.
Marquee

Emerging Companies & Venture Capital

A growing business needs creative entrepreneurship supported by sound legal advice.

As an entrepreneur, you need advice that combines legal knowledge with an understanding of your business, your industry, your markets, and your risks. Our Emerging Companies practice helps entrepreneurs create the legal foundation necessary to raise capital, attract and retain employees, protect intellectual property, and contract with partners.

We also work regularly with venture capital firms and investment banks to investigate and document investments in emerging companies, giving us both a well-rounded perspective and an ability to connect and introduce clients in need of financing.

Competent, Creative and Connected
With Emerging Companies lawyers located across the country and in major international business centers around the world, Dorsey provides both legal and business services for the breadth of issues faced by a growing business – from initial investment to final liquidity.

Full Range of Services
Our services include: 

  • Formation, venture capital and other financing
  • Strategic alliances
  • Domestic and international licensing
  • Protection of intellectual property
  • Distribution agreements
  • Executive compensation and employee benefits
  • Public offerings
  • Mergers & acquisitions

Accolades

Tier 1
Corporate Law Firm Ranked in 5 Markets
Best Law Firms 2026
Tier 1
Securities / Capital Markets Law Practice in Utah
Best Law Firms 2026
Tier 1
Top Mergers and Acquisitions Law Firm
Best Law Firms 2026
Tier 1
Securities Litigation Firm in Minneapolis and Utah
Best Law Firms 2026
Tier 1
Tax Law Firm in Minneapolis
Best Law Firms 2026
Recognized Firm
Leading Tax Law Practice in Washington
Chambers USA 2026

Insights

Client Alert

DOJ on Campus: DOJ’s First Intervention in False Claims Act Case Alleging University Knowingly Failed to Meet Contractual Cybersecurity Requirements

September 4, 2024

Cybersecurity requirements for federal contractors and grantees continue to proliferate—and those requirements do not just come with contractual risk. Increasingly, the United States government is leveraging enforcement tools, particularly the False Claims Act (and its treble damages), to police these requirements. A recent action against a public research institution is a good case study for compliance officers and legal professionals who advise recipients of federal funding. The United States Department of Justice (DOJ) recently announced that it had intervened in a whistleblower’s False Claims Act case against the Georgia Institute of Technology and Georgia Tech Research Corp., a non-profit contracting entity for Georgia Tech (GTRC). The complaint-in-intervention alleges that these entities (collectively, Georgia Tech) knowingly failed to meet contractual cybersecurity requirements in performance of Department of Defense (DoD) contracts.[1] The original whistleblower lawsuit was filed months earlier by a current and a former member of Georgia Tech’s cybersecurity compliance team. As the complaint explains, defense contractors typically must comply with DoD contractual cybersecurity requirements to protect any non-public government information that can be accessed from contractors’ information systems. [2] DoD imposes cybersecurity requirements to minimize threats to national security and the U.S. economy from malicious cyber activity and theft of intellectual property. The federal government has specifically warned research universities that they are known targets for cyberattacks by foreign intelligence services and other foreign adversaries. From as early as 2019, Georgia Tech allegedly failed to heed the government’s warning and for years engaged in what a former Georgia Tech employee called “no enforcement” of cybersecurity regulations. Georgia Tech purportedly bowed to the pressures of large dollar grant recipient researchers who pushed back on cybersecurity compliance because of what they saw as the excessive burdens. As opposed to a culture of compliance that DOJ repeatedly emphasizes in its corporate enforcement policies,[3] Georgia Tech allegedly failed to comply with these cybersecurity requirements. More specifically, a lab at Georgia Tech allegedly failed to develop or implement a required system security plan to outline how the lab would protect covered defense information in its possession, and it failed to install or update antivirus software on servers and computers that contained non-public DoD information. The complaint alleges that Georgia Tech violated the DoD contractual conditions by failing to provide DoD with an accurate summary level score to demonstrate the lab’s compliance with applicable cybersecurity regulations. Instead, Georgia Tech allegedly provided DoD with a false summary score for a “campus-wide” IT system when purportedly no such system existed. The complaint’s primary cause of action is not for breach of contract or an administrative sanction; it is the False Claims Act, 31 U.S.C. §§ 3729–3733. The False Claims Act provides that any person who “knowingly presents, or causes to be presented, a false or fraudulent claim” to the government, or who “knowingly makes, uses, or causes to be made or used, a false record or statement material to a false or fraudulent claim,” is liable to the federal government for significant financial penalties per false claim plus treble damages. A Georgia Tech spokesperson issued a statement denying the allegations and noting that “in this case, there was no breach of information, and no data leaked.”[4] This is DOJ’s first complaint-in-intervention in a False Claims Act filed under DOJ’s Civil Cyber-Fraud Initiative (CCFI).[5] When the CCFI was first launched in October 2021, DOJ Deputy Attorney General Lisa Monaco announced that its goal was to “hold accountable entities or individuals that put U.S. information or systems at risk by knowingly providing deficient cybersecurity products or services, knowingly misrepresenting their cybersecurity practices or protocols, or knowingly violating obligations to monitor and report cybersecurity incidents and breaches.”[6] DOJ said that its CCFI would rely on “the False Claims Act to pursue cybersecurity related fraud by government contractors and grant recipients.”[7] Although this is the first complaint-in-intervention filed by DOJ, over the past two years, DOJ’s CCFI has reached multimillion dollar settlements in several other cases.[8] DOJ’s complaint-in-intervention comes on the heels of DoD’s recently announced rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) to incorporate contractual requirements related to the proposed Cybersecurity Maturity Model Certification (CMMC) 2.0 program rule.[9] The proposed rule will apply to all DoD solicitations and contracts, will require contractors to prove required CMMC compliance, and will require all contractors to self-certify or to obtain a third-party certification before beginning work on any DoD contracts. Key Takeaways Beyond protecting against cyber incidents, robust cybersecurity protocols are now legal requirements that the government will enforce aggressively. To minimize the risk of facing a False Claims Act case or a government investigation more broadly, research universities and other government contractors should: Review compliance programs, including compliance hotlines, internal monitoring and audit functions, and employee training on these programs, to ensure that they are functioning effectively and truly foster a “culture of compliance;” Evaluate cybersecurity policies and practices, especially subcontractor policies and practices, to ensure compliance with federal regulations and contractual requirements, such as identifying the location of all non-public government data and ensuring implementation of appropriate and effective cybersecurity assessments and plans; Document their own and their subcontractors’ cybersecurity protocols and use regular audits or assessments to validate and ensure that these protocols are effective, complaint with legal requirements, and working as intended; Ensure that business leadership and, in the case of federal grant funding, Principal Investigators, understand the consequences for non-compliance with cybersecurity requirements, including potential personal exposure; Verify that all reports to and communications with the government are accurate and truthful and contain no material omissions; and Conduct prompt, credible investigations of complaints about non-compliance and, where appropriate, provide timely voluntary self-disclosure to the United States.   [1] Office of Public Affairs | United States Files Suit Against the Georgia Institute of Technology and Georgia Tech Research Corporation Alleging Cybersecurity Violations | United States Department of Justice. [2] The case is U.S. ex rel. Craig and Koza v. Georgia Tech Research Corp. et al., Civil Case No. 1:22-cv-02698 (N.D. Ga.). The complaint is available online: https://www.justice.gov/opa/media/1364901/dl?inline. [3] Microsoft Word - 2023.03.03 - Revised ECCP (revised3) (justice.gov). [4] Federal Gov't Hits Georgia Tech With Cybersecurity FCA Suit - Law360. [5] Northern District of Georgia | United States Files Suit Against the Georgia Institute of Technology and Georgia Tech Research Corporation Alleging Cybersecurity Violations | United States Department of Justice. [6] Office of Public Affairs | Deputy Attorney General Lisa O. Monaco Announces New Civil Cyber-Fraud Initiative | United States Department of Justice. [7] Id. [8] See Office of Public Affairs | Staffing Company to Pay $2.7M for Alleged Failure to Provide Adequate Cybersecurity for COVID-19 Contact Tracing Data | United States Department of Justice; Office of Public Affairs |Consulting Companies to Pay $11.3M for Failing to Comply with Cybersecurity Requirements in Federally Funded Contract | United States Department of Justice; Office of Public Affairs | Cooperating Federal Contractor Resolves Liability for Alleged False Claims Caused by Failure to Fully Implement Cybersecurity Controls | United States Department of Justice; Office of Public Affairs | Aerojet Rocketdyne Agrees to Pay $9 Million to Resolve False Claims Act Allegations of Cybersecurity Violations in Federal Government Contracts | United States Department of Justice; Office of Public Affairs | Jelly Bean Communications Design and its Manager Settle False Claims Act Liability for Cybersecurity Failures on Florida Medicaid Enrollment Website | United States Department of Justice [9] Federal Register :: Defense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041).

Client Alert

United States Imposes More Sanctions to Block Russian Access to U.S. Banking System and U.S. Goods, Technology or Software

March 1, 2022

On February 24, 25 and 28, the United States broadened its economic sanctions against Russia in response to its full-scale military invasion of Ukraine. As the Biden Administration had promised in recent weeks, in close cooperation with its major allies, the United States imposed further rounds of coordinated sanctions against the Russian Federation in reaction to this grave and violent expansion of hostilities. We summarize below some key provisions of these new U.S. sanctions.   The February 24 package added both economic sanctions that target the Russian financial services sector and vastly expanded export controls that will restrict Russia’s access to U.S. goods, software, and technology. The February 25 measures placed asset blocking sanctions on Russian President Vladimir Putin, Foreign Minister Sergei Lavrov, Defense Minister Sergei Shoigu and a Russian general individually so that U.S. persons may not now engage in any transactions involving their blocked property interests. On February 28, OFAC expanded the sanctions to target the Russian Federation’s Central Bank, National Wealth Fund, and Ministry of Finance. This new round of sanctions is on top of those imposed earlier last week, which we reported earlier here. (We will also be issuing additional separate summaries of other U.S. sanctions measures that have been announced since February 25, keeping in mind that these U.S. sanctions-based responses to the invasion are still evolving and expanding quickly.) Expanded U.S. Economic Sanctions Against Russian Financial Sector. On February 24, the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) significantly expanded the targeted sanctions against the Russian financial services sector. According to OFAC, this round of sanctions targets “all of Russia’s largest financial institutions and the ability of state-owned and private entities to raise capital,” affecting “nearly 80 percent of all banking assets in Russia.” OFAC indicated that it had selected these particular Russian sanctions targets based on their likely impact on the Russian Government while trying to minimize potential collateral effects on the U.S. and allied economies. These new measures are based on OFAC Directives 2 and 3 that the Biden Administration had issued on February 22 and 24, 2022, which are in addition to previous OFAC Directives that the Obama Administration had issued in 2014 that still remain in effect as amended. OFAC issued its new Directive 2 on February 24, citing its authority under Executive Order (“EO”) 14024 of April 15, 2021 (“EO 14024 Directive 2”). EO 14024 had been the basis for OFAC’s expanded sanctions under EO 14024 Directive 1A (issued on February 22 and discussed here) against Russian sovereign debt. Under this new EO 14024 Directive 2, U.S. financial institutions are now prohibited from (1) opening or maintaining any correspondent account of payable-through account or (2) processing any transactions on behalf of targeted Russian owned financial institutions. OFAC is adding any Russian owned financial institutions targeted under this EO 14024 Directive 2 to its Correspondent Account and Payable-Through Account List (“CAPTA List”). Under this new EO 14024 Directive 2 authority, OFAC imposed sanctions on Sberbank, the largest bank in Russia that is majority owned by the Russian Government, along with 25 Sberbank subsidiaries. Effective March 26, 2022, Sberbank and its 50% or more owned subsidiaries will no longer be able to process transactions using correspondent accounts or payable-through accounts at any U.S. banking institution, effectively preventing Sberbank and its designated affiliates from processing U.S. foreign exchange transactions. However, even before this designation under EO 14024 Directive 2, OFAC had already imposed other sanctions against Sberbank under EO 13662 Directive 1, which OFAC issued in 2014 after Russia’s annexation of the Crimea region of Ukraine. As amended in September 2017, that EO 13662 Directive 1 prohibited transactions by U.S. persons with Sberbank involving any new equity or debt financing exceeding 14 days maturity.  This latest prohibition under OFAC’s EO 14024 Directive 2 has far broader consequences because it disrupts the ability of Russian account holders to make or receive international wire transfers for all cross-border transactions involving any part of the U.S. financial system unless OFAC grants a license. In addition, OFAC designated several other major Russian banks for asset blocking sanctions under EO 14024, adding them to OFAC’s List of Specially Designated Nationals and Blocked Persons (“SDN List”). As a consequence, a U.S. person may not engage in any transaction involving the property interests of those named Russian banks or the property interests of any 50% or greater owned subsidiaries even if those subsidiaries are not themselves named on the SDN List. Moreover, any property belonging to these targeted Russian financial institutions held by U.S. persons, such as deposits at U.S. banking institutions, are now “blocked” and cannot be released to the sanctioned Russian banks or any other party unless authorized by OFAC. OFAC added the following Russian owned banks to the SDN List along with some of their domestic and foreign subsidiaries: VTB Bank and 20 subsidiaries, which hold about 20% of banking assets in Russia; Otkritie and 12 subsidiaries, which constitute Russia’ seventh largest banking institution; Sovcombank and 22 subsidiaries, which constitute Russia’s ninth largest banking institution; and Novikombank, a state-owned banking institution that provides financial services to the Russian defense sector. OFAC also issued Directive 3 under EO 14024 (“EO 14024 Directive 3”) on February 24 to prohibit U.S. persons from engaging in transactions that involve the new equity or new debt of designated Russian entities that exceed 14 days maturity.1 This prohibition significantly curtails the ability of the listed Russian companies to raise capital through capital markets transactions. EO 14024 Directive 3 names 13 Russian financial institutions as the initial set of entities subject to this new prohibition, to take effect on March 26, 2022: Credit Bank of Moscow Sovcomflot  Gazprombank Russian Railways  Alfa-Bank Alrosa  Russian Agricultural Bank Gazprom  Gazprom Neft Sberbank  Rostelecom Transneft  Rushydro   Six of these Russian firms had already been subject to debt or equity restrictions under one or more of the EO 13662 Directives issued in 2014. This overlap includes Sberbank, which OFAC simultaneously designated for the CAPTA List sanctions under EO 14024 Directive 2 as described above. However, given the potentially broad effect of these bank-related sanctions, to alleviate humanitarian, safety, and other concerns, OFAC concurrently issued eight general licenses (“GLs”) to allow certain categories of transactions to continue notwithstanding the sanctions imposed on February 24, including transactions involving international organizations; agricultural and medical commodities; aviation safety; energy; certain debts and equity; derivative contracts; and the wind-down and rejection of transactions involving persons subject to the SDN List. In addition to the sanctions targeting entities in the Russian financial services sector, OFAC also added to its SDN List ten prominent and wealthy Russian individuals who are connected to the Russian Government and 24 Belarusian entities and individuals for their roles in supporting and enabling Russia’s invasion of Ukraine. Please see here for the complete list of the entities and individuals added to the SDN List and that became subject to OFAC’s EO 14024 Directives 2 and 3 through OFAC’s February 24 sanctions designations. On February 25, OFAC also designated Russian President Vladimir Putin, Foreign Minister Sergei Lavrov, Defense Minister Sergei Shoigu, and Chief of the General Staff Valery Gerasimov for individual asset blocking sanctions and added them to the SDN List. OFAC rarely designates heads of state personally for sanctions on the SDN List, so this latest move signals the U.S. Government’s vehement opposition to the Russian Government’s actions in Ukraine and to these sanctioned officials’ personal roles in the invasion. For information about these additional designations to the SDN List, please see here. On February 28, following reports of intense combat in Ukrainian cities, OFAC also issued  Directive 4 under EO 14024 (“EO 14024 Directive 4”), which prohibits U.S. persons from engaging in transactions that involve the Russian Federation’s Central Bank, National Wealth Fund, and Ministry of Finance. This prohibition includes any transfer of assets to these entities and foreign exchange transactions on their behalf. This significant expansion of U.S. sanctions effectively freezes the Russian Government’s assets held by U.S. financial institutions (including the Federal Reserve) and will prevent the Russian Government from using those assets to mitigate the economic impact from the sanctions imposed by the United States and its allies. (Other leading nations and their central banks have taken similar steps to block the Russian Central Bank’s access to assets held by those institutions so as to apply these sanctions on a multilateral basis to enhance the financial pressure on the Russian government to end its invasion of Ukraine.) Allied Actions on Russian Access to SWIFT Interbank System. In the weeks leading up to Russia’s full-scale invasion of Ukraine, there has been widespread discussion whether the United States and its allies would cut off Russia from the international SWIFT interbank messaging system as a sanctions measure. Such a step would make it very onerous for Russian financial institutions to engage in international fund transfers. When the President Biden announced sanctions on February 24 in the wake of the Russian invasion, he did not announce such a move. During a White House press conference, President Biden indicated that certain of the European allies were not yet prepared to take that step. However, on February 26, after additional consultations among the European allies, the United States and EU governments announced a plan to cut off certain Russian financial institutions, but not the entire Russian banking sector, from SWIFT. Some analysts had suggested that a number of European leaders initially opposed sanctions involving SWIFT because, although such a move could potentially inflict the virtual severance of Russian banks from the global financial system, that degree of economic pain in Russia might then trigger a Russian counter-measure to reduce or even cut off oil and gas supplies to Europe. Russia supplies roughly one-quarter of all crude oil and almost 40% of all natural gas to the European Union. European leaders probably remain concerned that any significant Russian reduction or cut-off of these energy supplies at a time of soaring energy prices could add to the already-severe inflation across Europe and might even trigger an economic recession just as Europe is seeking to recover from the pandemic. Thus, the partial cut-off from SWIFT appears to be designed to allow Russian oil and gas exports (and payments by EU customers) to continue, at least for now. Russian Export Pipeline Sanctions. One of Europe’s largest energy projects is the Nord Stream 2 (“NS2”) natural gas export pipeline running under the Baltic Sea between Russia and Germany. Nord Stream 2 AG (“NS2 AG”), a Swiss entity, built the pipeline and would be its operator if operations commence. NS2 AG is wholly owned by the Russian state-owned natural gas company, Gazprom, and NS2 AG had already been named by the U.S. State Department in a May 2021 report that was required under the Protecting Europe’s Energy Security Act (“PEESA”). Under EO 14039 of August 20, 2021, NS2 AG would have been subject to asset blocking sanctions by virtue of that May 2021 report, but the Biden Administration had decided to waive those sanctions from taking effect. The Obama, Trump and Biden Administrations had opposed the NS2 pipeline because it would bypass the Ukrainian natural gas pipeline system, and thus further weaken Ukraine’s struggling economy and would, at the same time, lead to further German and European energy dependence on Russia, allowing Russia to exert substantial geopolitical leverage on Europe that could weaken the military alliance of the North Atlantic Treaty Organization (“NATO”). In spite of opposition in principle to the NS2 pipeline project, U.S. Secretary of State Anthony Blinken waived that specific sanctions designation in May 2021, apparently at the request of the German government, which still strongly supported the project. That waiver decision then triggered significant criticism from members of the U.S. Congress, notably Senator Ted Cruz of Texas, who sponsored legislative proposals to compel U.S. sanctions against NS2 AG. Now, with Russian forces actually fighting inside Ukraine, the Biden Administration has reversed itself on the May 2021 NS2 AG waiver. Citing Russia’s recognition of the self-proclaimed separatist republics in Ukraine’s eastern Donetsk and Luhansk regions, on February 23, Secretary Blinken terminated his previous waiver and allowed the PEESA-based SDN List sanctions against NS2 AG and its chief executive officer to take effect. OFAC also issued a General License 4 to allow wind-down of transaction involving NS2 AG until 12:01 am Eastern U.S. Time on March 2, 2022. Germany concurrently announced its own indefinite suspension of certification of the NS2 pipeline that would be required for its operation to commence. Thus, for now, full U.S. SDN List-based sanctions will be imposed on NS2 AG and its CEO and Germany will not allow the NS2 pipeline to become operational, which will inflict financial losses on NS2 AG and its owner Gazprom, who would supply the gas for that pipeline. Expanded U.S. Export Controls Against Russia. The Department of Commerce and its Bureau of Industry and Security (“BIS”) significantly expanded the scope of goods, software, and technology that will require an export license to Russia under the U.S. Export Administration Regulations (“EAR”) which are codified under the newly created EAR Section 746.8 and amendments to conform various EAR sections to the new requirements. These changes will result in many more transactions to Russia being subject to export license requirements and, moreover, many of those transactions will now be mostly subject to a BIS policy of denial for the issuance of such export licenses. These changes to the EAR also became effective as of February 24. Exports from the United States and of Certain U.S. Items. BIS will now impose a license requirement to export or reexport to Russia or transfer within Russia any goods, software or technology that are listed under any Export Control Classification Number (“ECCN”) in any of the following categories of the EAR’s Commerce Control List (“CCL”): Category 3:  Electronics Category 4:  Computers Category 5:  Telecommunications and Information Security Category 6:  Sensors and Lasers Category 7:  Navigation and Avionics Category 8:  Marine Category 9:  Aerospace and Propulsion This new EAR license requirement for exports or reexports to Russia and transfers within Russia covers all goods exported from or through U.S. territory, U.S.-origin items wherever located, and foreign-made items that have controlled U.S. content that exceeds the de minimis threshold (generally 25% of the item’s value). As examples, this rule change will expand export license requirements for Russia to include even low-technology electronic components, consumer computers, basic telecommunications equipment, certain lasers and sensors, navigation equipment, commercial aircraft, and parts and components of commercial aircraft. In its public notice, BIS acknowledges the potential impact on civil aviation for items that previously were not controlled for exports to Russia. However, BIS believes these controls are now necessary to deny the Russian defense sector access to these items. As a result of these changes, many U.S. and non-U.S. companies will need to apply for BIS export licenses to send items to Russia (or even to transfer items that are already in Russia). Moreover, BIS has stated such applications generally will be subject to a policy of denial. However, BIS will review applications on a more lenient “case-by-case basis” for items relevant to flight safety, maritime safety, humanitarian needs, space cooperation, certain civil telecommunications infrastructure, government-to-government activities, and operations of companies that are subsidiaries or joint ventures of enterprises based in the United States or certain allied countries. As part of this “case-by-case” review, BIS will focus on whether such transactions would benefit the Russian government or Russian defense sector (which are both disfavored under this new licensing policy). Foreign Direct Products of U.S. Software or Technology. BIS also created a special foreign direct product (“FDP”) rule that will apply just to Russia (the “Russia FDP Rule”). Before issuing this Russia FDP Rule, the EAR already had other FDP rules that covered foreign-made products that were made by using certain controlled U.S.-origin software or technology or by using production equipment that had been made through the use of certain controlled U.S.-origin software or technology.2 The Russia FDP Rule now triggers a new license requirement in either of two scenarios: (1) If the foreign-made product is classified under an ECCN (i.e., not EAR99), and if it was a direct product of any technology or software controlled under CCL Categories 3 through 9; or (2) If the foreign-made product is classified under an ECCN (i.e., not EAR99), and if it was created from equipment that is a direct product of technology or software controlled under CCL Categories 3 through 9. The Russia FDP Rule applies only if the exporter or re-exporter knows or has reason to know based on the circumstances that the foreign-produced item’s ultimate destination will be Russia, or if that foreign-produced item will be incorporated or used to produce an item in Russia or in a third country before re-exportation to Russia that is classifiable under CCL Categories 3 through 9. Moreover, the EAR defines “direct product” to mean the “immediate product (including processes and services) produced directly by the use of technology or software,” which imposes some limits to the otherwise expansive scope of the Russia FDP Rule. The Russia FDP Rule is BIS’s most significant expansion of its FDP rules and imposes EAR licensing requirements for non-U.S. companies that rely on basic software or technology from the United States, or that use production equipment that had been made with U.S. software or technology, to produce items destined, directly or indirectly, for Russia. To comply with the Russia FDP Rule, companies must exercise considerable vigilance about whether any U.S.-origin software or technology is used to produce foreign-made products or whether any U.S.-origin software or technology is used to make production or testing equipment necessary for making items that will be destined to Russia. If that is the case, companies must then consider whether such U.S.-origin software or technology falls under the scope of software or technology that is subject to the Russia FDP Rule. The Russia FDP Rule thus captures a considerable volume of foreign-made electronic components, computers, telecommunications equipment, production equipment, encryption software, aircraft parts, and many other items that could be supplied from other nations to Russia. As context and perhaps by way of precedent, BIS had created a specific FDP rule for Huawei Technologies Co., Ltd (“Huawei”) in the People’s Republic of China. Prior to imposing the Russia FDP Rule, U.S. Government officials had highlighted the success of that focused use of its FDP rule in obstructing Huawei’s access to crucial inputs for its 5G and other product lines because of the prominence of U.S.-origin software and technology in the production of numerous parts and components around the world. The U.S. Government had previously warned that similar punitive action could be taken with respect to Russian companies in the event of hostilities against Ukraine.    New Russian Military End User FDP Rule. In addition to the Russia FDP Rule above, BIS also issued another new FDP rule that vastly expands the scope of foreign-made items that will now be considered “subject to the EAR” and denied to certain sanctioned Russian military end users (“MEUs”). BIS is implementing this separate FDP rule through footnote 3 to the Entity List, which BIS applies to designated Russian MEUs through a notation in the sanctioned MEUs’ entries on the Entity List. BIS calls this new FDP rule the “Russia Military End User FDP Rule” (“Russia MEU FDP Rule”) because it targets specific known Russian MEUs. In particular, the Russia MEU FDP Rule imposes a license requirement for exports to any of these designated sanctioned Russian entities of a foreign-made item that is a direct product of technology or software controlled under any of the 10 CCL categories. Likewise, the Russia MEU FDP Rule adds a license requirement for exports to these sanctioned Russian entities of any foreign-made item that is created from production equipment that is a direct product of controlled technology or software under any the 10 CCL categories. These license requirements apply if the exporter knows or has reason to know under the circumstances that the foreign-made product will be incorporated into or used in the production of an item that is produced, purchased, or ordered by a sanctioned Russian company on the Entity List with a Footnote 3 designation or if such a sanctioned Russian company is a transaction party (e.g., a purchaser, ultimate consignee, intermediate consignee, or end-user). The foreign-made item or production equipment must be a “direct product” of U.S.-origin software or technology controlled under an ECCN. Unlike the Russia FDP Rule above, the scope of the new Russia MEU FDP Rule includes even EAR99 foreign-produced products. There is a limited exemption for foreign-made EAR99 food, EAR99 medicine, and certain mass market encryption items. However, even that limited exemption would not apply in the case of any Russian Government entities or Russian state-owned enterprises (“SOEs”). Because the new Russia MEU FDP Rule has such a wide sweep, it could cover even very basic products made outside of the United States, such as EAR99 electronics or consumer goods, software, or other items, so long as their production or related production equipment were products of ECCN controlled U.S.-origin software or technology. Relatedly, BIS made conforming changes to the MEU Rule in EAR Section 744.21 with respect to Russia. As amended, the MEU Rule covers all items subject to the EAR for Russian MEUs, except EAR99 food, EAR99 medicine, and certain mass market items. However, like the Russia MEU FDP Rule, this exception would not apply in the case of MEUs that are Russian Government entities or Russian SOEs. Exclusions from FDP Rules for Certain Allies. BIS excludes from the new Russian FDP rules described above any allies of the United States who, according to BIS, will be implementing their own strengthened export control measures on Russia. This means that foreign-produced items from those countries bound for Russia will not be deemed subject to the new Russia FDP Rule or Russia MEU FDP Rule requirements (but those countries presumably will now apply their own export regulations to the same items). As of February 24, the following countries’ foreign-made direct products will be exempt under either of these new Russian FDP provisions: Australia, Austria, Belgium, Bulgaria, Canada, Croatia, Cyprus, the Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Japan, Latvia, Lithuania, Luxemburg, Malta, Netherlands, New Zealand, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, and the United Kingdom. Russian Entity List Additions and Sanctioning of Military End Users. In addition to the above expansions to the EAR, BIS moved 45 Russian entities from its Military End Users List to its Entity List, added two Russian entities to the Entity List, and amended two existing entries on the Entity List. With limited exceptions, no items “subject to the EAR” may be sent to these entities unless authorized by a BIS export license. Furthermore, BIS made all of these 49 Russian entities in the Russian defense sector subject to the new Russia MEU FDP Rule by adding a “footnote 3” designation next to each of their entries on the Entity List. As a result of this action, with a few exceptions, unless licensed by BIS, U.S. and non-U.S. companies can no longer provide these Russian entities any goods, software, or technology that are sent from or through the United States, U.S.-origin items wherever located, or that contain more than de minimis amounts of controlled U.S.-content.  Because these 49 sanctioned entities also are subject to the new Russia MEU FDP Rule, they also will be barred from receiving items that are made from certain U.S.-origin software or technology or made by using production equipment that had been made with such U.S. software or technology. This combined prohibition denies access by the sanctioned entities to a vastly broader array of items than is ordinarily the case for sanctioned entities on the Entity List (which already was quite broad). Any license applications by these 49 entities to mitigate the effect of the sanctions would be subject to BIS review under its policy of denial. Codification of Luhansk and Donetsk Region Restrictions. BIS also codified territorial embargoes under the EAR against the Luhansk region (“LHR”) and the Donetsk region (“DNR”), which we described earlier here. Thus, under the EAR, unless licensed by BIS, all items subject to the EAR are prohibited from being exported to either the LHR or DNR except for EAR99 food, EAR99 medicine or certain software necessary for the functioning of personal communications over the internet that is widely available at no cost to the user. This BIS action places LHR and DNR on the same footing as the Crimea region of Ukraine that had already been similarly blocked off by BIS in 2014. Conclusion. As a result of these actions, both companies in the United States and many non-U.S. companies should consider whether any of their transactions with Russia or the occupied territories of Crimea, LHR or DNR in Ukraine are now subject to any of these new legal requirements or export restrictions. In addition, since the situation in Ukraine is still highly volatile with active combat still under way between the military forces of Ukraine and the Russian Federation, it seems likely that the U.S. Government will continue to adjust its economic sanctions and export control regimes in response to new developments, so all such companies should continue to monitor both the changing geopolitical news and further legal changes as they occur. If you have any questions regarding this eUpdate, please contact the attorneys profiled below. Dorsey’s attorneys routinely counsel clients to address and mitigate the impact of U.S. economic sanctions, trade embargoes, export controls and other measures that affect cross-border transactions. 1 OFAC had previously issued Directive 1 through 4 under EO 13662 in 2014 to impose sectoral sanctions on various Russian entities and individuals after Russia’s annexation of the Crimea region of Ukraine (collectively, “EO 13662 Directives”). The latest OFAC sanctions imposed on February 24 also use the same terminology of sequentially numbered “Directives,” but it is legally important to distinguish between the EO 13662 Directives from the latest EO 14024 Directives because they carry different consequences for the targeted Russian entities and individuals. 2 The FDP rules reference “complete plant” or a “major component” of a complete plant that is used to make foreign-made items that are subject to the FDP rules. These terms refer to production equipment. For example, the EAR defines “major component” as “’equipment’ that is essential to the ‘production’ of an item, including testing ‘equipment.’”  

Firm Highlights

Insights

SEC Proposes Expansion of Investment Adviser Performance-Based Compensation Rule

On September 30, 2026, the Securities and Exchange Commission (the “SEC”) proposed amendments to Rule 205-3 under the Investment Advisers Act of 1940, as amended (the “Advisers Act”), which provides an exemption from the general prohibition under Section 205(a)(1) of the Advisers Act on registered investment advisers receiving performance-based compensation (the “Proposal”) so long as performance-based compensation is limited to “qualified clients”.1 Most notably for private fund sponsors, the Proposal would expand the definition of “qualified client” to include any investors that satisfy the “accredited investor” definition under Regulation D. The Proposal may also have implications for private fund managers that rely on exemptions from investment adviser registration under state law because certain state-level investment adviser registration exemptions incorporate or otherwise reference the federal qualified client definition. Expansion of the Qualified Client Definition Under the current Rule 205-3, an investor generally may qualify as a qualified client if, among other alternatives, the investor has at least $1.4 million under management with the adviser or has a net worth exceeding $2.7 million. These thresholds are higher than the financial thresholds applicable to many accredited investors under Regulation D. As a result, an investor may currently qualify as an accredited investor for purposes of investing in a private offering without qualifying as a qualified client for purposes of paying performance-based compensation. The Proposal would expand the qualified client definition to include any natural person or legal entity investor that satisfies the accredited investor definition under Regulation D. The Proposal would also remove the assets under management and net worth thresholds under the current Rule 205-3 qualified client test. For private funds relying on Section 3(c)(1) of the Investment Company Act of 1940, this change could reduce the need to apply a separate qualified client standard to investors that already qualify as accredited investors. Dorsey Observations and Next Steps If adopted as proposed, the expanded qualified client definition could be particularly significant for private fund managers. Most private fund offerings are already limited to accredited investors under Regulation D. However, the Proposal could expand the pool of prospective investors available to emerging private fund managers while reducing the regulatory burden associated with complying with Rule 205-3. The Proposal could also benefit advisers operating below the SEC registration threshold that rely on a state private fund adviser exemption. A number of states have adopted exemptions modeled on the North American Securities Administrators Association (“NASAA”) private fund adviser exemption, which may condition relief for advisers to certain funds relying on Section 3(c)(1) on each beneficial owner satisfying the federal qualified client definition. However, state requirements vary, and any effect of the Proposal would depend on the text of the applicable state exemption and how it incorporates Rule 205-3. Many emerging private fund managers may have a larger network of accredited investor relationships than qualified client relationships during the early stages of their investment advisory business. Currently, under Rule 205-3, private fund managers may receive performance-based compensation from investors who do not satisfy the qualified client definition if those investors were admitted to their private funds prior to registration with the SEC. Following registration with the SEC, however, managers may continue to permit investors that are not qualified clients to invest in future private funds but may not receive performance-based compensation from those investors with respect to such investments. In addition, because the net worth and assets under management thresholds for qualified client status are adjusted for inflation every five years, the pool of qualified client investors may diminish over time as previously eligible investors no longer satisfy the applicable thresholds. The Proposal could provide the dual benefit of greater flexibility for private fund managers to establish and maintain relationships with accredited investors as their businesses scale and they become registered with the SEC, and greater flexibility for certain accredited investors to participate in investment strategies that historically have been restricted to much larger institutional investors. Unless and until the Proposal is adopted, investment advisers should continue to comply with the existing qualified client requirements. If the Proposal is adopted, private fund sponsors should consider whether corresponding changes are appropriate for their subscription documents, investor questionnaires, and other offering materials. Advisers that are state-registered or rely on a state-level exemption should also consult the laws and regulations of each relevant jurisdiction before changing investor eligibility standards or performance-based compensation practices, because adoption of the federal amendments may not automatically modify state requirements. Comments on the Proposal will be due 60 days after publication in the Federal Register. 1 Investment Adviser Performance-Based Compensation Modernization, Investment Advisers Act Release No. IA-7022 (Sept. 30, 2026), available at https://www.sec.gov/rules-regulations/2026/09/s7-2026-28#33-11443proposed.

Insights

Energy Law: Month in Review - September 2026

Welcome to Dorsey’s Energy Law: Month in Review. We provide this update to our clients to identify significant developments in the previous month. Please reach out to any of the authors, listed above, to discuss these issues. Regulatory Developments Massachusetts Ratchets Up State and Local Regulation of AI Data Centers In early September, Governor Maura Healey of Massachusetts signed an executive order requiring that artificial intelligence data centers secure the approval of local communities as a precondition to proceeding with a given project. According to the terms of the order, data center developers will need to secure a “community benefits agreement” as a precondition to receiving permits from numerous state agencies, including the Department of Environmental Protection, the Energy Facilities Siting Board, and the Massachusetts Environmental Policy Act Office. Beyond requiring community benefits agreements, the order also mandates that developers mitigate utility costs to consumers, prohibits the use of nondisclosure agreements, and requires various state agencies to develop measures to limit data center impacts on the environment. North Carolina Regulators Decline Approval of Duke Energy Gas Turbine On September 18, 2026, North Carolina Utilities Commission (NCUC) denied Duke Energy’s application for a certificate of public convenience and necessity required to construct a gas-fueled combustion turbine at its Smith Energy Complex in North Carolina. The NCUC objected strongly to the $584 million price tag and noted that Duke appeared to be constructing the facility “based on anticipated data center customer additions.” The NCUC rejected that anticipated growth as “insufficiently reliable for the Commission to act at this point.” In rejecting Duke’s application, the NCUC also noted that Duke had signed the White House Ratepayer Protection Pledge, in which it represented that it would not shift data center costs to consumers. The NCUC observed that the record did not demonstrate how Duke “intends to adhere to its commitments under the Ratepayer Protection Pledge with regard to the Proposed Facility.” Notably, commission staff had actually supported the construction of the turbine, citing concerns about Duke’s reserve margins. The NCUC noted that it “understands the Public Staff’s expressed concerns,” but those concerns were outweighed by the NCUC’s reservations, including questions of demand. Department of Energy Approves Funds for Grid Improvement The U.S. Department of Energy (DOE) recently announced that it would fund 31 grid-improvement projects in 26 states. The funding initiative is part of the DOE’s “SPARK” initiative. The funding will include $1.9 billion in federal funding from DOE and $3.35 billion in recipient cost-sharing funding. The funds will go to projects designed to improve grid reliability and lower electricity costs. Recipients plan to reconductor over 1,500 miles of transmission lines and will deploy grid-enhancing technologies across approximately 21,000 miles. DOE stated that this initiative will make available over 23 additional gigawatts of electricity. Texas Moderates Rules Governing Data Center Interconnection The Texas Public Utility Commission adopted new regulations governing large-load interconnections. The rules impose a flat study fee of $100,000 for all proposed interconnections, which departs from the initial proposal to impose study fees using a tiered system based on project size. Additionally, the final rule eliminates the PUC’s previous proposal to impose a non-refundable interconnection fee of $50,000 per MW of contracted peak demand. The final rule also moderates the initially proposed regulations governing Electric Reliability Council of Texas (ERCOT) notifications for large-load customers’ non-utilized capacity. The proposed rules would have required notifying ERCOT within 30 days of missing a scheduled energization milestone by six months. The final rules, however, do not require informing ERCOT unless a scheduled energization milestone is missed by 24 months. FERC Denies TransAlta 202(c) Cost-Recovery Plan The Federal Energy Regulatory Commission (FERC) recently rejected TransAlta’s plan to recover $19.9 million in expenses stemming from a DOE order in which DOE prohibited TransAlta from retiring its coal-powered Centralia power plant. TransAlta had previously intended to retire the facility at the end of 2025. TransAlta’s cost recovery plan proposed spending an additional $23 million on repairs to continue operating the unit. FERC’s main objection had to do with geographic scope. TransAlta’s recovery plan called for recovering costs from California Independent System Operator (CAISO) and the Southwest Power Pool (SPP), but the DOE’s order requiring operation of the plant was designed to ensure reliability in the Northwest assessment area (Montana, Oregon, Washington, and parts of northern California and northern Idaho). Accordingly, FERC was unwilling to allow cost recovery from CAISO and SPP when the order that precipitated the additional costs only related to the Northwest assessment area. FERC informed TransAlta that it would only approve cost recovery from load-serving entities in the Northwest assessment area. FERC’s decision comes amid a rush of DOE emergency orders requiring the continued operation of coal-fired generating units. Litigation Appeals Court Upholds Washington Hydropower Plant With Caveats In a September 21, 2026, opinion, the Washington Court of Appeals largely upheld a Clean Water Act water quality certification by the Washington Department of Ecology for the Goldendale Energy Storage Project, a proposed pumped-water storage hydropower system adjacent to, but off-stream from, the Columbia River. A nonprofit (Columbia Riverkeeper) and the Confederated Tribes and Bands of the Yakama Nation appealed the certification, contending that it failed to impose necessary conditions and monitoring requirements to protect the water quality of the Columbia River. Most saliently, the plaintiffs argued that the project had the potential to leak 100 acre-feet of water per year into tributaries of the Columbia River. The Court of Appeals broadly rejected plaintiffs’ challenge to the state’s conclusion that “the project was designed not to leak.” That said, the Court of Appeals did reverse on one narrow issue. Specifically, the court determined that the state’s conclusion that “leakage from the project’s tunnels would be monitored and reported” was not supported by the evidence because the certification “does not explicitly require monitoring and reporting to determine whether there is any leakage.” Accordingly, the court remanded the matter to the state to impose monitoring and reporting requirements but otherwise affirmed the certification. Legislative Developments California Legislates Restrictions on Data Center Energy Use and Grid Costs On September 21, 2026, California Governor Gavin Newsom signed seven bills broadly regulating data centers in the state. SB 1168 directed the California Public Utilities Commission to assess the energy used by data centers. It also requires the PUC to pass costs of transmission and distribution upgrades and load increases on to data centers, rather than customers. SB 886 and SB 887 compel data centers to pay for infrastructure upgrade and generation costs, and wildfire mitigation costs, in addition to imposing environmental review. The statutes additionally increase local oversight of data centers. AB 1577 imposes a monthly reporting requirement that requires data centers to supply energy consumption and efficiency data to the California Energy Commission. AB 2383 contains incentives for data centers to use onsite clean energy generation. Finally, AB 2469 and AB 2619 require data center developments to assess water supply and develop a water scarcity plan. The statutes also mandate statewide water reporting as a precondition to obtaining and renewing business licenses.

Insights

The Supreme Court Update - October 8, 2026

On September 29, 2026, the Supreme Court granted certiorari in one case: Department of Homeland Security v. D.V.D., No. 26-426: This case concerns the Trump Administration’s “third-country removal” procedures, where immigrants are deported to countries not listed in the removal orders. In granting certiorari, the Court granted the Government’s application to stay a lower court decision halting the practice, which will allow third-country removals to continue pending resolution of the case. The issues presented are: (1) Whether the district court had jurisdiction over respondents’ claims; (2) whether the district court had authority to enter class-wide declaratory relief and APA vacatur under 8 U.S.C. § 1252(f)(1); (3) whether the Government’s guidance on third-country removals is unlawful under 8 U.S.C. § 1231(b), the due process clause, or FARRA/CAT and its implementing regulations; and (4) such other questions that the Government determines are appropriate for the proper disposition of the case. On October 1, 2026, the Court granted certiorari in three additional cases: Rhoney v. Barbosa da Cunha, No. 26-104: Immigration officials detained Ricardo Aparecido Barbosa da Cunha—a Brazilian citizen who had lived in the United States for approximately twenty years after entering without inspection—and denied him a bond hearing under 8 U.S.C. § 1225(b)(2)(A). The Second Circuit held that his detention was instead governed by § 1226(a), which permits release on bond, because § 1225(b)(2)(A)’s mandatory-detention requirement applies only to noncitizens apprehended while entering the country or shortly thereafter. The question presented is: Whether 8 U.S.C. § 1225(b)(2)(A) mandates the detention pending removal proceedings of aliens who, like Barbosa da Cunha, are present in the United States without having been admitted. Missionaries of St. John the Baptist, Inc. v. Frederic, No. 25-113: A Catholic religious organization sought to build a shrine to the Virgin Mary on land the organization owned adjacent to its church in Park Hills, Kentucky. Local zoning restrictions prohibited the proposed construction. The question presented is: Whether a land-use regulation that prohibits a religious institution from building a religious structure on its own property constitutes a “substantial burden” on religious exercise under the Substantial Burden Provision of the Religious Land Use and Institutionalized Persons Act, 42 U.S.C. § 2000cc(a). Marschner v. Marschner, No. 25-1349: Under the Uniformed Services Former Spouses’ Protection Act (“USFSPA”), a veteran’s longevity-based retirement pay can be divided in a divorce, but retirement pay based on disability and retirement pay that was waived to receive disability pay are indivisible. The question presented is: Does the USFSPA require state courts to refuse enforcement of indemnification provisions in a divorce settlement agreement?

Insights

EPA Limits Title V Re-Litigation of NSR Permits

Overview On September 25, 2026, the U.S. Environmental Protection Agency (“EPA”) published a final rule that significantly limits the ability of third parties to use the Clean Air Act (“CAA”) Title V permitting process to revisit New Source Review (“NSR”) permitting decisions years after those decisions were made. The rule establishes that NSR permitting determinations generally must be challenged during the original permitting proceeding, thereby providing regulated sources with greater permitting certainty and finality for major capital projects. Published in the Federal Register titled Clarifying the Scope of “Applicable Requirements” Under State Operating Permit Programs and the Federal Operating Permit Program (Docket ID No. EPA-HQ-OAR-2023-0401), the rule amends 40 C.F.R. Parts 70 and 71 to codify EPA’s interpretation regarding when requirements established under other CAA programs may be reviewed, modified, or implemented through the Title V operating permit program. The rule becomes effective 30 days after publication. The rule addresses two principal issues: (1) the relationship between NSR preconstruction permitting and Title V operating permits, and (2) the treatment of the General Duty Clause under CAA section 112(r)(1). Most significantly, the rule provides greater certainty for sources navigating the NSR permitting process. EPA’s amendments are intended to ensure that NSR permitting decisions made through an approved public process are generally not revisited later through Title V permit proceedings. The rule responds to a circuit split between the U.S. Courts of Appeals for the Fifth and Tenth Circuits. In Environmental Integrity Project v. EPA, 969 F.3d 529 (5th Cir. 2020), the Fifth Circuit upheld EPA’s interpretation, concluding that it was consistent with the text, structure, and purpose of Title V. In contrast, the Tenth Circuit reached the opposite conclusion in Sierra Club v. EPA, 964 F.3d 882 (10th Cir. 2020), finding that the then-existing regulatory definition of “applicable requirement” did not support EPA’s position. By amending the regulatory language on which the Tenth Circuit relied and codifying the interpretation approved by the Fifth Circuit, EPA has established a nationwide framework governing the interaction between NSR and Title V. NSR and Title V: EPA Establishes a Uniform Nationwide Framework At the core of the rule is EPA’s effort to define the respective roles of NSR and Title V. The rule codifies the approach EPA has applied since 2017: once a source obtains an NSR permit under an EPA-approved permitting program, and that permit was issued following public notice with an opportunity for comment and judicial review, the permit establishes the NSR-related “applicable requirements” of the State Implementation Plan (“SIP”) or Federal Implementation Plan (“FIP”) for Title V purposes. Under this framework, Title V is not a vehicle for re-examining underlying NSR permitting decisions. EPA does not intend to use the Title V process to revisit applicability determinations, emissions calculations, control technology determinations, permit conditions, or other issues resolved through the NSR permitting process. This principle applies regardless of the stage of the Title V proceeding; whether the NSR permit was issued pursuant to a SIP or FIP; the type of NSR issue involved; or whether the NSR permit is incorporated into Title V sequentially or concurrently. Limited Exceptions EPA recognizes several circumstances in which NSR issues may still be reviewed through the Title V program: No NSR permit was issued at all; The permit was issued without public notice and an opportunity for comment and judicial review; or The issue involves substantive overlap between Title V and NSR requirements, such as the adequacy of monitoring provisions. As a result, the rule does not insulate unpermitted projects or foreclose review of matters that independently arise under Title V. Key Regulatory Amendments The rule revises the definition of “applicable requirement” in 40 C.F.R. §§ 70.2 and 71.2. Paragraph (1): Where an NSR permit is issued with public notice and an opportunity for comment and judicial review, the permit establishes and defines the applicable SIP or FIP requirements for Title V purposes. Paragraph (2): All NSR permit terms, including terms contained in minor NSR permits, constitute applicable requirements that must be incorporated into Title V permits. Paragraph (4): CAA section 112(r)(1) (the General Duty Clause) is expressly excluded from the definition of “applicable requirement,” while section 112(r)(7) Risk Management Program requirements remain included. EPA also amended 40 C.F.R. §§ 70.8 and 70.12 to clarify that alleged defects in requirements established outside the Title V process generally do not provide a basis for EPA objection to a Title V permit or for a Title V citizen petition. General Duty Clause Exclusion The rule also codifies EPA’s longstanding position that the General Duty Clause in CAA section 112(r)(1) is not an “applicable requirement” for Title V purposes. EPA points to several considerations supporting that conclusion, including the distinction between the General Duty Clause and Title V permit terms, the provision’s origins in the Occupational Safety and Health Act’s general duty clause, and the different enforcement structures applicable to the General Duty Clause and Title V permit requirements. Importantly, excluding section 112(r)(1) from the definition of “applicable requirement” does not eliminate EPA’s authority to enforce the General Duty Clause independently of the Title V program. The final rule instead clarifies that the General Duty Clause need not—and should not—be incorporated into Title V permits as an applicable requirement. Practical Implications for Regulated Sources Greater Finality for NSR Permits  For projects requiring PSD, nonattainment NSR, or minor NSR permits, the permitting process becomes the primary forum for resolving disputes regarding applicability determinations, emissions calculations, control technology requirements, offsets, and permit conditions. Once an NSR permit is issued through a qualifying public process, regulated sources should face substantially reduced risk that those same issues will be challenged years later through Title V permit proceedings. Reduced Risk of Collateral Permit Challenges Stakeholders have sometimes sought to use Title V permit issuance, renewal, revision, or citizen-petition proceedings to challenge underlying NSR determinations. The final rule makes clear that Title V is not the appropriate vehicle for challenging whether an applicable requirement was correctly established in the first instance. This should reduce the risk of permit delays and uncertainty associated with collateral challenges to previously issued NSR permits. The rule does not, however, eliminate all Title V challenges relating to an NSR permit. Challenges concerning the Title V permit itself—including whether it appropriately incorporates applicable requirements or contains adequate compliance provisions—remain possible. Increased Importance of the Initial NSR Proceeding Because Title V generally will not provide a second opportunity to challenge the substantive validity of an NSR determination, the administrative record developed during the NSR process becomes increasingly important. Permit applicants should ensure that applicability analyses, emissions calculations, control technology evaluations, modeling demonstrations, and supporting technical documentation are thoroughly developed during the original permitting proceeding. For significant projects, applicants may therefore have an additional incentive to identify and resolve potential permitting issues before the NSR permit is issued rather than assuming that unresolved issues can be addressed during a subsequent Title V proceeding. Potential Incentive for Broader Public Participation EPA also notes that permitting authorities may choose to provide public notice and an opportunity for comment for a broader range of NSR permits because permits issued through a qualifying public process receive the benefit of the finality framework established by the rule. Some permitting authorities may conclude that greater public participation at the NSR stage is preferable to uncertainty during subsequent Title V proceedings. Conclusion The final rule is principally a permitting-certainty measure. For sources that obtain NSR permits through a public process, EPA has substantially limited the ability of third parties to revisit underlying NSR determinations through the Title V program. As a result, regulated entities should benefit from greater finality regarding key permitting decisions, reduced risk of collateral permit challenges, and increased certainty when planning and implementing capital projects.