Insights

On April 11, 2025, the U.S. Department of Justice (DOJ) issued guidance regarding the implementation and enforcement of the newly enacted final rule, “Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons,” now referred to as the Data Security Program (DSP). The release included an Implementation and Enforcement Policy, a Compliance Guide, and Frequently Asked Questions (FAQs). Collectively, these documents are designed to help entities subject to the DSP understand and comply with the obligations set out under the Final Rule.

On April 15, 2025, the White House issued an Executive Order (“EO”), “Restoring Common Sense to Federal Procurement” calling for the reform of the Federal Acquisition Regulation (“FAR”) consistent with the aims of EO 14192, “Unleashing Prosperity Through Deregulation,” which sought to eliminate perceived unnecessary regulatory burdens. Specifically, the April EO notes that the FAR should only contain statutorily required provisions or those “essential to sound procurement,” and it recommends the removal of any FAR provisions that do not advance these objectives.

Foreign Corrupt Practices Act (“FCPA”) enforcement has been fairly predictable for many years as the Fraud Section of the Department of Justice (“DOJ”) has maintained exclusive authority over investigating claims and bringing enforcement actions in federal courts across the country. President Trump’s recent pause on FCPA enforcement, the first of its kind since the statute was passed in 1977, has created significant uncertainty for individuals and businesses operating internationally regarding the future of FCPA enforcement. While DOJ is in the process of assessing what the future of FCPA enforcement, state attorneys general are stepping in. On April 2, California Attorney General Rob Bonta issued a Legal Advisory (the “Advisory”) to California businesses explaining that violations of the FCPA are actionable under California’s Unfair Competition Law (UCL). The announcement signals a shift in FCPA enforcement where states may take the lead and pursue FCPA enforcement through their state unfair competition laws.

On April 7, 2025, the Defense Contract Audit Agency (DCAA) announced agency reorganization plans aimed at reducing the number of field offices and centralizing audit operations. DCAA plans to close 40 smaller audit suboffices around the country, many staffed with fewer than 10 personnel, to reduce the costs of associated leases. The agency will also consolidate the existing Region Audit Directorates for the Eastern, Central and Western Regions and four Corporate Audit Directorates (CADs), located proximate to large contractors, into three new Directorates—Land, Sea, and Air. The audit offices of the CADs will be merged into the new Directorate that most closely aligns with a contractor’s product. DCAA’s announcement states that the organizational restructuring will be completed by September 30, 2025. The full text of the announcement is available here.

This news bulletin is provided by the International Trade Group of Crowell & Moring. If you have questions or need assistance on trade law matters, please contact Jana del-Cerro, Anand Sithian, or Simeon Yerokun or any member of the International Trade Group.

On April 2, 2025, the U.S. Supreme Court extended the reach of Section 1964(c) of the Racketeer Influenced and Corrupt Organizations (RICO) Act by holding that a plaintiff may seek treble damages for a business or property loss resulting from a personal injury.[1] The 5-4 decision has resolved a 3-2 circuit split over whether the RICO statute precludes relief for losses stemming from a personal injury.

Most protests involve competitive procurements and the many rules governing how agencies are to conduct such procurements. In certain circumstances, agencies are permitted to bypass some of these rules and limit competition. But, as GAO noted in a recently issued sustain decision, the authority to use noncompetitive procedures does not provide the agency carte blanche.

In its first healthcare proposed regulation, the Trump Administration, through the Centers for Medicare & Medicaid Services (CMS), displayed on March 10, 2025, a proposed rule titled, “2025 Marketplace Integrity and Affordability Proposed Rule” (the Proposed Rule), which proposes policy changes for the Health Insurance Marketplaces that impact health plans and insurers offering Affordable Care Act (ACA) coverage to consumers. Specifically, the Proposed Rule shortens the Annual Open Enrollment Period (OEP) for all individual market coverage; proposes standards related to income verification for Health Insurance Marketplaces (Marketplaces); modifies eligibility redetermination procedures; and eliminates eligibility for “Deferred Action for Childhood Arrivals” (DACA) recipients, among other provisions.  

The settlement approval hearing in In re College Athlete NIL Litigation, No. 4:20-cv-03919 (N.D. Cal.) is set for April 7, 2025. Commonly known as the “House Settlement,” the pending resolution between plaintiffs and the NCAA, if approved by Judge Claudia Wilken, could have far-reaching implications for higher education NCAA-member institutions and student-athletes.

Those familiar with the supplier and buyer contracting realm will have likely heard of a “requirements contract” or a “blanket purchase order” which essentially allows parties to mutually guarantee that they will buy and sell to each other for a specific period of time, but lets the parties figure out the exact amount of a product later, often on an order-by-order basis. This approach is often favored for its reliability in knowing your supply needs are met (or you have a reliable buyer), while letting the supply move up or down based on real and variable demand. These arrangements are particularly prevalent in supply agreements in the automobile industry.

When a company learns that it may wind up as a defendant in a multidistrict litigation (or MDL), it may initially feel like a disaster. Between expensive, drawn out, and complicated legal proceedings and the possibility of outsized damages and company-threatening liability, it is difficult to imagine the upside. However, MDLs may not be as unfavorable a forum for defendants as they initially seem.

On March 27, 2025, the Department of Justice Antitrust Division launched an Anticompetitive Regulations Task Force (the “Task Force”) designed to identify and eliminate state and federal laws and regulations that are deemed to hinder free market competition. The Task Force will bring together attorneys, economists, and other staff from across the Division and interagency partners, and its target sectors include the transportation, healthcare, energy, food & agriculture, and housing industries.

On March 26, 2025, the Department of Justice (DOJ) announced that defense contractor MORSECORP Inc. (MORSE) will pay $4.6 million to settle allegations that MORSE violated the False Claims Act (FCA) by failing to comply with cybersecurity requirements and subsequently submitting false or fraudulent claims for payment in its contracts with the Departments of the Army and Air Force. This is the first FCA settlement that is based on a defense contractor’s failure to reevaluate and promptly update its self-assessment score in the Supplier Performance Risk System (SPRS) after a third-party assessment resulted in a lower score.

On March 13, 2025, the United States Court of Appeals for the Federal Circuit issued a decision about Patent Term Extensions (PTEs) under the Hatch-Waxman Act for reissue patents. In Merck Sharp & Dohme B.V. v. Aurobindo Pharma USA, Inc. (No. 2023-2254), the Court confirmed that the PTE provision under 35 U.S.C. § 156 refers to the original patent’s issue date, not the reissue patent’s issue date. Thus, the issue date of the original patent should be used when calculating the extension period.

On March 12, 2025, the Government of Canada announced plans to launch the Canadian Program for Cyber Security Certification (CPCSC). CPCSC is a cybersecurity compliance verification program that aims to protect sensitive unclassified government information handled by Canadian government contractors and subcontractors within Canada’s defense sector. Canada will roll out CPCSC to contractors in four phases, with the first phase launching this month.

On March 27, 2025, HHS announced a “dramatic restructuring” of its various agencies and offices in accordance with President Trump's Executive Order, “Implementing the President’s ‘Department of Government Efficiency’ Workforce Optimization Initiative.” HHS also published a Fact Sheet.

Since December of last year, the status of the CTA has been in a state of perpetual flux, following a dizzying series of federal court rulings and FinCEN announcements. On February 28, 2025, we reported that FinCEN paused enforcement actions for entities required to report under the CTA’s Beneficial Ownership Information Reporting Rule (BOI Rule) until FinCEN issued an interim final rule providing new guidance regarding the BOI Rule’s requirements and associated deadlines. Then, on March 2, 2025, Treasury went a step further, indicating that it would altogether cease enforcement against U.S. citizens and domestic reporting companies for violations of the BOI Rule, explaining that it would instead issue proposed rulemaking to narrow the scope of the BOI Rule to “foreign reporting companies” only and set new reporting deadlines. 

On March 20, 2025, Florida Attorney General James Uthmeier announced an investigation into whether two leading proxy advisors’ advice involving the consideration of Environmental, Social, and Governance (ESG) and Diversity, Equity, and Inclusion (DEI) constitutes deceptive or unfair trade practices under Florida law or a violation of Florida antitrust law.

Despite other sweeping changes to the federal government under the Trump administration, the Modernization of Cosmetics Regulation Act of 2022 (MoCRA), passed under former President Biden, remains good law. Below, we report on recent trends in FDA’s implementation and enforcement of MoCRA in the early months of Trump’s presidency.

On March 24, 2025, the Federal Risk and Authorization Management Program (FedRAMP) unveiled “FedRAMP 20x,” a proposal to make FedRAMP more efficient by automating FedRAMP security assessments and continuous monitoring, simplifying required technical controls, and leaning on industry to provide tooling and solutions to support automation.