.
Marquee

Emerging Companies & Venture Capital

A growing business needs creative entrepreneurship supported by sound legal advice.

As an entrepreneur, you need advice that combines legal knowledge with an understanding of your business, your industry, your markets, and your risks. Our Emerging Companies practice helps entrepreneurs create the legal foundation necessary to raise capital, attract and retain employees, protect intellectual property, and contract with partners.

We also work regularly with venture capital firms and investment banks to investigate and document investments in emerging companies, giving us both a well-rounded perspective and an ability to connect and introduce clients in need of financing.

Competent, Creative and Connected
With Emerging Companies lawyers located across the country and in major international business centers around the world, Dorsey provides both legal and business services for the breadth of issues faced by a growing business – from initial investment to final liquidity.

Full Range of Services
Our services include: 

  • Formation, venture capital and other financing
  • Strategic alliances
  • Domestic and international licensing
  • Protection of intellectual property
  • Distribution agreements
  • Executive compensation and employee benefits
  • Public offerings
  • Mergers & acquisitions

Accolades

Tier 1
Corporate Law Firm Ranked in 5 Markets
Best Law Firms 2026
Tier 1
Securities / Capital Markets Law Practice in Utah
Best Law Firms 2026
Tier 1
Top Mergers and Acquisitions Law Firm
Best Law Firms 2026
Tier 1
Securities Litigation Firm in Minneapolis and Utah
Best Law Firms 2026
Tier 1
Tax Law Firm in Minneapolis
Best Law Firms 2026
Recognized Firm
Leading Tax Law Practice in Washington
Chambers USA 2026

Insights

Client Alert

DOJ on Campus: DOJ’s First Intervention in False Claims Act Case Alleging University Knowingly Failed to Meet Contractual Cybersecurity Requirements

September 4, 2024

Cybersecurity requirements for federal contractors and grantees continue to proliferate—and those requirements do not just come with contractual risk. Increasingly, the United States government is leveraging enforcement tools, particularly the False Claims Act (and its treble damages), to police these requirements. A recent action against a public research institution is a good case study for compliance officers and legal professionals who advise recipients of federal funding. The United States Department of Justice (DOJ) recently announced that it had intervened in a whistleblower’s False Claims Act case against the Georgia Institute of Technology and Georgia Tech Research Corp., a non-profit contracting entity for Georgia Tech (GTRC). The complaint-in-intervention alleges that these entities (collectively, Georgia Tech) knowingly failed to meet contractual cybersecurity requirements in performance of Department of Defense (DoD) contracts.[1] The original whistleblower lawsuit was filed months earlier by a current and a former member of Georgia Tech’s cybersecurity compliance team. As the complaint explains, defense contractors typically must comply with DoD contractual cybersecurity requirements to protect any non-public government information that can be accessed from contractors’ information systems. [2] DoD imposes cybersecurity requirements to minimize threats to national security and the U.S. economy from malicious cyber activity and theft of intellectual property. The federal government has specifically warned research universities that they are known targets for cyberattacks by foreign intelligence services and other foreign adversaries. From as early as 2019, Georgia Tech allegedly failed to heed the government’s warning and for years engaged in what a former Georgia Tech employee called “no enforcement” of cybersecurity regulations. Georgia Tech purportedly bowed to the pressures of large dollar grant recipient researchers who pushed back on cybersecurity compliance because of what they saw as the excessive burdens. As opposed to a culture of compliance that DOJ repeatedly emphasizes in its corporate enforcement policies,[3] Georgia Tech allegedly failed to comply with these cybersecurity requirements. More specifically, a lab at Georgia Tech allegedly failed to develop or implement a required system security plan to outline how the lab would protect covered defense information in its possession, and it failed to install or update antivirus software on servers and computers that contained non-public DoD information. The complaint alleges that Georgia Tech violated the DoD contractual conditions by failing to provide DoD with an accurate summary level score to demonstrate the lab’s compliance with applicable cybersecurity regulations. Instead, Georgia Tech allegedly provided DoD with a false summary score for a “campus-wide” IT system when purportedly no such system existed. The complaint’s primary cause of action is not for breach of contract or an administrative sanction; it is the False Claims Act, 31 U.S.C. §§ 3729–3733. The False Claims Act provides that any person who “knowingly presents, or causes to be presented, a false or fraudulent claim” to the government, or who “knowingly makes, uses, or causes to be made or used, a false record or statement material to a false or fraudulent claim,” is liable to the federal government for significant financial penalties per false claim plus treble damages. A Georgia Tech spokesperson issued a statement denying the allegations and noting that “in this case, there was no breach of information, and no data leaked.”[4] This is DOJ’s first complaint-in-intervention in a False Claims Act filed under DOJ’s Civil Cyber-Fraud Initiative (CCFI).[5] When the CCFI was first launched in October 2021, DOJ Deputy Attorney General Lisa Monaco announced that its goal was to “hold accountable entities or individuals that put U.S. information or systems at risk by knowingly providing deficient cybersecurity products or services, knowingly misrepresenting their cybersecurity practices or protocols, or knowingly violating obligations to monitor and report cybersecurity incidents and breaches.”[6] DOJ said that its CCFI would rely on “the False Claims Act to pursue cybersecurity related fraud by government contractors and grant recipients.”[7] Although this is the first complaint-in-intervention filed by DOJ, over the past two years, DOJ’s CCFI has reached multimillion dollar settlements in several other cases.[8] DOJ’s complaint-in-intervention comes on the heels of DoD’s recently announced rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) to incorporate contractual requirements related to the proposed Cybersecurity Maturity Model Certification (CMMC) 2.0 program rule.[9] The proposed rule will apply to all DoD solicitations and contracts, will require contractors to prove required CMMC compliance, and will require all contractors to self-certify or to obtain a third-party certification before beginning work on any DoD contracts. Key Takeaways Beyond protecting against cyber incidents, robust cybersecurity protocols are now legal requirements that the government will enforce aggressively. To minimize the risk of facing a False Claims Act case or a government investigation more broadly, research universities and other government contractors should: Review compliance programs, including compliance hotlines, internal monitoring and audit functions, and employee training on these programs, to ensure that they are functioning effectively and truly foster a “culture of compliance;” Evaluate cybersecurity policies and practices, especially subcontractor policies and practices, to ensure compliance with federal regulations and contractual requirements, such as identifying the location of all non-public government data and ensuring implementation of appropriate and effective cybersecurity assessments and plans; Document their own and their subcontractors’ cybersecurity protocols and use regular audits or assessments to validate and ensure that these protocols are effective, complaint with legal requirements, and working as intended; Ensure that business leadership and, in the case of federal grant funding, Principal Investigators, understand the consequences for non-compliance with cybersecurity requirements, including potential personal exposure; Verify that all reports to and communications with the government are accurate and truthful and contain no material omissions; and Conduct prompt, credible investigations of complaints about non-compliance and, where appropriate, provide timely voluntary self-disclosure to the United States.   [1] Office of Public Affairs | United States Files Suit Against the Georgia Institute of Technology and Georgia Tech Research Corporation Alleging Cybersecurity Violations | United States Department of Justice. [2] The case is U.S. ex rel. Craig and Koza v. Georgia Tech Research Corp. et al., Civil Case No. 1:22-cv-02698 (N.D. Ga.). The complaint is available online: https://www.justice.gov/opa/media/1364901/dl?inline. [3] Microsoft Word - 2023.03.03 - Revised ECCP (revised3) (justice.gov). [4] Federal Gov't Hits Georgia Tech With Cybersecurity FCA Suit - Law360. [5] Northern District of Georgia | United States Files Suit Against the Georgia Institute of Technology and Georgia Tech Research Corporation Alleging Cybersecurity Violations | United States Department of Justice. [6] Office of Public Affairs | Deputy Attorney General Lisa O. Monaco Announces New Civil Cyber-Fraud Initiative | United States Department of Justice. [7] Id. [8] See Office of Public Affairs | Staffing Company to Pay $2.7M for Alleged Failure to Provide Adequate Cybersecurity for COVID-19 Contact Tracing Data | United States Department of Justice; Office of Public Affairs |Consulting Companies to Pay $11.3M for Failing to Comply with Cybersecurity Requirements in Federally Funded Contract | United States Department of Justice; Office of Public Affairs | Cooperating Federal Contractor Resolves Liability for Alleged False Claims Caused by Failure to Fully Implement Cybersecurity Controls | United States Department of Justice; Office of Public Affairs | Aerojet Rocketdyne Agrees to Pay $9 Million to Resolve False Claims Act Allegations of Cybersecurity Violations in Federal Government Contracts | United States Department of Justice; Office of Public Affairs | Jelly Bean Communications Design and its Manager Settle False Claims Act Liability for Cybersecurity Failures on Florida Medicaid Enrollment Website | United States Department of Justice [9] Federal Register :: Defense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041).

Client Alert

United States Imposes More Sanctions to Block Russian Access to U.S. Banking System and U.S. Goods, Technology or Software

March 1, 2022

On February 24, 25 and 28, the United States broadened its economic sanctions against Russia in response to its full-scale military invasion of Ukraine. As the Biden Administration had promised in recent weeks, in close cooperation with its major allies, the United States imposed further rounds of coordinated sanctions against the Russian Federation in reaction to this grave and violent expansion of hostilities. We summarize below some key provisions of these new U.S. sanctions.   The February 24 package added both economic sanctions that target the Russian financial services sector and vastly expanded export controls that will restrict Russia’s access to U.S. goods, software, and technology. The February 25 measures placed asset blocking sanctions on Russian President Vladimir Putin, Foreign Minister Sergei Lavrov, Defense Minister Sergei Shoigu and a Russian general individually so that U.S. persons may not now engage in any transactions involving their blocked property interests. On February 28, OFAC expanded the sanctions to target the Russian Federation’s Central Bank, National Wealth Fund, and Ministry of Finance. This new round of sanctions is on top of those imposed earlier last week, which we reported earlier here. (We will also be issuing additional separate summaries of other U.S. sanctions measures that have been announced since February 25, keeping in mind that these U.S. sanctions-based responses to the invasion are still evolving and expanding quickly.) Expanded U.S. Economic Sanctions Against Russian Financial Sector. On February 24, the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) significantly expanded the targeted sanctions against the Russian financial services sector. According to OFAC, this round of sanctions targets “all of Russia’s largest financial institutions and the ability of state-owned and private entities to raise capital,” affecting “nearly 80 percent of all banking assets in Russia.” OFAC indicated that it had selected these particular Russian sanctions targets based on their likely impact on the Russian Government while trying to minimize potential collateral effects on the U.S. and allied economies. These new measures are based on OFAC Directives 2 and 3 that the Biden Administration had issued on February 22 and 24, 2022, which are in addition to previous OFAC Directives that the Obama Administration had issued in 2014 that still remain in effect as amended. OFAC issued its new Directive 2 on February 24, citing its authority under Executive Order (“EO”) 14024 of April 15, 2021 (“EO 14024 Directive 2”). EO 14024 had been the basis for OFAC’s expanded sanctions under EO 14024 Directive 1A (issued on February 22 and discussed here) against Russian sovereign debt. Under this new EO 14024 Directive 2, U.S. financial institutions are now prohibited from (1) opening or maintaining any correspondent account of payable-through account or (2) processing any transactions on behalf of targeted Russian owned financial institutions. OFAC is adding any Russian owned financial institutions targeted under this EO 14024 Directive 2 to its Correspondent Account and Payable-Through Account List (“CAPTA List”). Under this new EO 14024 Directive 2 authority, OFAC imposed sanctions on Sberbank, the largest bank in Russia that is majority owned by the Russian Government, along with 25 Sberbank subsidiaries. Effective March 26, 2022, Sberbank and its 50% or more owned subsidiaries will no longer be able to process transactions using correspondent accounts or payable-through accounts at any U.S. banking institution, effectively preventing Sberbank and its designated affiliates from processing U.S. foreign exchange transactions. However, even before this designation under EO 14024 Directive 2, OFAC had already imposed other sanctions against Sberbank under EO 13662 Directive 1, which OFAC issued in 2014 after Russia’s annexation of the Crimea region of Ukraine. As amended in September 2017, that EO 13662 Directive 1 prohibited transactions by U.S. persons with Sberbank involving any new equity or debt financing exceeding 14 days maturity.  This latest prohibition under OFAC’s EO 14024 Directive 2 has far broader consequences because it disrupts the ability of Russian account holders to make or receive international wire transfers for all cross-border transactions involving any part of the U.S. financial system unless OFAC grants a license. In addition, OFAC designated several other major Russian banks for asset blocking sanctions under EO 14024, adding them to OFAC’s List of Specially Designated Nationals and Blocked Persons (“SDN List”). As a consequence, a U.S. person may not engage in any transaction involving the property interests of those named Russian banks or the property interests of any 50% or greater owned subsidiaries even if those subsidiaries are not themselves named on the SDN List. Moreover, any property belonging to these targeted Russian financial institutions held by U.S. persons, such as deposits at U.S. banking institutions, are now “blocked” and cannot be released to the sanctioned Russian banks or any other party unless authorized by OFAC. OFAC added the following Russian owned banks to the SDN List along with some of their domestic and foreign subsidiaries: VTB Bank and 20 subsidiaries, which hold about 20% of banking assets in Russia; Otkritie and 12 subsidiaries, which constitute Russia’ seventh largest banking institution; Sovcombank and 22 subsidiaries, which constitute Russia’s ninth largest banking institution; and Novikombank, a state-owned banking institution that provides financial services to the Russian defense sector. OFAC also issued Directive 3 under EO 14024 (“EO 14024 Directive 3”) on February 24 to prohibit U.S. persons from engaging in transactions that involve the new equity or new debt of designated Russian entities that exceed 14 days maturity.1 This prohibition significantly curtails the ability of the listed Russian companies to raise capital through capital markets transactions. EO 14024 Directive 3 names 13 Russian financial institutions as the initial set of entities subject to this new prohibition, to take effect on March 26, 2022: Credit Bank of Moscow Sovcomflot  Gazprombank Russian Railways  Alfa-Bank Alrosa  Russian Agricultural Bank Gazprom  Gazprom Neft Sberbank  Rostelecom Transneft  Rushydro   Six of these Russian firms had already been subject to debt or equity restrictions under one or more of the EO 13662 Directives issued in 2014. This overlap includes Sberbank, which OFAC simultaneously designated for the CAPTA List sanctions under EO 14024 Directive 2 as described above. However, given the potentially broad effect of these bank-related sanctions, to alleviate humanitarian, safety, and other concerns, OFAC concurrently issued eight general licenses (“GLs”) to allow certain categories of transactions to continue notwithstanding the sanctions imposed on February 24, including transactions involving international organizations; agricultural and medical commodities; aviation safety; energy; certain debts and equity; derivative contracts; and the wind-down and rejection of transactions involving persons subject to the SDN List. In addition to the sanctions targeting entities in the Russian financial services sector, OFAC also added to its SDN List ten prominent and wealthy Russian individuals who are connected to the Russian Government and 24 Belarusian entities and individuals for their roles in supporting and enabling Russia’s invasion of Ukraine. Please see here for the complete list of the entities and individuals added to the SDN List and that became subject to OFAC’s EO 14024 Directives 2 and 3 through OFAC’s February 24 sanctions designations. On February 25, OFAC also designated Russian President Vladimir Putin, Foreign Minister Sergei Lavrov, Defense Minister Sergei Shoigu, and Chief of the General Staff Valery Gerasimov for individual asset blocking sanctions and added them to the SDN List. OFAC rarely designates heads of state personally for sanctions on the SDN List, so this latest move signals the U.S. Government’s vehement opposition to the Russian Government’s actions in Ukraine and to these sanctioned officials’ personal roles in the invasion. For information about these additional designations to the SDN List, please see here. On February 28, following reports of intense combat in Ukrainian cities, OFAC also issued  Directive 4 under EO 14024 (“EO 14024 Directive 4”), which prohibits U.S. persons from engaging in transactions that involve the Russian Federation’s Central Bank, National Wealth Fund, and Ministry of Finance. This prohibition includes any transfer of assets to these entities and foreign exchange transactions on their behalf. This significant expansion of U.S. sanctions effectively freezes the Russian Government’s assets held by U.S. financial institutions (including the Federal Reserve) and will prevent the Russian Government from using those assets to mitigate the economic impact from the sanctions imposed by the United States and its allies. (Other leading nations and their central banks have taken similar steps to block the Russian Central Bank’s access to assets held by those institutions so as to apply these sanctions on a multilateral basis to enhance the financial pressure on the Russian government to end its invasion of Ukraine.) Allied Actions on Russian Access to SWIFT Interbank System. In the weeks leading up to Russia’s full-scale invasion of Ukraine, there has been widespread discussion whether the United States and its allies would cut off Russia from the international SWIFT interbank messaging system as a sanctions measure. Such a step would make it very onerous for Russian financial institutions to engage in international fund transfers. When the President Biden announced sanctions on February 24 in the wake of the Russian invasion, he did not announce such a move. During a White House press conference, President Biden indicated that certain of the European allies were not yet prepared to take that step. However, on February 26, after additional consultations among the European allies, the United States and EU governments announced a plan to cut off certain Russian financial institutions, but not the entire Russian banking sector, from SWIFT. Some analysts had suggested that a number of European leaders initially opposed sanctions involving SWIFT because, although such a move could potentially inflict the virtual severance of Russian banks from the global financial system, that degree of economic pain in Russia might then trigger a Russian counter-measure to reduce or even cut off oil and gas supplies to Europe. Russia supplies roughly one-quarter of all crude oil and almost 40% of all natural gas to the European Union. European leaders probably remain concerned that any significant Russian reduction or cut-off of these energy supplies at a time of soaring energy prices could add to the already-severe inflation across Europe and might even trigger an economic recession just as Europe is seeking to recover from the pandemic. Thus, the partial cut-off from SWIFT appears to be designed to allow Russian oil and gas exports (and payments by EU customers) to continue, at least for now. Russian Export Pipeline Sanctions. One of Europe’s largest energy projects is the Nord Stream 2 (“NS2”) natural gas export pipeline running under the Baltic Sea between Russia and Germany. Nord Stream 2 AG (“NS2 AG”), a Swiss entity, built the pipeline and would be its operator if operations commence. NS2 AG is wholly owned by the Russian state-owned natural gas company, Gazprom, and NS2 AG had already been named by the U.S. State Department in a May 2021 report that was required under the Protecting Europe’s Energy Security Act (“PEESA”). Under EO 14039 of August 20, 2021, NS2 AG would have been subject to asset blocking sanctions by virtue of that May 2021 report, but the Biden Administration had decided to waive those sanctions from taking effect. The Obama, Trump and Biden Administrations had opposed the NS2 pipeline because it would bypass the Ukrainian natural gas pipeline system, and thus further weaken Ukraine’s struggling economy and would, at the same time, lead to further German and European energy dependence on Russia, allowing Russia to exert substantial geopolitical leverage on Europe that could weaken the military alliance of the North Atlantic Treaty Organization (“NATO”). In spite of opposition in principle to the NS2 pipeline project, U.S. Secretary of State Anthony Blinken waived that specific sanctions designation in May 2021, apparently at the request of the German government, which still strongly supported the project. That waiver decision then triggered significant criticism from members of the U.S. Congress, notably Senator Ted Cruz of Texas, who sponsored legislative proposals to compel U.S. sanctions against NS2 AG. Now, with Russian forces actually fighting inside Ukraine, the Biden Administration has reversed itself on the May 2021 NS2 AG waiver. Citing Russia’s recognition of the self-proclaimed separatist republics in Ukraine’s eastern Donetsk and Luhansk regions, on February 23, Secretary Blinken terminated his previous waiver and allowed the PEESA-based SDN List sanctions against NS2 AG and its chief executive officer to take effect. OFAC also issued a General License 4 to allow wind-down of transaction involving NS2 AG until 12:01 am Eastern U.S. Time on March 2, 2022. Germany concurrently announced its own indefinite suspension of certification of the NS2 pipeline that would be required for its operation to commence. Thus, for now, full U.S. SDN List-based sanctions will be imposed on NS2 AG and its CEO and Germany will not allow the NS2 pipeline to become operational, which will inflict financial losses on NS2 AG and its owner Gazprom, who would supply the gas for that pipeline. Expanded U.S. Export Controls Against Russia. The Department of Commerce and its Bureau of Industry and Security (“BIS”) significantly expanded the scope of goods, software, and technology that will require an export license to Russia under the U.S. Export Administration Regulations (“EAR”) which are codified under the newly created EAR Section 746.8 and amendments to conform various EAR sections to the new requirements. These changes will result in many more transactions to Russia being subject to export license requirements and, moreover, many of those transactions will now be mostly subject to a BIS policy of denial for the issuance of such export licenses. These changes to the EAR also became effective as of February 24. Exports from the United States and of Certain U.S. Items. BIS will now impose a license requirement to export or reexport to Russia or transfer within Russia any goods, software or technology that are listed under any Export Control Classification Number (“ECCN”) in any of the following categories of the EAR’s Commerce Control List (“CCL”): Category 3:  Electronics Category 4:  Computers Category 5:  Telecommunications and Information Security Category 6:  Sensors and Lasers Category 7:  Navigation and Avionics Category 8:  Marine Category 9:  Aerospace and Propulsion This new EAR license requirement for exports or reexports to Russia and transfers within Russia covers all goods exported from or through U.S. territory, U.S.-origin items wherever located, and foreign-made items that have controlled U.S. content that exceeds the de minimis threshold (generally 25% of the item’s value). As examples, this rule change will expand export license requirements for Russia to include even low-technology electronic components, consumer computers, basic telecommunications equipment, certain lasers and sensors, navigation equipment, commercial aircraft, and parts and components of commercial aircraft. In its public notice, BIS acknowledges the potential impact on civil aviation for items that previously were not controlled for exports to Russia. However, BIS believes these controls are now necessary to deny the Russian defense sector access to these items. As a result of these changes, many U.S. and non-U.S. companies will need to apply for BIS export licenses to send items to Russia (or even to transfer items that are already in Russia). Moreover, BIS has stated such applications generally will be subject to a policy of denial. However, BIS will review applications on a more lenient “case-by-case basis” for items relevant to flight safety, maritime safety, humanitarian needs, space cooperation, certain civil telecommunications infrastructure, government-to-government activities, and operations of companies that are subsidiaries or joint ventures of enterprises based in the United States or certain allied countries. As part of this “case-by-case” review, BIS will focus on whether such transactions would benefit the Russian government or Russian defense sector (which are both disfavored under this new licensing policy). Foreign Direct Products of U.S. Software or Technology. BIS also created a special foreign direct product (“FDP”) rule that will apply just to Russia (the “Russia FDP Rule”). Before issuing this Russia FDP Rule, the EAR already had other FDP rules that covered foreign-made products that were made by using certain controlled U.S.-origin software or technology or by using production equipment that had been made through the use of certain controlled U.S.-origin software or technology.2 The Russia FDP Rule now triggers a new license requirement in either of two scenarios: (1) If the foreign-made product is classified under an ECCN (i.e., not EAR99), and if it was a direct product of any technology or software controlled under CCL Categories 3 through 9; or (2) If the foreign-made product is classified under an ECCN (i.e., not EAR99), and if it was created from equipment that is a direct product of technology or software controlled under CCL Categories 3 through 9. The Russia FDP Rule applies only if the exporter or re-exporter knows or has reason to know based on the circumstances that the foreign-produced item’s ultimate destination will be Russia, or if that foreign-produced item will be incorporated or used to produce an item in Russia or in a third country before re-exportation to Russia that is classifiable under CCL Categories 3 through 9. Moreover, the EAR defines “direct product” to mean the “immediate product (including processes and services) produced directly by the use of technology or software,” which imposes some limits to the otherwise expansive scope of the Russia FDP Rule. The Russia FDP Rule is BIS’s most significant expansion of its FDP rules and imposes EAR licensing requirements for non-U.S. companies that rely on basic software or technology from the United States, or that use production equipment that had been made with U.S. software or technology, to produce items destined, directly or indirectly, for Russia. To comply with the Russia FDP Rule, companies must exercise considerable vigilance about whether any U.S.-origin software or technology is used to produce foreign-made products or whether any U.S.-origin software or technology is used to make production or testing equipment necessary for making items that will be destined to Russia. If that is the case, companies must then consider whether such U.S.-origin software or technology falls under the scope of software or technology that is subject to the Russia FDP Rule. The Russia FDP Rule thus captures a considerable volume of foreign-made electronic components, computers, telecommunications equipment, production equipment, encryption software, aircraft parts, and many other items that could be supplied from other nations to Russia. As context and perhaps by way of precedent, BIS had created a specific FDP rule for Huawei Technologies Co., Ltd (“Huawei”) in the People’s Republic of China. Prior to imposing the Russia FDP Rule, U.S. Government officials had highlighted the success of that focused use of its FDP rule in obstructing Huawei’s access to crucial inputs for its 5G and other product lines because of the prominence of U.S.-origin software and technology in the production of numerous parts and components around the world. The U.S. Government had previously warned that similar punitive action could be taken with respect to Russian companies in the event of hostilities against Ukraine.    New Russian Military End User FDP Rule. In addition to the Russia FDP Rule above, BIS also issued another new FDP rule that vastly expands the scope of foreign-made items that will now be considered “subject to the EAR” and denied to certain sanctioned Russian military end users (“MEUs”). BIS is implementing this separate FDP rule through footnote 3 to the Entity List, which BIS applies to designated Russian MEUs through a notation in the sanctioned MEUs’ entries on the Entity List. BIS calls this new FDP rule the “Russia Military End User FDP Rule” (“Russia MEU FDP Rule”) because it targets specific known Russian MEUs. In particular, the Russia MEU FDP Rule imposes a license requirement for exports to any of these designated sanctioned Russian entities of a foreign-made item that is a direct product of technology or software controlled under any of the 10 CCL categories. Likewise, the Russia MEU FDP Rule adds a license requirement for exports to these sanctioned Russian entities of any foreign-made item that is created from production equipment that is a direct product of controlled technology or software under any the 10 CCL categories. These license requirements apply if the exporter knows or has reason to know under the circumstances that the foreign-made product will be incorporated into or used in the production of an item that is produced, purchased, or ordered by a sanctioned Russian company on the Entity List with a Footnote 3 designation or if such a sanctioned Russian company is a transaction party (e.g., a purchaser, ultimate consignee, intermediate consignee, or end-user). The foreign-made item or production equipment must be a “direct product” of U.S.-origin software or technology controlled under an ECCN. Unlike the Russia FDP Rule above, the scope of the new Russia MEU FDP Rule includes even EAR99 foreign-produced products. There is a limited exemption for foreign-made EAR99 food, EAR99 medicine, and certain mass market encryption items. However, even that limited exemption would not apply in the case of any Russian Government entities or Russian state-owned enterprises (“SOEs”). Because the new Russia MEU FDP Rule has such a wide sweep, it could cover even very basic products made outside of the United States, such as EAR99 electronics or consumer goods, software, or other items, so long as their production or related production equipment were products of ECCN controlled U.S.-origin software or technology. Relatedly, BIS made conforming changes to the MEU Rule in EAR Section 744.21 with respect to Russia. As amended, the MEU Rule covers all items subject to the EAR for Russian MEUs, except EAR99 food, EAR99 medicine, and certain mass market items. However, like the Russia MEU FDP Rule, this exception would not apply in the case of MEUs that are Russian Government entities or Russian SOEs. Exclusions from FDP Rules for Certain Allies. BIS excludes from the new Russian FDP rules described above any allies of the United States who, according to BIS, will be implementing their own strengthened export control measures on Russia. This means that foreign-produced items from those countries bound for Russia will not be deemed subject to the new Russia FDP Rule or Russia MEU FDP Rule requirements (but those countries presumably will now apply their own export regulations to the same items). As of February 24, the following countries’ foreign-made direct products will be exempt under either of these new Russian FDP provisions: Australia, Austria, Belgium, Bulgaria, Canada, Croatia, Cyprus, the Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Japan, Latvia, Lithuania, Luxemburg, Malta, Netherlands, New Zealand, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, and the United Kingdom. Russian Entity List Additions and Sanctioning of Military End Users. In addition to the above expansions to the EAR, BIS moved 45 Russian entities from its Military End Users List to its Entity List, added two Russian entities to the Entity List, and amended two existing entries on the Entity List. With limited exceptions, no items “subject to the EAR” may be sent to these entities unless authorized by a BIS export license. Furthermore, BIS made all of these 49 Russian entities in the Russian defense sector subject to the new Russia MEU FDP Rule by adding a “footnote 3” designation next to each of their entries on the Entity List. As a result of this action, with a few exceptions, unless licensed by BIS, U.S. and non-U.S. companies can no longer provide these Russian entities any goods, software, or technology that are sent from or through the United States, U.S.-origin items wherever located, or that contain more than de minimis amounts of controlled U.S.-content.  Because these 49 sanctioned entities also are subject to the new Russia MEU FDP Rule, they also will be barred from receiving items that are made from certain U.S.-origin software or technology or made by using production equipment that had been made with such U.S. software or technology. This combined prohibition denies access by the sanctioned entities to a vastly broader array of items than is ordinarily the case for sanctioned entities on the Entity List (which already was quite broad). Any license applications by these 49 entities to mitigate the effect of the sanctions would be subject to BIS review under its policy of denial. Codification of Luhansk and Donetsk Region Restrictions. BIS also codified territorial embargoes under the EAR against the Luhansk region (“LHR”) and the Donetsk region (“DNR”), which we described earlier here. Thus, under the EAR, unless licensed by BIS, all items subject to the EAR are prohibited from being exported to either the LHR or DNR except for EAR99 food, EAR99 medicine or certain software necessary for the functioning of personal communications over the internet that is widely available at no cost to the user. This BIS action places LHR and DNR on the same footing as the Crimea region of Ukraine that had already been similarly blocked off by BIS in 2014. Conclusion. As a result of these actions, both companies in the United States and many non-U.S. companies should consider whether any of their transactions with Russia or the occupied territories of Crimea, LHR or DNR in Ukraine are now subject to any of these new legal requirements or export restrictions. In addition, since the situation in Ukraine is still highly volatile with active combat still under way between the military forces of Ukraine and the Russian Federation, it seems likely that the U.S. Government will continue to adjust its economic sanctions and export control regimes in response to new developments, so all such companies should continue to monitor both the changing geopolitical news and further legal changes as they occur. If you have any questions regarding this eUpdate, please contact the attorneys profiled below. Dorsey’s attorneys routinely counsel clients to address and mitigate the impact of U.S. economic sanctions, trade embargoes, export controls and other measures that affect cross-border transactions. 1 OFAC had previously issued Directive 1 through 4 under EO 13662 in 2014 to impose sectoral sanctions on various Russian entities and individuals after Russia’s annexation of the Crimea region of Ukraine (collectively, “EO 13662 Directives”). The latest OFAC sanctions imposed on February 24 also use the same terminology of sequentially numbered “Directives,” but it is legally important to distinguish between the EO 13662 Directives from the latest EO 14024 Directives because they carry different consequences for the targeted Russian entities and individuals. 2 The FDP rules reference “complete plant” or a “major component” of a complete plant that is used to make foreign-made items that are subject to the FDP rules. These terms refer to production equipment. For example, the EAR defines “major component” as “’equipment’ that is essential to the ‘production’ of an item, including testing ‘equipment.’”  

Firm Highlights

Event/Resource

Corporate Counsel Symposium 2026 Materials Hub

Materials Symposium Agenda Sessions 8:30 am - 9:30 am CT Session A: The Corporate Compass: Finding True North When Ethical Duties Conflict Philip Kaplan, Senior Legal Counsel, Howden Re Lucia Suljic, Vice President, Corporate Legal, Canon USA Nicole Stanton, Partner & Deputy General Counsel, Dorsey & Whitney LLP This panel addresses ethical obligations of in-house counsel, including balancing obligations and duties that may conflict with each other. How should a responsible in-house lawyer deal with those challenging situations? Rather than stick to an academic discussion, this panel will revolve around a series of practical scenarios that are designed to be realistic and timely, including situations where counsel is asked to represent both the company and an individual, how and when to disclose uncomfortable facts and inconvenient documents, issues involving changing firms and companies, and multijurisdictional practice. The panel will feature discussion from two experienced in-house lawyers and Dorsey’s Deputy General Counsel. Session B: Managing Rapid Regulatory Change in International Trade and Cross-Border Investment Nathan Brower, Executive Vice President, General Counsel, Nature’s Sunshine Greg Ogunsanya, Senior Vice President, General Counsel and Corporate Secretary, H.B. Fuller Kathryn Wood, Senior Vice President & General Counsel, DecoPac, Inc. Dave Townsend and Lawrence Ward, Dorsey & Whitney LLP This program is designed for attorneys advising on cross-border transactions, international trade, regulatory compliance, and corporate governance matters. Panelists will examine recent developments in U.S. trade and investment law and policy, as well as their impact on international collaborations, corporate compliance, and mergers and acquisitions. The discussion will explore how general counsel and in-house legal teams assess and manage evolving trade-related risks within their organizations. Particular focus will be given to developments during the first two years of the second Trump Administration, including changes in tariff policy, tariff refunds, export controls, economic sanctions, and national security reviews of foreign investment. Through a discussion of regulatory trends and practical case studies, attendees will gain a deeper understanding of the legal risks and compliance obligations associated with cross-border business activities, and hear about practical strategies for advising clients and managing compliance obligations in a rapidly changing trade and investment environment. 9:45 am - 10:45 am CT Session A: The Elon Musk Cases: What Tesla and Twitter Can Teach Your Board of Directors Loren Unterseher, Managing Partner, Oxbow Industries, LLC Shulamite White, Chief Legal Officer and Head of People, Motive Technologies Kirsten Schubert, Tom Swigert, and Jonathan Van Horn, Dorsey & Whitney LLP Recent cases involving Elon Musk and his businesses have had significant impact on principles governing board of directors’ fiduciary duties and corporate processes. This panel will examine recent litigation involving Elon Musk, Tesla, and Twitter, and its effects on the law governing the duties of directors and executives, including the executive compensation and director compensation processes, conflicts that may arise when a single executive has control over multiple businesses, and the ramifications of tweets or other public statements by an executive. Session B: All Eyes on DEI: Managing Diversity Efforts Amid Regulatory Scrutiny and Potential Litigation Maggie Dalton, Senior Commercial Attorney, Cargill; Board Co-Chair, Twin Cities Diversity in Practice Laura A. Vannelli, Legal Counsel, Mayo Clinic Susan Lorenc and Jack Sullivan, Dorsey & Whitney LLP The legal and regulatory landscape surrounding diversity, equity, and inclusion (DEI) initiatives has changed dramatically over the past two years. Law firms and legal departments are continuing to grapple with how to recruit, retain, and develop talent from a wide range of personal backgrounds, in a world where previously accepted recruiting and employment practices are facing increased scrutiny and litigation. This program will provide a practical overview of the current legal regime, including recent federal enforcement actions and litigation trends associated with DEI initiatives. Panelists will discuss practical ways in which organizations can pursue and retain legal talent and increase inclusion while minimizing legal, business, and reputational risk. 11:00 am - 12:00 pm CT Session A: Governance in an Age of Increasing Unpredictability James Chosy, Senior Executive Vice President and General Counsel, U.S. Bancorp Todd Hartman, Executive Vice President and Chief Legal and Risk Officer, Best Buy Co., Inc. Alan Rosselot, Associate General Counsel & Assistant Secretary, Delta Air Lines, Inc. Cam Hoang and Robert Rosenbaum, Dorsey & Whitney LLP More than ever, ensuring that boards are well-informed and forward-thinking is critical to a company’s success. Join our panel of corporate governance experts as they share their experiences advising boards through crisis and unpredictable events; capitalizing on, but also checking, disruptive technologies; and positioning the company to succeed in an environment of shifting government priorities. Session B: A Day in the Life of a Trademark, Copyright & Advertising Attorney: A Hypothetical Case Study Alexander Kim, Vice President and General Counsel, Binks Nate Whitaker, Chief Legal Officer and General Counsel, Crumbl Cathy Dahl and Tiffany Shimada, Dorsey & Whitney LLP What issues are companies facing daily while developing rights in intellectual property, protecting those rights, and staying in compliance with myriad potential issues related to advertising, social media, relationships with influencers, and environmental or governmental claims? This panel will feature two in-house counsel who are navigating these issues, utilizing a hypothetical case study, with the support of two Dorsey attorneys helping to develop a roadmap for meeting business objectives and minimizing the risk of claims. 12:00 pm - 1:15 pm CT Keynote Address Dr. Rebecca Heiss, Stress Physiologist Dr. Rebecca Heiss is a stress physiologist, author, and sought-after speaker who helps audiences transform fear and stress into fuel for greater performance and resilience. Her research has been recognized as “transformative” by the National Science Foundation, and she is the author of two books, Springboard and Instinct. Through her Fear(less) message, Rebecca inspires audiences with practical, science-based strategies to train our brains to work for us – not against us – and navigate change and uncertainty with greater confidence.

Insights

The Methane Regulatory Pendulum Swings Again: EPA Proposes Sweeping Changes to Federal Standards for the Oil and Natural Gas Sector

Few environmental regulations better illustrate Washington’s regulatory “ping-pong” than EPA’s methane standards for the oil and natural gas sector. Over the last decade, successive administrations have repeatedly expanded, narrowed, rescinded, reinstated, and revised federal methane requirements, leaving industry to navigate a shifting compliance landscape with each change in administration. EPA’s October 27, 2026 proposal to reconsider significant portions of the 2024 oil and natural gas New Source Performance Standards (“NSPS”) and Emission Guidelines (“EG”) under Subparts OOOOb and OOOOc represents the latest swing of the regulatory pendulum. If finalized, the proposal would substantially reduce compliance obligations in several areas, particularly with respect to lower-producing wells, associated gas flaring, equipment and control-device standards, and the Super Emitter Program. EPA estimates that the proposal would result in approximately $45 billion in savings, while preserving what the agency considers appropriate methane emission controls. EPA’s proposal was published in the Federal Register on October 29, 2026. Comments must be received on or before December 16, 2026.  Significantly, EPA is not using this rulemaking to reconsider its general authority to regulate methane emissions from the oil and natural gas sector. Rather, the agency is addressing specific requirements adopted in the 2024 methane rule, while broader questions concerning greenhouse gas regulation are being addressed in separate proceedings. The present proposal therefore focuses on the appropriate design and scope of particular methane regulations, rather than resolving the threshold question of whether methane may be regulated under the Clean Air Act at all. I.    EPA Proposes to Eliminate the Super Emitter Program Among the proposal’s most consequential changes is the complete elimination of the Super Emitter Program. Adopted in 2024, the program created a regulatory framework under which EPA-certified third parties could identify large methane releases using approved remote-sensing technologies. Upon receiving a qualifying notification from EPA, owners and operators were required to investigate the reported emissions event, report findings to EPA, and take corrective action where necessary. EPA now proposes to repeal the Super Emitter Program in its entirety. The agency questions the program’s legal and policy foundations, including the role of third parties in identifying emissions events and triggering regulatory obligations. EPA also questions whether the program is necessary or effective given other requirements applicable to regulated sources and whether its expected emissions reductions justify its costs and implementation challenges. Because the program was incorporated into both the NSPS applicable to new, modified, and reconstructed sources and the EG applicable to existing sources, its removal would affect federal requirements as well as the presumptive requirements that States otherwise would be expected to address in Clean Air Act § 111(d) plans. Importantly, EPA’s proposed repeal does not prevent States from developing and implementing their own Super Emitter Program based on the existing requirements, which several states are already doing.  II.    EPA Reconsiders Associated Gas Requirements Another centerpiece of EPA’s proposal is its reconsideration of the 2024 rule’s restrictions on flaring associated gas from oil wells. The 2024 rule determined that the best system of emission reduction (“BSER”) generally required operators to capture and beneficially use associated gas by routing it to a sales line, using it onsite, or reinjecting it, rather than routinely flaring it. Although EPA provided certain transition periods and compliance flexibilities, particularly for wells facing infrastructure constraints, the rule ultimately established a framework strongly favoring capture and utilization over flaring. Since promulgation, EPA has received significant feedback regarding gathering-system limitations, gas quality issues, and other practical barriers operators face in securing outlets for associated gas. In response, EPA proposes to replace the existing capture-focused approach with a substantially more flexible standard. EPA argues that the 2024 rule relied too heavily on the availability of third-party gathering and processing infrastructure that is often beyond an operator’s control, raising questions regarding achievability and cost-effectiveness. Under the proposal, BSER would be based on routing associated gas to a flare or other control device capable of achieving at least a 95 percent reduction in methane and volatile organic compound (“VOC”) emissions. Operators could continue to capture gas for sale, use it onsite, or reinject it where feasible, but those practices would no longer be required. EPA also proposes that if a portion of associated gas is routed to sales or used for another purpose, the remaining portion must comply with the 95 percent standard. For example, if a company can route 40 percent of its associated gas to a sales line, the company would need to route the other 60 percent to a control device with a 95 percent reduction, or to a flare. EPA is also soliciting comment on less sweeping alternatives that would preserve the basic structure of the 2024 associated-gas program, while providing additional compliance flexibility. In particular, EPA requests comment on whether it should retain the current capture-and-sales framework but expand the circumstances under which temporary flaring is permitted or extend the duration of temporary flaring allowances where operators face infrastructure constraints. EPA appears to recognize that gathering-system availability, processing constraints, and other third-party factors can affect an operator's ability to route gas to sales, even where the operator ultimately intends to comply with the capture requirements. These requests for comment suggest that EPA is considering whether targeted revisions to the existing framework could address implementation concerns without fully abandoning the 2024 rule's underlying preference for gas capture and beneficial use. III.    EPA’s Reconsideration of the “No Identifiable Emissions” Standard EPA's proposal would substantially revise the 2024 rule’s “no identifiable emissions” (“NIE”) requirements applicable to certain covers and closed vent systems (“CVS”) associated with storage tanks. Under the existing rule, covered equipment generally must operate without identifiable emissions, creating a compliance framework that focuses heavily on the absence of observable emissions rather than solely on equipment design or overall control effectiveness. Since promulgation, industry has argued that the standard effectively functions as a zero-emissions requirement that may be difficult to satisfy under all operating conditions, even where equipment and vapor control systems are properly designed, maintained, and operated. Moreover, EPA stated in the preamble to the 2024 rule that any identified emissions would constitute a deviation of the emissions limitation, resulting in a framework under which the observation of emissions could itself establish noncompliance. EPA now proposes to separate the requirements into distinct design and operational components and to fundamentally alter how compliance with the operational NIE requirement is evaluated. EPA proposes to distinguish between deviations of the design requirements and deviations of the operational NIE requirements. Under the proposed approach, failure to repair an identified emission or defect within 24 hours would constitute a deviation of the design requirement, although not necessarily an underlying violation. Separately, operators could demonstrate compliance with the operational NIE requirement by making repairs as soon as practicable, with an initial repair attempt within five days and final repair within 30 days, or by qualifying for the existing delay-of-repair provisions. A deviation of the operational requirement would occur if the applicable repair deadlines are not met and the delay-of-repair provisions do not apply. The proposal also establishes a new framework for addressing recurring or “chronic” emissions events. After the third emissions event or defect from the same cover or CVS within a year, the owner or operator would be required to conduct an investigative analysis within 10 days to determine whether the underlying cause relates to equipment design, operation, maintenance, or prior repair efforts. The results of that investigation would have important compliance implications. If recurring emissions are attributable to a design flaw, EPA would treat the issue as a deviation of the design requirements. If the emissions result from inadequate prior repairs, the deviation would be attributed to the repair requirements. If operations, maintenance, or other site practices are responsible, the deviation would be classified under the operational requirements. EPA would also require implementation of corrective measures identified through the analysis, including design modifications within 90 days and operational or maintenance-related corrective actions within 30 days. Taken together, these revisions would shift the NIE standard away from a framework in which the mere presence of emissions may establish noncompliance and toward one that focuses on whether operators identify emissions, complete timely repairs, investigate recurring problems, and address the root causes of repeated emissions events. IV.    Solicitation of Comment on “Legally and Practicably Enforceable” Standard EPA is also soliciting comment on the definition of “legally and practicably enforceable” (“LPE”), which industry has identified as one of the more problematic existing requirements. Under the 2024 rule, EPA adopted an interpretation of LPE that many commenters argued effectively disqualifies numerous state regulatory programs, permits, and other federally enforceable mechanisms from serving as the basis for remaining below applicable Subpart OOOOb storage tank thresholds. In particular, stakeholders have asserted that the current LPE framework makes it difficult for state air permitting programs and other state regulatory requirements to satisfy EPA's criteria, thereby causing more storage tanks and other emission units to remain subject to Subpart OOOOb requirements than would otherwise be the case. EPA now requests comment on whether its current interpretation of LPE is overly restrictive and whether alternative approaches would better account for the manner in which state permitting and regulatory programs are administered and enforced. The request is significant because a broader interpretation of LPE could allow a wider range of federally enforceable state permits and regulatory requirements to satisfy exemption criteria under OOOOb, potentially reducing the number of storage tanks and other sources subject to direct NSPS regulation. As a result, the LPE issue has implications that extend beyond compliance mechanics and could materially affect the scope of sources regulated under the federal methane program. V.    Revised Requirements for Marginal Wells EPA is also proposing significant revisions to the treatment of lower-producing wells under Subparts OOOOb and OOOOc. The agency notes that marginal wells constitute a substantial portion of the nation’s producing well inventory but account for a relatively small share of overall production. At the same time, EPA discusses studies estimating that marginal wells contribute a disproportionate share of methane emissions from oil and natural gas production. The agency is evaluating whether the 2024 rule appropriately accounts for the operational characteristics, emissions profiles, and compliance costs associated with these wells. To address those concerns, EPA is proposing two alternative approaches to well-site subcategorization. Under the first option, EPA would distinguish between marginal and non-marginal well sites. EPA proposes to define a marginal well as a well that produced no more than 15 barrels of oil equivalent (“BOE”) per day over the prior 12-month period and a marginal well site as a site consisting exclusively of marginal wells with total site-wide production of no more than 15 BOE per day over the same period. EPA is also soliciting comment on whether marginal wells should be further subdivided based on production levels, including a potential distinction between sites producing 6 BOE per day or less and sites producing more than 6 BOE but no more than 15 BOE per day, which could result in additional regulatory flexibility for the lowest-producing wells. Under the second option, EPA would distinguish between conventional and unconventional well sites and tailor requirements based on that classification, including reduced requirements for conventional wells. The agency is seeking comment on which framework better reflects the operational and emissions characteristics of different well sites, as well as whether additional subcategories should be established within the marginal-well population and the extent to which compliance requirements should differ among categories. VI.    LDAR, Pneumatic Controllers, Control Device Monitoring, and Facility Modifications EPA's proposal also includes several targeted revisions to the 2024 rule's leak detection and repair (“LDAR”) requirements. Most notably, EPA proposes additional flexibility in the use of advanced monitoring technologies and seeks to move away from compliance frameworks that rely heavily on a single detection method. The agency is proposing changes intended to facilitate the use of multiple monitoring technologies, including optical gas imaging and other alternative detection approaches, and is seeking comment on whether technology-neutral compliance options can achieve equivalent emissions reductions at lower cost. EPA also proposes revisions for components and equipment that are particularly difficult to monitor using conventional LDAR methods, reflecting concerns that certain 2024 requirements may not be practical or cost-effective in the field. More broadly, EPA questions whether some of the monitoring frequencies adopted in 2024 appropriately balance compliance burdens and emissions-reduction benefits and seeks comment on additional opportunities to tailor LDAR obligations based on emissions risk and source characteristics. EPA also proposes technical revisions to requirements governing control devices and related equipment. These include changes addressing continuous pilot-flame requirements, flame-monitoring data deviations, control-device alerts, visible-emissions test conditions, temporary or backup control devices, temporary process controllers, and control-device categories. The agency’s stated objective is to provide additional compliance flexibility while maintaining appropriate emissions controls. The practical effect will depend on the final requirements and the equipment and circumstances to which each amendment applies. The proposal also addresses pneumatic controllers and equipment leaks at gas processing plants. For certain high-pressure process controllers at transmission compressor stations, EPA proposes a separate regulatory approach based on its reassessment of technical feasibility and cost. The proposal should not be read as establishing a general exemption for pneumatic controllers across the industry. EPA also proposes changes to other equipment-specific requirements, including requirements applicable to pumps, storage vessels, and equipment leaks at gas plants, in response to concerns raised following promulgation of the 2024 rule. Finally, EPA proposes changes to certain requirements governing liquids unloading and other well-site operations, as well as technical corrections and clarifications to the existing regulatory text. These provisions form part of EPA’s broader effort to address implementation concerns and reassess the costs and expected emissions reductions associated with selected requirements in the 2024 rule. Operators should evaluate the specific proposed amendments applicable to their facilities rather than assume that the proposal would provide across-the-board relief from existing monitoring, equipment, or control-device obligations. VII.    Implications for States and Future Congressional or Administrative Action EPA’s proposal would substantially revise several consequential elements of the 2024 methane rule, but it would not eliminate regulation of existing oil and natural gas sources under Clean Air Act § 111(d). As a result, states remain subject to the existing obligation to develop and submit plans for existing sources. If the proposed revisions are finalized, states currently developing those plans may need to reevaluate key program elements, including requirements relating to associated gas, well-site subcategories, the Super Emitter Program, and other compliance obligations. The proposal does not itself extend the January 22, 2027 deadline for state-plan submissions established under the existing framework. The Congressional Review Act (“CRA”) remains a potential source of uncertainty. Depending on when EPA submits a final rule to Congress and the applicable congressional-session timing, a future Congress and President could seek to disapprove the rule under the CRA. A successful disapproval would invalidate the rule and generally restrict the agency from issuing a rule in substantially the same form absent subsequent statutory authorization. The CRA’s lookback provisions can affect the period during which a rule remains subject to congressional review, so the risk cannot be assessed solely by reference to the calendar year in which the rule is finalized. The timing of finalization and submission to Congress, together with the applicable congressional calendar, will determine the extent of that exposure. Finally, unlike the CRA, which can nullify a recently promulgated rule through legislative action, a future administration seeking to unwind this rule would generally need to proceed through a new notice-and-comment rulemaking. EPA would need to revisit the underlying BSER determinations, cost analyses, technical feasibility findings, and enforceability conclusions that support the final rule. Because this proposal is grounded heavily in findings regarding achievability, legal and practical enforceability, and cost-effectiveness, a future administration would need to develop a sufficient record supporting different conclusions before reinstating more stringent requirements. Consequently, the final rule may prove more durable than prior pendulum swings, even if it remains politically controversial.

Insights

Minnesota Consumer-Fraud Enforcement: Disclaimers Won’t Cure Deception, and Penalties Can Add Up

Misleading advertising claims can lead to costly consequences. In State of Minnesota ex rel. Ellison v. Wall & Associates, Inc., No. A25-2064, 2026 WL 3118291 (Minn. App. Oct. 19, 2026), the Minnesota Court of Appeals recently affirmed a bench trial verdict against a tax-relief company and two executives for violations of the Minnesota Consumer Fraud Act (“MCFA”) and the Minnesota Deceptive Trade Practices Act (“MDTPA”). The decision, which affirmed a substantial restitution and civil penalty judgment, underscores the broad power of the Minnesota Attorney General to act against deceptive sales practices. The decision also offers practical lessons for businesses seeking to reduce liability risks in consumer-facing communications. Background Wall & Associates (“W&A”), a Virginia-based tax-relief company, marketed assistance to taxpayers seeking relief from outstanding federal and state tax liabilities, often with offers in compromise—agreements to settle tax liabilities for less than the amount owed. In its extensive advertising campaigns, W&A represented that its average client received a 90% reduction in their tax debt, that it was a local company with Minnesota offices, that it provided legal services, and that it would “Solve ALL Tax Problems.” In reality, W&A’s promises bore little resemblance to what many clients received. Most of W&A’s clients saw just a 9.5% reduction in federal tax debt and 1.2% in state tax debt. W&A had no permanent Minnesota offices. And W&A provided neither legal representation nor assistance with filing tax returns—those services required referrals to separate firms for an additional fee. All the while, W&A clients paid upfront and recurring fees, including during periods when W&A did no work on their cases. Minnesota Attorney General Keith Ellison sued W&A, its founder and owner Ernest Kenneth Wall, and its president and CEO Patrick Mark Yates, alleging violations of, among other laws, the MCFA and the MDTPA. Following a 12-day bench trial, the district court determined that W&A violated the MCFA and MDTPA through its false and embellished advertising. The district court also held Wall and Yates individually liable for those violations because they directed, participated in, and acquiesced in the violations. The district court ordered injunctive relief, $2.7 million in restitution (with Wall and Yates jointly and severally liable for $1.3 million), and civil penalties of $786,517 against W&A, $415,500 against Wall, and $207,750 against Yates. The district court also awarded over $2.5 million in attorneys’ fees and costs to the state. W&A, Wall, and Yates appealed to the Minnesota Court of Appeals, which affirmed the district court’s decision on October 19, 2026. Although W&A, Wall, and Yates challenged the judgment on numerous grounds, several highlights of the decision provide important takeaways for consumer-facing businesses. Individual Reliance Is Not Required for Statutory Liability W&A argued that Attorney General Ellison had to prove a causal nexus between each violation of the MCFA and MDTPA and the injury to a particular consumer to establish liability. In W&A’s view, this required proof that each injured consumer had personally relied on W&A’s false representation. The Court of Appeals rejected this argument based on the MCFA’s and MDTPA’s plain language, which requires no proof of actual deception or confusion by consumers. The Court of Appeals finally pointed to the Minnesota Supreme Court’s decision in State v. Minnesota School of Business, Inc., which held that when a defendant’s misrepresentations are directed at and affected “a broad group of consumers, proof of direct individual reliance is not required to establish a causal nexus between MCFA violations and the harm suffered by consumers.” 935 N.W.2d 124, 135 (Minn. 2019). The Court of Appeals affirmed, however, that a causal nexus is necessary to support an award of damages under the MCFA and MDTPA. In making that determination, district courts look to various factors, including whether the misrepresentations were “longstanding, pervasive, and widespread in communications directed to consumers,” whether the seller intended and understood that consumers would rely on the misrepresentations, and whether the information was of a kind on which consumers would typically rely. The Court of Appeals’ decision continues Minnesota School of Business’s broad interpretation of liability under the MCFA and the MDTPA. Coordinated marketing campaigns to a “broad group of consumers” may expose businesses to MCFA and MDTPA liability without customer-by-customer proof of injury. That said, a causal nexus remains an element of an MCFA and MDTPA claim, and businesses involved in litigation should build a clear record at trial and on appeal showing how each of the relevant factors bears on the causal-nexus inquiry. Contractual Disclaimers Are Not an Automatic Defense to a Misleading Pitch W&A next argued that disclaimers in its client contracts prevented consumers from claiming they had been misled by its advertising. Reiterating that individual reliance is not required under the MCFA and MDTPA, the Court of Appeals held that a contractual disclaimer does not necessarily defeat a claim based on a conflicting oral representation. And on the facts of this case, the Court of Appeals agreed with the district court that W&A’s contractual disclaimers were insufficient given the extensive misrepresentations by W&A and the unequal bargaining power between it and its customers. This holding confirms that contractual disclaimers are not a cure-all for misleading advertising or sales practices. Businesses should review the entire customer journey, including pre-contract representations, as those representations may survive a contractual disclaimer to the contrary. And if faced with litigation, businesses should build a strong record, both at trial and on appeal, showing why any disclaimer is effective in context. The State Has Broad Authority to Seek Restitution W&A also challenged Attorney General Ellison’s authority to seek restitution under the state’s parens patriae authority to protect residents’ collective interests, arguing that injury to only 228 Minnesotans did not affect a sufficiently substantial segment of the population. The Court of Appeals rejected a simple headcount approach, instead explaining that the state had a legitimate interest in protecting residents’ economic well-being as a whole. In any event, the Court of Appeals held that if restitution was not appropriate under the state’s parens patriae authority, then it would still be appropriate under the Attorney General’s enforcement powers under Minn. Stat. § 8.31. The decision reinforces that the broader and more sustained the deceptive advertising, the stronger the case for restitution to protect Minnesotans’ economic interests. Civil Penalties Accrue Per Violation, Not Per Defendant The Court of Appeals finally rejected W&A’s claim that the Attorney General’s enforcement powers under Minn. Stat. § 8.31 permit only civil penalties of up to $25,000 for each defendant. Rather, the Court of Appeals explained that penalties are limited to $25,000 per violation. Multiple violations can therefore produce substantially greater penalties. The Court of Appeals also rejected the argument that restitution made penalties unnecessary: repaying consumers does not eliminate the need to address gains from deceptive conduct and deter future violations. Final Takeaways Align every consumer-facing communication. Broad and extensive marketing campaigns can expose businesses to stronger enforcement standards under the MCFA and MDTPA, making it critical that consumer communications remain accurate and consistent from the first advertisement through the final sale. Plan for layered enforcement exposure. Penalties under the MCFA and MDTPA can add up quickly: W&A, Wall, and Yates ultimately faced more than $6 million in civil penalties, restitution, and attorneys’ fees. The decision continues a line of Minnesota cases recognizing the Attorney General’s broad consumer-protection authority. Details matter. Although the Attorney General’s enforcement power is broad, it is not boundless. As the Court of Appeals explained, issues of causation, the effectiveness of contractual disclaimers, and the availability of restitution and civil penalties all turn on the specific facts of the case. Effective advocacy at trial and on appeal is critical to developing the facts relevant to liability and damages.

Insights

Observations on the SEC’s 2027 Examination Priorities

The SEC’s Division of Examinations (the “Division”) recently announced its examination priorities (“Exam Priorities”) for fiscal year 2027.1 Although many of the Division’s core areas of focus remain consistent with fiscal year 2026, the 2027 Exam Priorities include notable changes and refinements, which we discuss below, along with other key 2027 examination priorities. Dorsey Observations Renewed focus on economic conflicts of interest. After certain economic-incentive topics received less emphasis in the 2026 Exam Priorities2, the Division has again expressly identified economic conflicts as an examination focus. The 2027 Exam Priorities indicate that the Division will prioritize reviewing advisers’ fiduciary obligations relating to economic conflicts of interest raised by fee rebates, fee and expense calculations, cash management, quid pro quo arrangements, and deposits and withdrawals. Greater emphasis on private-fund practices. Building on the private-fund items in the 2026 Exam Priorities, the 2027 Exam Priorities indicate that the Division will assess private-fund disclosures and controls relating to investment allocations, leverage, affiliated service providers, and fees and expenses. The Division also identified investments in private companies through special purpose vehicles (“SPVs”) and loans provided by private funds and business development companies (“BDCs”) as products the Division will scrutinize. Advisers, particularly private-fund advisers, should evaluate whether their disclosures and compliance programs address these areas. Expanded focus on AI-related cybersecurity risks. While the 2026 Exam Priorities focused on advisers’ use of and representations regarding artificial intelligence (“AI”), the 2027 Exam Priorities specifically highlight AI-enabled cybersecurity threats, including AI-generated phishing and synthetic or “deepfake” voice and video used for social engineering. The shift signals that registrants should consider whether their cybersecurity policies and controls adequately address these evolving threats. New focus on proxy advisory firms. The 2027 Exam Priorities state that the Division will examine advisers that rely on proxy advisory firms, including how those advisers evaluate the firms’ recommendations, assess the bases for those recommendations, identify potential conflicts of interest, and determine whether that reliance satisfies applicable legal obligations. Advisers that rely on proxy advisory firms may wish to consider whether their compliance programs address these areas. Updated focus on Regulation S-P and Regulation S-ID. The 2026 Exam Priorities stated that the Division would engage firms during examinations regarding their progress in preparing incident response programs ahead of the compliance dates for the amendments to Regulation S-P and would examine compliance with the amended rule after those dates. The 2027 Exam Priorities indicate that examinations will focus on whether firms have developed, implemented, and maintained reasonably designed policies and procedures addressing administrative, technical, and physical safeguards to protect customer information and that, in accordance with the amended rule, staff will evaluate response program policies and procedures for unauthorized access to or use of customer information, including customer notification procedures and oversight of service providers. With respect to Regulation S-ID, the 2027 Exam Priorities indicate that examiners will assess whether firms are updating their Identity Theft Prevention Program to address emerging risks, such as those related to AI and stolen credentials. Advisers may wish to consider whether their compliance programs address these areas, as applicable. Summary of Other 2027 Examination Priorities Beyond the developments discussed above, many of the Division’s core examination priorities remain consistent with fiscal year 2026. These include investment adviser fiduciary obligations and compliance programs, examinations of never-examined and recently registered advisers, and cybersecurity and operational resiliency. The Exam Priorities are not exhaustive, and examinations will vary based on each registrant’s business, activities and risks. Advisers should consider the 2027 Exam Priorities in reviewing their compliance programs and preparing for potential examinations, including by: Reviewing risk disclosures and controls. The Division states that, when examining advisers to private funds, it will assess whether investment-related risk disclosures are consistent with fiduciary standards and whether compliance policies, procedures, and controls are designed to address both fund-level and investment-level risks. Reviewing disclosures on allocations, leverage, and affiliated service providers. The 2027 Exam Priorities identify disclosures related to certain investments and allocations, the use of debt and fund-level lines of credit, and the use of affiliated service providers as examples. Confirming the accuracy of fee and expense calculations. The Division states that it will assess the accuracy of fee and expense calculations at both the fund and investment levels, and it identifies fee rebates, cash management, quid pro quo arrangements, deposits, and withdrawals as areas in which economic conflicts of interest may affect the impartiality of advice. Reviewing recommendations of illiquid or hard-to-trade products. The Division states that it will prioritize advisers that recommend products that are difficult to trade, have unusual features, or are illiquid, including loans provided by private funds or BDCs and investments in private companies through SPVs. Confirming that the compliance program is implemented and reviewed. The Division states that it will review compliance program components such as marketing, valuation, and custody, as appropriate, and will typically analyze the annual compliance review. It will also focus on compliance practices when advisers have started advising new asset classes or clients or grown through mergers or acquisitions. 1 SEC Division of Examinations 2027 Examination Priorities. 2 See Dorsey’s Client Alert on the SEC’s fiscal year 2026 exam priorities.

News

Dorsey & Whitney Advises Beijing Xunzhong on Two Consecutive H Share Placings Raising HK$418.5 Million

International law firm Dorsey & Whitney LLP acted as Hong Kong legal advisors to Beijing Xunzhong Communication Technology Co., Ltd. (“Xunzhong”) as to Hong Kong law in connection with two consecutive placings of new H shares under general mandate (the “First Placing” and the “Second Placing”, respectively, and together, the “Placings”). Xunzhong’s H shares are listed on the Main Board of the Hong Kong Stock Exchange (Stock Code: 2597). Winbull Securities International (Hong Kong) Limited acted as sole overall coordinator and placing agent on both Placings. The First Placing of 11,190,000 new H shares at HK$28.20 each was completed on September 17, 2026, followed by the Second Placing of 3,550,000 new H shares at HK$29.00 each on October 30, 2026. The Placings raised approximately HK$315.56 million and HK$102.95 million in gross proceeds, respectively, or approximately HK$418.51 million in aggregate (approximately HK$415.96 million in aggregate net proceeds). Both Placings were conducted under the same general mandate granted by shareholders at Xunzhong’s 2025 annual general meeting, and each was completed within one week of the signing of its placing agreement. Completing placings in consecutive months is relatively uncommon in the Hong Kong market, and doing so called on the technical depth of Dorsey’s Hong Kong Capital Markets team. Working closely with Xunzhong to understand its business needs and prepare the transaction documents, the team addressed in quick succession the remaining capacity under the general mandate, disclosure of the use of proceeds and the maintenance of Xunzhong’s public float, enabling both Placings to be completed seamlessly. “We are pleased to have advised Xunzhong on both Placings,” said Rachel Han, Partner and Co-Head of Dorsey’s Asia Capital Markets practice. “We appreciate the trust placed in our team and the close collaboration among all parties involved. We look forward to supporting Xunzhong as it continues to execute its growth strategy and pursue future capital markets opportunities.” Xunzhong is principally engaged in cloud-based communications services and enterprise digitalization services in the PRC. As disclosed in its announcements, the net proceeds of the First Placing are allocated to developing Xunzhong’s new computing power operation services business, while those of the Second Placing will be used to integrate model-as-a-service (MaaS) and AI agent capabilities into its existing cloud communications platform-as-a-service (PaaS) platform and software-as-a-service (SaaS) products. Approximately 55% of the net proceeds of the Second Placing will be used for computing power equipment upgrades for the MaaS system, approximately 35% for MaaS, PaaS and SaaS platform upgrades, and approximately 10% for working capital and general corporate purposes. With a single MaaS platform and shared computing power supporting its PaaS and SaaS offerings, Xunzhong intends for its MaaS, PaaS and SaaS capabilities to complement and reinforce one another, and to address customer needs from multiple angles, from embedding AI in customer communications and business workflows to maintaining stable performance at scale and keeping customer data within controlled environments. Partner and Co-Head of Dorsey’s Asia Capital Markets practice Rachel Han and Of Counsel in the Capital Markets and Corporate Compliance group Carlton Ng, along with Associate Kristy Ting, led the Dorsey Hong Kong Capital Markets & Corporate Compliance group in advising Xunzhong on both Placings.