applicants to individually contact LSAC compliance to regain account access.

On September 8, OFAC took the further step of suspending long-standing general licenses related to aviation activities within and involving Iran, including payments for overflight of Iranian airspace. Notably, OFAC suspended GL J-1, which previously authorized the temporary reexportation of civil aircraft subject to U.S. jurisdiction to Iran. The direct impact of these measures is to heavily restrict all transactions involving aircraft and aircraft components involving Iran when such aircraft or components are subject to U.S. export controls. With the removal of the temporary sojourn provisions, aircraft subject to U.S. export controls are prohibited from flying into Iran unless authorized within the narrow set of “transaction ordinarily incident and necessary to the wind down of any transaction previously authorized” as outlined in General License DD. Almost immediately, major carriers that had continued to fly to Iran—including Turkish Airlines and Qatar Airways—announced a suspension of flights, and additional routes from Tehran have been cancelled.

On September 10, OFAC announced a broader update to its Statement of Licensing Policy for Iran, establishing a presumption of denial for specific license requests to engage in otherwise prohibited activities. The policy directs that specific licenses may only be issued as required by law or in exceptional and urgent circumstances, such as “risk to life, limb, or environmental safety.” The policy supersedes prior case-by-case review policies for specific license requests related to democracy and human rights projects, support of independent civic organizations, or certain activities related to Internet-based communications that did not qualify for existing general licenses.

c. Updated OFAC Guidance on Strait of Hormuz Passage Demands

OFAC also published an updated alert, “Sanctions Risks of Iranian Demands for Strait of Hormuz Passage,” revising its May 1, 2026 guidance. The alert responds to Iran’s toll-and-clearance regime for the Strait, administered through three now-designated entities: the so-called Persian Gulf Strait Authority (PGSA), designated May 27, 2026, under counterterrorism authorities for support to the IRGC; and the Persian Gulf Marine Insurance Company (PGMIC) and HormuzSafe Marine Services Authority (Hormuz Safe), both designated July 29, 2026, under E.O. 13902 for operating in the financial sector of the Iranian economy. This has increased risks for the entire shipping value chain—from ship owners, to managers, to insurers.

The most consequential takeaway from the OFAC alert is to underscore the risk arising from dealings with these entities, even apart from any payment. OFAC states that U.S. and non-U.S. persons risk sanctions or penalties by engaging with PGSA, PGMIC, or Hormuz Safe—including by accepting insurance or other services, or by responding to information demands for guarantees of safe passage—even where no payment or other exchange of value occurs. OFAC further advises that tolls may be demanded in a range of forms, including fiat currency, digital assets, offsets, government-to-government arrangements, informal swaps, and in-kind payments such as nominally charitable donations to entities including the Iranian Red Crescent Society, Bonyad Mostazafan, or Iranian embassy accounts. OFAC states that the risk exists regardless of payment method or structure.

OFAC also sets out affirmative diligence expectations for maritime service providers, which are directed to review voyage planning and actual transits through Iranian territorial waters, and—significantly—to ask counterparties whom they coordinated with to transit the Strait whether safe-passage fees were or will be paid to Iran, and whether any services, including insurance, were accepted from Iran.

d. FinCEN’s Section 311 Proposal Against Banque Misr UAE; Designation of Golden Global Bank in Turkey; Rurther Designation of Russia’s VTB Bank

On August 28, 2026, Treasury took a further action under Operation Economic Outcast when FinCEN issued a notice of proposed rulemaking (NPRM) finding Banque Misr UAE to be a financial institution operating outside the United States that is of primary money laundering concern. Once finalized, the rule will prohibit U.S. financial institutions from opening or maintaining a correspondent account for, or on behalf of, Banque Misr UAE and require U.S. banks to conduct due diligence on existing correspondent relationships to ensure that Banque Misr UAE is not an indirect beneficiary. In the proposed rule, Treasury describes Banque Misr UAE as a critical node for the Iranian regime’s access to U.S. dollars, estimating that between January 2024 and June 2026 the bank processed approximately $1.8 billion for 103 companies potentially part of Iranian shadow banking networks. Importantly, the proposed rule only applies to Banque Misr UAE, not its Egyptian parent company or branches in other jurisdictions.

Subsequently, OFAC announced blocking sanctions on a Turkish bank, Golden Global Bank, for alleged involvement in transferring funds from China to Turkey, for the benefit of the IRGC, in connection with sales of Iranian oil. Unlike the FinCEN rule described above, the blocking sanctions on Golden Global Bank were effective as of announcement, with a limited wind-down authorization. The Turkish bank regulator subsequently took control of the bank restricting its operations in general and with respect to Iran in particular.

On September 14, 2026, OFAC took perhaps its most significant public step to date to pressure global financial participants to cut off Iran by re-designating VTB Bank, Russia’s second largest bank, under Iran-related E.O. 13902, bringing to bear the Iranian secondary sanctions architecture on the already heavily sanctioned Russian financial institution. OFAC reports VTB Bank has opened offices in Iran in recent years and established correspondent banking relationships with sanctioned Iranian banks, including the Central Bank of Iran. OFAC further alleges that VTB Bank has used these channels to reportedly move billions of Iranian assets and to facilitate bilateral trade by creating a ruble-to-rial payment settlement channel. While VTB Bank is already subject to blocking sanctions imposed by the United States, United Kingdom, the European Union, and others, this additional layer of sanctions adds further pressure to financial institutions in China, India, and elsewhere to diminish dealings with Iran.

II. Syria Trade Restrictions Relief

Reflecting the United States’ broader rapprochement with Syria’s post-Assad government, initially covered in a prior Gibson Dunn client alert, on August 24, 2026, the Secretary of State rescinded Syria’s designation as a State Sponsor of Terrorism (SST). The rescission lifts the statutory restrictions triggered by the designation—including bars on foreign assistance and related financial dealings—and clears the way for the Bureau of Industry and Security (BIS) and the Directorate of Defense Trade Controls (DDTC) to relax controls on civilian and defense items.

At the same time that the U.S. government ended Syria’s SST status, it also:

Revoked Hay’at Tahrir al-Sham’s (HTS) designation as a Specially Designated Global Terrorist (SDGT) and removed it from the Specially Designated Nationals and Blocked Persons List (SDN List);
Waived the remaining statutory bars on exports of defense items—the munitions-export prohibition of the Syria Accountability and Lebanese Sovereignty Restoration Act of 2003 (SAA) and the defense-trade sanctions of the Chemical and Biological Weapons Control and Warfare Elimination Act of 1991 (CBW Act); and
Signaled future amendments to the Export Administration Regulations (EAR) and to the International Traffic in Arms Regulations (ITAR), including the elimination of the defense-trade policy of denial for Syria.

Although trade with and investment in Syria continue to present compliance challenges, these developments—particularly the lifting of Syria’s SST status—signal that an end to most trade restrictions with Syria is likely approaching.

The United States has been dismantling comprehensive sanctions on Syria since June 2025, when Executive Order 14312 terminated the national emergency underlying the Syrian Sanctions Regulations and their broad prohibitions on trade, investment, and financial dealings. OFAC then delisted President Ahmed al-Sharaa and Interior Minister Anas Hasan Khattab in November 2025, and in December 2025 Congress repealed the Caesar Act and its mandatory secondary sanctions.

While the doors are increasingly open and some companies have started to make preliminary moves into the country, there remain significant risks given the broader violence in the region and the fact that the authorities in Damascus have yet to fully consolidate power over the country.

III. A Trade War with Canada

Meanwhile, the escalating trade confrontation between the United States and Canada further exemplifies how rising geopolitical uncertainty can amplify trade compliance risks. On July 1, 2026, the United States declined to renew the United States-Mexico-Canada Agreement (USMCA) in its current form, triggering a period of annual reviews rather than extending the agreement, and creating substantial uncertainty in one of the world’s largest trading relationships. Against the backdrop of already-elevated tariffs—including Section 232 duties on steel, aluminum, copper, and automobiles, and the 10 percent duty applied to Canadian goods under the near-global Section 301 forced-labor action effective July 24, 2026—bilateral negotiations collapsed on August 21, 2026, after Canadian Prime Minister Mark Carney suspended negotiations over what he characterized as “uneconomic” and “unfair” U.S. demands. On August 22, an additional 50 percent duties on approximately $20 billion USD worth of Canadian goods took effect in the United States under never-before-used Section 338 of the Tariff Act of 1930. On August 25, Canada announced retaliatory tariffs on approximately $20 billion USD worth of imports from the United States into Canada—including steel, dairy, appliances, agricultural equipment, and electronics—effective September 8, 2026, designed to match the U.S. tariffs dollar-for-dollar.

The United States has subsequently responded by announcing plans to convert the retaliatory duties into outright import bans on motorcycles, certain dairy products, and alcoholic beverages from Canada. Canada seems inclined to continue retaliation in kind; and, in what might prove to be a much more substantial, long-term effort, Ottawa has even approached the European Union to inquire about joining the Bloc as an “associate member,” a status that has never existed but one that many EU member states are at least willing to consider.

This escalation illustrates that trade compliance risk is no longer confined to traditional sanctions and export controls contexts involving adversarial states; companies must now also navigate rapidly shifting tariff regimes and retaliatory measures arising from the breakdown of established multilateral trade frameworks, compounding the compliance challenges posed by developments such as those involving Iran and Syria.

IV. Sanctioning Russia and Iran Act

The latest in a period of significant trade developments has been the passage of the Lindsey O. Graham Sanctioning Russia and Iran Act of 2026, which Congress passed on September 16, 2026, and which President Trump signed on September 18, 2026. Passed in honor of the late senator who long championed its measures, the act codifies existing sanctions on Russia, expands both primary and secondary sanctions in new ways, and, for the first time, specifically authorizes (indeed, mandates) the President to impose certain tariffs on countries continuing to engage with Russian energy exports.

Apart from codifying sanctions on key Russian government officials and entities operating in the Russian defense industrial sector, the act focuses on Russian energy exports, which remain a key driver of Russia’s ability to prosecute its war against Ukraine. It directs the President to identify as blocked property any foreign vessels that knowingly transport crude oil, uranium, natural gas, LNG, petroleum, petroleum products, or coal from Russia as well as those providing support for such vessels, including insurance and port services. The bill also sanctions entities owned or controlled by the Russian government and prohibits any new investment in Russia by U.S. persons, actions which largely codify existing executive actions.

On the tariff front, the bill employs the relatively novel concepts of primary and secondary tariffs against Russia—it would have been completely novel if not for the Trump Administration already employing this unprecedented measure in 2025 against India. First, it requires the President to increase the rate of duty on all goods from Russia to a rate of up to 500 percent (“primary tariffs”). Then it authorizes the President to increase the rate of duty up to 100 percent for all goods imported from a country that is among the five largest importers of crude oil or natural gas that originated in Russia in the prior year or are among the top five countries facilitating Russian oil sanctions evasion during that period (“secondary tariffs”). Importantly, the bill makes an exception for countries whose total imports of Russian natural gas were less than 15 percent of Russia’s natural gas output and who have taken “significant steps” to reduce Russian natural gas imports, a measure that allows the President to absolve certain European countries from additional tariffs on these grounds. The focus remains on China, India, Türkiye, and others who continue to make significant purchases of Russian energy products or facilitate those transactions. This model of exempting countries who decrease their reliance on Russian energy borrows directly from a 2012 National Defense Authorization Act provision that imposed secondary sanctions against parties buying Iranian crude. That law allowed for a “significant reduction exception,” which likewise was granted principally to European countries (though China was subsequently added).

The new Act includes standard sanctions waivers for humanitarian reasons, certain diplomatic activities, and the continued ability for OFAC to issue specific and general licenses. It also enables the President to waive any of the mandated sanctions for 30 days upon a certification to Congress that such waiver is in the United States’s national interests. The act also includes a termination provision if Russia agrees to a peace deal with Ukraine, subject to congressional approval.

In a late-breaking addition to the bill, Congress renewed the Iran Sanctions Act of 1996—a key statute underlying the Iran sanctions program which has been renewed and expanded multiple times during the past three decades—for another five years, moving the expiration date from 2026 to 2031.

V. Conclusion: Practical Implications for U.S. and non-U.S. Companies and Financial Institutions

The Treasury Department’s Operation Economic Outcast reboots the United States’ efforts to economically isolate Iran, although it does so without the evident cooperation of Russia or China, countries that were previously parties to the 2015 Iran nuclear deal. OFAC appears to be making good on its threats by targeting third-country financial institutions, including the proposed Section 311 correspondent account closure requirement for Banque Misr UAE, the designation of Türkiye-based Golden Global Bank, and the re-designation of Russia’s VTB Bank. To what extent these measures result in material disruptions to Iran’s economic channels with Russia, China, and other actors remains to be seen. However, we expect more and similar announcements from U.S. authorities restricting any remaining channels of Iran-related trade, travel, and financial flows.

Meanwhile, the general license suspensions shift the burden onto a very different constituency: institutions without historic high exposure to sanctions. Universities, testing and credentialing bodies, conference organizers, and athletic federations who long relied on the now-suspended general licenses for Iran-related activities now need enhanced sanctions compliance functions capable of judgments they never had to make. The first is that seeking a specific license is no longer a realistic fallback—activity that previously depended upon a now-suspended authorization should be treated as ended, not as awaiting relicensing, unless another authorization applies. Holders of existing Iran-related specific licenses should assume the same trajectory and plan for non-renewal, identifying expiration dates, mapping what happens to enrollments, contracts, and payment flows if a license lapses, and building wind-down mechanics into arrangements that presently assume continuity. The opposite error carries its own cost: treating these changes as a blanket prohibition on all dealings with Iranian nationals invites legal exposure of a different kind with no sanctions benefit. Institutions should calibrate carefully and seek legal advice.

On the other hand, the Trump Administration is following through on its plans to remove sanctions and export controls targeting Syria, where the United States has effectively repealed comprehensive sanctions and is taking steps to remove remaining barriers to global trade, including trade in defense and dual-use items between the United States and the new Syrian regime. While compliance-related risks remain in light of list-based sanctions affecting parties in the region, the Administration appears eager for global business to reengage with Syria.

But trade tensions are not solely an issue of far-flung markets, affecting also one of the United States’ largest and longest-running trading relationships with its neighbor. The U.S.-Canada “trade war” does not show any immediate signs of ramping down, and firms with Canadian operations or suppliers will need to watch those developments very closely.

Finally, Congress is not to be forgotten, and its recent passage of the Lindsay O. Graham Sanctioning Russia and Iran Act reminds industry that U.S. lawmakers are unlikely to sit by in the event the White House contemplates reengaging with Russia, short of a peace deal being in place. Depending upon the result of the midterm elections we will likely see more Congressional activity in this regard.

More than ever, businesses with a global footprint, and especially those with significant ties to the U.S. economy, are encouraged to re-assess their risk profile in light of rapidly changing geopolitical and geoeconomic conditions. Concrete steps might include refreshing counterparty screening following dozens of new designations around the world in response to U.S. pressure on Iran, assessing “constructive” blocking risk arising from ownership or control of counterparties, determining whether suspension of any Iran-related general licenses affects current or planned activities, and mapping exposure (direct and indirect) to newly designated economic sectors of Iran (including via third parties located in higher risk jurisdictions for diversion concern). For financial institutions or those involved in the maritime industry, it will be important to assess potential exposure to newly restricted banks or activity involving the Strait of Hormuz.

Gibson Dunn attorneys are closely monitoring these developments and are standing by to assist with any questions or issues that may arise.

The following Gibson Dunn lawyers prepared this update: Adam M. Smith, Samantha Sewall, Chris Mullen, Roxana Akbari, Erika Holmberg, Dominic Solari, and Justin duRivage.

For further information, please feel free to contact the authors, the Gibson Dunn lawyer with whom you usually work, or any leader or member of the firm’s International Trade Advisory & Enforcement or Sanctions & Export Enforcement practice groups.

United States:
Matthew S. Axelrod – Co-Chair, Washington, D.C. (+1 202.955.8517, maxelrod@gibsondunn.com)
Adam M. Smith – Co-Chair, Washington, D.C. (+1 202.887.3547, asmith@gibsondunn.com)
Ronald Kirk – Co-Chair, Dallas (+1 214.698.3295, rkirk@gibsondunn.com)
Stephenie Gosnell Handler – Washington, D.C. (+1 202.955.8510, shandler@gibsondunn.com)
Donald Harrison – Washington, D.C. (+1 202.955.8560, dharrison@gibsondunn.com)
Christopher T. Timura – Washington, D.C. (+1 202.887.3690, ctimura@gibsondunn.com)
David P. Burns – Washington, D.C. (+1 202.887.3786, dburns@gibsondunn.com)
Nicola T. Hanna – Los Angeles (+1 213.229.7269, nhanna@gibsondunn.com)
Courtney M. Brown – Washington, D.C. (+1 202.955.8685, cmbrown@gibsondunn.com)
Chris R. Mullen – Washington, D.C. (+1 202.955.8250, cmullen@gibsondunn.com)
Samantha Sewall – Washington, D.C. (+1 202.887.3509, ssewall@gibsondunn.com)
Audi K. Syarief – Washington, D.C. (+1 202.955.8266, asyarief@gibsondunn.com)
Roxana Akbari – Orange County (+1 949.475.4650, rakbari@gibsondunn.com)
Karsten Ball – Washington, D.C. (+1 202.777.9341, kball@gibsondunn.com)
Dharak Bhavsar – Denver (+1 303.298.5971, dbhavsar@gibsondunn.com)
Sarah Burns – Washington, D.C. (+1 202.777.9320, sburns@gibsondunn.com)
Hugh N. Danilack – Washington, D.C. (+1 202.777.9536, hdanilack@gibsondunn.com)
Justin duRivage – Palo Alto (+1 650.849.5323, jdurivage@gibsondunn.com)
Hui Fang – Washington, D.C. (+1 202.887.3620, hfang@gibsondunn.com)
Bill Huesken – Denver (+1 303.298.5948, bhuesken@gibsondunn.com)
Dorkas Laura Medina – Washington, D.C. (+1 202.777.9444, dmedina@gibsondunn.com)
Sarah L. Pongrace – New York (+1 212.351.3972, spongrace@gibsondunn.com)
Anna Searcey – Washington, D.C. (+1 202.887.3655, asearcey@gibsondunn.com)
Dominic J. Solari – Washington, D.C. (+1 202.777.9597, dsolari@gibsondunn.com)
Erika Suh Holmberg – Washington, D.C. (+1 202.777.9539, eholmberg@gibsondunn.com)
Scott R. Toussaint – Washington, D.C. (+1 202.887.3588, stoussaint@gibsondunn.com)
Shuo (Josh) Zhang – Washington, D.C. (+1 202.955.8270, szhang@gibsondunn.com)

Asia:
Kelly Austin – Denver/Hong Kong (+1 303.298.5980, kaustin@gibsondunn.com)
David A. Wolber – Hong Kong (+852 2214 3764, dwolber@gibsondunn.com)
Fang Xue – Singapore (+65 6507 3692, fxue@gibsondunn.com)
Qi Yue – Beijing (+86 10 6502 8534, qyue@gibsondunn.com)
Soo-Min Chae – Singapore (+65 6507 3632, schae@gibsondunn.com)
Arnold Pun – Hong Kong (+852 2214 3838, apun@gibsondunn.com)

Europe:
Attila Borsos – Brussels (+32 2 554 72 10, aborsos@gibsondunn.com)
Patrick Doris – London (+44 207 071 4276, pdoris@gibsondunn.com)
Michelle M. Kirschner – London (+44 20 7071 4212, mkirschner@gibsondunn.com)
Penny Madden KC – London (+44 20 7071 4226, pmadden@gibsondunn.com)
Irene Polieri – London (+44 20 7071 4199, ipolieri@gibsondunn.com)
Benno Schwarz – Munich (+49 89 189 33 110, bschwarz@gibsondunn.com)
Nikita Malevanny – Munich (+49 89 189 33 224, nmalevanny@gibsondunn.com)
Josephine Kroneberger – London (+44 20 7071 4971, jkroneberger@gibsondunn.com)
Melina Kronester – Munich (+49 89 189 33 225, mkronester@gibsondunn.com)
Vanessa Ludwig – Frankfurt (+49 69 247 411 531, vludwig@gibsondunn.com)

We examine the Commerce Department’s four 2026 antiboycott settlements and what they reveal about an enforcement program enhanced under the prior administration – and accelerating under the current one.

The last two years have produced the most intensive period of U.S.-Gulf commercial engagement in a generation, with announced trade and investment commitments across the Gulf Cooperation Council states spanning artificial intelligence and data center buildouts, civil and military aviation, energy and critical minerals, advanced manufacturing, and healthcare. At the same time, Gulf sovereign wealth funds have become among the most active foreign investors in U.S. capital markets. As U.S. companies compete for regional tenders, procurement programs, joint ventures, and new investment opportunities, their operational footprint will expand into precisely the jurisdictions where the Arab League boycott of Israel retains commercial expression. Because the U.S. antiboycott regimes attach liability to the receipt of certain requests to participate in unsanctioned foreign boycotts, the same growth that makes the Gulf a strategic priority also increases the risks that can arise from failing to identify reportable boycott requests.

Against this backdrop, the U.S. Commerce Department’s Office of Antiboycott Compliance (OAC) has already announced four public settlements in 2026, resolving charges that arose not from deliberate boycott participation, but from routine commercial paperwork, including pre-populated trade show shipping documents and boilerplate purchase order terms containing boycott-related language. Although each respondent voluntarily self-disclosed the conduct, each was nonetheless required to admit its conduct publicly and pay a penalty.

These settlements are the clearest evidence to date that the enforcement program BIS began enhancing in 2022 has outlasted the administration then in place – the reforms announced under the prior administration (including enhanced penalties, mandatory admissions of misconduct, and a public Boycott Requester List) are now being applied, at an accelerating pace, under the current one. For companies doing business in the Gulf, where U.S. commercial engagement is at a generational high and where the Arab League boycott of Israel remains a feature of domestic law, the top takeaway is that antiboycott compliance must remain top-of-mind, not only for compliance and legal departments but also for sales and logistics teams and contract reviewers up and down the organization.

I. Antiboycott Legal Framework in Brief

The United States maintains two separate antiboycott regimes, both enacted in the 1970s in response to the Arab League boycott of Israel and both still in force. They are administered by different agencies on different reporting cycles, and compliance with one does not ensure compliance with the other.

The Commerce regime. Part 760 of the Export Administration Regulations (EAR) applies to “U.S. persons” (a term that reaches foreign subsidiaries controlled by U.S. persons) and prohibits, among other things, refusing to do business with a boycotted country or blacklisted persons, furnishing information about business relationships with them, and implementing letters of credit containing prohibited conditions. Narrow exceptions exist but are construed strictly. Separately, Section 760.5 requires U.S. persons to report, on a calendar quarterly cycle, the receipt of boycott-related requests – whether or not the requests are complied with, and even if the requests are refused outright. Ignorance of the rules is not a defense, and civil penalties can reach the greater of $374,474 per violation or twice the value of the underlying transaction; willful violations may be criminally prosecuted.

The Treasury regime. Section 999 of the Internal Revenue Code denies certain U.S. tax benefits (including the foreign tax credit) to taxpayers that participate in or cooperate with an unsanctioned international boycott and requires annual reporting with a company’s annual tax return on Form 5713 of operations in boycotting countries and of any request to participate. Participation in a single transaction presumptively taints all operations in that country unless the taxpayer clearly demonstrates that a particular operation is separate and identifiable. Because the two regimes overlap imperfectly and their filings go to different agencies on different schedules, inconsistencies between a company’s boycott request reports and its Form 5713 filings are readily identified – and for many multinationals, the Section 999 financial impact (via loss of certain tax credits) exceeds any penalty OAC is likely to assess.

II. The Four 2026 Settlements

As summarized below, each of the four settlements to-date in 2026 followed a voluntary self-disclosure; each required the respondent to admit the conduct alleged; and each resulted in a public charging letter, settlement agreement, and order.

Thales Defense & Security, Inc. (Case 25-02)

On April 15, 2026, Thales Defense & Security (Thales) entered into a settlement agreement with BIS for three violations of the EAR. On January 31, 2019, Thales furnished to a freight forwarder/logistics provider two items of information concerning its relationship with a boycotted country (Israel) with intent to comply with an unsanctioned foreign boycott in violation of 15 C.F.R. § 760.2(d). Specifically, Thales certified to a UAE entity that “no labor, capital, parts or raw materials of Israeli origin ha[d] been used in the printing, publishing or manufacture of” the goods it was shipping to the UAE and that “none [of the shipping entities] are part or parent companies of firms included on the Israeli boycott blacklist.” Additionally, on the same date Thales received a boycott request and failed to report it as required in violation of 15 C.F.R. § 760.5. As part of the settlement, Thales agreed to pay the Department of Commerce $44,750.

Colt’s Manufacturing Company LLC (Case 26-01)

On May 18, 2026, Colt’s Manufacturing Company LLC (Colt) entered into a settlement agreement with BIS for six violations of the EAR. On three occasions in 2019 – January 31, October 8, and November 15 – Colt furnished to a U.S. trade show logistics provider information concerning its business relationships with a boycotted country (Israel) with intent to comply with an unsanctioned foreign boycott in violation of 15 C.F.R. § 760.2(d). In each instance, Colt employees executed and returned a combined commercial invoice/packing list that the logistics provider had supplied in connection with temporary exports of Colt products for display at the International Defense Exhibition and Conference (IDEX) in the UAE, the Bahrain International Defense Exhibition and Conference (BIDEC) in Bahrain, and the Gulf Defense & Aerospace trade show in Kuwait, certifying that “no labor, capital, parts or raw materials of Israeli origin have been used in the printing, publishing or manufacture of these goods.” Additionally, Colt received each of those three templates from the logistics provider and failed to report its receipt of the resulting boycott requests as required in violation of 15 C.F.R. § 760.5. As part of the settlement, Colt admitted the conduct alleged and agreed to pay the Department of Commerce $72,750.

MAAG Gala, Inc. (Case 25-03)

On June 18, 2026, MAAG Gala, Inc. (MAAG) entered into a settlement agreement with BIS for 18 violations of the EAR. Between January 2021 and April 2024, MAAG received 18 purchase orders for spare parts, at primarily low values and totaling approximately $115,000, from a single customer located in Qatar. The terms and conditions of each purchase order included boycott-related language stating either that “Israeli origin goods are not permitted to import into Qatar” or directing the recipient to “[f]ollow Qatar import regulations on restricted, banned and boycotted origin goods.” MAAG failed to report its receipt of any of the eighteen requests to BIS as required in violation of 15 C.F.R. § 760.5. Unlike in the three other 2026 resolutions, BIS brought no furnishing charge, and the case did not arise from trade show participation. As part of the settlement, MAAG admitted the conduct alleged and agreed to pay the Department of Commerce $67,500.

The Boeing Company (Case 26-02)

On July 31, 2026, The Boeing Company (Boeing) entered into a settlement agreement with BIS for two violations of the EAR. Between on or about October 28, 2019, and November 1, 2019, Boeing furnished to a U.S. trade show logistics provider two items of information concerning its business relationships with a boycotted country (Israel) with intent to comply with an unsanctioned foreign boycott in violation of 15 C.F.R. § 760.2(d). Specifically, in connection with temporary exports of Boeing models and office supplies for the Dubai Airshow held in the UAE in November 2019, a Boeing employee downloaded from the logistics provider’s website, and completed on Boeing’s behalf, a combined commercial invoice/packing list template certifying that “no labor, capital, parts or raw materials of Israeli origin have been used in the printing, publishing or manufacture of these goods and [that] none are part or parent companies of firms included on the Israeli Boycott Blacklist.” BIS charged the two certifications as separate furnishing violations, and no reporting charge was brought. As part of the settlement, Boeing admitted the conduct alleged and agreed to pay the Department of Commerce $41,000.

Respondent	Order Date	Charges	Boycotting Country	Conduct Period	Penalty
Thales Defense & Security, Inc. (Case 25-02)	Apr. 15, 2026	2 violations of § 760.2(d) (furnishing); 1 violation of § 760.5 (reporting)	UAE	2019	$44,750
Colt’s Manufacturing Company LLC (Case 26-01)	May 18, 2026	3 violations of § 760.2(d); 3 violations of § 760.5	UAE, Bahrain, Kuwait	2019	$72,750
MAAG Gala, Inc. (Case 25-03)	June 18, 2026	18 violations of § 760.5	Qatar	2021–2024	$67,500
The Boeing Company (Case 26-02)	July 31, 2026	2 violations of § 760.2(d)	UAE	2019	$41,000

A. Comparing the Facts

Participation in trade shows is a consistent source of antiboycott risk. The Thales, Colt, and Boeing actions each arose from participation in Gulf defense or aerospace trade shows in 2019, where a U.S. trade show logistics provider or freight forwarder supplied a combined commercial invoice/packing list template that was pre-populated with boycott certification language – specifically, certifying that “no labor, capital, parts, or raw materials of Israeli origin ha[d] been used in the printing, publishing or manufacture” of the goods, and that none of the entities involved appeared on the Israeli Boycott Blacklist. Company employees completed and returned the templates. The same fact pattern had already produced a factually similar settlement in 2025 (a $44,750 civil penalty for three violations arising from completing a combined commercial invoice/packing list related to participation in the International Defense Exhibition and Conference held in Abu Dhabi in 2019), confirming that OAC worked this cluster as a related set across two enforcement years.

Civil penalties were imposed regardless of the lack of a commercial sale. The goods at issue were temporary exports for display – one charging letter describes the goods as aircraft models and office supplies for use at a Dubai trade show. In three out of four of the settlements, there was no commercial sale – merely an export of goods and supplies to support trade show participation. And in each of these cases, the value of the underlying goods bore no relationship to the penalty imposed because BIS priced these matters per violation rather than by transaction value.

One document can generate multiple violations. In two of the actions, BIS charged each discrete item of prohibited information within a single document as a separate violation: the “no Israeli origin” certification and the “not on the blacklist” certification counted as two “furnishing of information” violations appearing in the same document. Further, these documents generated two different kinds of violations – a reporting violation when the document was received and, separately, furnishing violations when they were executed and returned.

Failure to catch routinized prohibited language can quickly increase the penalty. The MAAG case is an outlier among the four cases because it did not arise from trade show participation and there was no allegation that MAAG furnished information regarding relationships with a boycotted country or blacklisted person. Between January 2021 and April 2024, MAAG received 18 purchase orders for spare parts from a single Qatari customer, for goods with a total value of approximately $115,000 – each carrying boilerplate terms restricting Israeli-origin goods. MAAG did not report any of them. Several elements in this case deserve particular attention. First, the conduct is recent and most of it falls in the post-2022 enforcement era. Second, although the language sat close to the exception for compliance with a boycotting country’s import requirements, its receipt itself was reportable, and that alone was sufficient to result in a civil penalty. Finally, the arithmetic is sobering: a $67,500 penalty on roughly $115,000 of aggregate sales (approximately 59 cents of penalty for every dollar of revenue). In other words, a recurring clause in a modest, long-running customer relationship proved more costly for MAAG than a one-time certification on marquee airshow shipment did for Boeing.

B. Penalties Per Violation: An Observable Schedule

BIS has not published a per-violation rate card. But the 2026 settlements – together with a closely related May 2025 settlement – point to an arithmetic pattern:

760.2(d) furnishing violations (Category B): $20,500 per violation.
760.5 reporting violations (Category C): $3,750 per violation.

Applying those figures to the penalty amounts and number of violations in each case reproduces every announced penalty exactly. We offer this as an observed pattern rather than as announced agency policy, and it may reflect the particular posture of these cases – all voluntary self-disclosures, all resolved by settlement, none involving egregious conduct. Applied with appropriate caution, however, it is a useful tool for estimating exposure before deciding whether and how to self-disclose. It also makes two points concrete: furnishing violations are priced at roughly 5.5 times reporting violations; and because penalties scale with the number of violations rather than with transaction value, a high-frequency, low-value pattern of conduct can generate greater liability than a single significant transaction – as the MAAG case illustrates.

Finally, and critically: all four respondents self-disclosed, and all four nonetheless received a public charging letter, a mandatory admission of misconduct, and a monetary penalty. While the penalties have remained low compared to other BIS enforcement actions (where eight of this year’s nine export enforcement resolutions have had penalties of $1,000,000 or more), the public nature of an antiboycott resolution can have an outsized reputational impact. Under the post-2022 policy, voluntary self-disclosure only mitigates – it does not guarantee confidentiality or a no-action outcome. Accordingly, this calculus should be understood before a voluntary self-disclosure decision is made.

III. An Enforcement Push That Spans Administrations

The 2026 settlements did not emerge from nowhere. Through October 2022 and July 2023, BIS overhauled the antiboycott enforcement program through two policy memoranda and a final rule – reforms announced under the prior administration that provide the framework for what is currently unfolding.

The 2022 reforms. An October 2022 policy memorandum regarding Enhanced Enforcement of the Antiboycott Rules enhanced penalties (with BIS beginning its penalty calculus for all Category A violations at the statutory maximum) and marked an end to “no admit / no deny” settlements. The 2022 memorandum also renewed enforcement focus on the conduct of controlled foreign subsidiaries of U.S. parents, emphasizing that such firms should neither agree to nor pass along boycott-related requests to U.S. counterparties. A companion BIS final rule in October 2022 reshuffled the violation categories so that Category B captures the violations that most commonly arise in commercial transactions, including furnishing information about business relationships (§ 760.2(d)), and made those violations the express focus of OAC’s enforcement.

The 2023 reporting changes. A July 2023 OAC memorandum, Strengthening Antiboycott Reporting and Compliance, further required U.S. persons to identify the specific party from whom a boycott-related request was received, an innovation on the longstanding reporting form. For decades previously, only the disclosure of the boycott-related request itself and its country of origin was required. Identification of the boycott “requester” now serves as the engine behind the quarterly Boycott Requester List that BIS began publishing in March 2024. BIS also worked with government offices responsible for public procurement to publish antiboycott policy statements on U.S. government contracting websites, OAM and SAM.gov, framing antiboycott compliance as a contracting responsibility for U.S. Government contractors.

Acceleration under the current administration. The current administration has not merely maintained these developments; it has put them to work in practice. Five public enforcement actions have been issued so far since January 20, 2025. Each furnishing charge was brought under § 760.2(d), the paradigmatic Category B violation: BIS previously identified where it would focus its enforcement, and that is where it has in fact looked. Each settlement carried a mandatory admission of misconduct, creating a public factual record precedent from which other actors and companies are expected to learn. Finally, the Boycott Requester List is functioning as designed – both as notice to U.S. persons of counterparties likely to generate reportable requests and as a lever on requesters themselves, with BIS removing entities that certify they have ceased making boycott-related requests. At the same time, however, BIS has stopped publishing updated iterations of the list quarterly as it originally promised, with updates coming annually since the new administration. Perhaps to level-set expectations, BIS now promises only that the list will be updated “periodically.”

IV. Compliance Program Takeaways

Risk lives in third-party paperwork, not only in negotiated contracts. Not one of the 2025 or 2026 cases involved a term that in-house counsel negotiated. The offending language arrived in a forwarder’s template invoice or a customer’s standard purchase order terms – i.e., documents that may never reach the legal department. Companies are expected to extend compliance review to third-party-supplied transactional documents, including commercial invoices, packing lists, certificates of origin, shipping instructions and bills of lading, letters of credit and documentary collections, tender and pre-qualification packages, and purchase order terms and conditions. Practical measures include automated keyword screening (for example, “Israeli origin,” “blacklist,” “boycott,” “banned origin,” “eligible to enter the ports of”), standing instructions that logistics providers may not complete or submit shipping documentation on the company’s behalf without review, and contractual representations from forwarders, brokers, and exhibition agents. Logistics and freight forwarding companies should note if they are themselves U.S. persons subject to Part 760 – distributing a boycott-laden template is not a commercially neutral act. Financial institutions should ensure that trade finance and documentary credit teams screen instrument terms before implementation.

Treat reporting as a standalone program, because that is where violations often accumulate. The reporting obligation is triggered by receipt, runs on a fixed quarterly clock under the Commerce Department rules, and applies even where the company refuses the request outright. It is also where volume builds: 18 reporting failures can produce a penalty larger than two or three furnishing violations, even though reporting failures are considered third-tier (“Category C”) violations. Companies should establish a defined intake and escalation channel for boycott-related requests and train the functions that actually receive them – sales, order management, logistics, accounts receivable, trade finance, and tender or bid teams – rather than only the trade compliance group. Legal and compliance must closely track quarterly filing deadlines. Because a request that is reportable but not prohibited is easy to overlook, the intake process should be triggered by boycott language, not by a determination that the language is unlawful.

Screen against the Requester List and reconcile Commerce with Treasury. The quarterly Boycott Requester List should be run against the customer, supplier, and counterparty base as a matter of routine – not to restrict dealings, which it does not require, but to identify in advance which relationships are likely to generate reportable requests. Separately, companies should confirm that relevant facts (such as geographic scope of operations) are reflected consistently in their Section 760.5 reports and their Form 5713 filings, while accommodating different reporting requirements and exemptions across the two regimes. The two regimes ask overlapping but non-identical questions; they are answered by different functions that often do not speak to one another. Legal and compliance teams can serve an important role by ensuring that information collected for the purpose of complying with the Commerce Department antiboycott rules is accurately relayed and appropriately tailored to the Treasury Department reporting requirements.

Gibson Dunn’s International Trade Advisory & Enforcement practice group is closely monitoring antiboycott developments and advises clients across the manufacturing, defense, financial services, technology, and logistics sectors on the full range of U.S. antiboycott issues under both the Commerce and Treasury regimes, including assessing antiboycott compliance programs, evaluating potential self-disclosures, and responding to agency inquiries. Should you have any questions regarding these issues, please do not hesitate to contact us.

The following Gibson Dunn lawyers prepared this update: Matthew Axelrod, Samantha Sewall, Soo-Min Chae, and Dominic Solari.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these issues. For additional information about how we may assist you, please contact the Gibson Dunn lawyer with whom you usually work, the authors, or the following leaders and members of the firm’ Sanctions & Export Enforcement or International Trade Advisory & Enforcement practice groups:

Europe:
Attila Borsos – Brussels (+32 2 554 72 10, aborsos@gibsondunn.com)
Patrick Doris – London (+44 207 071 4276, pdoris@gibsondunn.com)
Michelle M. Kirschner – London (+44 20 7071 4212, mkirschner@gibsondunn.com)
Penny Madden KC – London (+44 20 7071 4226, pmadden@gibsondunn.com)
Irene Polieri – London (+44 20 7071 4199, ipolieri@gibsondunn.com)
Benno Schwarz – Munich (+49 89 189 33 110, bschwarz@gibsondunn.com)
Nikita Malevanny – Munich (+49 89 189 33 224, nmalevanny@gibsondunn.com)
Melina Kronester – Munich (+49 89 189 33 225, mkronester@gibsondunn.com)
Vanessa Ludwig – Frankfurt (+49 69 247 411 531, vludwig@gibsondunn.com)

Companies continue to be required under Rule 14a-8(j) to notify the SEC when they intend to exclude Rule 14a-8 shareholder proposals from their proxy materials.

On August 14, 2026, the Division of Corporation Finance (the Division) of the U.S. Securities and Exchange Commission (the SEC) issued an Updated Statement Regarding the Division of Corporation Finance’s Role in the Exchange Act Rule 14a-8 Process [1] (the Updated Statement) announcing that the Division will continue and expand its practice of not responding to Rule 14a-8 no-action requests and not expressing any view in response to companies’ notices of their intention to exclude shareholder proposals on any of the bases available under Rule 14a-8. Companies continue to be required under Rule 14a-8(j) to notify the SEC when they intend to exclude Rule 14a-8 shareholder proposals from their proxy materials.

The Updated Statement follows on the Statement Regarding the Division of Corporation Finance’s Role in the Exchange Act Rule 14a-8 Process for the Current Proxy Season,[2] issued in November 2025 (the 2025 Statement), in which the Division initially stated that it would not substantively address or respond to most Rule 14a-8 no-action requests during the 2025-2026 proxy season (i.e., October 1, 2025 – September 30, 2026) due to limited staff resources and “the extensive body of guidance” available under Rule 14a-8. However, in the Updated Statement the Division states that it will not issue any form of response to Rule 14a-8(j) exclusion notices, ceasing the practice it had initiated under the 2025 Statement of issuing “No Objection” letters if a company’s exclusion notice contained an unqualified representation that the company had a reasonable basis to exclude the proposal based on the provisions of Rule 14a-8, prior published guidance, and/or judicial decisions. In addition, the Division’s new “no response” position will apply even to exclusion notices that assert Rule 14a-8(i)(1) as a basis for exclusion, “unless and until the Division announces otherwise.”[3]

The Updated Statement was previewed in remarks by Chairman Atkins on July 9, 2026 at the Society for Corporate Governance.[4] Addressing the 2025-2026 proxy season as “both a turning point and a proof of concept,” Chairman Atkins stated that a central takeaway from the 2025-2026 proxy season is that the Division’s “interposition between companies and shareholder proponents is unnecessary to effectively and efficiently resolve whether shareholder proposals should be included in proxy statements.” Noting “the significant time and costs expended by the SEC in prior proxy seasons that have been avoided this season,” he stated, “It is difficult for me to order our talented staff to return to a tedious, and evidently ineffectual, task in future years when so many other vital filings and issues lie unattended awaiting a delayed resolution.”

In the same speech, Chairman Atkins implored companies to prevent their annual meetings from becoming vehicles “for political or social debates that have little or no bearing on investors’ financial returns,” and he encouraged companies not to be “lackadaisical” and instead to pick up the “substantial tools” available to limit such proposals, reiterating that applying Rule 14a-8 is no different from the “difficult” securities law judgments that companies make all the time. Notably, in the 2025 Statement the Division stated, “Prior staff responses to Rule 14a-8 no-action requests are not binding and reflect only informal staff views… Likewise, a prior staff response indicating that the staff was unable to concur with a company’s view that a proposal may be excluded does not mean that companies cannot form a reasonable basis to exclude the same or a similar proposal.”[5] Consistent with those comments, Chairman Atkins stated with respect to Rule 14a-8(i)(7) that “companies do not need a no-action letter to reasonably conclude that what was once extraordinary – and perhaps constituted a significant social policy issue – may now be treated as ordinary.”

The Updated Statement is not likely to be the only action the SEC takes with respect to Rule 14a-8 this year. With “Shareholder Proposal Modernization” listed on the SEC’s rulemaking agenda under Chairman Atkins’s leadership,[6] even some shareholder proponents have acknowledged that the Rule 14a-8 shareholder proposal regime should be reformed.[7] Chairman Atkins has stated that “the SEC is also holistically evaluating the rule itself,” with its focus being the fundamental question of “what is the federal government’s appropriate role in regulating shareholder proposals.” These and other statements suggest that the SEC may propose to cease regulating who is eligible to submit shareholder proposals and what subjects are proper for shareholder proposals, and instead focus its rules on its traditional mandate under Exchange Act Section 14(a) by addressing and enhancing transparency around vote solicitations that are conducted in connection with shareholder proposals.

At least for the 2026-2027 proxy season, public companies will face a situation similar to the 2025-2026 proxy season. Companies can expect continued engagement with shareholder proponents as part of their overall shareholder engagement activities, and will need to carefully evaluate any shareholder proposals they receive. As noted above, if a company determines to exclude a proposal because the proposal or proponent has not satisfied Rule 14a-8, the company must still notify the Division and the proponent of its intention to exclude the proposal. However, as the Division will no longer issue a “No Objection” letter, the exclusion notice will not need to include an “unqualified representation” that the company has a “reasonable basis” to exclude the proposal, which is what the Division requested in exchange for the Division’s issuing a “No Objection” letter in the 2025-2026 proxy season. Under Rule 14a-8(j), the exclusion notice nevertheless should include “an explanation of why the company believes that it may exclude the proposal, which should, if possible, refer to the most recent applicable authority,” and a supporting opinion of counsel when such reasons are based on matters of state or foreign law. That explanation will continue to be closely scrutinized by other shareholders and by proxy advisory firms, as well as by shareholder proponents, and remains subject to potential legal challenge. As such, companies should continue to work closely with inside or outside counsel to assess the merits of their arguments before deciding to exclude a proposal. For additional guidance, see the Client Alert we issued when the Division issued its November 2025 statement that it would cease to issue Rule 14a-8 no-action responses.[8]

[1] Available at https://www.sec.gov/newsroom/speeches-statements/corpfin-statement-rule-14a-8-process-081426?utm_medium=email&utm_source=govdelivery.

[2] Available at https://www.sec.gov/newsroom/speeches-statements/statement-regarding-division-corporation-finances-role-exchange-act-rule-14a-8-process-current-proxy-season.

[3] In the 2025 Statement, the Division stated that although it generally would not issue no-action responses to Rule 14a-8 exclusion notices, it would respond to no-action requests under Rule 14a-8(i)(1). This carveout for Rule 14a-8(i)(1) exclusion arguments was based on Chairman Atkins’ speech questioning whether precatory proposals are proper subjects for shareholder action under Delaware law. The Updated Statement notes that the Division did not receive any no-action requests to exclude a proposal under Rule 14a-8(i)(1) during the 2025-2026 proxy season. See “SEC Chairman Atkins Comments on Rule 14a-8 Challenges to Non-Binding Shareholder Proposals, as well as Delaware and Texas Corporate Laws”.

[4] See Chairman Atkins, Remarks at the Society for Corporate Governance Conference (July 9, 2026), available at https://www.sec.gov/newsroom/speeches-statements/atkins-remarks-society-corporate-governance-07-09-2026-remarks-society-corporate-governance-conference.

[5] 2025 Statement, at note 3.

[6] Gibson Dunn Client Alert, “A New Day at the SEC: The SEC’s Spring 2025 Reg Flex Agenda” (Sept. 5, 2025), available at https://www.gibsondunn.com/the-pendulum-swings-again-the-sec-spring-2025-reg-flex-agenda/. The SEC’s current Regulatory Flexibility Act Agenda is available here.

[7] See Rulemaking Petition of the “Shareholders Rights Group,” https://www.sec.gov/files/rules/petitions/2026/petn4-918.pdf and an associated comment letter at https://www.sec.gov/files/rules/petitions/2026/petn4-917.pdf.

[8] See, “SEC Staff Issues Statement Revising Its Role in the Shareholder Proposal Process for the 2026 Proxy Season” (Nov. 18, 2025), available at https://www.gibsondunn.com/sec-staff-issues-statement-revising-its-role-in-the-shareholder-proposal-process-for-2026-proxy-season/.

The following Gibson Dunn lawyers prepared this update: Aaron Briggs, Mellissa Campbell Duru, Elizabeth A. Ising, Thomas J. Kim, Brian J. Lane, Julia Lapitskaya, Ronald O. Mueller, Michael A. Titera, Geoffrey E. Walter, and Lori Zyskowski.

Please view this and additional information on Gibson Dunn’s Securities Regulation & Corporate Governance Monitor.

Gibson Dunn’s lawyers are available to assist with any questions you may have regarding these developments. To learn more about these issues, please contact the Gibson Dunn lawyer with whom you usually work, or any of the following lawyers in the firm’s Securities Regulation & Corporate Governance practice group:

Aaron Briggs – San Francisco (+1 415.393.8297, abriggs@gibsondunn.com)
Mellissa Campbell Duru – Washington, D.C. (+1 202.955.8204, mduru@gibsondunn.com)
Elizabeth Ising – Washington, D.C. (+1 202.955.8287, eising@gibsondunn.com)
Thomas J. Kim – Washington, D.C. (+1 202.887.3550, tkim@gibsondunn.com)
Brian J. Lane – Washington, D.C. (+1 202.887.3646, blane@gibsondunn.com)
Julia Lapitskaya – New York (+1 212.351.2354, jlapitskaya@gibsondunn.com)
Ronald O. Mueller – Washington, D.C. (+1 202.955.8671, rmueller@gibsondunn.com)
Michael A. Titera – Orange County (+1 949.451.4365, mtitera@gibsondunn.com)
Geoffrey E. Walter – Washington, D.C. (+1 202.887.3749, gwalter@gibsondunn.com)
Lori Zyskowski – New York (+1 212.351.2309, lzyskowski@gibsondunn.com)

This update, the first in a series, explains what Perpetuals are and how they work, and traces recent relevant regulatory developments in the U.S.

Key Takeaways

Perpetual contracts are derivative contracts with no fixed expiration or maturity date that rely on a periodic funding rate mechanism to maintain alignment between the contract’s price and the price of the underlying asset.
Long a fixture of offshore digital asset markets, Perpetuals have begun trading on CFTC-regulated exchanges following the CFTC’s May 29, 2026 order approving the first U.S. Perpetual and an accompanying policy statement.
Additional U.S. listings have followed quickly, while Perpetuals referencing asset classes beyond certain digital commodities remain subject to case-by-case CFTC review.
The U.S. regulatory regime that applies to a particular Perpetual depends on how the product is classified under existing federal statutes. The CFTC and the SEC have jointly requested public comment on the application of those definitions to innovative products, including Perpetuals. This alert does not address how Perpetuals referencing different underlying assets should be classified.

I. Introduction

Perpetual contracts (Perpetuals), long a fixture of offshore digital asset markets, have made their debut in regulated U.S. markets thanks to recent action by the Commodity Futures Trading Commission (the CFTC).

This alert, the first in a series, explains what Perpetuals are and how they work, and traces recent relevant regulatory developments in the U.S. As outlined below, Perpetuals are innovative financial products for which global market demand is significant and rapidly expanding. The U.S. regulatory framework that will govern Perpetuals is still taking shape. Future publications in this series will address specific legal, regulatory and market structure issues relating to Perpetuals in greater depth.

II. What Is a Perpetual?

A. Definition

A Perpetual is a derivative contract. Like many derivatives, Perpetuals provide economic exposure to the price movement of an underlying asset. In contrast to other derivative contracts with a fixed expiration or maturity date, Perpetuals have an indefinite term.

Perpetuals rely on a periodic funding rate mechanism to maintain relative parity with the underlying asset’s spot price, whereas the price of a traditional futures contract converges with the spot price of its underlying on the expiration date.

Perpetuals may also be available to trade on a 24/7 basis where the rules and operational framework of the exchange on which they are listed permit. Although 24/7 trading is not inherent to Perpetuals, it is a common feature, particularly with respect to Perpetuals that reference an underlying that trades around the clock, such as most digital assets. Perpetuals also allow traders to take on greater exposure by using leverage, subject to any margining, clearing, risk management and customer protection requirements imposed by regulators, the relevant market and the trading venue.

B. Funding Rate

The funding rate is a periodic payment between long and short position holders, calculated and paid on a schedule set by contract terms. The funding rate is based generally on the difference between the Perpetual’s price and the spot price of the underlying asset. The methodology for calculating the funding rate is set by the listing venue and is typically published in the contract specifications for each product rather than kept proprietary. Although the precise formula varies by venue and by product, it generally includes a premium or discount component that measures the divergence of the Perpetual’s price, often calculated on a time-weighted average basis, from a spot index for the underlying asset and, on some venues, an interest rate component. Funding intervals also vary by venue and product, with payments commonly exchanged at one-hour to eight-hour intervals.[1] When the Perpetual trades above the spot price, the long position pays the short position an amount determined by the funding rate. Conversely, when the Perpetual trades below the spot price, the short position pays the long position the funding rate payment.

In a traditional futures contract, convergence with the spot price of the underlying occurs at expiration of the contract. By contrast, because a Perpetual has no expiration date, its funding rate is designed to promote alignment between the price of the Perpetual and the price of the underlying asset. When the Perpetual trades below the spot price, traders have an incentive to buy the Perpetual to receive the periodic payments determined by the funding rate, driving the price of the Perpetual up toward the spot price. The opposite occurs when the price of the Perpetual exceeds the spot price: payments to the short position incentivize selling the Perpetual, moving the price downwards.

C. Origins and Trading Venues

The concept of a derivative contract without a fixed expiration date was proposed in academic literature in the early 1990s,[2] but Perpetuals achieved commercial prominence in digital asset markets beginning in 2016, when offshore digital asset exchanges introduced Perpetuals where the underlying asset referenced was bitcoin. Perpetuals have since become among the most actively traded instruments in global digital asset markets, and trading venues have expanded the product to reference other underlyings, including other digital assets, precious metals, foreign exchange, equity indexes, single equities and the implied valuations of certain private companies.

Perpetuals currently trade on several distinct types of venues. Offshore centralized exchanges have historically accounted for the substantial majority of global trading volume in Perpetuals and operate outside the U.S. regulatory framework, subject to the licensing regimes of their home jurisdictions. Perpetuals are also listed on decentralized, or onchain, trading protocols, which execute trades and administer margin, funding payments and liquidations through smart contracts rather than through a centralized exchange operator. Most recently, as discussed in Section III below, certain Perpetuals referencing digital commodities, such as bitcoin and ether, have been listed on CFTC-registered designated contract markets (DCMs) and cleared through CFTC-registered derivatives clearing organizations (DCOs). The availability and design of the risk controls described below, and the regulatory requirements applicable to them, vary depending on the type of venue and the framework under which it operates.

D. Risk Controls

Trading venues may employ various tools to mitigate certain risks associated with Perpetuals:[3]

i. Auto-liquidation. Because Perpetuals permit traders to take on leverage without a fixed expiration date, exchanges rely on auto-liquidation as a primary tool for managing the counterparty and default risk that such positions create. Auto-liquidation lets an exchange set margin requirements at which trader positions are automatically closed and the trader’s collateral is applied to cover losses on the position, rather than initiating a margin call.

For example, a trader that posts $500 of margin at 2x leverage, thereby opening a Perpetual position worth $1,000, could have the position auto-liquidated if losses reduce the trader’s remaining margin below the applicable maintenance margin requirement. In practice, that liquidation threshold would generally be reached before the position declines enough to exhaust the full $500 of posted margin.

Auto-liquidation is designed to reduce the risk that losses on an under-margined position will exceed available collateral and affect the trading venue, clearing arrangement or other market participants. It can, however, result in rapid and involuntary closures of positions. A trader whose position is liquidated may not benefit from a subsequent price recovery. Traders may use stop-loss orders or other similar order types to exit a position before it reaches the applicable liquidation threshold. However, stop-loss orders do not guarantee execution at the specified price, particularly in fast-moving or illiquid markets, and they are distinct from margin, liquidation, clearing and default management controls that may be implemented by an exchange.

ii. Insurance funds. Some exchanges maintain insurance funds to address residual losses that remain after liquidation of a defaulting participant’s position. In a typical liquidation process, the exchange first closes the under-margined position and applies the participant’s collateral to cover losses. If there is insufficient collateral to cover the deficit, the insurance fund may be used to absorb the shortfall before losses are allocated to other market participants by way of auto-deleveraging (described below). Insurance funds are intended to protect against exchange-wide deficits, instituting a capital buffer that may be used to absorb residual losses. The size, capitalization and governance of insurance funds vary by venue and are distinct from the default resources required of a CFTC-regulated derivatives clearing organization.

iii. Auto-deleveraging. Auto-deleveraging addresses residual losses that remain after liquidation and any available insurance fund resources are exhausted. In the event of auto-deleveraging, an exchange reduces or closes positions of other market participants, typically profitable traders holding positions opposite the liquidated account, to offset the remaining shortfall. Auto-deleveraging is designed to preserve platform solvency and prevent losses from accumulating at the venue level, but it can also result in involuntary reductions or closures of otherwise profitable positions. The design and frequency vary by venue.

E. Use Cases and Principal Benefits

Market participants use Perpetuals for a variety of purposes that depend on the underlying referenced asset, product structure, and trading venue. Generally, Perpetuals provide synthetic long or short exposure to an underlying asset without buying or selling the asset itself. Because Perpetuals have no scheduled expiration date, they may also serve as a continuous trading instrument for market participants seeking exposure, hedging or arbitrage opportunities without periodically rolling a futures position. Common uses of Perpetuals are set forth below.

Directional exposure. Traders may use Perpetuals to take long or short positions based on expected price movements in the referenced asset.
Hedging. Market participants may use Perpetuals to hedge existing exposure to the referenced asset or to a related market.
Arbitrage. Traders may arbitrage the price difference between the Perpetual market and relevant spot or reference market, including differences reflected in funding rate payments.

Recently, offshore Perpetuals have provided synthetic exposure to private companies expected to go public. For example, in advance of several widely anticipated initial public offerings in 2025 and 2026, offshore venues listed Perpetuals referencing the implied valuations of the relevant pre-IPO companies, and prices in those markets were closely watched as an indication of market valuation for the offerings.

Perpetuals also have features that distinguish them from other financial products. Relative to traditional futures, Perpetuals avoid costs from rolling over or settling expired contracts and concentrate liquidity in one continuous contract. Perpetuals also differ from options in both structure and economics. An option provides the right, but not the obligation, to buy or sell the underlying asset at a specified price, in exchange for an upfront premium, and the value of an option generally erodes as its expiration approaches. A Perpetual, by contrast, provides linear exposure to the price of the underlying asset, involves no upfront premium (although margin must be posted and periodic funding rate payments apply) and has no expiration date. In addition, because options expire, a market participant seeking to maintain continuous exposure through options generally must roll its position into a new contract as each expiration approaches, incurring additional transaction costs, and potentially a new premium payment, with each roll. For market participants seeking continuous directional exposure, a Perpetual may therefore avoid the premium costs, time decay, rolling costs and expiration management associated with maintaining successive options positions. Additionally, compared with spot trading, Perpetuals provide long or short exposure without requiring ownership or custody of the asset itself. Because Perpetuals are typically offered with leverage, they can increase both potential gains and losses.

III. Regulatory Status of Perpetuals

On May 29, 2026, the CFTC issued an Order for Approval (the Kalshi Order) to KalshiEX, LLC (Kalshi), a CFTC-registered DCM, for the listing of the “BTCPERP Contract,” a Perpetual referencing the spot price of bitcoin, as a futures contract. The Kalshi Order also addressed the treatment of “similarly structured” Perpetuals that reference digital commodities with “deep, active, and continuous spot market trading,” as futures contracts. The CFTC determined that such Perpetuals exhibit the characteristics of futures contracts and reasoned that deep, active, broadly distributed and continuously observable spot trading in such assets supports the effective functioning of the funding rate mechanism.[4] Chairman Michael Selig described the approval as a “historic action” and stated that it creates a path for one of the most actively traded segments of the crypto asset markets to operate within the U.S. regulatory framework.[5]

On the same day, the CFTC indicated in a policy statement (the Policy Statement) that all Perpetuals that reference underlying assets outside the scope of the Kalshi Order, such as agricultural products, precious metals, equity securities, and narrow-based security indexes, should be submitted for case-by-case review and approval under CFTC Regulation 40.3 before being listed on a DCM. The CFTC stated that such products may raise novel questions relating to market structure, customer protection, resilience during periods of market stress and consistency with the Core Principles of the Commodity Exchange Act.[6]

The CFTC’s actions also highlight and build on the broader coordination between the CFTC and the U.S. Securities and Exchange Commission (SEC). The report released by the President’s Working Group on Digital Asset Markets in July 2025 (the PWG Report) encouraged the agencies to provide near-term regulatory clarity for innovative derivatives products, and a September 2025 joint statement by the agencies’ leadership identified Perpetuals as a priority area for regulatory harmonization, noting that the agencies could consider concurrent steps to bring onshore Perpetuals that meet investor and customer protection standards.[7] In March 2026, the CFTC and the SEC entered into a Memorandum of Understanding to coordinate their efforts to foster lawful innovation, uphold market integrity and bring novel financial products, including Perpetuals, onshore in the U.S.[8] CFTC Chairman Michael Selig and SEC Chairman Paul Atkins have each publicly supported this objective, with Chairman Selig stating that the CFTC will use the tools at its disposal to bring Perpetuals and other novel derivative products onshore, subject to appropriate safeguards.[9]

Market activity has developed quickly since the Kalshi Order was issued. Kalshi listed the BTCPERP Contract shortly after the Kalshi Order was issued and has since filed self-certifications for additional Perpetuals referencing other digital commodities. Bitnomial Exchange, LLC (Bitnomial) has launched Perpetuals referencing nine digital commodities, including bitcoin, ether and Solana, and Coinbase Derivatives, LLC (Coinbase Derivatives) has announced the conversion of certain existing futures contracts with expiration dates many years—often multiple decades—in the future into Perpetuals with no expiration date in reliance on the no-action relief described below. Market participants have also publicly expressed interest in Perpetuals referencing additional asset classes, such as foreign exchange, precious metals and energy commodities, which, under the Policy Statement, would be subject to case-by-case CFTC review.[10]

The characterization of Perpetuals has also become the subject of litigation. On June 18, 2026, Chicago Mercantile Exchange Inc. filed a complaint in the U.S. District Court for the District of Columbia against the CFTC and Chairman Selig challenging the Kalshi Order and the Policy Statement, arguing that Perpetuals are swaps, not futures, and that the CFTC did not sufficiently address the proper characterization of Perpetuals before approving the BTCPERP Contract. This alert does not address the merits of that litigation, which remains pending as of the date of this publication.[11]

A. Jurisdictional Considerations

The CFTC has jurisdiction over derivatives, including commodity futures, options and swaps. Accordingly, a Perpetual referencing a commodity, including many digital assets, may fall within the CFTC’s jurisdiction if it is structured as a futures contract, option or swap.

The SEC has jurisdiction over securities and security-based swaps, and the CFTC and the SEC share jurisdiction over security futures products, which are futures on a single security or on a narrow-based security index, while futures on a broad-based security index fall within the exclusive jurisdiction of the CFTC.[12] Accordingly, a Perpetual referencing a single security, a narrow-based security index, or another security-linked reference could fall within the SEC’s jurisdiction, the CFTC’s jurisdiction, or both, depending upon the design of the product and statutory classification. The precise allocation of jurisdiction over any particular Perpetual will depend on the classification of the product under these statutory definitions. In the Kalshi Order, the CFTC set out its reasoning for permitting certain Perpetuals referencing digital commodities to be listed by a DCM as futures contracts, and, as discussed below, the CFTC and the SEC have jointly requested public comment on the application of existing statutory definitions to Perpetuals and other innovative products, including whether a cash-settled Perpetual referencing an equity security could be treated as a security futures product. This alert does not address how any particular Perpetual is or should be classified.

B. Regulatory Updates

The following table summarizes the principal CFTC and SEC actions relevant to Perpetuals to date. Certain developments are specific to Perpetuals, such as the CFTC order issued on May 29, 2026 and the CFTC no-action letter issued on June 12, 2026. Other developments, such as those relating to product classification, margining or market structure, apply to the market more generally but are included based on their potential relevance to Perpetuals specifically.

Date	Development
April 21, 2025	The CFTC requested public comment on the trading and clearing of Perpetuals.[13]
May 29, 2026	The CFTC issued the Kalshi Order[14] and the Policy Statement,[15] and CFTC staff issued interpretive and no-action relief allowing Coinbase Financial Markets, Inc. to offer certain digital asset Perpetuals listed on Deribit FZE, an affiliated foreign board of trade, as “foreign futures” under CFTC Regulation 30.1.[16]
June 12, 2026	CFTC staff issued a no-action letter permitting Bitnomial and Coinbase Derivatives to convert certain existing “perpetual-style” digital commodity futures contracts into Perpetuals by removing their expiration dates, subject to the terms and conditions set out in the Kalshi Order.[17]
June 18, 2026	The CFTC and the SEC jointly requested comment on the clarification and harmonization of the definitions of “swap” and “security-based swap” and related interpretive issues that may be relevant to the characterization of Perpetuals. Comments are due August 24, 2026.[18]
June 22, 2026	The CFTC requested comment on (i) 24/7 trading of standard futures contracts and (ii) Perpetuals referencing physically delivered or storable energy commodities, such as crude oil, signaling that the CFTC is evaluating whether and how Perpetuals beyond digital commodities could be listed in U.S. markets. On July 23, 2026, the CFTC extended the comment deadline from July 27, 2026 to August 26, 2026 and added additional questions for public comment.[19]
June 26, 2026	The CFTC and the SEC jointly requested comment on the harmonization of portfolio margining and cross-margining of securities and derivatives, which, although not specific to Perpetuals, may affect the margining of Perpetuals or portfolios that include them. Comments are due August 31, 2026.[20]

IV. Conclusion

Perpetuals are increasingly popular financial products that are still finding their place within the U.S. regulatory framework. As of the date of this alert, that framework remains product- and asset-specific: recent CFTC orders, policy statements and staff no-action letters provide a pathway for certain digital commodity Perpetuals to be listed for trading in the U.S., while Perpetuals referencing other asset classes remain subject to a case-by-case analysis by either or both of the CFTC and the SEC. The proper characterization of certain Perpetuals under the federal derivatives and securities laws remains the subject of pending litigation and open requests for public comment. Market participants should continue to monitor CFTC and SEC activity as the regulatory framework for Perpetuals develops. Gibson Dunn’s Derivatives, Fintech and Digital Assets and Financial Regulatory teams are available to assist in any matters relating to Perpetuals and market regulation.

[1] For Perpetuals listed on DCMs to date, funding rates generally have been calculated at one-hour to eight-hour intervals, with the resulting payments applied to positions through the clearing process. By comparison, offshore centralized exchanges commonly use eight-hour funding intervals, although some venues or products use shorter intervals, including four-hour or one-hour intervals, and onchain trading protocols often apply funding even more frequently, in some cases settling payments every hour or accruing funding on an effectively continuous basis. The funding conventions for a particular product are set out in the listing venue’s contract specifications or protocol documentation.

[2] See Robert J. Shiller, Measuring Asset Values for Cash Settlement in Derivative Markets: Hedonic Repeated Measures Indices and Perpetual Futures, 48 J. Fin. 911 (1993).

[3] The risk controls described in this section are principally associated with offshore and onchain trading venues, which generally are not available to U.S. persons. The framework for Perpetuals listed on CFTC-regulated markets is different. A DCM is the CFTC-registered exchange on which a contract is listed and traded: it sets the terms of its listed contracts, establishes margin levels for those products and conducts market and trade practice surveillance. Perpetuals listed on a DCM are cleared through a DCO, a CFTC-registered clearinghouse that stands between the parties to each cleared contract and guarantees its performance, supported by initial and variation margin requirements, daily (and, as applicable, intraday) mark-to-market and prescribed default management procedures backed by a pre-defined waterfall of financial resources. Depending on the market structure, customers may access a DCM through a futures commission merchant (an FCM, which collects margin from its customers and must hold customer funds in segregated accounts) or, on non-intermediated venues, as direct participants. Under-margined positions on these markets are generally addressed through margin calls and, if a margin call is not met, liquidation of the position by the FCM in accordance with the customer agreement and applicable rules, or through liquidation procedures set out in the exchange’s and clearinghouse’s rulebooks, rather than through the discretionary insurance funds or auto-deleveraging mechanisms described above. DCMs and DCOs are also subject to statutory core principles and CFTC regulations addressing, among other things, position limits or position accountability levels, price fluctuation limits, minimum financial resource requirements and customer protections.

[4] See In re Request for Approval by KalshiEX LLC of the BTCPERP Futures Contract, Order Approving KalshiEX LLC BTCPERP Futures Contract (CFTC May 29, 2026), https://www.cftc.gov/filings/documents/2026/orgdcmkexbtxperporder26601.pdf (“Order for Approval”).

[5] See Michael S. Selig, Chairman, CFTC, Statement Regarding the Approval of the BTCPERP Contract, Release No. 9240-26 (May 29, 2026), https://www.cftc.gov/PressRoom/PressReleases/9240-26; see also Michael S. Selig, What American crypto asset perpetuals mean for the future of crypto, CoinDesk (May 29, 2026), https://www.coindesk.com/opinion/2026/05/29/what-american-crypto-asset-perpetuals-mean-for-the-future-of-crypto.

[6] See CFTC, Policy Statement Concerning the Listing of Perpetual Contracts, Release No. 9242-26 (May 29, 2026), 91 Fed. Reg. 33160 (June 3, 2026) (“May 29 Policy Statement”).

[7] See President’s Working Group on Digital Asset Markets, Strengthening American Leadership in Digital Financial Technology (July 30, 2025), https://www.whitehouse.gov/wp-content/uploads/2025/07/Digital-Assets-Report-EO14178.pdf; Paul S. Atkins & Caroline D. Pham, Joint Statement from the Chairman of the SEC and Acting Chairman of the CFTC (Sept. 5, 2025), https://www.sec.gov/newsroom/speeches-statements/joint-statement-atkins-pham-090525. For additional information regarding the PWG Report, see our prior publication, Update on the U.S. Digital Assets Regulatory Framework – Market Structure, Banking, Payments, and Taxation (Aug. 5, 2025), https://www.gibsondunn.com/update-on-the-us-digital-assets-regulatory-framework-market-structure-banking-payments-and-taxation/.

[8] See CFTC & SEC, Memorandum of Understanding between the U.S. Securities and Exchange Commission and the U.S. Commodity Futures Trading Commission regarding Harmonization in Areas of Common Regulatory Interest, Release No. 9192-26 (Mar. 11, 2026), https://www.cftc.gov/media/13471/SEC_CFTC_MOU031126/download.

[9] See Michael S. Selig, Chairman, CFTC, The Next Phase of Project Crypto: Unleashing Innovation for the New Frontier of Finance (Jan. 29, 2026), https://www.cftc.gov/PressRoom/SpeechesTestimony/opaselig1.

[10] See, e.g., Anirban Sen, Exclusive: Kalshi in Talks with Regulators to Expand Never-Expiring Derivatives to New Areas, Reuters (July 9, 2026), https://www.reuters.com/business/finance/kalshi-talks-with-regulators-expand-never-expiring-derivatives-new-areas-2026-07-09 ; KalshiEX LLC, Commission Regulation 40.3(a), Voluntary Submission of New Products for Commission Review and Approval Regarding the Initial Listing of the GOLDPERP Futures Contract (July 21, 2026), https://www.cftc.gov/filings/ptc/ptc07212611017.pdf; KalshiEX LLC, Commission Regulation 40.3(a), Voluntary Submission of New Products for Commission Review and Approval Regarding the Initial Listing of the SILVERPERP Futures Contract (July 21, 2026), https://www.cftc.gov/filings/ptc/ptc07212611023.pdf; KalshiEX LLC, Commission Regulation 40.3(a), Voluntary Submission of New Products for Commission Review and Approval Regarding the Initial Listing of the PLATINUMPERP Futures Contract (July 21, 2026), https://www.cftc.gov/filings/ptc/ptc07212611030.pdf; CFTC, Request for Comment on the Extension of Standard Futures Contracts to 24/7 Trading and on Perpetual Contracts Referencing Physically Delivered or Storable Energy Commodities, Release No. 9259-26 (June 22, 2026), 91 Fed. Reg. 38334 (June 25, 2026) (“Extension RFC”); May 29 Policy Statement, supra note 6.

[11] See Complaint, Chi. Mercantile Exch. Inc. v. Selig, No. 1:26-cv-02157 (D.D.C. June 18, 2026), ECF No. 1.

[12] See 7 U.S.C. § 2(a)(1)(D); 15 U.S.C. § 78c(a)(55) (security futures and security futures products); 7 U.S.C. §§ 2(a)(1)(A), 2(a)(1)(C)(ii) (futures on broad-based security indexes).

[13] See CFTC, Request for Comment on the Trading and Clearing of “Perpetual” Style Derivatives, Release No. 9069-25 (Apr. 21, 2025), https://www.cftc.gov/media/12041/Perpetuals_RFC042125/download.

[14] See Order for Approval, supra note 4.

[15] See May 29 Policy Statement, supra note 6.

[16] See CFTC, Staff Interpretation Regarding the Categorization of Deribit Perpetuals as Foreign Futures and No-Action Position Regarding Digital Commodities and Payment Stablecoins Deposited to Margin Customer Positions with a Foreign Broker Under a Right of Re-Use (No-Action Letter), Release No. 9241-26 (May 29, 2026), https://www.cftc.gov/csl/26-17/download.

[17] See CFTC, No-Action Positions Regarding Removal of Expiration Dates from Existing Digital Commodity Perpetual-Style Futures Contracts (No-Action Letter), Release No. 9252-26 (June 12, 2026), https://www.cftc.gov/csl/26-19/download.

[18] See CFTC & SEC, Joint Request for Comment on Further Definition of “Swap” and “Security-Based Swap” and on Alternative Compliance (Request for Comment), Release No. 9258-26 (June 18, 2026), 91 Fed. Reg. 37873 (June 24, 2026).

[19] See Extension RFC, supra note 10. The comment period was subsequently extended to August 26, 2026, and additional questions were posed for public comment. See Press Release, CFTC, CFTC Extends Public Comment Period on Proposed Rule on the Extension of Standard Futures Contracts to 24/7 Trading and on Perpetual Contracts Referencing Physically Delivered or Storable Energy Commodities (July 23, 2026), https://www.cftc.gov/PressRoom/PressReleases/9271-26.

[20] See CFTC & SEC, Joint Request for Comment on Further Implementation of Portfolio Margining and Cross-Margining of Securities and Derivatives (Request for Comment), Release No. 9262-26 (June 26, 2026), 91 Fed. Reg. 39579 (June 30, 2026).

The following Gibson Dunn lawyers prepared this update: Jeffrey Steiner, Sara Weed, Mellissa Campbell Duru, Nick Harper, Hagen Rooke, Marian Fowler, Matt Gregory, William Hallatt, Sameera Kimatrai, Michelle Kirschner, Lauren Cook Jackson, Rachel Jackson, Hayden McGovern, Karin Thrasher, Alexis Levine, and Frederick Freeman.

Gibson Dunn’s lawyers are available to assist with any questions you may have regarding these developments. To learn more, please contact the Gibson Dunn lawyer with whom you usually work, any leader or member of the firm’s Derivatives, Securities Regulation & Corporate Governance, Fintech & Digital Assets, Financial Institutions, Financial Regulatory, or Administrative Law & Regulatory practice groups, or the following authors:

Mellissa Campbell Duru – Washington, D.C. (+1 202.955.8204, mduru@gibsondunn.com)

Marian Fowler – Washington, D.C. (+1 202.955.8525, mfowler@gibsondunn.com)

Matt Gregory – Washington, D.C. (+1 202.887.3635, mgregory@gibsondunn.com)

William R. Hallatt – Hong Kong (+852 2214 3836, whallatt@gibsondunn.com)

Nick Harper – Washington, D.C. (+1 202.887.3534, nharper@gibsondunn.com)

Lauren Cook Jackson – Washington, D.C. (+1 202.955.8293, ljackson@gibsondunn.com)

Sameera Kimatrai – Dubai (+971 4 318 4616, skimatrai@gibsondunn.com)

Michelle M. Kirschner – London (+44 20 7071 4212, mkirschner@gibsondunn.com)

Hagen H. Rooke – Singapore (+65 6507 3620, hhrooke@gibsondunn.com)

Jeffrey L. Steiner – Washington, D.C. (+1 202.887.3632, jsteiner@gibsondunn.com)

Sara K. Weed – Washington, D.C. (+1 202.955.8507, sweed@gibsondunn.com)

FDA has proposed converting its voluntary notification program for substances in food that are generally recognized as safe (GRAS) into a mandatory one, with a one-year window for streamlined submissions for food substances already on the market. If the GRAS notification requirement is not met, FDA intends to consider noncompliance as a factor in its prioritization of food substances for post-market review.

On August 10, 2026, HHS announced FDA’s widely anticipated proposed rule requiring submission of GRAS notifications (the GRAS rule). HHS also announced “final review” of a proposed definition of “ultra-processed foods,” referring to an HHS/FDA/USDA white paper currently under review with the Office of Management and Budget.[1]

The GRAS rule proposes to amend FDA regulations (21 CFR parts 170 and 570) to require notices for uses of human and animal food substances purported to be GRAS under section 201(s) of the Federal Food, Drug, and Cosmetic Act (FD&C Act).[2] This proposed rule follows Secretary Kennedy’s March 10, 2025 direction that FDA eliminate the pathway by which GRAS substances are marketed without notification to FDA.[3] Acting FDA Commissioner Kyle Diamantas described the GRAS rule as closing a decades-old information gap while “respecting the limitation to our authority,” referring to commentary that FDA lacks the statutory authority to mandate GRAS reporting.[4] The comment period for the proposed rule closes on December 9, 2026.

GRAS notification requirement, with seven exceptions. Under the proposed rule, any person introducing a substance into interstate commerce under the GRAS provision would be required to notify FDA of the basis for its GRAS conclusion, unless one of seven exceptions applies:

The substances are subject to an existing “no questions” letter that covers the conditions of its intended use. A letter may not extend to a use where identity, manufacturing process, or conditions of use differ significantly from the underlying notice.
The substances are listed or affirmed as GRAS in 21 CFR Parts 182, 184, or 186, which hinge on particular conditions of use.
The substances are considered GRAS as (a) pre-1958 ingredients of natural biological origin widely consumed for their nutrient properties and without known detrimental effects or (b) substances affirmed as GRAS under its intended use in Part 184 or 186, with no limitation other than good manufacturing practice, so long as its conditions of use do not differ significantly from those in the regulation.
The substances’ intended use has been considered by FDA through established FDA processes (i.e., Voluntary Premarket Consultations and Meetings, or Animal Cell Culture Consultations), and public FDA documentation does not identify a need for a GRAS notice. Informal technical assistance and the Early Food Safety Evaluation Program do not qualify.
The substances’ intended use is subject of a threshold of regulation (TOR) exemption.
The substances are subject to an effective food contact substance notification (FCN), for the manufacturer or supplier listed in the FCN.[5]
Substances where information about the intended conditions of use has been submitted in a streamlined submission, discussed further below, and the submission is included on a public list, unless FDA has determined a GRAS notice or food additive petition must be submitted.[6]

Review timelines remain the same, with additional extension. The notification obligation is met only when FDA files the submission. FDA proposes a 45-day pre-filing evaluation period and intends to issue filing decision letters within two business days. In terms of review timelines, existing regulations provide for an 180-day review period after filing, followed by one 90-day extension, if needed. The proposed rule would add the option for a second 90-day extension. The addition of a second 90-day extension suggests an anticipated strain on review timelines, but FDA does not estimate the staffing or other resources required to absorb the increase in GRAS notices.

Time-limited streamlined submission option. For a period of one year after a final rule goes into effect, a streamlined submission will be able to substitute for a full GRAS notice for certain intended uses of substances that were introduced into interstate commerce before the effective date. This streamlined submission need not include underlying data or information pertaining to a conclusion of GRAS status but would need to include the file number of any prior GRAS notice on which FDA issued a cease to evaluate letter. A streamlined submission would not be available, however, for conditions of use that are the subject of an insufficient basis letter or of an FDA determination that the substance is not GRAS. FDA notes that it intends to use the information gathered through these streamlined submissions to evaluate whether the use of substances should be re-evaluated, including whether a GRAS notice must be submitted for the intended use of the substance that is the subject of a streamlined submission.

No premarket review? FDA asserts that a mandatory GRAS notification program would not, unlike with food additives, constitute a premarket review and approval requirement. Rather, the proposed rule would facilitate FDA’s efficient administration and enforcement of provisions of the FD&C Act that task FDA with identifying food substances that have not been the subject of a safety review. FDA also submits that a company can introduce a substance into interstate commerce before submitting a GRAS notice, or continue to market purported GRAS substances before submitting a GRAS notice or after submitting a GRAS notice before it is filed with FDA. FDA states that failure to comply with the GRAS notification requirements would factor into the agency’s prioritization of food substances for post-market review.

Other key aspects of the proposed rule include:

Implications of ceased evaluations: Currently, a notifier can ask FDA to cease evaluating a GRAS notice with no regulatory implications. Of 1,215 filed GRAS notices that have been resolved, 231 have ended in a cease-to-evaluate letter, with roughly 17% for human foods, and 37% for animal foods.[7] Under the proposed rule, if FDA ceases evaluation, even of its own accord, it means the notification requirement is not met.
Expanded threshold of regulation (TOR) exemption. Current FDA regulations allow for an exemption from regulation for substances used in food contact articles if such substance meets certain criteria that demonstrate safe use due to very low dietary exposure. The proposed rule would exempt food substances more broadly from the GRAS notification requirement if it meets these TOR criteria.
No-questions letters can be updated or rescinded. The proposed rule provides that FDA can question a notifier after issuing a no-questions letter, and may update or rescind it.
Public disclosure. FDA currently makes data and information in GRAS notices publicly available in a searchable inventory. FDA further puts the onus on submitters of GRAS notices to identify specific data and information viewed as exempt from public disclosure under the Freedom of Information Act. Under the proposed rule, if submitters fail to do so, FDA will consider the data and information not to be exempt from disclosure or that the submitter has waived any claim of confidentiality.
Application to animal food. FDA proposes parallel revisions to FDA’s animal food regulations that largely track the human food provisions, with certain key differences. FDA proposes two exceptions to the GRAS notice requirement with no human food counterpart: one for substances whose intended use has been the subject of an established animal-ingredient consultation with FDA (e.g., the Animal Food Ingredient Consultation) and a summary document made publicly available by FDA through that process indicates FDA has no questions or concerns about its safety; and one for ingredients listed in and used in accordance with Chapter 6 of the 2024 edition of the Official Publication of the Association of American Feed Control Officials (AAFCO), unless FDA has publicly expressed concerns about the ingredient’s GRAS status or the use of the ingredient. Streamlined submissions for animal food ingredients must identify the target species and, for food-producing animals, the residue quantities to which humans may be exposed in edible animal tissues.
Rule compliance dates: FDA proposes a final rule effective date of 60 days after its publication, and a compliance date of 18 months after the effective date. The window for streamlined submissions would close one year after the effective date.

Looking ahead

Preparation. Companies relying on independent GRAS conclusions should start preparing now. In particular, they should: (1) inventory self-affirmed determinations and supporting documentation, including those inherited through acquisitions or held by suppliers; (2) determine which uses are already covered by a no questions letter, a GRAS affirmation or listing, or an effective FCN, and confirm conditions of use have not evolved; (3) evaluate whether particular uses are suited for a TOR request or FCN (neither is available for animal food); and (4) decide which legacy food substances go through a streamlined submission versus a full notice.

Legislation. GRAS notification rulemaking could turn into GRAS notification legislation. HHS has urged Congress to legislate, and Acting Commissioner Diamantas has described bipartisan discussions on legislative options for GRAS and nutrition reform. However, no introduced GRAS legislation on the Hill is bipartisan at this time, and obstacles to such legislation include likely sticking points on the scope of GRAS reporting, enforcement authorities, state preemption, and FDA funding amounts and mechanisms (e.g., appropriated funds versus user fees). Public reception to the proposed rule could influence bipartisan talks and momentum for legislation, as could the results of the midterm elections this fall.

Gibson Dunn lawyers are prepared to help companies consider and address the implications of these changes, if finalized, and submit comments to FDA on the proposed rule.

[1] U.S. Department of Health and Human Services, Secretary Kennedy Announces Landmark Food Policy Reforms to Advance President Trump’s MAHA Agenda (Aug. 10, 2026), https://www.hhs.gov/press-room/hhs-announces-ultra-processed-foods-gras-reforms.html. Office of Information and Regulatory Affairs, Pending EO 12866 Regulatory Review: White Paper: Proposed Definition of Ultra-Processed Food, RIN 0910-ZD60 (HHS/FDA), received Aug. 3, 2026, https://www.reginfo.gov/public/do/eoDetails?rrid=1495413.

[2] Food and Drug Administration, HHS, Substances Generally Recognized as Safe, Proposed rule, 91 Fed. Reg. 51834 (Aug. 11, 2026), Docket No. FDA-2025-N-3262, RIN 0910-AJ02; FDA, Substances Generally Recognized as Safe: Preliminary Regulatory Impact Analysis (PRIA), Initial Regulatory Flexibility Analysis, Unfunded Mandates Reform Act Analysis, Docket No. FDA-2025-N-3262, https://www.fda.gov/media/194138/download.

[3] U.S. Department of Health and Human Services, HHS Secretary Kennedy Directs FDA to Explore Rulemaking to Eliminate Pathway for Companies to Self-Affirm Food Ingredients Are Safe (Mar. 10, 2025), https://www.hhs.gov/press-room/revising-gras-pathway.html; see also The MAHA Report (May 2025), available at https://www.whitehouse.gov/wp-content/uploads/2025/05/MAHA-Report-The-White-House.pdf.

[4] Remarks of Acting FDA Commissioner Kyle Diamantas, press event (Aug. 10, 2026) https://www.youtube.com/watch?v=PQWnhvLsvBk.

[5] The TOR and FCN exceptions do not apply to animal food.

[6] Certain uses cannot be the subject of a GRAS notice because they fall outside the statutory definition of a food additive: pesticide chemicals and pesticide chemical residues, color additives, substances used under a sanction or approval granted before September 6, 1958, new animal drugs, and ingredients described in section 201(ff) of the FD&C Act in, or intended for use, in a dietary supplement.

[7] See PRIA at 12.

The following Gibson Dunn lawyers prepared this update: Katlin McKelvie, Carlo Felizardo, and Al Kelly.

Gustav W. Eyler – Washington, D.C. (+1 202.955.8610, geyler@gibsondunn.com)
Katlin McKelvie – Washington, D.C. (+1 202.955.8526, kmckelvie@gibsondunn.com)
Carlo Felizardo – Washington, D.C. (+1 202.955.8278, cfelizardo@gibsondunn.com)
Al Kelly – Denver (+1 303.298.5742, akelly@gibsondunn.com)

When can thousands of individual GDPR claims be pursued as a single collective action in the EU?

In a significant ruling, a German appeals court made filing collective actions for damages materially harder.[1] The Berlin Court of Appeal (Kammergericht) dismissed a collective redress action against the platform X, holding that non-material damages resulting from alleged GDPR violations are not sufficiently “similar” to be bundled under Germany’s collective redress regime. The decision, which is subject to appeal to the German Federal Court of Justice (Bundesgerichtshof, FCJ), highlights a fundamental tension between the individualized nature of German tort law and the procedural logic of collective redress. If approved by the FCJ, questions about “similarity of claims” would likely become more contested in German collective redress and could become a vital defense tool, similar to contesting “commonality” in U.S. class actions.

1. Background and Facts of the Case

The case concerns a collective action brought by a Dutch consumer protection organization against X in connection with two categories of alleged GDPR violations:

extensive data processing and tracking practices for personalized content and advertising, and
an “API bug” that allegedly enabled the association of user accounts with phone numbers or email addresses.

The claimant sought non-material damages on behalf of users located in Germany in the form of lump-sum compensation, including a minimum of EUR 750 per user. The action was brought under the German Consumer Rights Enforcement Act (Verbraucherrechtedurchsetzungsgesetz – VDuG), which transposes the EU Directive 2020/1828 on representative actions (RAD) and enables qualified entities to pursue collective redress actions (Abhilfeklage) on behalf of consumers.

This procedure consists of two stages.

In the first stage, a court issues a judgment deciding the common questions of law and fact (Abhilfegrundurteil). Critically, that judgment must specify by which means individual consumers can prove that they rightfully opted into the action and are entitled to claim damages.
In the second stage, an appointed administrator (Sachwalter) distributes the collective sum to registered consumers purely by checking these stipulated proofs of eligibility. Importantly, there is no assessment of individualized harms possible at this stage. This makes the similarity requirement central: only claims that can be resolved without a detailed, case-by-case inquiry into individual harm are suitable for a collective redress action.

2. Key Holdings

The court held the claim inadmissible for lack of “similarity” (Gleichartigkeit) of claims required by § 15(1) VDuG.

Central requirement: “similarity” of claims

Under the VDuG, collective actions require that claims be “essentially of the same kind” (gleichartig). The court emphasized that this requirement is particularly strict in collective redress proceedings as this type of action enables consumers to claim damages without further individualized consideration of the facts specific to their case.

Individualized nature of GDPR damages

The Kammergericht opined that damages cannot be established in the abstract, divorced from the individual consumer. In its view, damages for data privacy violations inherently depend on individual circumstances which, as presented by the claimant, defeat the similarity requirement. Among these individual circumstances the court includes

the duration of the loss of control,
the development of negative emotions such as fear or distress,
any actual misuse of the data,
the nature and sensitivity of the affected data,
whether the person had already lost control over the same data,
the user’s own handling of their data (including voluntary public disclosure),
the duration and intensity of platform use, and,
for minors, age and degree of maturity.

No “average consumer” or abstract harm model

The court rejected the claimant’s reliance on an “average affected person” or “average internet user,” holding that German law recognizes no such generalized standard for this assessment.

No minimum compensation to all users

The court also refused to award uniform minimum compensation to all users, which would allow them to pursue further compensation individually. Such an approach would undermine the purpose of collective proceedings which aim to increase efficiency by combining individual claims.

The judgment is subject to appeal to the German Federal Court of Justice, which has not yet ruled on a similar case.

3. Takeaways and Outlook for Collective Enforcement

A new certification-style battleground

The decision, if confirmed on appeal, is likely to elevate “similarity” into the central contested gateway of German collective redress, particularly for lump-sum non-material damage claims, much as “commonality” and “predominance” operate as the decisive battleground in U.S. class certification. Defendants facing collective claims in Germany should therefore expect “similarity” to become an important early line of defense and resource it accordingly, just as U.S. defendants concentrate on defeating certification.

A potentially higher bar than U.S. class certification

The German “similarity” requirement may prove more demanding than its U.S. analogue. U.S. courts have developed tools to accommodate individualized damages without denying certification outright, so they do not necessarily defeat a class.

Due to the Kammergericht’s finding that individualized damages cannot be “parked” for a later phase, as they can in U.S. practice, similarity functions as a fused commonality-and-predominance gate.

A European defense strategy becomes vital

In line with the principle of procedural autonomy, the RAD explicitly leaves it up to the Member States to specify the required degree of similarity of individual claims.[2] Claimants may seek to circumvent the structural rigidity of the “similarity” requirement in Germany by fine-tuning future claims or forum-shopping toward more permissive EU jurisdictions.

In 2025, the Amsterdam Court of Appeals held that GDPR claims for non-material damages can be pursued collectively under the Dutch Civil Code.[3] That approach is the mirror image of the Kammergericht’s and points to growing fragmentation across the EU. An effective defense of future class and representative actions in the EU will need to take a broad view across multiple EU jurisdictions. It will require constantly monitoring developments at the European level and evaluating whether and when to advocate before national courts for a referral to the Court of Justice of the European Union as the final authority on the interpretation of EU law.

[1] Kammergericht Berlin, judgement of 30 April 2026, 20 VKl 1/25.

[2] Recital 12 RAD.

[3] Gerechtshof Amsterdam, Judgement of 07 October 2025, ECLI:NL:GHMAMS:2025:2666.

The following Gibson Dunn lawyers prepared this update: Friedrich Wagner, Alexander Schürmann, Carla Baum, and Katharina Heinrich.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these topics. Please contact the Gibson Dunn lawyer with whom you usually work, any leader or member of the firm’s Privacy, Cybersecurity & Data Innovation or Class Actions practice groups, or the authors:

Friedrich A. Wagner – Munich (+49 89 189 33 262, fwagner@gibsondunn.com)

Alexander Schürmann – Frankfurt (+49 69 247 411 537, aschuermann@gibsondunn.com)

Carla Baum – Munich (+49 89 189 33 263, cbaum@gibsondunn.com)

Katharina Heinrich – Munich (+49 89 189 33 275, kheinrich@gibsondunn.com)

Current market conditions are creating attractive sell-down opportunities in Spain.

Investors looking to monetise stakes in Spanish listed companies are benefiting from strong equity markets, increased investor demand and competitive execution dynamics.

Recent accelerated secondary block trades in Spain include Naturgy, Cirsa, Indra, Sacyr, CIE Automotive or Arteche.

Understanding the legal and commercial issues may be what separates a clean execution from a missed window.

Key Commercial Considerations

Decisions on structure, timing and stakeholder management can have a significant impact on pricing and deal certainty

Choosing the right execution structure – selecting between a bought deal, backstopped or best-efforts, each striking a different balance between price and risk
Aligning stakeholders – coordinating with participating issuers (buy-back, new raise or treasury re-placement), banks (increased competition allows for seller-friend terms) and legal advisors is critical for the momentum
Optimising timing – favourable market windows can be short, so the ability to move quickly on documentation and structuring points is essential for execution
Other hot topics – liaising with lenders for timely release of any security over the shares subject to the block trade and potential 30-day stabilisation to support the aftermarket

Key Legal Considerations

Addressing the legal and commercial issues early can help maximise flexibility and achieve a successful outcome

Market abuse regulation – assessing clean trading windows (blackouts, inside info, peer reporting, macro) and cleansing strategy if launch is delayed after wall-crossing
Taxation is a recurrent theme a seller must consider carefully (FTT impact, availability of exemptions, cross-border parties and seller’s tax insurance)
Regulatory filings (significant-shareholder & PDMR) and impact of the sell-down on the issuer’s corporate governance
Closing and settlement mechanics – careful and early planning in these type of accelerated placements is paramount to minimize execution risk

HOW WE HELP

Gibson Dunn advises investors, issuers and financial institutions on some of the market’s most complex and high-profile ECM transactions, including secondary sell-downs. Our integrated global platform combines local market knowledge with cross-border execution experience, enabling clients to navigate accelerated transactions efficiently and confidently.

If a transaction is on your radar, we would be glad to talk.

The following Gibson Dunn lawyers prepared this update: Armando Albarrán, Alfonso Bernar, and Lucía Berrícano Bayón.

Gibson Dunn’s lawyers are available to assist with any questions you may have regarding these developments. Please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any of the following members of the firm’s Capital Markets, Private Equity, or Mergers and Acquisitions practice groups:

Armando Albarrán – Madrid (+34 919 340 801, aalbarran@gibsondunn.com)

Alfonso Bernar – Madrid (+34 919 340 802, abernar@gibsondunn.com)

Hugo Hernández-Mancha – London (+44 20 7071 4267, hhernandez-mancha@gibsondunn.com)

Asís Martín de Cabiedes – Madrid (+34 919 340 806, amartindecabiedes@gibsondunn.com)

Reka Palla – Madrid (+34 919 340 805, rpalla@gibsondunn.com)

Mario Pacini – Madrid (+34 919 340 804, mpacini@gibsondunn.com)

Lucía Berrícano Bayón – Madrid (+34 919 340 809, lberricanobayon@gibsondunn.com)

Alberto Broseta – Madrid (+34 919 340 803, abroseta@gibsondunn.com)

This update summarizes the Court’s reasoning, explains the decision’s practical significance, and identifies key considerations for employers, fiduciaries, and other parties evaluating potential withdrawal liability exposure.

On May 21, 2026, the Supreme Court unanimously held that ERISA does not require multiemployer pension plans to calculate withdrawal liability using only actuarial assumptions adopted on or before the statutory measurement date. In M & K Employee Solutions, LLC v. Trustees of the IAM National Pension Fund, No. 23-1209, 608 U.S. ___ (2026), Justice Jackson, writing for the Court, affirmed the D.C. Circuit and rejected the argument that ERISA’s “as of” measurement-date language for withdrawal liability determinations freezes the actuarial assumptions that must be used to determine an employer’s withdrawal liability.

The decision is significant for employers participating in multiemployer pension plans, and for multiemployer plan trustees, fiduciaries, and actuaries. The Court held that ERISA §§ 4211 and 4213, codified at 29 U.S.C. §§ 1391 and 1393, do not impose a deadline by which actuarial assumptions must be selected. Instead, the statute requires that assumptions and methods must, in the aggregate, be reasonable, take into account plan experience and reasonable expectations, and reflect the actuary’s best estimate of anticipated plan experience.[1]

At the same time, the Court did not give plans and actuaries carte blanche. Employers remain able to challenge withdrawal liability assessments in arbitration, including on the ground that the assumptions used were unreasonable. The Court also expressly left open whether assumptions adopted after the measurement date must be based only on information available as of that date.[2]

This alert summarizes the Court’s reasoning, explains the decision’s practical significance, and identifies key considerations for employers, fiduciaries, and other parties evaluating potential withdrawal liability exposure.

Background

ERISA, as amended by the Multiemployer Pension Plan Amendments Act of 1980, requires an employer that withdraws from an underfunded multiemployer pension plan to pay “withdrawal liability.”[3] Withdrawal liability represents the employer’s share of the plan’s unfunded vested benefits—that is, the difference between the present value of vested benefits owed to participants and beneficiaries and the value of plan assets.[4]

ERISA generally requires withdrawal liability to be calculated “as of” the last day of the plan year preceding the year of withdrawal—i.e., the measurement date.[5] That calculation depends not only on hard data, such as the number of participants and the value of plan assets, but also on actuarial assumptions about future events, including mortality, retirement dates, investment returns, and discount rates.

The discount rate is particularly important. As the Court explained, the discount rate is the interest rate used to convert future benefit payments to present value. A higher discount rate generally reduces the present value of liabilities, which then reduces unfunded vested benefits and withdrawal liability; a lower discount rate generally has the opposite effect.[6]

Facts and Procedural History

Prior to January 2018, the IAM National Pension Fund used a 7.50% discount rate to value unfunded vested benefits. In January 2018, after the relevant December 31, 2017 measurement date, the Fund and its actuarial firm adopted a 6.50% discount rate for withdrawal liability calculations for employers withdrawing in 2018. The petitioning employers withdrew between April and December 2018. The Fund assessed their withdrawal liability using the 6.50% discount rate, which increased their potential liability compared to what it would have been with a 7.50% discount rate. For example, M&K Employee Solutions was assessed approximately $6.2 million using the 6.50% rate, whereas using the prior 7.50% rate would have resulted in an assessment of approximately $1.8 million.[7]

The employers initiated arbitration under 29 U.S.C. § 1401(a). The arbitrators ruled for the employers, concluding that the Fund could not apply assumptions adopted after the December 31, 2017 measurement date and instead had to use the assumptions “in effect” on that date. The Fund sought review in federal district court, where three of the cases were consolidated and the fourth proceeded separately. The district courts disagreed with the employers’ position, and the D.C. Circuit affirmed, holding that actuaries could select assumptions after the measurement date.[8]

The Supreme Court granted certiorari to resolve a split with the Second Circuit, which had held that interest-rate assumptions for withdrawal liability purposes must be adopted no later than the measurement date.[9]

The Supreme Court’s Decision

The Supreme Court affirmed the D.C. Circuit, holding that ERISA “does not require pension plans to assess withdrawal liability based on actuarial assumptions adopted before the measurement date.”[10]

The Court first rejected the employers’ argument that 29 U.S.C. § 1391 freezes actuarial assumptions as of the measurement date. In the Court’s view, § 1391’s “as of” language fixes the historical data used in the withdrawal liability calculation—such as plan assets and participant information—but does not dictate when the actuary must select the assumptions used to perform that calculation. The Court reasoned that actuarial assumptions are not observable facts “in effect” on a particular date; they are predictive judgments and valuation tools used to calculate unfunded vested benefits.[11]

The Court then held that 29 U.S.C. § 1393, which governs actuarial assumptions used for this purpose, confirms that conclusion. Section 1393 requires assumptions and methods that, in the aggregate, are reasonable, account for plan experience and reasonable expectations, and reflect the actuary’s “best estimate of anticipated experience under the plan.”[12] But it contains no deadline for selecting assumptions, and, the Court explained, courts generally do not read limitations into statutes that Congress omitted.[13] The Court also contrasted § 1393 with 29 U.S.C. § 1399(c)(1)(A)(ii), where Congress expressly referred to assumptions used for the “most recent actuarial valuation,” reinforcing that Congress knew how to impose timing limits when it wished to do so.[14]

The Court further reasoned that the employers’ proposed rule could undermine § 1393’s “best estimate” requirement by forcing actuaries to rely on assumptions selected before relevant plan or market information became available. In the Court’s view, ERISA does not require actuaries to value unfunded vested benefits using measurement-date data while applying assumptions based on older facts.[15]

Finally, the Court rejected the employers’ anti-retroactivity and policy arguments. 29 U.S.C. § 1394, which limits application of certain post-withdrawal plan rules or amendments, does not apply to actuarial assumptions. And while the employers warned of manipulation, the Court held that policy concerns cannot override statutory text. Employers remain able to challenge assumptions in arbitration, including on the ground that they are unreasonable.[16]

Key Takeaways for ERISA Plan Sponsors, Contributing Employers, and Fiduciaries

Multiemployer plans and actuaries have greater timing flexibility. The M & K decision confirms that ERISA does not require actuarial assumptions for withdrawal liability calculations to be adopted on or before the measurement date. Plans may adopt assumptions later, provided they separately satisfy § 1393’s reasonableness and best-estimate requirements.
Timing-based challenges will be harder; substantive actuarial challenges will become more important. After M & K, an employer generally will not prevail merely by showing that an assumption was adopted after the measurement date. Future disputes are more likely to focus on whether the assumptions, in the aggregate, were reasonable, accounted for plan experience and reasonable expectations, and reflected the actuary’s “best estimate of anticipated experience under the plan.”[17]
Withdrawal liability forecasting may become less predictable. Employers evaluating potential withdrawal from underfunded multiemployer plans should be cautious about relying on assumptions disclosed in prior annual valuations, Form 5500 filings, or earlier plan-provided withdrawal liability estimates as a proxy for ultimate withdrawal liability assessments. The M & K decision confirms that plans are not necessarily limited to assumptions adopted before plan year-end, which may affect forecasting, transaction diligence, restructuring analysis, and labor negotiations.
Discount-rate changes remain a critical exposure driver. The facts of M & K illustrate the magnitude of the issue: a one-percentage-point reduction in the discount rate materially increased the Fund’s unfunded vested benefits and the employers’ assessed withdrawal liability. Employers with unionized operations should evaluate potential exposure under alternative assumption sets, particularly when considering withdrawals, facility closures, asset sales, restructurings, or changes in bargaining strategy.
Arbitration remains essential. The Court emphasized that ERISA allows employers to challenge unreasonable assumptions in arbitration. Employers receiving withdrawal liability assessments should preserve their arbitration rights, retain actuarial expertise promptly, and develop a record focused on the statutory standards in 29 U.S.C. §§ 1393 and 1401.
One important question remains open. The Court expressly did not decide whether actuarial assumptions adopted after the measurement date must be based only on information available as of the measurement date.[18] That issue may become significant in future disputes, particularly during periods of market volatility or rapidly changing economic conditions.

Conclusion

M & K is an important decision for multiemployer pension plans, contributing employers, fiduciaries, and businesses evaluating potential withdrawal liability exposure. The Court clarified that ERISA does not impose a measurement-date deadline for adopting actuarial assumptions used to calculate withdrawal liability, reducing the force of timing-based challenges to withdrawal-liability assessments.

At the same time, the decision preserves important safeguards. Assumptions must still satisfy § 1393’s reasonableness and best-estimate requirements, and employers may continue to challenge unreasonable assumptions in arbitration. In light of the decision, employers with multiemployer pension plan exposure should carefully evaluate withdrawal liability forecasts, reserve assumptions, transaction diligence, and labor or restructuring strategies.

Gibson Dunn lawyers are available to assist clients in evaluating the implications of this decision, assessing withdrawal-liability exposure, challenging or defending actuarial assumptions, and addressing multiemployer pension issues in litigation, transactions, and restructurings.

[1] 29 U.S.C. § 1393(a)(1).

[2] M & K, slip op. at 6 n.2.

[3] 29 U.S.C. § 1381(a).

[4] See 29 U.S.C. §§ 1381(b), 1393(c).

[5] 29 U.S.C. § 1391.

[6] M & K, slip op. at 3.

[7] M & K, slip op. at 4–5.

[8] Trustees of the IAM Nat’l Pension Fund v. M & K Employee Solutions, LLC, 92 F.4th 316, 322–23 (D.C. Cir. 2024).

[9] See Nat’l Ret. Fund v. Metz Culinary Mgmt., Inc., 946 F.3d 146, 152 (2d Cir. 2020).

[10] M & K, slip op. at 12.

[11] M & K, slip op. at 6–8.

[12] 29 U.S.C. § 1393(a)(1).

[13] M & K, slip op. at 9 (citing Romag Fasteners, Inc. v. Fossil Group, Inc., 590 U.S. 212, 215 (2020)).

[14] Id. (citing Russello v. United States, 464 U.S. 16, 23 (1983)).

[15] M & K, slip op. at 9–10.

[16] M & K, slip op. at 10–11; 29 U.S.C. § 1401(a)(3)(B)(i).

[17] 29 U.S.C. § 1393(a)(1).

[18] M & K, slip op. at 6 n.2.

The following Gibson Dunn lawyers prepared this update: Jennafer Tryck, Michael Collins, and Ashley Johnson.

Gibson Dunn lawyers are available to assist in addressing any questions you may have about these developments. Please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any leader or member of the firm’s ERISA Litigation, Labor & Employment, or Executive Compensation & Employee Benefits practice groups:

ERISA Litigation:
Karl G. Nelson – Dallas (+1 214.698.3203, knelson@gibsondunn.com)
Ashley E. Johnson – Dallas (+1 214.698.3111, ajohnson@gibsondunn.com)
Jennafer M. Tryck – Orange County (+1 949.451.4089, jtryck@gibsondunn.com)

Labor & Employment:
Jason C. Schwartz – Washington, D.C. (+1 202.955.8242, jschwartz@gibsondunn.com)
Katherine V.A. Smith – Los Angeles (+1 213.229.7107, ksmith@gibsondunn.com)

Executive Compensation & Employee Benefits:
Michael J. Collins – Washington, D.C. (+1 202.887.3551, mcollins@gibsondunn.com)
Sean C. Feller – Los Angeles (+1 310.551.8746, sfeller@gibsondunn.com)
Krista Hanvey – Dallas (+1 214.698.3425, khanvey@gibsondunn.com)

From the Derivatives Practice Group: This week, the CFTC published notices of proposed rulemaking for whistleblower rules and event contracts.

New Developments

CFTC Seeks Public Comment on Notice of Proposed Rulemaking Concerning Whistleblower Rules. On June 11, the CFTC published a Notice of Proposed Rulemaking to amend its whistleblower rules. According to the CFTC, the proposal incorporates a 30 percent presumption for whistleblower awards of $5 million or less, subject to Commission discretion and its analysis of relevant regulatory factors, and is modeled on the Securities and Exchange Commission’s rule 21F-6(c). The comment period will be open for 30 days after publication of the Notice of Proposed Rulemaking in the Federal Register. [NEW]

CFTC Seeks Public Comment on Notice of Proposed Rulemaking Concerning Event Contracts Involving Enumerated Activities. On June 10, the CFTC published a Notice of Proposed Rulemaking seeking public comment on amendments to CFTC Regulation 40.11 and the addition of Appendix F to part 40. The Commission said that it has continued to observe growth in the number and variety of event contracts listed for trading by CFTC-registered entities, including contracts referencing sporting events. The CFTC indicated, in light of these developments, that its proposal would establish a structured framework for evaluating whether such contracts involve an activity enumerated in Section 5c(c)(5)(C) of the Commodity Exchange Act and, if so, whether that contract is contrary to the public interest. According to the Commission, the proposal sets out a 90-day review process ensuring critical procedural protections and a set of public interest factors the Commission would apply on a contract-by-contract basis; it also proposes definitions key statutory terms, including “involve” and “gaming.” [NEW]

CFTC Establishes Joint Data Standards as Required Under the Financial Data Transparency Act of 2022. On June 8, the CFTC announced that it established joint data standards under the Financial Data Transparency Act of 2022. According to the Commission, the final rule establishes technical standards for data submitted to certain financial regulatory agencies and is designed to promote interoperability of financial regulatory data across various agencies by establishing common identifiers for entities, geographic locations, dates, and certain products and currencies. [NEW]

CFTC Rescinds Policy Regarding Denials of Settlements in Enforcement Actions. On June 3, the CFTC rescinded a policy, codified in Appendix A to Part 10, stating that it will not accept settlement offers where the defendant continues to deny the allegations in the complaint or administrative order. According to the CFTC, rescinding this policy aligns the Commission with the overwhelming majority of federal agencies and gives the Commission more flexibility in settling enforcement actions, which conserves resources, provides certainty, and potentially expedites the return of money to injured investors.

CFTC Staff Issues No-Action Position Related to Designated Contract Market Procedures. On June 3, the CFTC’s Division of Market Oversight announced it has issued a no-action letter to Cboe Digital Exchange, LLC, a designated contract market, which addresses certain procedures related to dormancy. The no-action position is time-limited and subject to the terms and conditions in the letter.

CFTC Implements Technical Enhancements to Streamline Product Self-Certification Process. On June 1, the CFTC announced the launch of enhancements to its electronic filing system for product self-certifications. According to the CFTC, Exchanges are now able to submit a single set of product certification documents applicable to multiple closely related contract certifications in one consolidated submission. Updated submission instructions regarding this new functionality are available here.

CFTC Chairman Selig Announces Dr. Patrick J. Schorno as Chief Economist. On June 1, CFTC Chairman Michael S. Selig announced that Dr. Patrick J. Schorno has been named the agency’s chief economist to serve as economic adviser to the Commission and integrate rigorous economic analysis, regulatory cost-benefit analysis, and research into the CFTC’s mission. Dr. Schorno joins the CFTC from the Public Company Accounting Oversight Board where he served as the deputy chief economist.

New Developments Outside the U.S.

Euribor Panel to Include KBC Bank. On May 27, the European Money Markets Institute, the administrator of Euribor, announced the inclusion of KBC Bank in the Euribor panel. ESMA and the Belgian Financial Services and Markets Authority welcome the inclusion of KBC Bank in the panel as a positive development that contributes to strengthening the robustness and reliability of this critical benchmark. [NEW]

ESAs Publish the First Report on DORA Major ICT-related Incidents. On June 3, the European Supervisory Authorities (ESAs) published their first annual overview of major information and community technology (ICT) incidents in the EU financial sector based on a reporting mechanism established by the Digital Operational Resilience Act (DORA). ESMA said that the report shows that ICT risks are increasingly borderless and interconnected. The ESAs also noted that the recent evolution of highly capable AI-driven tools should encourage financial entities to strengthen cybersecurity measures going forward.

GMTF Presents its Findings on EU Gas and Gas Derivative Markets. On June 2, the Gas Market Task Force (GMTF) published a report on the functioning of EU gas and gas derivatives markets. ESMA said that the report suggests further work in several areas to ensure that European gas and gas derivatives markets continue performing as expected and to the benefit of European competitiveness and consumers.

New Industry-Led Developments

ISDA Publishes Report on ISDA-Actrix US Treasury Repo Market Clearing Indicators. On June 10, ISDA published a report concerning indicators related to central clearing adoption in the U.S. Treasury repo market. According to ISDA, sponsored cleared repo volumes can be used as a proxy to monitor client participation in central clearing, the key objective of the Securities and Exchange Commission’s U.S. Treasury clearing mandate. [NEW]

ISDA Publishes ISDA-Actrix US Treasury Repo Market Clearing Indicators Methodology. On June 9, ISDA published a white paper intended for market participants interested in the structure and methodology used to construct the ISDA-Actrix US Treasury Repo Market Clearing Indicators. According to ISDA, this report provides precise details that allow participants to access the publicly available data and replicate the calculations in the report themselves. [NEW]

IOSCO Publishes Recommendations for Secondary Market Disclosure. On June 8, IOSCO published its Final Report on Recommendations for Secondary Market Disclosure. The report is intended to assist regulators in reviewing their existing disclosure frameworks and considering whether updates or refinements may be appropriate. [NEW]

ISDA Responds to BoE Consultation on Permissions to Facilitate Mobilization of New CCPs. On June 4, ISDA submitted a response to the Bank of England’s (BoE) consultation on its approach to using its requirements and permissions powers to facilitate mobilization of new central counterparties (CCPs). The consultation includes a draft policy statement, setting out how the BoE will use its powers to impose de miminis limits and give permissions to modify or waive certain rules for new CCPs in a “mobilization” phase. [NEW]

ISDA and the Credit Derivatives Governance Committee Select S&P Global as DC Administrator. On June 4, ISDA and the Credit Derivatives Governance Committee announced that S&P Global Market Intelligence has been selected as the administrator for the Credit Derivatives Determinations Committees (DCs). According to ISDA, the DCs were introduced in 2009 as a centralized decision-making body to enable a standardized auction settlement process and ensure central clearing could be implemented for credit derivatives.

ISDA, GDF Respond to the Central Bank of Ireland on DLT and Tokenization. On June 3, ISDA and Global Digital Finance responded to the Central Bank of Ireland’s discussion paper on distributed ledger technology (DLT) and tokenization in financial services. ISDA said the response focused on the potential role of DLT and tokenization within wholesale markets, including their use in collateral and liquidity management, and that the paper also emphasized that any regulatory framework for DLT and tokenization should be assessed through the lens of prudent risk management, with particular attention to liquidity, credit risk, operational resilience and legal certainty.

IOSCO Publishes Final Report on Valuing Collective Investment Schemes. On June 1, IOSCO published its Final Report on Valuing Collective Investment Schemes (CIS). According to IOSCO, the paper sets out a comprehensive and updated set of recommendations to further enhance the reliability, consistency, and transparency of valuation practices across global investment funds and updates and consolidates IOSCO’s earlier principles on valuation for collective investment schemes and hedge funds

The following Gibson Dunn attorneys assisted in preparing this update: Jeffrey Steiner, Adam Lapidus, Karin Thrasher, and Alice Wang.

Jeffrey L. Steiner, Washington, D.C. (202.887.3632, jsteiner@gibsondunn.com)

Michael D. Bopp, Washington, D.C. (202.955.8256, mbopp@gibsondunn.com)

Michelle M. Kirschner, London (+44 (0)20 7071.4212, mkirschner@gibsondunn.com)

Darius Mehraban, New York (212.351.2428, dmehraban@gibsondunn.com)

Jason J. Cabral, New York (212.351.6267, jcabral@gibsondunn.com)

Adam Lapidus, New York (212.351.3869, alapidus@gibsondunn.com )

Stephanie L. Brooker, Washington, D.C. (202.887.3502, sbrooker@gibsondunn.com)

William R. Hallatt, Hong Kong (+852 2214 3836, whallatt@gibsondunn.com )

David P. Burns, Washington, D.C. (202.887.3786, dburns@gibsondunn.com)

Marc Aaron Takagaki, New York (212.351.4028, mtakagaki@gibsondunn.com )

Karin Thrasher, Washington, D.C. (202.887.3712, kthrasher@gibsondunn.com)

Alice Yiqian Wang, Washington, D.C. (202.777.9587, awang@gibsondunn.com)

The EU’s newly adopted FDI Screening Regulation reshapes how foreign investments into Europe will be reviewed – harmonizing timelines and procedures, but also expanding mandatory screening, eliminating preferential treatment for U.S. and other allied-country investors, and introducing a post-closing call-in right of up to five years. Our alert walks through what’s improved, what’s not, and which provisions may have the most pronounced negative impact on non-EU investors’ investment in the EU.

On June 8, 2026, the Council of the European Union (EU) adopted a new Regulation on the screening of foreign investments (FDI Screening Regulation), which is expected to enter into force before the end of August. The new rules will apply 18 months after entry into force (likely around the start of 2028), and EU Member States must use that window to amend their national screening laws accordingly.

The reform lands amid a changing stance vis-à-vis U.S. investors and mounting European sensitivity around foreign influence over the digital infrastructure underpinning core governmental functions. A case in point: On May 25, 2026, the Dutch government prohibited U.S.-based Kyndryl’s acquisition of Solvinity, the cloud provider hosting the Netherlands’ digital identity platform for accessing government services – the Netherlands’ first FDI prohibition of a U.S. acquirer. The message is unambiguous: U.S. investments in Europe enjoy no safe harbor, and that message is now being reinforced in the new EU FDI Screening Regulation.

One theme that runs throughout the reform: The new Regulation provides a floor, not a ceiling – it harmonizes a minimum standard but allows Member States to go further. Therefore, significant divergence between national FDI regimes in Europe is expected to persist.

The Good

The FDI Screening Regulation brings several welcome improvements – including better structure, more process discipline, and additional guidance.

Exemption for internal restructurings: Intra-group reorganizations that do not change an EU target’s beneficial owner will not need to be notified. This exemption will be lost only if the reorganization introduces a new legal entity from a non-EU jurisdiction that is not already represented in the holding chain above the EU target. This will keep many routine internal restructurings out of unnecessary screening.

(Some) guidance on the EU Cooperation Mechanism: The Regulation provides some clarity on when a case must be referred through the EU cooperation mechanism. Broadly: sensitive-sector deals involving state-owned, sanctioned or previously non-compliant investors, or cases where a Member State opens an in-depth (Phase 2) investigation or intends a pre-emptive mitigation, prohibition or unwinding. That said, the residual catch-all for factors which any Member State considers could affect security or public order still leaves some space for arbitrary referrals.

Consistent phases and cap on Phase 1 duration: All Member States will need to divide the substantive review process into two stages: an initial Phase 1 review capped at 45 calendar days (non-extendable), then, where necessary, an in-depth Phase 2 review. While the fixed Phase 1 deadline will offer welcome certainty for most deals, the lack of a Phase 2 deadline and the inability to extend Phase 1 means that more complex transactions will continue to face considerable uncertainty on timing. In addition, Member States will continue to be able to open Phase 2 reviews for no other reason than running out of time in Phase 1.

Member States to publish guidance: Member States will have to publish guidance on their respective FDI regimes’ scope, thresholds, timelines and procedures, and publish an annual report with screening statistics. This is a clear predictability win that drags some more opaque national FDI regimes into the open and gives investors a documented basis for assessing filing obligations and risk.

The Bad

Notwithstanding the above benefits, the new regime is not without challenges that will complicate deal-making in the EU. It contemplates a wider filing universe and strengthens the European Commission’s (EC) influence on national review processes.

End of Member States’ freedom to apply exemptions for “safe-country” investors: The Regulation ends Member States’ discretion to grant blanket exemptions to investors from safe / allied countries of origin – including, e.g., the United States and other OECD jurisdictions. Several Member States currently apply such exemptions or lighter-touch treatment to investors from certain non-EU jurisdictions. Such exemptions will now need to be removed, notwithstanding the low national security risk profile of investors from the jurisdictions in question.

Mandatory (and partly ambiguous) risk factors: Member States will be under an obligation to consider a long, prescribed list of risk factors when reviewing any deal – including, e.g., impact on programs of EU interest; critical technologies and IP; critical entities and infrastructure; continuity of supply of critical inputs; sensitive information; media freedom and pluralism; electoral processes; public health and critical medicines; food security and large farmland holdings; and proximity to military or other sensitive public facilities. For many jurisdictions, the list broadens what must be weighed in every review, and several factors are vaguely described, making outcomes harder to predict.

Same-day filings across Member States: Where a deal triggers FDI filings in several Member States, applicants must “endeavour” to file on the same day in each, and each filing must cross-refer to the others. This restricts the freedom to sequence filings in line with particular deal considerations and can put increased pressure on drafting timelines, since multiple submissions must be readied in parallel. The only silver lining is that the requirement is now a soft “endeavour”, not the hard same-day mandate envisaged in earlier drafts of the Regulation.

Mandatory minimum list of screened sectors: Member States must require prior authorization for foreign investments in a defined minimum list of sectors – including, e.g., targets with activities related to: dual-use items and EU Common Military List goods; semiconductors, quantum and AI technologies; critical transport, energy and digital infrastructure; strategic raw materials; certain financial institutions; and voter-registration databases and voting systems. The practical bite falls on jurisdictions that previously had a voluntary regime or treated a narrower set of sectors as sufficient to protect national security – they must now widen their mandatory screening scope.

EC database of notified cases and outcomes: The EC will run a central database accessible to all Member States, recording cases notified through the EU Cooperation Mechanism as well as their outcomes. Cases notified since 2020 will be added to the database retrospectively. While it is helpful that this measure reduces information asymmetry, it also raises concerns – a shared record of how peers handled comparable deals may nudge authorities toward the majority view and diminish the careful case-by-case assessment of individual transactions based on their merits (and their true local sensitivities). It may also lead to commitments more commonly being required across the EU with Member States following the example of, e.g., France, a Member State that regularly requires commitments as a condition to authorize transactions.

The Not-so-Pretty

Lastly, several further unwelcome changes may significantly jeopardize deal certainty by introducing broad discretion and post-closing call-in risks.

Foreign-controlled EU entities deemed foreign investors: Investments through EU entities “controlled” by non-EU investors are now always treated as foreign investments. This legislative change deliberately narrows the ruling of the European Court of Justice in Xella Magyarország, which held that the acquisition of an EU target by an EU-incorporated buyer fell outside the EU FDI Regulation even where that buyer was ultimately controlled from a third country (except for, e.g., deliberate attempts at screening circumvention). The change is a clear, if unwelcome, expansion of scope, and Member States may go even further – with several jurisdictions likely to continue capturing indirect minority non-EU investments.

Sector-agnostic call-in right of up to five years: Member States’ legislation must provide for the right to call in foreign investments on the respective authority’s own initiative, independent of sector, for a period between 15 months and five years post-closing. This injects lasting uncertainty into deal-making at the discretion of national governments. Unnotified deals can be reopened long after closing, and the Regulation does not require Member States to offer investors the option of a voluntary filing to obtain ex-ante clearance or otherwise lock in certainty. However, this provision will not apply retroactively to investments completed before the new rules take effect.

EU cooperation deadlines may constrain 45-day Phase 1 clearance: The Regulation preserves the EC’s and Member States’ ability to provide comments or opinions on cases notified through the EU Cooperation Mechanism. Although such comments remain non-binding, the reviewing Member State must “give due consideration” to them and may adopt its decision only after the relevant EU cooperation deadlines have expired. This creates new pressure on timing: If the EC or another Member State requests additional information, or if substantial new information or circumstances trigger a limited extension of the cooperation mechanism period, the resulting deadlines for comments may remain open beyond the 45-day Phase 1 period. This would prevent the reviewing Member State from adopting a Phase 1 clearance, thus effectively forcing the case to proceed to Phase 2. Furthermore, the prospect of peer and EC comments, however non-binding, may risk coloring the relevant Member State’s independent assessment, particularly since the reviewing Member State must now also explain in the summary of reasons for its decision the extent to which it has considered such comments and any reasons for disagreement with them.

Key Takeaways

For investors who value predictability, the new FDI Screening Regulation is a mixed bag:

the codified notification rules, the capped Phase 1 timetable and the new guidance duties are genuine gains;
the wider mandatory sector net, broader set of risk factors and end of Member States’ freedom to apply exemptions for “safe-country” investors are expansive (even if mostly clear); and
the discretionary ex-post call-in, the absolute look-through for EU entities controlled from a third country and the pressure that cross-border comments place on independent national reviews and timelines are unwelcome changes making European FDI regimes harder to navigate.

As most of the new regime hinges on national implementation over the next 18 months, the practical contours, including the application of risk factors and the call-in power, will emerge only after this. Investors active in the covered sectors in the EU should map their filing footprint and closely monitor national implementation over the coming months.

The following Gibson Dunn lawyers prepared this update: Attila Borsos, Philipp Baschenhof, Alana Tinkler, Claire Shepherd, Adam Dawson, and Valeri Bozhikov.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. For further information, please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any leader or member of the firm’s Antitrust & Competition, International Trade Advisory & Enforcement, Mergers & Acquisitions, or Private Equity practice groups:

Attila Borsos – Head of Cross-Border Merger Control and Foreign Investment, Brussels (+32 2 554 72 10, aborsos@gibsondunn.com)
Alana Tinkler – Antitrust and Competition, London (+44 20 7071 4906, atinkler@gibsondunn.com)
Claire Shepherd – Antitrust and Competition, London (+44 20 7071 4155, cshepherd@gibsondunn.com)
Adam Dawson – Antitrust and Competition, Brussels (+32 2 554 72 02, adawson@gibsondunn.com)
Valeri Bozhikov – Antitrust and Competition, London (+44 20 7131 0326, vbozhikov@gibsondunn.com)

Antitrust & Competition:
Rachel S. Brass – San Francisco (+1 415.393.8293, rbrass@gibsondunn.com)
Kristen C. Limarzi – Washington, D.C. (+1 202.887.3518, klimarzi@gibsondunn.com)
Samuel G. Liversidge – Los Angeles (+1 213.229.7420, sliversidge@gibsondunn.com)
Ali Nikpay – London (+44 20 7071 4273, anikpay@gibsondunn.com)
Cynthia Richman – Washington, D.C. (+1 202.955.8234, crichman@gibsondunn.com)
Christian Riis-Madsen – Brussels (+32 2 554 72 05, criis@gibsondunn.com)

International Trade Advisory & Enforcement:
Ronald Kirk – Dallas (+1 214.698.3295, rkirk@gibsondunn.com)
Adam M. Smith – Washington, D.C. (+1 202.887.3547, asmith@gibsondunn.com)

Mergers & Acquisitions:
Robert B. Little – Dallas (+1 214.698.3260, rlittle@gibsondunn.com)
Saee Muzumdar – New York (+1 212.351.3966, smuzumdar@gibsondunn.com)
George Sampas – Head of Cross-Border M&A, New York (+1 212.351.6300, gsampas@gibsondunn.com)

Private Equity:
Richard J. Birns – New York (+1 212.351.4032, rbirns@gibsondunn.com)
Wim De Vlieger – London (+44 20 7071 4279, wdevlieger@gibsondunn.com)
Federico Fruhbeck – London (+44 20 7071 4230, ffruhbeck@gibsondunn.com)
Ari Lanin – Los Angeles (+1 310.552.8581, alanin@gibsondunn.com)
Michael Piazza – Houston (+1 346.718.6670, mpiazza@gibsondunn.com)
John M. Pollack – New York (+1 212.351.3903, jpollack@gibsondunn.com)

Thomas Keathley v. Buddy Ayers Construction, Incorporated, No. 25-6 – Decided June 11, 2026

Today, the Supreme Court unanimously held that courts must consider the totality of the circumstances before barring a debtor from asserting a claim that the debtor failed to disclose in bankruptcy proceedings.

“To determine whether an omission was inadvertent or mistaken for purposes of judicial estoppel, courts should look to the totality of the circumstances surrounding the omission.”

Justice Jackson, writing for the Court

Background:

The Bankruptcy Code requires debtors to disclose their assets—including claims against third parties—so that the bankruptcy court, the trustee, and creditors can evaluate the estate and any proposed repayment plan.

When Thomas Keathley’s bankruptcy case was ongoing, he was hit by a truck driven by an employee of Buddy Ayers Construction. Keathley told his bankruptcy attorney about the crash and that he planned to sue, but his attorney did not disclose Keathley’s claim to the bankruptcy court. When Keathley eventually sued, the district court granted summary judgment in favor of Buddy Ayers Construction on judicial estoppel grounds, reasoning that Keathley had taken an inconsistent position in the bankruptcy proceeding by implicitly representing that he did not have a claim against Buddy Ayers Construction. The district court acknowledged an exception to the doctrine of judicial estoppel where the debtor’s omission was the result of “inadvertence or mistake” but, applying Fifth Circuit precedent, held that an omission qualifies as inadvertent or a mistake only if the debtor did not know the facts underlying the claim or had no potential motive to conceal it—conditions that were not satisfied. Under this approach, the district court declined to consider Keathley’s evidence that his omission was not the result of a bad-faith attempt to hide assets from the bankruptcy court and his creditors.

The Fifth Circuit affirmed, based on the same precedent. One judge concurred, doubting that the Fifth Circuit’s rule was consistent with judicial estoppel’s goals and noting that other circuits took a more holistic, totality-of-the-circumstances approach.

Issue:

Whether the doctrine of judicial estoppel can be invoked to bar a plaintiff who fails to disclose a civil claim in bankruptcy filings from pursuing that claim.

Court’s Holding:

Yes. The doctrine of judicial estoppel requires courts to evaluate the “totality of the circumstances” surrounding the debtor’s omission.

What It Means:

Under today’s decision, courts must undertake a fact-intensive assessment of a debtor’s failure to disclose a claim in bankruptcy proceedings before barring the debtor from asserting that claim.
The Court did not indicate which factors should be considered or how they should be weighed. That said, the Government, participating as amicus curiae, identified several potential considerations, including the debtor’s sophistication, when and how the omission was corrected, whether the debtor informed his attorney or the trustee of the claim, and whether the debtor disclosed other lawsuits.
The Court’s decision is notable for what it did not decide. The Court assumed without deciding that judicial estoppel applies in the bankruptcy context and that a debtor’s “inadvertence or mistake” in failing to disclose a claim can provide an exception. The Court also declined to consider whether a debtor’s bad faith in failing to disclose a claim is a prerequisite to application of that exception. And the Court did not resolve a circuit split regarding a debtor’s continuing obligation to disclose claims arising after a bankruptcy petition is first filed.
Justice Thomas, joined by Justice Gorsuch, wrote a concurrence in which they questioned whether judicial estoppel is a valid judicial doctrine in any context, noting that it lacks historical support and improperly expands upon the doctrine of equitable estoppel. These Justices urged the Court to consider the validity of judicial estoppel in a future case.
Justice Sotomayor also wrote a concurrence questioning judicial estoppel’s application in the bankruptcy context, where the doctrine’s application often provides a windfall for a potentially tortious third-party defendant at the expense of creditors who might otherwise recover if the claim ultimately succeeds.

The Court’s opinion is available here.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding developments at the Supreme Court. Please feel free to contact the following practice group leaders:

Appellate and Constitutional Law

Thomas H. Dupree Jr. +1 202.955.8547 tdupree@gibsondunn.com	Allyson N. Ho +1 214.698.3233 aho@gibsondunn.com	Julian W. Poon +1 213.229.7758 jpoon@gibsondunn.com	Jeffrey B. Wall +1 202.955.8533 jwall@gibsondunn.com
Lucas C. Townsend +1 202.887.3731 ltownsend@gibsondunn.com	Bradley J. Hamburger +1 213.229.7658 bhamburger@gibsondunn.com	Brad G. Hubbard +1 214.698.3326 bhubbard@gibsondunn.com

Related Practice: Business Restructuring

Scott J. Greenberg
+1 212.351.5298
sgreenberg@gibsondunn.com

This alert was prepared by Samuel Eckman and Blake Hirst.

The Updated Guidance applies to AIs providing custodial services for digital assets, defined broadly to include virtual assets, tokenized securities and other tokenized assets. It does not apply to the custody of proprietary assets held by AIs or their group companies which are not held on behalf of clients.

On 27 May 2026, the Hong Kong Monetary Authority (HKMA) published updated guidance on the expected standards for the provision of custodial services for digital assets by authorized institutions (AIs) (Updated Guidance).[1] The Updated Guidance supersedes and substantially expands the HKMA’s original guidance issued on 20 February 2024 (Guidance).[2]

The revisions reflect the HKMA’s assessment of emerging risks in the digital asset custody space, including the evolving cyber threat landscape, lessons drawn from significant industry incidents, and the rapid expansion of the digital asset ecosystem since the Guidance was originally issued. This client alert sets out the key changes introduced in the Updated Guidance.

The Updated Guidance applies to AIs providing custodial services for digital assets, defined broadly to include virtual assets (VAs), tokenized securities and other tokenized assets. It does not apply to the custody of proprietary assets held by AIs or their group companies which are not held on behalf of clients.

I. Governance and Risk Management Requirements

The Updated Guidance contains two notable amendments to the HKMA’s requirements in relation to the governance and risk management:

The Updated Guidance introduces a new training requirement specifically for transaction signers, who must now receive comprehensive training to ensure that they fully understand verification requirements and the appropriate handling procedures for exception or uncertainty concerning a transaction.
AIs are already required to establish and maintain effective contingency and disasters recovery arrangements to ensure business continuity of its custodial activities. The Updated Guidance clarifies that AIs should also conduct drills to address emergency and business continuity plan (BCP) scenarios.

II. Technical Safeguarding Controls

The most significant changes in the Updated Guidance relate to the technical requirements for safeguarding client digital assets. In particular, the Updated Guidance requires AIs to have written policies and procedures for the below measures:

Detecting unauthorized access and transactions: In addition to existing obligations regarding access controls and authentication, the Updated Guidance requires AIs to establish a robust mechanism to detect unauthorized access or intrusions to critical wallet infrastructure, including cold wallet vaults, signing devices, databases, production binaries and code repositories. AIs are also expected to establish robust systematic controls to prevent unauthorized transactions from cold wallets. This includes introducing whitelist controls to prevent asset transfer to unapproved wallet addresses and stringent controls on changes to the cold wallet whitelists. Each transaction must also be subject to systematic verification to ensure authorization.
Handling of security incidents: When responding to security alerts and incidents, AIs should classify them based on severity levels and apply corresponding response protocols accordingly.

The HKMA’s original Guidance emphasized that AIs are expected to adopt industry best practices and follow applicable international security standards in a way that is commensurate with the nature, features and risks of the assets being held, but also set out a range of procedures and controls that the HKMA generally expected AIs to adopt in relation to holding of client VAs. The Updated Guidance expands this list of procedures and controls as follows:

Hardware Security Module (HSM) due diligence: The Updated Guidance introduces new requirements in respect of HSMs. AIs must now (i) perform appropriate due diligence on the HSM provider before onboarding, and (ii) conduct periodic ongoing evaluations to ensure the vendor maintains security standards through effective patch management, and that any patched HSM is validated and its certification updated promptly.
Localization of seeds and private keys: The Updated Guidance retains the requirement to securely generate, store and back up seeds and private keys in Hong Kong. However, there is a limited exception for HKMA-licensed stablecoin issuers – with the HKMA’s consent, such an issuer may be appointed by an AI (e.g. under a delegation or outsourcing arrangement) to provide custody services for specified stablecoins it issues, provided the seeds and/or private keys are safeguarded and backed up in Hong Kong or a location acceptable to the HKMA. This reflects the new stablecoin regulatory framework introduced under the Stablecoins Ordinance (Cap. 656).[3]
Cold wallet architecture requirement: The Updated Guidance introduces two new requirements specific to cold wallet architecture. First, cold wallet implementations must not include smart contracts on public blockchains, in order to minimize potential online attack vectors associated with on-chain smart contracts. Second, in client cold wallet operations, devices used for transaction approval must now be dedicated, with restricted functionality and limited network connectivity, and must be isolated from general purpose workstations. Critically, integrity checks on critical transaction data must be conducted using air-gapped devices stored in a cold vault, which require physical access for code modifications.
Assessment of potential attack vectors: The Updated Guidance requires AIs to assess potential attack vectors on a regular basis, including before any material changes to processes, systems or authorized personnel, and to implement multiple layers of independent data integrity checks across the transaction lifecycle with an end-to-end integrity protection and proper segregation of duties.
Segregation of duties: Segregation of duties and comprehensive oversight mechanisms must be strictly enforced for wallet system code management, whether the codebase is developed internally or externally. These controls should encompass gatekeeping procedures such as code reviews, testing, software supply chain management, approvals and secure deployment practices, all of which should be supported by comprehensive audit trails. Administrator access to production systems must adhere to the principles of least privilege and privilege separation as well as industry best practices.
Anti-blind signing controls: The Updated Guidance introduces a new requirement to prevent blind signing (i.e., the practice of signing a transaction without being able to view and verify its details). AIs must implement robust measures to prevent blind signing and ensure effective manual transaction review or approval. All details of a transaction requiring manual review must be displayed in a clear, human-readable format to allow signers to review before signing.
Third party transfers: The Updated Guidance relaxes the prior absolute restriction on transfers to non-client wallet addresses. Under the Updated Guidance, deposits and withdrawals of client digital assets need only be made through whitelisted wallet addresses belonging to clients, except for transfers to support payment services or to execute client settlement instructions, where third-party transfers will be permitted, provided that effective risk controls are in place.
Revised insurance requirements: The Guidance included a requirement for AIs to maintain a compensation or insurance arrangement covering potential losses of at least 50% of client digital assets in cold storage and 100% of client digital assets in hot and other storage. Importantly, this prescriptive insurance floor has been removed in the Updated Guidance. In its place, the Updated Guidance provides that AIs must be liable to their clients for the loss of any client digital assets arising in relation to an incident attributable to the AI and must ensure that they have adequate financial resources, which “may include” suitable insurance arrangements to cover potential losses. We anticipate that this will be favourably received by the industry, as the previous compensation / insurance requirements had been considered by many to be onerous to comply with.

III. Delegation and Outsourcing Obligations

The Updated Guidance expands the list of permissible delegees for VA custody functions. Under the Guidance, AIs could only delegate or outsource VA custody to (i) another AI (or subsidiary of a locally incorporated AI), or (ii) a VA trading platform licensed by the Securities and Futures Commission (SFC). The Updated Guidance adds a third category: an HKMA-licensed stablecoin issuer that has obtained the HKMA’s consent to provide custody for specified stablecoins it issues, provided the issue of such stablecoins is authorized under the Stablecoins Ordinance.

The Updated Guidance further significantly expands the ongoing monitoring obligations for delegation and outsourcing arrangements. Under the Guidance, AIs were required to monitor and review the performance of delegates and service providers on an ongoing basis. The Updated Guidance retains this obligation but adds prescriptive detail as to what that monitoring must entail:

regular evaluation of the delegate’s or service provider’s security controls and operational processes;
mandatory timely reporting of incidents and emerging risks;
regular testing of the delegate’s or service provider’s disaster recovery capabilities;
regular inherent risk assessments covering third-party dependencies and vulnerability management, with mitigation measures to address residual risks;
periodic independent cybersecurity assessments of the deployed systems; and
regular end-to-end rehearsals to ensure that business continuity plans meet recovery time objectives.

IV. Ongoing Monitoring Framework

The Updated Guidance enhances existing ongoing monitoring obligations as follows:

Any system changes, including the implementation of new systems or upgrades to existing ones, must undergo thorough testing prior to deployment. Security monitoring should be conducted on a 24/7 basis, supported by adequate resourcing and established procedures to address contingencies and incidents at any time, including during holidays.
The Updated Guidance clarifies that monitoring processes must extend beyond the custody system itself to encompass its dependencies, including vendors, technologies, blockchain protocols, encryption algorithms and common libraries that may impact the safety of client assets.
The monitoring framework must also incorporate consideration of significant industry incidents and publicly identified security vulnerabilities that may threaten the integrity of the custody system and related components. In practice, this requires AIs to maintain an active awareness of the broader digital asset security landscape and to undertake ongoing assessments regarding the relevance of industry incidents to their own systems and controls.

V. Anti-Money Laundering and Counter-Financing of Terrorism

You may notice that the Updated Guidance drops the original Guidance’s standalone Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) section, which required AIs to manage the money laundering and terrorist financing risks of their custodial activities and to comply with the HKMA’s Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Authorized Institutions) (AML/CFT Guideline).[4] However, this should not be interpreted as a relaxation. That section merely cross-referred to obligations imposed elsewhere, and AIs remain fully subject to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615)[5] and the HKMA’s AML/CFT Guideline. This is reinforced by the covering circular’s reminder that AIs must comply with all applicable legal and regulatory requirements. As such the purpose of the deletion appears to be to avoid duplicating requirements for the dedicated AML/CFT framework, rather than to change what is expected of AIs.

VI. Provision of Staking Services

Finally, the Updated Guidance draws attention to HKMA guidance on staking services issued on 7 April 2025, which mandates AIs providing VA staking services from custodial arrangements to implement robust internal controls to safeguard client assets, retain control over unstaking mechanisms, and manage operational and conflict risks.[6] The Updated Guidance also reminds AIs that, in complying with the relevant requirements, they should also have due regard to the terms and conditions for providing staking services as imposed by the SFC on SFC-licensed VA trading platforms.[7]

VII. Conclusion

While the HKMA’s Updated Guidance applies only to AIs, it contains important indications regarding the direction of travel for Hong Kong’s broader VA ecosystem. In particular, many of the requirements set out in the Updated Guidance, such as robust segregation of client assets, stringent governance over private key management, monitoring of delegation and outsourcing – are broadly consistent with the policy trajectory already outlined by the Securities and Futures Commission (SFC) in relation to custody of virtual assets.[8] Given this, we anticipate that many of the requirements in the Updated Guidance will also form part of the detailed regulatory requirements imposed on licensed VA custodian service providers under the SFC’s forthcoming VA custody regime.

Additionally, in light of the significant changes introduced by the Updated Guidance, AIs providing or contemplating digital asset custodial services should consider conducting a review of their internal systems and controls against the enhanced requirements under the Updated Guidance to identify and remediate any gaps.

[1] “Updated Guidance on Expected Standards on Provision of Custodial Services for Digital Assets by Authorized Institutions” published by the Hong Kong Monetary Authority on 27 May 2026, accessible here.

[2] “Guidance on Expected Standards on Provision of Custodial Services for Digital Assets by Authorized Institutions” published by the Hong Kong Monetary Authority on 20 February 2024, accessible here.

[3] Stablecoins Ordinance (Cap. 656), accessible at: https://www.elegislation.gov.hk/hk/cap656. See also “Hong Kong Gets Ready for Stablecoin Regulation: HKMA Prepares for Enactment of the Regime” published by Gibson, Dunn & Crutcher on 4 June 2025, accessible at: https://www.gibsondunn.com/hong-kong-gets-ready-for-stablecoin-regulation-hkma-prepares-for-enactment-of-the-regime/.

[4] “Guideline on Anti-Money Laundering and Counter Financing of Terrorism (For Authorized Institutions)” published by the Hong Kong Monetary Authority on May 2023, accessible at: https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20230525-4-EN/AML-2.pdf.

[5] Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), accessible at: https://www.elegislation.gov.hk/hk/cap615.

[6] “Provision of Staking Services for Virtual Assets from Custodial Services” published by the Hong Kong Monetary Authority on 7 April 2025, accessible at: https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20250407-1-EN/20250407-1-EN.pdf.

[7] “Terms and conditions for providing staking services” published by the Securities and Futures Commission on 7 April 2025, accessible here.

[8] See, for example, “Circular to licensed virtual asset trading platform operators on custody of virtual assets” published by the Securities and Futures Commission, accessible here.

The following Gibson Dunn lawyers prepared this update: William Hallatt, Emily Rumble, and Jane Lu.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. If you wish to discuss any of the matters set out above, please contact any member of Gibson Dunn’s Financial Regulatory team, including the following members in Hong Kong:

William R. Hallatt (+852 2214 3836, whallatt@gibsondunn.com)

Emily Rumble (+852 2214 3839, erumble@gibsondunn.com)

Arnold Pun (+852 2214 3838, apun@gibsondunn.com)

Becky Chung (+852 2214 3837, bchung@gibsondunn.com)

Jane Lu (+852 2214 3735, jlu@gibsondunn.com)

The OCC Interpretive Letter reinforces the OCC’s continued defense of federal preemption and further consolidates its authority over digital asset activities in the banking space in advance of the GENIUS Act’s effectiveness.

1. A Familiar Principle, Restated

On June 9, 2026, the Office of the Comptroller of the Currency (OCC) published OCC Interpretive Letter 1192 (May 12, 2026) (IL 1192).[1] IL 1192 confirms again that national banks, including national trust banks engaged in digital asset activities, are not bound by state money transmitter licensing laws, nor subject to state visitorial authority over those activities. The OCC framed its conclusion as “clear and unambiguous under applicable law and longstanding precedent,” resting on the long-settled Barnett standard, as recently reaffirmed in Cantero. More importantly, the letter reinforces the OCC’s continued defense of federal preemption and further consolidates its authority over digital asset activities in the banking space in advance of the GENIUS Act’s effectiveness.

2. Background

Fidelity Digital Assets Service, LLC, was a New York-chartered trust company that held money transmitter licenses in parallel, which subsequently converted to an OCC-chartered national trust bank, Fidelity Digital Assets, National Association. Fidelity Digital Assets provides digital asset custody, trade execution, settlement, and related services, and plans to engage in additional activities such as stablecoin issuance and staking services.

The Iowa Division of Banking later took the position that notwithstanding Fidelity’s conversion to a national trust bank, Fidelity Digital Assets remained subject to the Iowa Uniform Money Transmission Modernization Act, as its statutory exemption applied only to federally insured depository institutions. Because Fidelity Digital Assets is a national trust bank and is not FDIC-insured, Iowa deemed its money transmission licensing requirements applicable.

Fidelity Digital Assets requested the OCC confirm that the National Bank Act preempts state law that would otherwise require the bank to hold an Iowa money transmitter license.

3. OCC Interpretive Letter No. 1167 and Federally Authorized Fiduciary Powers

This is a familiar story. In the wake of New York DFS’ and other states’ objections to ADP Trust Company’s national trust bank charter operating without money transmitter licenses, the OCC issued Interpretive Letter 1167 (May 20, 2020) (IL 1167), which confirmed that states could not require money transmitter licenses for activities conducted pursuant to the bank’s federally authorized fiduciary powers.[2] There the OCC opined that subject to the limits established by 12 U.S.C. § 92a and 12 C.F.R. Part 9, a national bank “may exercise fiduciary powers in any state without obtaining a state money transmitter license” (emphasis added). The OCC distinguished activities that may “in some contexts be regulated as money transmission” when conducted by a national trust bank “within the scope of [the trust bank’s] federally authorized fiduciary powers.”

Because IL 1167 arose on a narrow set of facts in the fiduciary context, the letter framed its preemption analysis in terms of the bank’s federally authorized fiduciary powers. As a result, the letter gave rise to an apparent misperception among new nonbank and digital assets-based entrants regarding the extent to which national trust banks could rely on federal preemption for payments activities that were not fiduciary in nature. This was particularly significant for those national trust banks engaged in payments-related activities, which generally are not considered fiduciary activities and therefore did not clearly fall within the traditional scope of national trust bank powers and related preemption arguments. IL 1192 resolves this apparent misperception and confusion in the market.[3]

4. Confirming Preemption Beyond Fiduciary Activities

In issuing IL 1192, the OCC made clear again that national banks, including national trust banks engaged in digital asset activities, may conduct federally authorized activities (both fiduciary and non-fiduciary alike) nationwide without obtaining state money transmitter licenses.

In confirming, the OCC reiterated that the National Bank Act expressly contemplates national trust banks, whose operations are “limited to those of a trust company and activities related thereto.”[4] Once chartered by the OCC, national trust banks may engage in a broad range of fiduciary and non-fiduciary activities authorized by federal law.[5]

According to the OCC, the authority to conduct those activities on a nationwide basis does not depend on obtaining additional authorization from any state, whether through a licensing regime or otherwise. Requiring a national trust bank to obtain a state license before exercising federally authorized powers would effectively make state approval a “condition precedent” to the exercise of those powers.

5. Where Does that Leave Us?

IL 1192 confirms that a national trust bank’s preemption of state money transmitter licensing requirements is “clear and unambiguous under applicable law and longstanding precedent” and follows from its exercise of federally authorized powers as a national bank, not from the fiduciary character of any particular activity. To the extent IL 1167 was read to limit that preemption to fiduciary activities, IL 1192 makes clear that reading was too narrow.

Nevertheless, the implications of IL 1192, read alongside the OCC’s recent defense of federal preemption[6] are clear: the OCC will continue to defend federal preemption of state laws that prevent or significantly interfere with a national bank’s exercise of its federally authorized powers. The principles in IL 1192 are not cabined to money transmission laws and extend to any state licensure regime that conditions a national bank’s exercise of its federally authorized powers on obtaining a state license, including the New York Bitlicense and the California Digital Financial Assets Law license.

IL 1192 is best understood as one piece of a broader consolidation. The GENIUS Act expressly preempts state licensing for “federal qualified payment stablecoin issuers”, which includes national trust banks and nonbank entities. IL 1192 confirms the same federal primacy over the custody, settlement, and payments activities a national trust bank conducts under its charter. Read together, they stake out the OCC’s supervisory ground over digital-asset national trust banks before the GENIUS Act rules are final.

[1] OCC Interpretive Letter No. 1192 (May 12, 2026).

[2] OCC Interpretive Letter No. 1167 (May 20, 2020).

[3] The principle of federal preemption itself is long-settled: as federal instrumentalities, national banks, including national trust banks, are not subject to state licensing requirements that prevent or significantly interfere with their exercise of federally authorized powers, and the OCC and the courts have applied that principle to consumer lending, mortgage lending, and payments activities, among others. See 12 U.S.C. § 25b; 12 C.F.R. §§ 7.4008(d)(1), 7.5002(c), 34.4(a)(1); see also Barnett Bank of Marion Cnty., N.A. v. Nelson, 517 U.S. 25 (1996); Watters v. Wachovia Bank, N.A., 550 U.S. 1 (2007). Congress recognized the same framework in the Dodd-Frank Act when it declined to extend these preemption benefits to national bank subsidiaries. See 12 U.S.C. § 25b(e), (h). What IL 1192 clarifies is not the preemption principle, but its application to national trust banks beyond federally authorized fiduciary activity, dispelling the narrower reading that IL 1167 had invited. As national banks thought, national trust banks have always benefitted from the same preemption principles.

[4] See 12 U.S.C. § 27(a).

[5] See, e.g., 12 U.S.C. §§ 24(Seventh), 92a.

[6] See, e.g., Order Preempting the Illinois Interchange Fee Prohibition Act, 91 Fed. Reg. 23150 (Apr. 29, 2026); National Bank Non-Interest Charges and Fees, 91 Fed. Reg. 22989 (Apr. 29, 2026) (interim final rule).

The following Gibson Dunn lawyers prepared this update: Jason Cabral, Rosemary Spaziani, Sara Weed, Karin Thrasher, and Paul Yu.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. Please feel free to contact the Gibson Dunn lawyer with whom you usually work, the authors, or any member of the firm’s Financial Institutions or Fintech & Digital Assets practice groups:

Jason J. Cabral – New York (+1 212.351.6267, jcabral@gibsondunn.com)

Ro Spaziani – New York (+1 212.351.6255, rspaziani@gibsondunn.com)

Sara K. Weed – Washington, D.C. (+1 202.955.8507, sweed@gibsondunn.com)

FS Credit Opportunities Corp. v. Saba Capital Master Fund, Ltd, No. 24-345 – Decided June 11, 2026

Today, the Supreme Court held 6-3 that Section 47(b) of the Investment Company Act of 1940 does not create a private right of action for rescission of contracts that violate the Act.

“[N]othing in the text or structure of the ICA indicates that Congress authorized private parties to enforce virtually every provision in the statute. For a cause of action to exist, we would have to create it.”

Justice Barrett, writing for the Court

Background:

The Investment Company Act of 1940 (ICA) comprehensively regulates investment companies and affords the Securities and Exchange Commission primary responsibility for enforcing its provisions. Any contract that violates the ICA or any rule or regulation thereunder “is unenforceable by either party” under Section 47(b)(1) “unless a court finds that under the circumstances enforcement would produce a more equitable result” and “would not be inconsistent with the purposes of this subchapter.” 15 U.S.C. § 80a-46(b)(1). To that end, “a court may not deny rescission at the instance of any party unless such court finds that under the circumstances the denial of rescission would produce a more equitable result than its grant and would not be inconsistent with the purposes of this subchapter.” Id. § 80a-46(b)(2).

Several investment companies sued several investment funds under Section 47(b), seeking rescission of contracts that allegedly violated the ICA. Relying on an earlier decision by the Second Circuit, the district court held that Section 47(b) created an implied private right of action. It then granted summary judgment to the investors and ordered the contracts rescinded. The Second Circuit affirmed.

Issue:

Whether Section 47(b) of the ICA creates a private right of action for rescission of contracts that violate the ICA.

Court’s Holding:

No. Section 47(b) does not create a freestanding private cause of action for parties to seek rescission of contracts that violate the ICA.

What It Means:

Today’s decision reiterates that the Court has “rejected the practice of fashioning rights of action” absent clear congressional intent in a statute’s text and structure. Op. 3. And “nothing in the text or structure of the ICA indicates that Congress authorized private parties to enforce virtually every provision in the statute.” Op. 8. Instead, Section 47(b) acts as a “mandate” to courts about their authority under the ICA in cases before it under other valid causes of action—like claims for breach of contract or for breach of fiduciary duties.
The Court’s decision reaffirms the SEC’s central role in enforcing—or exempting investment companies from—the ICA and reduces the risk that private suits will undermine the SEC’s enforcement priorities.

The Court’s decision also reveals sharp disagreement among the Justices about the role of legislative history in statutory interpretation. The majority rejects the use of legislative history to “divin[e] how Congress would have wanted courts to resolve” issues, remarking that such a mode of interpretation “depends on the fictional premise that hundreds of legislators (not to mention the President) shared a unified private view of how the statute should apply.” Op. 11. On the other hand, Justice Jackson, joined by Justice Sotomayor, called use of “legislative history as a tool of statutory interpretation . . . a time-honored tradition.” Justice Jackson Dissent 16. Justice Kagan, writing for herself, “fall[s] someplace in between,” explaining that “[r]eliance on legislative history may be appropriate” when statutory text is “stubbornly ambiguous.” Kagan Dissent 1.

The Court’s opinion is available here.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding developments at the Supreme Court. Please feel free to contact the following practice group leaders:

Appellate and Constitutional Law

Thomas H. Dupree Jr. +1 202.955.8547 tdupree@gibsondunn.com	Allyson N. Ho +1 214.698.3233 aho@gibsondunn.com	Julian W. Poon +1 213.229.7758 jpoon@gibsondunn.com	Jeffrey B. Wall +1 202.955.8533 jwall@gibsondunn.com
Lucas C. Townsend +1 202.887.3731 ltownsend@gibsondunn.com	Bradley J. Hamburger +1 213.229.7658 bhamburger@gibsondunn.com	Brad G. Hubbard +1 214.698.3326 bhubbard@gibsondunn.com

Related Practice: Securities Litigation

Monica K. Loseman
+1 303.298.5784
mloseman@gibsondunn.com

Brian M. Lutz
+1 415.393.8379
blutz@gibsondunn.com

Jason J. Mendro
+1 202.887.3726
jmendro@gibsondunn.com

Craig Varnen
+1 213.229.7922
cvarnen@gibsondunn.com

This alert was prepared by associates Elizabeth Kiernan, Matt Aidan Getz, and Noah Delwiche.

On June 2, 2026, the Securities and Futures Commission (SFC) issued a circular to licensed corporations, SFC-licensed virtual asset service providers (VATPs) and their associated entities (collectively referred to as licensed firms), reminding them to review and enhance their cybersecurity measures in light of heightened risks posed by artificial intelligence (AI)-enabled cyberattacks (SFC Circular).[1] On the same day, the Hong Kong Monetary Authority (HKMA) issued a circular to all authorized institutions, urging vigilance against AI-powered cyber threats (HKMA Circular), reflecting a parallel focus on cybersecurity resilience within the banking sector.[2]

The SFC and HKMA Circulars are especially relevant to licensed firms and banks engaging in electronic trading (particularly large retail brokers and depositaries of SFC-authorized collective investment schemes licensed for Type 13 regulated activity) as well as VATPs. The circulars come against the backdrop of a sharp rise in cyber incidents in Hong Kong, which the SFC notes increased by 27% to 15,877 in 2025 (from 12,536 in 2024) according to the Hong Kong Computer Emergency Response Team Coordination Centre. This client alert outlines the key expectations of the SFC and HKMA regarding measures to mitigate potential AI‑enabled cyberattack risks.

I. Developments in AI-Enabled Cyber Threats

Both regulators share the view that frontier AI models mark a qualitative shift in the cyber threat landscape. In particular, these models are becoming more capable of planning and executing complex, multi-step actions autonomously, identifying security flaws which have so far remained undetected by software developers (so-called “zero-day vulnerabilities”), chaining multiple lower risk-rated vulnerabilities together, and operating across interconnected systems.

This changes the risk calculus for firms in two important ways. First, by automating the discovery and chaining of vulnerabilities, frontier AI models significantly lower the technical barrier to entry, enabling a wider range of threat actors to execute sophisticated malicious activities (such as phishing and deepfake impersonation). Second, the increasing availability of frontier AI models also means existing security defences may no longer be adequate at their current calibration. Specifically, the time between the disclosure or identification of a vulnerability in security software and its exploitation may become significantly shorter, making traditional patching and change management timelines less effective.

II. Key Regulatory Expectations

In light of the escalating cyber risks from frontier AI models, both the SFC and the HKMA expect licensed firms and authorized institutions to enhance internal controls. Below is a summary of the key requirements organized by theme, drawing from both the SFC and HKMA Circulars.

Areas of focus	Requirements from the SFC Circular	Requirements from the HKMA Circular
Cybersecurity controls and resilience enhancements	Patching and vulnerability management Licensed firms review and enhance their patching and vulnerability management processes. This includes: taking prompt action to address known vulnerabilities; implementing adequate policies and procedures for urgent and critical fixes outside routine patching cycles, especially in relation to business critical components; and allocating sufficient resources to handle a potential surge in patching demands, particularly for vulnerabilities affecting business-critical components. Access and perimeter controls Licensed firms should design system controls on the assumption that any user, device, privileged account or network component may be compromised. In particular, they should: enforce least-privilege access to all business critical components; enhance firewalls and network segmentation; treat external and untrusted inputs (e.g., contents from apps, emails, documents and webpages) as potentially adversarial and do not allow them to alter system instructions or trigger privileged actions directly; and apply maker-checker controls for high-impact actions. Detection and monitoring Licensed firms should strengthen threat detection and monitoring of anomalies in client trading activities and system activities and improve their threat intelligence gathering capability.	Authorized institutions are already expected to have multi-layered defenses against zero-day vulnerabilities targeted by frontier AI-models (such as appropriate patching protocol) pursuant to the HKMA’s existing supervisory requirements. In view of the evolving threat, authorized institutions are expected to assess whether current arrangements remain fit-for-purpose assuming that the scale and speed of attacks will accelerate with frontier AI’s assistance. Additionally, authorized institutions that have implemented a Secure Tertiary Data Backup (STDB) should consider whether and how those arrangements could be improved to enhance response capacity in the event of a destructive attack. Authorized institutions that have not implemented STDB should revisit that decision in light of the evolved risk landscape.
Third-party supply chain risk management	Licensed firms should implement proper procedures to address AI-enabled threats targeting third party service providers that support their critical operations and business critical components (third party service providers). Specifically, they should: strengthen their third party supply chain risk governance framework; enhance initial and ongoing assessments on third party service providers to factor in the latest threat landscape; and ensure proper management of cybersecurity risks associated with third party service providers, especially those arising from AI-enabled cyberattacks.	Authorized institutions should assess the cyber resilience capabilities of third party service providers, which as common “nodes” supporting the ecosystem, are increasingly being targeted by threat actors.
Incident response and recovery	Licensed firms should review and enhance incident handling procedures and contingency plans for AI-enabled cyberattacks that may result in unauthorized access, leakage of sensitive information or significant service disruption. Since AI-enabled attacks may outpace traditional detection-and-response processes, the SFC expects licensed firms to establish adequate escalation and reporting mechanisms and consider pre-planned containment and exploit-interruption strategies, including the ability to block malicious activities, isolate affected systems and restrict access rapidly. Licensed firms should regularly test their cybersecurity incident handling procedures and contingency plans through tabletop exercises, simulated attacks or other appropriate methods to assess the effectiveness of these procedures and plans. Licensed firms should regularly back up business records, client and transaction databases, and supporting documentation, and implement appropriate measures to ensure the availability of those backup copies. Licensed corporations engaged in electronic trading and VATPs are required to back up such records and data at least on a daily basis. Licensed firms are reminded to notify the SFC promptly of material cybersecurity incidents and attacks.	The HKMA warns that as the velocity and intensity of cyberattacks trend upwards, breach scenarios will become more probable. Therefore, authorized institutions should: review the readiness of their incident response and recovery processes, including playbooks for prominent cyberattacks; conduct scenario testing where appropriate, including as part of existing operational resilience programs; and ensure that any third parties that are dependent on the response and recovery process are equipped and sufficiently resourced to step up in times of need.

The SFC Circular also includes an appendix setting out a non-exhaustive list of recommended controls and procedures to assist licensed firms to reviewing and enhancing their cybersecurity framework, and in managing and mitigating risks associated with AI-enabled cyberattacks (Appendix).[3] While these measures are illustrative and should be implemented having regard to the licensed firm’s nature, scale, complexity, technology dependencies and cyber risk exposure, the SFC indicates that certain firms, such as those engaged in electronic trading (particularly large retail brokers, depositaries of SFC-authorized collective investment schemes licensed for Type 13 regulated activity) and VATPs are generally expected to implement all of the measures in the Appendix.

More fundamentally, the SFC also expects licensed firms to maintain an accurate and up-to-date inventory of technology assets and components – including hardware, software, network infrastructure, databases and cloud services – and to identify assets and services that are externally exposed, business-critical or dependent on third-party components, so that remediation and protective measures can be directed to the highest-risk areas promptly and effectively. Licensed firms should also ensure that their asset inventories are kept sufficiently up-to-date to facilitate same-day prioritization and containment decisions when new vulnerabilities or threat intelligence emerge.

By contrast, the HKMA Circular does not specify particular controls or measures to be implemented. Instead, it largely builds on and refers authorized institutions to comply with existing supervisory requirements and emphasizes the need for authorized institutions to critically review whether their current controls remain fit‑for‑purpose in light of evolving AI‑enabled threats. The HKMA also places particular focus on testing and validation—such as assessing incident response and recovery readiness through scenario testing, and evaluating third‑party resilience.

III. Regulatory Initiatives Going Forward

Both the SFC and HKMA have stated that they will continue monitoring developments, maintain dialogue with the industry and relevant stakeholders, and provide additional guidance to the industry. Notably, the HKMA has also stated that it will continue to support the following targeted initiatives:

the establishment of a task force on AI-driven cyber risks as an official forum for key stakeholders in the financial and cyber risk ecosystem to facilitate information sharing and discussion of practical ecosystem responses;
the development of the Cyber Resilience Testing Framework aimed at assisting authorized institutions in stress testing their ability to respond to and recover from actual breach situations, with an initial test run involving selected institutions targeted for late 2026;
supporting the implementation of the Protection of Critical Infrastructures (Computer Systems) Ordinance (PCICSO) by entering into a Memorandum of Understanding with the Commissioner of Critical Infrastructure (Computer‑system Security) to ensure a coordinated approach to implementation, while prioritizing a reduction in compliance burdens for the industry where practicable;[4] and
issuing a Sectoral Code of Practice that provides practical guidance on how authorized institutions designated as critical infrastructure operators can comply with the obligations pursuant to PCICSO.[5]

IV. Conclusion

As frontier AI models continue to develop exponentially, we expect AI‑enabled cyber resilience to remain an area of close supervisory focus. Senior management (including the Manager-in-Charge of Information Technology in licensed firms) bears ultimate responsibility for managing cybersecurity risks and should ensure that internal policies and procedures are adequately reviewed, enhanced, and approved to align with the SFC and HKMA Circulars. Where appropriate, licensed firms and authorized institutions should also seek independent professional advice and support from information technology specialists.

[1] “Circular to licensed corporations, SFC-licensed virtual asset service providers and associated entities: Enhanced cybersecurity measures to address evolving risks arising from artificial intelligence-enabled cyberattacks”, published by the Securities and Futures Commission on June 2, 2026, available here.

[2] “Strengthening Cyber Resilience amid Artificial Intelligence-Empowered Cyber Threats”, published by the Hong Kong Monetary Authority on June 2, 2026, available here.

[3] “Appendix: Examples of controls and procedures to manage and mitigate potential risks associated with AI-enabled cyberattacks”, published by the Securities and Futures Commission on June 2, 2026, available here.

[4] Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653), available here.

[5] “Code of Practice Pursuant to the Protection of Critical Infrastructures (Computer Systems) Ordinance (for Authorized Institutions designated by the Monetary Authority as Critical Infrastructure Operators)”, published by the Hong Kong Monetary Authority on June 2, 2026, available here.

The following Gibson Dunn lawyers prepared this update: William Hallatt, Becky Chung, and Jane Lu.

William R. Hallatt (+852 2214 3836, whallatt@gibsondunn.com)

Emily Rumble (+852 2214 3839, erumble@gibsondunn.com)

Arnold Pun (+852 2214 3838, apun@gibsondunn.com)

Becky Chung (+852 2214 3837, bchung@gibsondunn.com)

Jane Lu (+852 2214 3735, jlu@gibsondunn.com)

We are pleased to provide you with the April 2026 edition of Gibson Dunn’s monthly European privacy, cybersecurity, and data innovation update. Please feel free to reach out to us to discuss any of the below topics further.

Europe

04/29/2026

European Commission | Recommendation | EU Age Verification App

The Commission has urged Member States to accelerate deployment of the EU age verification solution and make it available by the end of 2026.

Alongside this push targeting EU Member States, the Commission also adopted a Recommendation on age assurance and age verification technologies. The Recommendation indicates that Member States can deploy the solution either as a standalone app or through the future European Digital Identity Wallet. The Commission also states that the app is designed to let users prove they meet an age threshold without revealing their exact age, identity, or other personal details, and sets out the steps needed to ensure interoperability and swift rollout across the EU.

For more information: European Commission website and Recommendation [English]

04/16/2026

EDPB | Consultation | Personal Data for Scientific Research Purposes,/span>

The EDPB has opened a public consultation on draft guidance clarifying how the GDPR applies to scientific research.

The consultation concerns draft Guidelines 1/2026 on the processing of personal data for scientific research purposes. The draft guidance addresses GDPR issues arising in research contexts, including health-related research, the allocation of roles and responsibilities among actors involved in research projects, applicable legal bases (including consent), data subject rights and the conditions under which they may be limited, and expected safeguards when personal data is processed for scientific research. The consultation runs until 25 June 2026 and comments submitted through the consultation form will be published on the EDPB website.

For more information: EDPB Guidelines [English]

04/14/2026

EDPB | Public Consultation | Official DPIA Template

The EDPB has launched a public consultation on a harmonized template intended to promote greater consistency in Data Protection Impact Assessment (DPIA) practices across Europe.

According to the EDPB, the template is designed to help organizations structure, harmonize and evidence their DPIAs and is accompanied by an explainer document addressing practical questions and knowledge gaps. The consultation runs until 9 June 2026, after which supervisory authorities are expected to adopt it either as their own template or as a common “meta-template” compatible with national models; in the meantime, organizations are encouraged to use it and provide feedback as part of the consultation.

For more information: EDPB press release and Public consultation [English]

04/09/2026

EDPB | Report | 2025 Annual Report

The EDPB’s 2025 Annual Report highlights a year focused on guidance, regulatory coordination, and practical support for compliance.

The Report underscores the interaction between the GDPR and newer EU digital laws, in particular the DSA, DMA, and AI Act, as well as initiatives on pseudonymization, blockchain, account-creation requirements on e-commerce websites, and coordinated enforcement on the right to erasure. The reported figures include 414 new cross-border cases, 1,299 one-stop-shop procedures, 572 final decisions and approximately €1.16 billion in administrative fines.

For more information: EDPB website [English]

Belgium

04/28/2026

Belgium Supervisory Authority (APD) | Recommendation | Direct Marketing

The APD has overhauled its direct marketing compliance framework through an updated Recommendation and an accompanying practical checklist.

Recommendation 01/2025 adopts a broad understanding of direct marketing and identifies consent and legitimate interest as the main legal bases for the underlying processing activities, while making clear that controllers may not switch legal bases midstream for the same processing purpose. It also addresses sensitive data targeting, processing relating to minors, and the limits of “consent or pay” models. The APD has also published a practical checklist intended to help organizations assess compliance with the framework.

For more information: APD Recommendation and Checklist [French]

04/22/2026

APD / UK Information Commissioner’s Office (ICO) | Memorandum of Understanding | Cooperation Agreement

Belgium’s APD and the UK ICO have signed a Memorandum of Understanding (“MoU”) aimed at strengthening cooperation on cross-border data protection issues.

The MoU is framed as a practical cooperation instrument in response to the growing complexity of international personal data flows and seeks to promote more consistent regulatory approaches when both authorities face similar issues. The MoU aims at prioritizing exchange of experience, coordination, and recognition of parallel investigations, while expressly stating that it does not cover any sharing of personal data between the two authorities.

For more information: APD website / MoU [English]

France

04/28/2026

French Supervisory Authority (CNIL) | Guidelines | GDPR Code of Conduct (Retail Sector)

CNIL has approved a new sectoral code for French clothing and footwear retailers.

The code applies to French clothing and footwear retailers that are members of the Alliance du Commerce and act as controllers in consumer retail sales and distribution, both online and in-store. According to the CNIL, this is the first code of conduct of national scope and the third sector-specific code approved by the authority. The code translates GDPR requirements into a practical compliance framework tailored to the retail sector. Only retailers whose decision-making center is located in France, or which constitute a French establishment of an international group, may adhere to the code.

For more information: CNIL website and Code of Conduct [French]

04/27/2026

CNIL | Compliance Tool | Data Protection Officer (DPO)

CNIL has published a practical template to help DPOs structure and present their annual activity reports.

While the CNIL notes that DPO activity reports are not mandatory, it considers them best practice for supporting accountability and monitoring data protection compliance over time. According to the CNIL, such reports can help organizations assess their level of GDPR maturity, report internally on compliance actions and priorities, and strengthen both internal and external communication regarding compliance efforts. The template is therefore intended as a practical accountability tool designed to support the DPO’s visibility, governance, and follow-up on compliance actions.

For more information: CNIL website [French]

04/14/2026

CNIL | Recommendation | Tracking Pixels in Emails

CNIL has finalized its Recommendation on the use of tracking pixels in email communications.

The Recommendation emphasizes transparency obligations relating to the use of tracking pixels and recalls that some uses, especially marketing-related ones, require prior consent. This guidance is designed to increase transparency of email tracking, requiring that information be provided in an accessible, understandable and timely manner, and stressing that refusing or withdrawing consent should be as easy as granting it.

For more information: CNIL website and Recommendation [French]

04/07/2026

CNIL | Work Program | 2026 Guidance Roadmap

CNIL has laid out its 2026 guidance work program, outlining upcoming initiatives on consent, AI, health data, access rights, and cybersecurity.

The program includes work on multi-property consent mechanisms, AI deployment in the workplace and the healthcare sector, automatic analysis of voice communications, documentation tools for DPOs, and the allocation of responsibilities across the AI value chain. The CNIL also announced future guidance relating to social housing, health-research methodologies, employees’ access right requests, electronic voting, secure messaging, remote identity verification, web-filtering gateways, and endpoint detection and response solutions. The publication shows a clear effort to provide regulated actors with greater visibility over CNIL’s upcoming guidance priorities.

For more information: CNIL website [French]

04/03/2026

CNIL | Control Agenda | 2026 Inspection Priorities

The CNIL has announced its 2026 priority inspection themes, with a strong focus on recruitment practices, use of the national electoral register and data processing by sports federations.

The CNIL explains that approximately 20% of its annual inspections are tied to priority themes selected because of their significance for individuals’ rights and freedoms. In 2026, it will examine compliance with its 2023 recruitment guidance, especially on automated decision-making, candidate information, and retention periods, with a focus on large companies and recruitment firms. It will also scrutinize uses of the national electoral register and assess sports federations’ processing of large volumes of personal data, including health data and data relating to criminal offenses, concerning a significant number of minors, with particular attention to data relevance, retention and security in a sector recently affected by cyberattacks. Additionally, under the 2026 coordinated enforcement framework, the CNIL (in coordination with the EDPB) will join other EEA authorities in assessing the transparency and completeness of information provided to data subjects.

For more information: CNIL website [French]

04/02/2026

CNIL | Reference Framework | Retention Periods for Human Resources

CNIL has issued a new practical framework to help employers define retention periods for HR-related data.

The framework applies to private and public employers subject to French labour law and is designed to help employers determine the appropriate retention periods for personal data processing in the context of common HR activities. It covers recruitment, administrative personnel management, payroll, workplace security, professional vehicles, recorded phone calls at work, collective labour relations, workplace accidents, litigation, and whistleblowing. While not legally binding, this framework provides operational guidance and consolidates both soft-law recommendations and retention periods that are mandatory under applicable legislation or regulation.

For more information: CNIL website and Reference Framework [French]

Germany

04/24/2026 and 04/13/2026

Bavarian Data Protection Commissioner (BayLfD) | Guidance | LLM Chatbots and AI Translation Tools

The BayLfD has published practical guidance for Bavarian public bodies on the use of LLM-powered chatbots, following earlier guidance on AI-based translation tools.

The chatbot guidance covers key considerations for procurement, implementation, data processing agreements and DPIAs, as well as technical safeguards such as disabling the use of user inputs for training purposes. The translation-tool guidance focuses on issues such as the processing of voice data, potential biometric data as well as translation accuracy.

For more information: BayLfD chatbot guidance and BayLfD translation guidance [German]

04/22/2026

German Federal Government | Draft Law | IP Address Retention and Law Enforcement Access to Traffic Data

The German Federal Government has approved a draft law that would require internet access providers to retain IP addresses for a period of three months.

According to the government, the proposal is intended to strengthen the investigations and prosecution of online crime. It would also introduce a preservation order enabling law enforcement authorities to preserve traffic data for up to three months in specific cases. The draft also expands location/cell-site data inquiries to offences of significant importance.

For more information: Federal Government article [German]

04/07/2026

Germany’s Cyber Agency (BSI) | Cybersecurity Standard | Secure Cloud Computing

BSI has released the new version of its cloud-security catalogue.

According to the BSI, C5:2026 updates Germany’s main security standard for cloud providers and users and translates complex security requirements into auditable criteria. It highlights new treatment of topics such as container management, post-quantum cryptography, and confidential computing. The revised structure is intended to improve usability, comparability, and integration into governance, risk, and compliance processes. The catalogue is closely aligned with the European cloud certification framework and also takes into account ISO/IEC 27001:2022, the CSA Cloud Controls Matrix v4, and the NIS 2 Directive.

For more information: BSI press release [German]

04/02/2026

Administrative Court Düsseldorf | Judgment | GDPR

Administrative Court (VG) Düsseldorf has issued a decision on the requirements for email security under Art. 32 GDPR.

The Court held that the GDPR does not impose a general obligation to use end-to-end encryption for e-mail communication. Rather, the appropriate security measures under Article 32 GDPR must be determined on a risk-based, case-by-case basis, taking into account the specific risks posed to the data subject. In the case at hand, the personal data concerned was not considered particularly sensitive, and encryption during transmission was therefore deemed sufficient to ensure an appropriate level of protection. The Court nevertheless emphasized that stricter measures may be required where the sensitivity of the data or the level of risk is higher.

For more information: Judgment Administrative Court Düsseldorf [German]

04/02/2026

Independent federal and state data protection authorities | Statement | Digital Investigative Powers

The German Data Protection Conference (DSK) has raised concerns about proposed legislation that would expand digital investigative powers, particularly biometric online identification and automated data analysis.

According to the DSK, the draft legislation in its current form poses significant risks to fundamental rights, as it could allow identification and extensive analysis of individuals not involved in criminal conduct. The proposed measures could enable far-reaching surveillance, including by cross-referencing internet data and using AI-based tools to analyze large datasets. The DSK therefore calls for clearer statutory limitations, a stronger focus on proportionality, and more robust safeguards for fundamental rights.

For more information: German Federal Government announcement and DSK press release [German]

Italy

04/21/2026

Garante | Guidelines | Tracking Pixels in Emails

Garante has drawn a clear consent-first framework for tracking pixels used in emails.

According to the Guidelines, tracking pixels generally fall within the same legal framework as cookies and similar tracking technologies, meaning their use requires prior, free, specific, and informed consent. The Garante also identified limited exceptions, such as security or strictly necessary technical uses, while stressing proportionality, data minimization, privacy by design and by default, and the availability of simple withdrawal mechanisms. Providers will have six months from publication in the Official Gazette to comply. While the Garante and the CNIL align on core principles, their guidance differs in several respects, meaning organizations operating across jurisdictions will need to ensure compliance under both regimes.

For more information: Garante Guidelines [IT]

04/20/2026

Garante | Sanction | Two companies fined €12.5 Million

Garante has issued major fines against two companies over unlawful data processing linked to banking service apps.

The Garante issued one of the period’s most significant privacy fines – totaling about €12.5 million (€6.624 million and €5.877 million) against two companies providing banking apps. The authority found that the companies had unlawfully processed the personal data of millions of users through invasive device-monitoring measures embedded in their apps. According to the Garante, users were effectively forced to accept such monitoring measures to access the services. The investigation also identified shortcomings in the information notices, DPIA, retention framework, security measures, and processor arrangements. In addition to the fines, the Garante ordered the companies to stop the unlawful processing (if it had not already ceased) and to bring retention practices into line with its prescriptions.

For more information: Garante’s website and decision [IT]

The Netherlands

04/21/2026

Dutch Supervisory Authority (AP) | Public Consultation | Explanations for Automated Decision-Making

AP has opened a consultation on practical tools for explaining automated decisions to individuals.

The AP is developing guidance to help organizations explain automated decision-making in a way that works in practice, as part of its 2026 work on the “right to explanation” in cases where automated decisions have significant consequences for individuals. In substance, the consultation focuses on the information that individuals should receive when such decisions are made about them, including the use of automated decision-making, the significance and likely effects of the decision, the underlying logic, and the rights available to seek human intervention or otherwise challenge the outcome.

For more information: AP website [English]

04/16/2026

AP | Supervisory Initiative | Incoming Preventive Checks on ICT Suppliers

The AP introduces preventive inspections of ICT suppliers as part of its broader cyber-risk supervision strategy.

The AP indicates that the initiative aims to strengthen prevention against cyberattacks and data leaks by assessing in advance how organizations, especially ICT suppliers, have organized their digital security. The AP notes that ICT suppliers often process large volumes of personal data on behalf of many client organizations, meaning that a single breach can have significant downstream effects. The inspections are therefore presented as a preventive measure to help organizations identify and remedy weaknesses before incidents occur.

For more information: AP website [NL]

04/02/2026

AP | Report | 2025 Annual Report

The AP’s 2025 annual report reflects an increasingly strategic and intervention-focused approach to supervision.

The authority identifies five priority areas: algorithms and AI, big tech, data trade and leaks, freedom and security, and digital government. It also highlights more frequent use of informal and corrective measures alongside formal enforcement, with 13,517 complaints and 44,374 data breach notifications reported in 2025. The report further notes the AP’s expanding role under several EU digital regulations, including the DSA and the Political Advertising Regulation, as well as its broader involvement in EDPB work.

For more information: Autoriteit Persoonsgegevens website [NL]

Poland

04/02/2026

Ministry of Digital Affairs | Cybersecurity | NIS 2 Transposition enters into force

Poland’s revised cybersecurity framework has entered into force, triggering the first compliance deadlines for in-scope entities under NIS 2.

The amended Act aligns Poland’s national framework with the NIS 2 Directive, expands the range of regulated entities, and introduces new obligations linked to registration, incident reporting, governance, and auditing.

For more information: Ministry of Digital Affairs (Poland) website [Polish]

United Kingdom

04/16/2026

UK Government | Regulations | ICO Code of Practice on AI and Automated Decision-Making

The UK has adopted regulations requiring the ICO to prepare a code of practice on AI and automated decision-making.

The Regulations were made on 16 April 2026, laid before Parliament on 21 April 2026, and came into force on 12 May 2026. They require the ICO to prepare a code of practice on good practice in the processing of personal data under the UK GDPR and the Data Protection Act 2018, excluding Part 4 of the Act, in relation to developing and using artificial intelligence and automated decision-making; the code must also include guidance on the processing of children’s personal data.

For more information: UK Regulations and Legislative history [English]

04/21/2026

National Cyber Security Centre (NCSC) | Guidance | Cross-Domain Guidance for High-Risk Environments

The NCSC has updated its cross-domain architecture guidance to reflect more hostile threat models and more complex connected systems.

The guidance is aimed at organizations operating where targeted attack is assumed and the consequences of compromise are severe, including critical infrastructure and environments holding sensitive information or significant intellectual property. It shifts the focus from fixed boundaries and product-specific controls toward end-to-end architecture, “zones of trust,” and function “pipelines” across trust zones; for new end-to-end architectures it largely replaces the older cross-domain security principles, while the original import/export design patterns are being deprecated and further implementation material is awaited.

For more information: NCSC press release / guidance [English]

04/29/2026

ICO | Guidance | Use of Storage and Access Technologies

The ICO has published an updated guide to use of storage and access technologies, following two consultations on draft guidance between 2024 and 2025.

The guidance includes two new chapters on PECR guidance, focusing on (i) the ‘simple means of objecting’ (clarifying that a simple means of objection could be provided through an existing consent mechanism or use toggles) and (ii) using ‘the same storage and access technology for multiple purposes’.

For more information: ICO website [English]

The following Gibson Dunn lawyers prepared this update: Ahmed Baladi, Vera Lukic, Kai Gesing, Joel Harrison, Thomas Baculard, Ioana Burtea, Kelly Cannon, Billur Cinar, Hermine Hubert, Christoph Jacob, Yannick Oberacker, and Phoebe Rowson-Stevens.

Gibson Dunn lawyers are available to assist in addressing any questions you may have about these developments. Please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any leader or member of the firm’s Privacy, Cybersecurity & Data Innovation practice group:

Privacy, Cybersecurity, and Data Innovation:

United States:
Abbey A. Barrera – San Francisco (+1 415.393.8262, abarrera@gibsondunn.com)
Ashlie Beringer – Palo Alto (+1 650.849.5327, aberinger@gibsondunn.com)
Ryan T. Bergsieker – Denver (+1 303.298.5774, rbergsieker@gibsondunn.com)
Gustav W. Eyler – Washington, D.C. (+1 202.955.8610, geyler@gibsondunn.com)
Cassandra L. Gaedt-Sheckter – Palo Alto (+1 650.849.5203, cgaedt-sheckter@gibsondunn.com)
Svetlana S. Gans – Washington, D.C. (+1 202.955.8657, sgans@gibsondunn.com)
Lauren R. Goldman – New York (+1 212.351.2375, lgoldman@gibsondunn.com)
Stephenie Gosnell Handler – Washington, D.C. (+1 202.955.8510, shandler@gibsondunn.com)
Natalie J. Hausknecht – Denver (+1 303.298.5783, nhausknecht@gibsondunn.com)
Jane C. Horvath – Washington, D.C. (+1 202.955.8505, jhorvath@gibsondunn.com)
Martie Kutscher Clark – Palo Alto (+1 650.849.5348, mkutscherclark@gibsondunn.com)
Kristin A. Linsley – San Francisco (+1 415.393.8395, klinsley@gibsondunn.com)
Vivek Mohan – Palo Alto (+1 650.849.5345, vmohan@gibsondunn.com)
Ashley Rogers – Dallas (+1 214.698.3316, arogers@gibsondunn.com)
Sophie C. Rohnke – Dallas (+1 214.698.3344, srohnke@gibsondunn.com)
Eric D. Vandevelde – Los Angeles (+1 213.229.7186, evandevelde@gibsondunn.com)
Frances A. Waldmann – Los Angeles (+1 213.229.7914,fwaldmann@gibsondunn.com)
Debra Wong Yang – Los Angeles (+1 213.229.7472, dwongyang@gibsondunn.com)

Europe:
Ahmed Baladi – Paris (+33 1 56 43 13 00, abaladi@gibsondunn.com)
Patrick Doris – London (+44 20 7071 4276, pdoris@gibsondunn.com)
Kai Gesing – Munich (+49 89 189 33-180, kgesing@gibsondunn.com)
Joel Harrison – London (+44 20 7071 4289, jharrison@gibsondunn.com)
Lore Leitner – London (+44 20 7071 4987, lleitner@gibsondunn.com)
Vera Lukic – Paris (+33 1 56 43 13 00, vlukic@gibsondunn.com)
Lars Petersen – Frankfurt/Riyadh (+49 69 247 411 525, lpetersen@gibsondunn.com)
Christian Riis-Madsen – Brussels (+32 2 554 72 05, criis@gibsondunn.com)
Robert Spano – London/Paris (+44 20 7071 4000, rspano@gibsondunn.com)

Asia:
Connell O’Neill – Hong Kong (+852 2214 3812, coneill@gibsondunn.com)

Gibson Dunn’s Immigration Task Force is available to help clients understand what these and other expected policy changes will mean for them and how to comply with new requirements.

I. INTRODUCTION

Special Immigrant Juvenile Status (SIJS) is a form of federal immigration relief created by Congress in 1990 to protect noncitizen children who have been abused, neglected, or abandoned by one or both parents. Since its creation, SIJS has provided a pathway to lawful permanent residence (a green card) for some of the country’s most vulnerable young people. However, that pathway has always been a long one, with approved SIJS recipients often waiting several years for a visa to be available before they can apply for a green card. To bridge that gap and provide protection to this particularly vulnerable category of noncitizens, the U.S. Citizenship and Immigration Services (USCIS) implemented a deferred action policy in 2022, shielding SIJS holders from deportation and allowing them to work legally while awaiting visa availability. As of May 10, 2026, that policy has now been substantially rolled back.

This alert summarizes the legal framework underlying SIJS, the visa backlog that has left over 100,000 young people in legal limbo, and the evolving administrative and litigation landscape following USCIS’s recent elimination of the deferred action policy for SIJS holders.

II. LEGISLATIVE HISTORY OF SIJS

Congress created SIJS with broad bipartisan support in 1990, codified in the Immigration Act of 1990.[1] In its original form, SIJS allowed noncitizen children in state foster care who were abused, neglected, or abandoned to secure lawful immigration status in the U.S.[2] Eligibility for SIJS has expanded over time, in recognition of the needs and vulnerability of noncitizen children both in and out of the foster care system. In 2008, President George W. Bush signed the Trafficking Victims Protection and Reauthorization Act (TVPRA), a bill passed with unanimous bipartisan support in Congress. The TVPRA was animated by a concern for protecting the vulnerable population of noncitizen children in the United States, including through expanding SIJS eligibility by removing the requirement that a juvenile court find the child eligible for long-term foster care. Since this expansion, a child is now eligible for SIJS if a state juvenile court finds that the child cannot be reunified with one or both parents because of abuse, neglect, abandonment, or another similar basis under state law.[3] This allows children who are living with one parent but have been abused, neglected, or abandoned by the other parent to qualify for SIJS. The TVPRA also extended SIJS eligibility to children placed under the custody of a guardian or agency.

The TVPRA remains the basis for SIJS eligibility today. SIJS is currently available to individuals who apply with a form I-360 and who:[4]

are physically present in the U.S.;
are unmarried;
are younger than 21 at the time of filing; and
have a state juvenile court order (1) placing them in the custody of a guardian or in state foster care, (2) finding that the petitioner cannot reunify with one or both parents due to abuse, neglect, abandonment, or a similar basis under state law, and (3) determining that it would not be in the petitioner’s best interest to be returned to their (or their parents’) country of origin or last residence.

Even though SIJS is a status under federal law and applications for SIJS are processed by a federal agency (USCIS), SIJS was designed to require a state court order because state juvenile court judges are seen as having expertise on the child welfare determinations that SIJS requires.[5] Additionally, the factors to determine what is in a child’s best interest vary from state to state, and thus are seen to be best applied by state court judges.

As modified by the TVPRA, SIJS is unique among the various forms of immigration relief available to gain status in the United States because it introduces the “best interest” of the child applicant into legal determinations—unlike most other forms of immigration relief. This consideration comes from the United Nations’ Convention on the Rights of the Child, the most comprehensive children’s rights treaty in the world.[6] The Convention on the Rights of the Child instructs that “[i]n all actions concerning children . . . the best interests of the child shall be a primary consideration.”[7] The Convention on the Rights of the Child also instructs that children who are “temporarily or permanently deprived of his or her family environment, or in whose best interests cannot be allowed to remain in that environment, shall be entitled to special protection and assistance provided by the State.”[8] SIJS is the primary program the U.S. has to provide these rights to noncitizen children.

III. OVERVIEW OF SIJS: NATURE OF RELIEF, ELIGIBILITY, AND VISA BACKLOG

SIJS is intended to—and does— provide a pathway to lawful permanent residence (a green card). A SIJS applicant must go through a two-phase process. First, while still a juvenile, the applicant must obtain an order from a state juvenile court establishing that the applicant is dependent upon the juvenile court or under the appropriate custody of a state agency or assigned individual; that parental reunification with one or both parents is not viable due to abuse, abandonment, neglect, or a similar basis under state law; and that it is not in the applicant’s best interest to be returned to their or their parent’s country of nationality or last habitual residence.[9] Second, the applicant must file a Form I-360 petition with the USCIS submitting evidence of age, valid juvenile court order(s), evidence of a similar basis (if the juvenile court determined that parental reunification was not viable due to a similar basis to abuse, neglect, or abandonment), and additional evidence relevant to the juvenile court order(s) for USCIS consent.[10]

Under the statute, USCIS is required to make a decision on a petition for SIJS within 180 days of receipt of a properly filed petition with all the required evidence.[11]

However, approved SIJS recipients must wait for a visa to be available before they can apply for a green card. Strict statutory limits on immigrant visas have created a significant and growing backlog. As a result, many SIJS recipients must wait several years—often well into adulthood—before a visa becomes available. For example, as of the date of publication of this alert in May 2026, green cards are becoming available to SIJS holders who were approved in mid-2021, meaning they spent approximately five years in legal limbo after obtaining the necessary predicate orders, filing the required applications with USCIS, and having those applications approved by the agency.[12]

Procedurally, each SIJS youth is assigned a “priority date,” which reflects the date the SIJS petition was filed and establishes the applicant’s place in line for a visa.[13] To determine their visa eligibility, the SIJS recipient must compare their priority date to the Visa Bulletin on the U.S. Department of State’s website and cannot move forward to apply for lawful permanent residence unless their priority date is current under the Visa Bulletin.[14]

Despite SIJS’s basis on the best interests of the child and not employment, Congress assigned SIJS youth to share immigrant visas with the employment-based fourth preference (EB-4) visa category for “special immigrant” workers, which has an annual cap of less than 10,000 visas.[15] Moreover, in 2016, the Department of State determined that the annual limit on “immigrant visas” had been reached for certain countries, creating a backlog that has grown exponentially.[16] In 2023, the Department of State issued a public notice admitting that it had erroneously misinterpreted and misapplied the per-country cap, which led to it “correcting” the issue by creating a retrogression for all EB-4 applicants from all countries—including SIJS holders—and resulting in a years-long worldwide backlog for applicants from all countries.[17]

Currently, there are over 100,000 vulnerable immigrant children in the SIJS backlog, meaning more than 100,000 SIJS holders are still waiting for their turn to be able to apply for a green card despite indisputably meeting all substantive eligibility criteria to become permanent residents.[18] During their years-long wait, these SIJS youth remain in legal and economic limbo without important opportunities and protection, even though USCIS has already recognized the legitimacy of their claims for relief. Because of the enormous backlog, the deferred action policy created in 2022 (and described below) has played a critical role in providing temporary stability, including work authorization, while SIJS recipients await visa availability.

IV. THE 2022 SIJS DEFERRED ACTION POLICY: A BRIDGE DURING THE BACKLOG

In May 2022, in light of the growing backlog, USCIS updated its SIJS policy to automatically consider SIJS applicants for deferred action upon submission of their I-360 petition. Under this framework, once the I-360 was approved, the noncitizen child would be granted deferred action—a form of prosecutorial discretion exercised by the Department of Homeland Security (DHS), the parent agency of USCIS, whereby the government elects to temporarily defer removal of a noncitizen for a designated period. USCIS adopted this approach in recognition of the fact that the approved SIJS holder could not apply for adjustment of status solely because an immigrant visa number was not immediately available, leaving the SIJS holder without status or protection despite having established eligibility for humanitarian relief.[19] The policy was incorporated into the USCIS Policy Manual, reflecting the agency’s commitment to addressing the practical consequences of visa retrogression within the SIJS framework.[20]

Although deferred action does not confer lawful immigration status, it provides meaningful interim protection. In the SIJS context, deferred action is specifically tied to individuals with approved petitions who are unable to proceed to adjustment of status due to the visa backlog. As a practical matter, deferred action protects SIJS holders from deportation while they wait for a visa to become available and, crucially, it allows them to apply for a work permit while their priority date remains non-current.[21] Between 2022 and 2025, approximately 200,000 SIJS youth awaiting green card eligibility were granted protection from deportation under this policy and had the opportunity to obtain work authorization.[22]

The significance of deferred action for this population extends well beyond protection from removal. SIJS beneficiaries who obtain employment authorization are not only lawfully permitted to work but are also eligible for a Social Security number and federally recognized identity documents, enabling them to attend college, access state services, and avoid labor exploitation. Deferred action thus serves as a critical interim safeguard for vulnerable SIJS youth facing prolonged visa backlogs, promoting financial and personal stability during the waiting period for green card availability.

V. POLICY ROLLBACKS UNDER CURRENT ADMINISTRATION

A. Initial Rescission

Beginning in 2025, USCIS initiated a series of policy changes aimed at eliminating automatic consideration of deferred action for SIJS beneficiaries unable to adjust status due to visa unavailability. These changes carry significant consequences for SIJS recipients, including being unable to obtain employment authorization and increased exposure to removal proceedings.

On May 29, 2025, USCIS issued a 60-day information collection notice proposing changes to the form it uses to process deferred action[23] that would remove SIJS from the eligible categories to apply for deferred action.[24] On June 6, 2025, USCIS issued a policy alert eliminating automatic consideration of deferred action for SIJS recipients unable to adjust their status due to visa unavailability.[25] The policy applied to all SIJS recipients regardless of petition approval date.[26]

In July 2025, a nationwide class action, A.C.R. et al. v. Noem, was filed by nine immigrant youth and two legal services providers in the U.S. District Court for the Eastern District of New York challenging the federal government’s decision to end the SIJS deferred action policy.[27] The plaintiffs allege that USCIS’s rescission was arbitrary and capricious, contrary to agency regulations, a violation of the Accardi doctrine, and procedurally defective for failure to comply with Administrative Procedure Act (APA) rulemaking requirements.[28]

On November 19, 2025, the court granted a stay of the SIJS deferred action rescission, finding that the plaintiffs were likely to succeed on the merits.[29] The court noted that USCIS failed to account for the “serious reliance interests” of affected youth—many of whom had already enrolled in educational programs or built careers in reliance of the deferred action program—and its potential consequences that would “radiate outward” to families, schools, employers, and even state governments.[30] The court held that the government’s failure to account for these reliance interests was likely arbitrary and capricious under the APA.[31]

In January 2026, the court issued a clarifying opinion holding that its November order did not require USCIS to treat SIJS as a “strong factor that weighs heavily in favor of granting deferred action.”[32] Instead, the court created a two-tier framework in which applicable deferred action standard varies based on petition approval date. For SIJS beneficiaries approved between April 6, 2025 and June 6, 2025, USCIS must treat SIJS approval as a particularly strong factor weighing in favor of granting deferred action.[33] All other SIJS beneficiaries approved after June 6, 2025, and those seeking to renew their existing deferred action, are subject to a less favorable standard.[34] For this group, USCIS is only required to conduct an individualized, case-by-case evaluation pursuant to the 2022 Policy Alert, meaning SIJS approval carries no heightened weight.[35]

In February 2026, the plaintiffs filed an appeal to the Second Circuit Court of Appeals challenging the district court’s decision to allow for higher deferred action standards for applicants approved after June 6, 2025.[36] If appellants succeed on appeal, all SIJS beneficiaries would be entitled to a deferred action adjudication under the more favorable standard, which treats SIJS approval as a particularly strong positive factor, regardless of when their SIJS petition was approved. Briefing on the appeal is expected to conclude by early June 2026.

B. Second Rescission (USCIS Memorandum PM-602-0198)

On April 10, 2026, USCIS once again rescinded SIJS-based deferred action through its issuance of Policy Memorandum PM-602-0198.[37] In this new policy memorandum, USCIS announced that it was considering the government’s and affected parties’ interests, including current and future SIJ petitioners.[38]

Under this new policy, which became effective May 10, 2026, USCIS will no longer automatically consider deferred action for prospective SIJS beneficiaries who cannot yet adjust their status due to the visa backlog.[39] Instead, those individuals will need to affirmatively request deferred action and USCIS will evaluate each request on a case-by-case basis on its own merits, without treating SIJS approval as a particularly strong positive factor.[40]

VI. PRACTICAL IMPACT OF THE APRIL 10, 2026 POLICY

As of May 10, existing SIJS beneficiaries with deferred action will retain their status and employment authorization until their validity period expires.[41] However, USCIS may, within its discretion, terminate a grant of deferred action through the issuance of a Notice to Appear or a Notice of Termination, and revoke any employment authorization prior to the end of its validity period.[42] Once the SIJS beneficiary receives a written notice of the government’s intent to revoke their employment authorization, the individual has fifteen days to submit countervailing evidence.[43] A USCIS district director will make the final unappealable decision.[44]

New SIJS petitioners who file their Form I-360 on or after May 10, 2026 will not receive automatic deferred action consideration along with no automatic pathway to employment authorization.[45] SIJS beneficiaries may still apply for deferred action via Form G-325A, but their SIJS approval will no longer be treated as a strong positive factor that weighs in favor of granting deferred action. Without deferred action, approved SIJS beneficiaries waiting for green card eligibility are no longer able to apply for employment authorization based on their SIJS approval status and may face potential removal proceedings.

VII. CONCLUSION

The fate of SIJS-based deferred action remains unsettled. With the Second Circuit appeal pending and USCIS’s April 2026 policy memorandum now in effect, the coming months are likely to bring further legal and administrative developments with significant consequences for tens of thousands of vulnerable young people.

[1] Pub. L. 101-649 (November 29, 1990).

[2] U.S. Citizenship and Immigration Services, Policy Manual Vol. 6 Pt. J Ch. 1, https://www.uscis.gov/policy-manual/volume-6-part-j-chapter-1 (last visited May 14, 2026).

[3] Pub. L. No. 110-457, 122 Stat. 5044 § 235(d) (2008).

[4] U.S. Citizenship and Immigration Services, Policy Manual Vol. 6 Pt. J Ch. 1, https://www.uscis.gov/policy-manual/volume-6-part-j-chapter-2 (last visited May 14, 2026).

[5] Hannah Bridge & Leslye E. Orloff, Settled Law: The Role of State Court Judges in Making Special Immigrant Juvenile Status (SIJS) Judicial Determinations (Nov. 26, 2024), https://niwaplibrary.wcl.american.edu/wp-content/uploads/SIJS-Settled-Case-Law-DHS-Regs-Policies-Final-3.14.24.pdf.

[6] Sarah Mehta, There’s Only One Country that Hasn’t Ratified the Convention on Children’s Rights: US, ACLU (Nov. 20, 2015), https://www.aclu.org/news/human-rights/theres-only-one-country-hasnt-ratified-convention-childrens.

[7] United Nations Convention on the Rights of the Child, https://www.unicef.org/child-rights-convention/convention-text. It is noteworthy that while the U.S. signed the Convention in 1995, it is the only country in the U.N. to not have ratified the treaty. So, while the U.S. is not bound by the Convention, it is an important document informing fundamental principles for how to protect and give rights to all children, including immigrant children.

[8] Id.

[9] C.F.R. § 204.11(c).

[10] C.F.R. § 204.11(d).

[11] C.F.R. § 204.11(g).

[12] U.S. Dep’t of State, Visa Bulletin for May 2026, “Final Action Dates for Employment-Based Preference Cases,” https://travel.state.gov/content/travel/en/legal/visa-law0/visa-bulletin/2026/visa-bulletin-for-may-2026.html (last visited May 7, 2026) (showing that visas may be issued for those with priority dates before July 15, 2022).

[13] National Immigrant Justice Center, “Your Special Immigrant Juvenile Status Petition (Form I-260) has been Approved!” https://immigrantjustice.org/wp-content/uploads/2025/05/sijs_backlog_infosheet_2024-02-16_english.pdf.

[14] U.S. Dep’t of State, The Visa Bulletin, https://travel.state.gov/content/travel/en/legal/visa-law0/visa-bulletin.html (last visited May 5, 2026).

[15] Rachel Leya Davidson et al., False Hopes: Over 100,000 Immigrant Youth Trapped in the SIJS Backlog 22 (Dec. 2023).

[16] Id. at 8; 22-23.

[17] Id. at 22-23.

[18] Id. at 10; National Immigrant Project, “About the SIJS Backlog,” https://www.sijsbacklog.com/aboutsijs (last visited May 5, 2026).

[19] Id. at 2.

[20] U.S. Citizenship & Immigr. Servs., Policy Manual Update: Special Immigrant Juvenile Classification and Deferred Action (Mar. 7, 2022), https://www.uscis.gov/sites/default/files/document/policy-manual-updates/20220307-SIJAndDeferredAction.pdf.

[21] Id.

[22] Immigration and Citizenship Data, U.S. Citizenship & Immigr. Servs., https://www.uscis.gov/tools/reports-and-studies/immigration-and-citizenship-data (last visited May 7, 2026).

[23] Agency Information Collection Activities; Revision of a Currently Approved Collection: Biographic Information (for Deferred Action), 90 Fed. Reg. 22,752 (May 29, 2025) (to be codified at OMB Control No. 1615–0008), https://www.govinfo.gov/content/pkg/FR-2025-05-29/pdf/2025-09616.pdf.

[24] U.S. Citizenship & Immigration Servs., Dep’t of Homeland Sec., Draft Instructions for Biographic Information (for Deferred Action), Form G-325A, OMB No. 1615-0008 (May 15, 2025), https://downloads.regulations.gov/USCIS-2005-0024-0074/content.pdf; U.S. Citizenship & Immigration Servs., Dep’t of Homeland Sec., Table of Changes — Form G-325A, Biographic Information (for Deferred Action), OMB No. 1615-0008 (May 15, 2025), https://downloads.regulations.gov/USCIS-2005-0024-0073/content.pdf.

[25] U.S. Citizenship & Immigr. Servs., Policy Alert: Special Immigrant Juvenile Classification and Deferred Action, PA-2025-07 (June 6, 2025), https://www.uscis.gov/sites/default/files/document/policy-manual-updates/20250606-SIJDeferredAction.pdf.

[26] Id. at 2.

[27] A.C.R. et al. v. Noem et. al., No. 1:25-cv-03962 (E.D.N.Y. July 17, 2025), Dkt. No. 1 (Complaint).

[28] Id.

[29] A.C.R. v. Noem, 809 F. Supp. 3d 103, 128–29 (E.D.N.Y. 2025), reconsideration denied, No. 25-CV-3962 (EK)(TAM), 2026 WL 102611 (E.D.N.Y. Jan. 14, 2026).

[30] Id. at 121–22.

[31] Id. at 119–23.

[32] A.C.R. v. Noem, No. 25-CV-3962 (EK)(TAM), 2026 WL 102611, at *4 (E.D.N.Y. Jan. 14, 2026).

[33] Id. at *3 n. 7.

[34] Id. at *3–4.

[35] Id.

[36] Notice of Appeal, A.C.R. et al. v. Noem et al., No. 26-236 (2d Cir. Feb. 3, 2026), appeal from No. 1:25-cv-03962-EK-TAM (E.D.N.Y. Jan. 14, 2026).

[37] U.S. Citizenship & Immigr. Servs., Policy Memorandum: Special Immigrant Juvenile Classification and Deferred Action, PM-602-0198 (Apr. 10, 2026), https://www.uscis.gov/sites/default/files/document/memos/PM-602-0198-SIJDeferredAction-20260410.pdf.

[38] Id. at 1, 5.

[39] U.S. Citizenship & Immigr. Servs., Special Immigrant Juveniles, https://www.uscis.gov/working-in-US/eb4/SIJ (last visited May 14, 2026).

[40] U.S. Citizenship & Immigr. Servs., Policy Memorandum: Special Immigrant Juvenile Classification and Deferred Action, PM-602-0198 at 5–6, 9 (Apr. 10, 2026), https://www.uscis.gov/sites/default/files/document/memos/PM-602-0198-SIJDeferredAction-20260410.pdf.

[41] Id. at 5.

[42] Id.

[43] 8 C.F.R. § 274A.14 (b)(2).

[44] Id.

[45] U.S. Citizenship & Immigr. Servs., Special Immigrant Juveniles, https://www.uscis.gov/working-in-US/eb4/SIJ.

The following Gibson Dunn lawyers prepared this update: Katie Marquart, Stuart Delery, Ariana Sanudo, Laura Raposo, Arthur Halliday, Irvin De La O, Gracie Maynetto, and Harshini Malli.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. Please contact the Gibson Dunn lawyer with whom you usually work, the authors, any leader or member of the firm’s Pro Bono, Public Policy, Administrative Law & Regulatory, Appellate & Constitutional Law, or Labor & Employment practice groups, or the following members of the firm’s Immigration Task Force:

Stuart F. Delery – Co-Chair, Administrative Law & Regulatory Practice Group,
Washington, D.C. (+1 202.955.8515, sdelery@gibsondunn.com)

Naima L. Farrell – Partner, Labor & Employment Practice Group,
Washington, D.C. (+1 202.887.3559, nfarrell@gibsondunn.com)

Nancy Hart – Partner, Litigation Practice Group,
New York (+1 212.351.3897, nhart@gibsondunn.com)

Katie Marquart – Partner & Chair, Pro Bono Practice Group,
Los Angeles (+1 213.229.7475, kmarquart@gibsondunn.com)

Laura Raposo – Associate General Counsel,
New York (+1 212.351.5341, lraposo@gibsondunn.com)

Matthew S. Rozen – Partner, Appellate & Constitutional Law Practice Group,
Washington, D.C. (+1 202.887.3596, mrozen@gibsondunn.com)

Ariana Sañudo – Associate, Pro Bono Practice Group,
Los Angeles (+1 213.229.7137, asanudo@gibsondunn.com)

Betty X. Yang – Partner & Co-Chair, Trials Practice Group,
Dallas (+1 214.698.3226, byang@gibsondunn.com)

Jules v. Andre Balazs Properties, No. 25-83 – Decided May 14, 2026

Today, the Supreme Court held unanimously that federal courts retain jurisdiction to confirm or vacate arbitration awards in federal-court actions stayed for arbitration under the Federal Arbitration Act.

“A federal court with jurisdiction to stay claims pending arbitration under § 3 of the FAA has the same jurisdiction to resolve motions to confirm or vacate a resulting arbitral award.”

Justice Sotomayor, writing for the Court

Background:

Petitioner Adrian Jules sued his former employer and several related parties in federal court, alleging federal employment claims. The U.S. District Court for the Southern District of New York concluded that those claims were subject to an arbitration agreement between the parties, and stayed the case pending arbitration under Section 3 of the Federal Arbitration Act. After arbitration concluded, Respondents returned to federal court and sought to confirm the arbitration award, while petitioner sought to vacate it. Petitioner also raised a jurisdictional challenge, asserting that because the application to confirm the award presented no federal question, and because complete diversity did not exist between the parties, the district court lacked subject matter jurisdiction to confirm or vacate the award.

The district court held that it retained jurisdiction to resolve those post-arbitration motions and confirmed the award. The U.S. Court of Appeals for the Second Circuit affirmed, holding that a federal court that stays a case pending arbitration retains jurisdiction to decide subsequent motions to confirm or vacate the award. The Second Circuit recognized that the Supreme Court had previously held in Badgerow v. Walters, 596 U.S. 1 (2022), that federal courts lack jurisdiction to confirm arbitration awards in suits initially brought in state court absent independent grounds for federal jurisdiction. The Second Circuit reasoned that this holding did not extend to Petitioner’s case because it was initially filed in federal court rather than state court.

The Supreme Court granted certiorari, recognizing that the courts of appeals were divided on this jurisdictional issue. Most circuits had agreed with the Second Circuit, adopting the so-called “jurisdictional anchor” approach and reasoning that where parties initially file suit in federal court, the court retains jurisdiction to confirm or vacate an arbitration award after staying a case for arbitration. By contrast, the Fourth Circuit had held that federal courts must identify an independent basis for jurisdiction over post-arbitration applications, even where the case was previously filed in federal court.

Issue:

Whether a federal court that initially exercised jurisdiction, compelled arbitration, and stayed a case pending arbitration retains jurisdiction to resolve post-arbitration motions to confirm or vacate an arbitration award, even if no independent basis for federal jurisdiction exists.

Court’s Holding:

Yes. When a federal court has properly exercised jurisdiction over an action, compelled arbitration, and stays the case pending arbitration, it retains authority to resolve post-arbitration motions to confirm or vacate the resulting award. These post-arbitration proceedings are part of the same case and therefore do not require an independent basis for federal jurisdiction.

What It Means:

The decision confirms that federal courts can oversee arbitration-related disputes from beginning to end when a case starts in federal court. Parties may return to the same federal court to confirm or challenge arbitration awards, promoting efficiency and avoiding duplicative litigation in state court.
Parties who anticipate arbitration, but wish to preserve the option of a federal forum for post-arbitration proceedings, should consider filing suit in federal court or removing suits filed against them to federal court where jurisdiction exists, as doing so creates a durable jurisdictional anchor through confirmation or vacatur.

The Court’s opinion is available here.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding developments at the Supreme Court. Please feel free to contact the following practice group leaders:

Appellate and Constitutional Law

Thomas H. Dupree Jr. +1 202.955.8547 tdupree@gibsondunn.com	Allyson N. Ho +1 214.698.3233 aho@gibsondunn.com	Julian W. Poon +1 213.229.7758 jpoon@gibsondunn.com
Jeffrey B. Wall +1 202.955.8533 jwall@gibsondunn.com	Lucas C. Townsend +1 202.887.3731 ltownsend@gibsondunn.com	Bradley J. Hamburger +1 213.229.7658 bhamburger@gibsondunn.com
Brad G. Hubbard +1 214.698.3326 bhubbard@gibsondunn.com

Related Practice: Labor and Employment

Jason C. Schwartz
+1 202.955.8242
jschwartz@gibsondunn.com

Katherine V.A. Smith
+1 213.229.7107
ksmith@gibsondunn.com

This alert was prepared by Cate McCaffrey and Elan Wilson.

New guidance and a proposed rule are part of EPA’s ongoing efforts to reduce administrative burdens and speed up timelines for Clean Air Act major source permitting.

On May 11, 2026, U.S. EPA announced a new proposed rule[1] and updated guidance[2] aimed at improving the process for Clean Air Act Title V operating permits. In the proposed rule, EPA redefines what it means to “begin actual construction” under the New Source Review (NSR) program, in order to allow the construction of non-emitting components prior to issuance of an NSR permit. EPA’s updated guidance clarifies that EPA’s review of Title V permits may run concurrently with the public comment process, expediting permit review and issuance. Both actions aim to reduce air permitting timelines without relaxing substantive emission controls. However, owners and operators should be mindful that permit denial after undertaking pre-permitting construction activities is possible, and the shift to the concurrent public comment period and EPA review for operating permits does not alter the 60-day window for public petitions objecting to new permits.

Key Takeaways

NSR “Begin Actual Construction” Proposed Rule

EPA has proposed redefining the regulatory term “begin actual construction” to allow construction of non-emitting components—such as utility infrastructure, concrete pads, and certain building shells—before issuance of an NSR permit.[3]
This change is particularly significant for data center operators, who can now begin site preparation and foundational construction while their NSR permits remain pending.
Pre-permit work remains prohibited on equipment or structures that are pollutant‑emitting or specifically configured to serve emissions units.[4]
Early work proceeds at the owner’s risk, however, and the proposed rule warns that “preparatory construction activities prior to permit issuance” will not “alter or influence” permitting decisions.[5]
The proposed rule also clarifies that state and local permitting authorities must “exercise their judgment to resolve questions” about the scope of allowable construction on “on a case-by-case, project-specific basis.”[6]
Public comments on the proposed rule will be accepted for 45 days after Federal Register publication, which is expected imminently.[7]

Title V Operating Permit Review Guidance

EPA’s updated guidance clarifies that permitting authorities may submit Title V permit applications for EPA’s review concurrently with the public comment period, rather than sequentially, which can materially reduce permitting timelines.[8]
It also confirms that the Clean Air Act does not mandate a full 45-day EPA review period for Title V permits, and encourages EPA regional offices to expedite reviews upon request from permitting partners.[9]
However, by statute, EPA must accept petitions objecting to a final permit for 60 days starting from the end of the full 45‑day EPA review period, even if EPA completes review early.[10]
In jurisdictions where NSR preconstruction permits and Title V operating permits are processed in parallel, quicker Title V finalization can help avoid back‑end bottlenecks that might otherwise slow NSR approvals.[11]

Proposed Rule Redefining “Begin Actual Construction”

EPA’s proposed rule, “Begin Actual Construction in the New Source Review (NSR) Preconstruction Permitting Program,” seeks to resolve ambiguity in the scope of allowable pre-permit construction by clarifying that “construction of components that do not emit air pollutants, such as utility surface infrastructure for a site, concrete pads, and some types of buildings and building components” are permissible before an NSR air permit has been issued.[12] Under the NSR permitting program, new construction of certain stationary air emissions sources and major modifications of existing sources must obtain permits before the start of construction.[13] However, “significant uncertainty and inconsistent interpretations” of the term “begin actual construction” has “[led] to burdens on permitting authorities and industry stakeholders, complicat[ed] compliance, and delay[ed] projects.”[14]

To resolve this issue, the proposed rule allows regulated parties to begin constructing non-emitting components or structures before obtaining an NSR permit.[15] To implement this change, EPA proposes to revise the definition of “begin actual construction” and add a new definition of “pollutant-emitting activities” “to identify which on-site construction activities an owner or operator of a stationary source … may lawfully undertake” prior to receiving an NSR permit.[16]

The updated definition of “begin actual construction” contains a non-exclusive list of items that are allowed without an NSR permit, including preparing land for building (e.g., clearing, grading, stabilization, and excavation), paving surfaces, and installing trailers for construction management staff.[17] EPA is expressly soliciting comments on whether additional activities should be added to the list.[18]

The new “pollutant-emitting activities” definition is intended to be read alongside the definition of “stationary source”—a “building, structure, facility, or installation which emits or may emit a regulated NSR pollutant, “ 40 CFR 51.165(a)(1)(i), 51.166(b)(5), and 52.21(b)(5)—to help regulated parties determine what qualifies as a “stationary source.” Under the new definition, the following are excluded from “pollutant-emitting activities,” and, consequently, are not “stationary sources” requiring preconstruction permits:[19]

Office buildings
Retail stores
Buildings or structures for storing non-vapor or -particle emitting materials
Concrete pads, building foundations, walls, and roofs “that are not closed in on the interior side and do not have design elements … specifically and uniquely configured” to support an emissions-generating process or operation
HVAC systems
Utility services and “associated support structures”

EPA notes this is not an exclusive list and requests comments on additional activities that should be added.[20]

Throughout the proposed rule, EPA is careful to clarify that commencing pre-permitting construction is at the permit applicant’s own risk, and that on-site activities undertaken prior to obtaining a permit will not alter permitting decisions.[21] EPA specifies, “Permit applicants that choose to undertake on-site construction activities in advance of permit issuance do so at their own economic risk that a permit may be denied or issued with unanticipated conditions on operations, potentially resulting in a lost investment or increased construction costs.”[22]

Title V Operating Permit Streamlining Guidance

EPA’s new guidance on the review process for Clean Air Act Title V operating permits clarifies two points, both with the potential to reduce permitting timelines. First, it confirms that permitting authorities may submit Title V permit applications to EPA and open the public comment period concurrently with EPA’s review, rather than sequentially.[23] Treating these as sequential steps could add weeks or months to the permitting process, and EPA touts this guidance as “eliminat[ing] an unnecessary source of administrative delay.”[24] In EPA’s press release announcing the guidance, the agency notes that this concurrent approach “preserves public participation and is particularly effective when the permitting authority does not anticipate adverse comment on the draft permit.”[25]

Second, the guidance affirms that the Clean Air Act does not require EPA to take the full 45-day period allowed by statute to review a proposed permit.[26] EPA is accordingly encouraging EPA Regions “to expedite their reviews upon request from the permitting authority.”[27] In addition to potentially reducing the time between proposal and approval for Title V permits, in jurisdictions where NSR and Title V permits are processed simultaneously, “expeditious finalization of [T]itle V permits will also speed up issuance of NSR permits.”[28] However, the 60-day statutory period for public petitions objecting to a permit has not changed, and will continue to run “for 60 days after the end of the full 45-day EPA review period.”[29]

This guidance builds on EPA’s April 2026 guidance to streamline the Title V operating permit renewal process,[30] discussed in our prior update, continuing EPA’s efforts to reduce permitting timelines.

Practical Impacts

Together, these actions signal a sustained effort by EPA to reduce administrative burdens for major source permitting. Importantly, the agency has emphasized that neither action alters the substantive emissions standards under the Clean Air Act, including the assessment of control technologies under the NSR program.[31] In the proposed rule, EPA notes that its goal is to “reflect the best reading of the statute … and effectuate congressional intent to preserve and maintain air quality while facilitating economic growth.”[32]

The changes also underscore EPA’s focus on improving permitting timelines for data centers. In particular, the proposed rule builds on guidance EPA provided when launching its Clean Air Act Resources for Data Centers webpage, discussed in our prior update. There, EPA previewed the definition of “begin actual construction” adopted in this proposed rule. And in announcing the proposed rule, EPA stated that the new definitions will “support the development of Artificial Intelligence (AI) infrastructure and power generation” and facilitate “the data centers essential to making the U.S. the AI capital of the world.”[33]

For data center developers and operators, the practical impact of the NSR revisions could be substantial. Under the current regulatory framework, the definition of “begin actual construction” has prevented construction activities that have no emissions impact from taking place before completion of the often-lengthy NSR permitting process. If finalized, this rule would allow operators to commence significant site preparation—including pouring foundations, running electrical wiring, and installing piping—while awaiting permit approval for emissions-generating equipment. This could improve project timelines significantly, particularly for projects where non-emitting infrastructure represents a significant portion of early-stage construction.

[1] Proposed Rule, “Begin Actual Construction in the New Source Review (NSR) Preconstruction Permitting Program” (May 11, 2026), pre-publication version available at https://www.epa.gov/system/files/documents/2026-05/proposed-rule-begin-actual-construction-new-source-review-5-11-2026.pdf [hereinafter “Prepublication Rule”].

[2] Memorandum from Aaron Szabo, Assistant Administrator for Air and Radiation, U.S. EPA, “Guidance on Streamlining Title V Operating Permit Reviews” (May 11, 2026), https://www.epa.gov/system/files/documents/2026-05/guidance-on-streamlining-title-v-operating-permit-reviews-5-11-26.pdf [hereinafter “Title V Operating Permit Guidance”].

[3] Prepublication Rule at 11–12.

[4] Id. at 51.

[5] Id. at 65.

[6] Id. at 48-49.

[7] Id. at 2.

[8] Title V Operating Permit Guidance at 1–2.

[9] Id. at 3.

[10] Id. at 4.

[11] Id. at 3 n.12.

[12] Prepublication Rule at 11.

[13] Id. at 12–13.

[14] Id. at 30.

[15] Id. at 11.

[16] Id. at 49–50.

[17] Id. at 50.

[18] Id. at 51.

[19] Id.

[20] Id. at 52.

[21] See, e.g., id. at 64.

[22] Id.

[23] Title V Operating Permit Guidance at 1–2.

[24] Id. at 2.

[25] Press Release, U.S. EPA, “EPA Issues Guidance on Streamlining Clean Air Act Title V Operating Permit Process to Expedite Approvals” (May 11, 2026), https://www.epa.gov/newsreleases/epa-issues-guidance-streamlining-clean-air-act-title-v-operating-permit-process.

[26] Title V Operating Permit Guidance at 2–3.

[27] Id. at 3.

[28] Id. at 3 n.12.

[29] Id. at 4.

[30] Memorandum from Aaron Szabo, Assistant Administrator for Air and Radiation, U.S. EPA, “Guidance on Streamlining Clean Air Act Title V Operating Permit Renewals” (Apr. 16, 2026), https://www.epa.gov/system/files/documents/2026-04/guidance-on-streamlining-clean-air-act-title-v-operating-permit-renewals.pdf.

[31] Title V Operating Permit Guidance at 2; Prepublication Rule at 65.

[32] Prepublication Rule at 57.

[33] Press Release, U.S EPA, “EPA Proposes Redefining ‘Begin Actual Construction’ to Remove Unnecessary Impediments to Building and Advance Economic Progress” (May 11, 2026), https://www.epa.gov/newsreleases/epa-proposes-redefining-begin-actual-construction-remove-unnecessary-impediments.

The following Gibson Dunn lawyers prepared this update: Stacie Fletcher, Rachel Levick, and Veronica Goodson.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. To learn more about these issues, please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any leader or member of the firm’s Environmental Litigation & Mass Tort or Data Centers & Digital Infrastructure practice groups:

Environmental Litigation & Mass Tort:

Stacie B. Fletcher – Washington, D.C. (+1 202.887.3627, sfletcher@gibsondunn.com)

Rachel Levick – Washington, D.C. (+1 202.887.3574, rlevick@gibsondunn.com)

Veronica J.T. Goodson – Washington, D.C. (+1 202.887.3719, vgoodson@gibsondunn.com)

Data Centers & Digital Infrastructure:

Tory Lauterbach – Energy Regulation & Litigation, Washington, D.C. (+1 202.955.8519, tlauterbach@gibsondunn.com)

Emily Naughton – Real Estate, Washington, D.C. (+1 202 955 8509, enaughton@gibsondunn.com)