July 26, 2016 By Christopher Burgess 3 min read

Every country has its own rules and regulations, and companies engaging in international business will undoubtedly encounter multijurisdictional compliance issues. Companies with offices in multiple countries will be exposed to even more multijurisdictional compliance issues, which sometimes turn into conundrums.

This conflict can be mitigated, but it cannot be ignored.

Multijurisdictional Compliance in the U.S.

In the U.S., there is a plethora of rules and regulations surrounding the conduct of commerce. When doing business abroad, a U.S. company must observe both domestic regulations and those of the country in which it plans to do business.

For example, companies that develop advanced technologies, such as encryption devices or methodologies, should fully understand the ramifications of the Department of State’s International Traffic in Arms Regulations (ITAR) and Arms Export Control Act (AECA), as well as the Department of Commerce’s Export Administration Regulation (EAR), which regulates the export of technologies prior to sharing them with national employees or business partners from other countries.

Similarly, the Department of Justice’s Foreign Corrupt Practices Act (FCPA) comes into play for every company or person who conducts commerce within the U.S. With respect to the FCPA, the anti-bribery provision is especially important to understand.

Organizations from foreign countries doing business in the U.S. must comply with the U.S. International Trade Commission’s Sec. 1337 – Unfair practices in import trade so as not to run afoul of import regulations. According to the USITC, there have been more than 25 complaints in the past 90 days of unfair business practices by foreign entities.

Compliance Abroad

Companies conducting business abroad should be mindful not only of the laws and regulations of the U.S., but also those of the country in which they wish to operate. For example, companies operating in the European Union must handle data derived from customer engagement and employee information in accordance with EU privacy laws. This may require separating European data from U.S. data as different laws and regulations come into play.

Multijurisdictional compliance issues may also arise when a company attempts to transfer an individual from one foreign office to another. Is this individual eligible to work in the destination country? Will a special work visa be possible? A company’s desire to transfer the best employee for the job may be upended by the rules and regulations of the particular country. Thus, every entity must understand the legal requirements for the entire employee workforce in each locale, including the U.S.

Awareness and Education

Even after navigating the maze of regulations, companies must take cultural differences into account. Business practices differ from one locale to another, as do the cadence and manner in which commerce is conducted.

These cultural differences may, as noted above, place employees or companies in ethical dilemmas. Companies can avoid the FCPA and minimize ethical conflict by training employees to recognize the nuanced differences between the business methodologies and cultural mannerisms of different countries.

Once it obtains permission from the Department of State and Department of Commerce to share advanced technologies with a specific entity or person abroad, the company must educate its custodians that this permission does not extend beyond the specifics. If a company shares this data in an email to all members of a global team when the permission was for only the members of the team in a specific locale, it may find itself in a noncompliant status.

In 2012, for example, the Department of State announced that a company in the U.S. and its Canadian subsidiary were fined $75 million for the unauthorized disclosure of technology to a foreign government. On June 20, a separate U.S. company was fined $100,000 for violation of ITAR and AECA when it allowed technology to be obtained by an individual from a proscribed country. The individual was an employee of the company but was of a nationality that was proscribed from accessing the data due to its classification as advanced technology.

In both of these instances, the companies were found to be noncompliant even though the data was only accessed by company employees. Thus, it behooves all companies to understand the 360-degree compliance matrix when dealing with export regulations. Business practices, data access, privacy and ethics will go a long way toward keeping the train of commerce squarely on the rails.

More from CISO

Empowering cybersecurity leadership: Strategies for effective Board engagement

4 min read - With the increased regulation surrounding cyberattacks, more and more executives are seeing these attacks for what they are - serious threats to business operations, profitability and business survivability. But what about the Board of Directors? Are they getting all the information they need? Are they aware of your organization’s cybersecurity initiatives? Do they understand why those initiatives matter? Maybe not. According to Harvard Business Review, only 47% of board members regularly engage with their CISO. There appears to be a…

The evolution of 20 years of cybersecurity awareness

3 min read - Since 2004, the White House and Congress have designated October National Cybersecurity Awareness Month. This year marks the 20th anniversary of this effort to raise awareness about the importance of cybersecurity and online safety. How have cybersecurity and malware evolved over the last two decades? What types of threat management tools surfaced and when? The Cybersecurity Awareness Month themes over the years give us a clue. 2004 - 2009: Inaugural year and beyond This early period emphasized general cybersecurity hygiene,…

C-suite weighs in on generative AI and security

3 min read - Generative AI (GenAI) is poised to deliver significant benefits to enterprises and their ability to readily respond to and effectively defend against cyber threats. But AI that is not itself secured may introduce a whole new set of threats to businesses. Today IBM’s Institute for Business Value published “The CEO's guide to generative AI: Cybersecurity," part of a larger series providing guidance for senior leaders planning to adopt generative AI models and tools. The materials highlight key considerations for CEOs…

Bringing threat intelligence and adversary insights to the forefront: X-Force Research Hub

3 min read - Today defenders are dealing with both a threat landscape that’s constantly changing and attacks that have stood the test of time. Innovation and best practices co-exist in the criminal world, and one mustn’t distract us from the other. IBM X-Force is continuously observing new attack vectors and novel malware in the wild, as adversaries seek to evade detection innovations. But we also know that tried and true tactics — from phishing and exploiting known vulnerabilities to using compromised credentials and…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today