A recap of practical insights after the WBA’s August 19, 2026 International Law Forum event, “Navigating Cross-Border M&A Trade Diligence: Export Controls, Sanctions, CFIUS, and Other High-Stakes Risks”
Cross-border deals used to treat trade compliance as a closing-checklist item — a box to check somewhere in the disclosure schedules or after. That approach no longer works. Export control rules, sanctions programs, and national security review requirements now shape deal terms, timelines, and pricing from the earliest conversations with a target.
L-R: Gaela Gehring Flores, 2016 WBA President Susan Kovarovics, moderator and WBA International Law Forum cochair Lisa Lyhyun Park, Michelle Heisner, and 2025 WBA President Jennifer Kies Mammen
The Women’s Bar Association of DC, with the DC Bar and American Bar Association, recently sponsored a panel discussion at Akin Gump Strauss Hauer & Feld LLP in which five practitioners Michelle Heisner (Baker Donelson), Gaela Gehring Flores (Hughes Hubbard Reed), past WBA presidents Susan Kovarovics (Akin) and Jennifer Kies Mammen (BCLP), and moderator and WBA International Law Forum cochair Lisa Lyhyun Park (HaystackID) shared the practical lessons they see in M&A trade due diligence.
Here are eight of the strategies they recommended for conducting due diligence in M&A cross-border deals.
1. Map Your Foreign Footprint Early
Trade compliance risk — including exposure under U.S. sanctions promulgated by The Office of Foreign Assets Control (OFAC) and export controls regulated under Export Administration Regulations (EAR) and International Traffic in Arms Regulations) (ITAR) — extends to non-U.S. entities through U.S. content, U.S. person involvement, or Foreign-Direct Product Rules. When foreign target operations create successor liability for a U.S. buyer, parties must manage this exposure across diligence, contracting, disclosure, and post-closing integration:
Tailor Diligence to Foreign Footprints: Identify U.S. origin items, trace foreign-made products for de minimis U.S. content and products captured under the foreign-direct product rules, identify items made under ITAR export authorization agreements, such as Technical Assistance Agreements (TAA) or Manufacturing License Agreements (MLA), audit non-U.S. operations to ensure U.S. personnel/companies are not involved in or facilitating prohibited transactions, and run 10-year look back audits on export classifications, shipping records, and third-party distributor networks.
Practical Takeaway: Involve trade counsel to build foreign-footprint screening into the diligence request list from day one — don’t wait for a red flag to prompt the deeper look.
2. Build a Voluntary Disclosure and Safe Harbor Strategy
When diligence turns up a violation, parties generally have a few avenues for disclosure, each with different trade-offs for timing, certainty, and how risk is allocated between buyer and seller. The DOJ’s Safe Harbor Policy adds its own timing pressure on top of that choice, since its self-disclosure and remediation clocks start running at closing regardless of which avenue the parties pick.
Formulate a Voluntary Self-Disclosure (VSD) Strategy: In the event diligence identifies violations, determine whether to condition closing on a seller-led VSD (maximizing legal certainty but risking deal delay) or proceed with a buyer-led post-closing VSD backed by robust purchase price adjustments and escrows to secure penalty mitigation from OFAC or the U.S. Department of Commerce’s Bureau of Industry and Security (BIS). A middle ground may be to file an initial notice of voluntary disclosure before closing under seller’s watch file the full disclosure report post-closing with buyer and seller collaboration.
Trigger the Safe Harbor Clock at Closing: Under the Department of Justice (DOJ)’s M&A Safe Harbor Policy, self-disclose immediate risks right away and otherwise complete the 180-day self-disclosure and one-year remediation clock — both running from closing, regardless of whether the misconduct surfaces pre- or post-close.
Practical Takeaway: Decide your disclosure posture — seller-led VSD, buyer-led post-closing VSD, or a split approach — before closing, and make sure the Safe Harbor clock start date is unambiguous in the agreement.
3. Issue-Spot by Technology, Not by Industry
The single biggest diligence mistake is screening a target by its industry label instead of the technology it actually touches. A company’s SIC code or marketing description says nothing about whether its products trigger export controls or review by Committee on Foreign Investment in the U.S. (CFIUS, the interagency body reviewing foreign investment for national security risk) — that turns on the underlying technology, wherever it shows up in the business. While foreign investment regulators currently focus on a fairly identifiable set of technology categories, export control exposure extends much broader than this specific list to cover a wide array of commercial items, software, components, and technical data.
Regardless of what industry the target claims to be in, deal teams should screen for both overall export control exposure and these key target categories:
- Artificial intelligence and machine learning
- Semiconductors and advanced computing
- Biotechnology
- Quantum computing and related sensing or communications technology
- Critical minerals and raw materials
- Defense and dual-use hardware — components with both civilian and military applications, even when sold into a civilian market
An ordinary-sounding target — manufacturing, logistics, even agriculture — can still trip these categories if it uses, produces, or handles the underlying technology. Screening by technology first, before mapping the finding back to industry, catches exposure an industry-only checklist misses.
Practical Takeaway: Screen by technology first, then map back to industry — an industry-only checklist will miss exposure hiding in an ordinary-sounding target.
4. CFIUS Now Cuts Both Ways — Inbound and Outbound
National security reviews now heavily impact both inbound and outbound cross-border capital. Inbound, CFIUS fast-tracks allied capital while strictly scrutinizing or blocking adversary-tied investments in critical sectors like AI, defense, and semiconductors. Outbound, the Department of Treasury’s “reverse CFIUS” program restricts or requires notification for U.S. investments touching sensitive technologies in countries of concern.
Crucially, while enforcement expectations are high, final reverse CFIUS regulations must take effect by early 2027 (specifically March 2027 under the Comprehensive Outbound Investment National Security Act of 2025 COINS Act).
Practical Takeaway: Involve CFIUS counsel during the letter-of-intent stage rather than post-signing. Factoring in the CFIUS and reverse CFIUS review periods is essential when structuring the closing timeline—a process that typically takes 45 to 90 days from signing, causing clients far more timeline anxiety than cost concern.
5. Dual-Use and Supply-Chain Exposure Hides in the Middle Market
Export controls impact far more than defense contractors. Middle-market companies routinely handle dual-use technologies without realizing they might require export licenses based on export classification, leading diligence teams to demand specific item classifications over generic compliance representations.
Concurrently, restrictions under the CHIPS and Science Act regarding “foreign entities of concern” are driving supply chain representations. Deal teams must evaluate whether supply chain monitoring covenants offer genuine protection against drift or merely shift unmanageable risk onto the seller.
Practical Takeaway: Push for specific item classifications in reps, not generic compliance language, and pressure-test whether supply-chain monitoring covenants actually protect the buyer or just shift risk to the seller.
6. Timing a Disclosure Can Matter More Than the Disclosure Itself
Separate from the regulatory VSD decision, deal teams also face a timing question with the counterparty itself: when to disclose a known violation in the transaction documents. When diligence uncovers an undisclosed export violation, deciding when to disclose is the primary challenge. Disclosing before signing prevents buyers from claiming a later breach, while relying on general representations exposes sellers to indemnification claims if the issue surfaces post-closing. Because many middle-market sellers lack thorough trade classification programs and remain unaware of violations, clear framing in disclosure schedules avoids misrepresentation claims and yields a cleaner result for both parties.
Practical Takeaway: Get ahead of disclosure timing early — a well-framed disclosure schedule up front is usually cheaper than an indemnification fight later.
7. R&W Insurance Has Real Limits on Sanctions Risk
Representations and warranties (R&W) insurance is not a blanket backstop for sanctions risk. Underwriters treat formal sanctions designations and actual violations differently, and some exclude specific jurisdictions entirely. Deal teams should confirm exact policy exclusions for non-U.S. targets with brokers rather than assuming the policy will cover post-closing sanctions liabilities.
Practical Takeaway: Don’t assume the R&W policy covers sanctions exposure — confirm exact exclusions with the broker before relying on it in deal structure.
8. To Minimize the Risk of Later Disputes, Loop in Arbitration Counsel Early
Force majeure and sanctions clauses often intersect in arbitration, where proving an unforeseeable, uncaused event depends heavily on the governing law and seat. This grows more complex when state entities are involved—common in critical minerals and infrastructure deals—as international investment law may override commercial contract law, creating unpredictable outcomes without clear liquidated damages terms. Involving arbitration counsel before finalizing these provisions allows clients to manage this risk upfront.
Practical Takeaway: Loop in arbitration counsel before finalizing force majeure and dispute provisions, especially where a state entity or cross-border seat is involved.
The Takeaway
None of these issues is new in isolation. What has changed is how early they now surface in a deal’s lifecycle, and how directly they shape price, timing, and structure rather than sitting in a closing condition nobody expects to matter. Deal teams that bring trade, CFIUS, and arbitration expertise into the room at the term sheet stage — instead of after diligence findings force the issue — are better positioned to close on schedule and with fewer surprises.
Get Involved: Email the WBA’s International Law Forum at internationallaw@wbadc.org to learn about upcoming programming, or sign up for the WBA newsletter for event announcements.
About the Author
Lisa Park
Lyhyun Lisa Park is a trilingual attorney with a background in corporate and project finance, focused on shipping, energy, and infrastructure, with particular experience in AML, sanctions, and CFIUS review. She previously worked at Korea Development Bank, KfW IPEX-Bank, and Kutak Rock LLP. She holds an LL.B. from Ewha Womans University, an M.A. in Finance from Frankfurt University, and an LL.M. from GW Law School, and serves as Co-Chair of the International Law Forum of the Women’s Bar Association of DC.
The views expressed in this article are those of the author(s) and do not necessarily reflect the views of the Women’s Bar Association of the District of Columbia. This article is for informational purposes only and does not constitute legal advice.