Trade Compliance Due Diligence in M&A and Private Equity Transactions
By Ruta Riley, Founding Partner, One Lex Partners LLC. October 12, 2026.
A buyer that acquires a company's stock acquires its customs, export control, sanctions, and supply chain history, and the government has years to act on it. In an asset deal the seller generally retains liability for pre-closing customs entries, although successor liability can reach a buyer that continues the business essentially unchanged. A customs penalty action may be brought within five years of the violation, or of its discovery in a case of fraud, and a sanctions enforcement action under the International Emergency Economic Powers Act (IEEPA) within ten years. This article describes what strategic acquirers, private equity sponsors, and venture capital investors should request in each area.
The analysis applies whether the target is in the United States, Germany, or China. A non-U.S. target comes within reach of U.S. law when it handles U.S.-origin items, employs U.S. persons, is paid in dollars, or will be owned by a U.S. parent after closing. The Office of Foreign Assets Control (OFAC) has identified mergers and acquisitions (M&A) as a recurring source of sanctions violations. The sections below follow the order we use in our own reviews, including review by the Committee on Foreign Investment in the United States (CFIUS) and the Outbound Investment Security Program (OISP). Where deal counsel's firm has no trade practice, or its trade group is conflicted, outside trade counsel can conduct the review alongside the deal team.
Customs due diligence
Classification, valuation, and origin
Most customs findings involve classification, valuation, or country of origin. Where Section 232 and Section 301 duties apply to the same goods, a single error can understate both. The review should test a sample of the target's entries from the Automated Commercial Environment (ACE) maintained by U.S. Customs and Border Protection (CBP) against what was declared, with separate attention to valuation, where assists, royalties, and related-party pricing are routinely omitted. For a foreign target that ships to U.S. customers, the buyer should establish who acted as importer of record.
Antidumping and countervailing duties
The United States assesses antidumping and countervailing duties retrospectively. The final liability is fixed years after entry, so unliquidated entries are an open liability that can exceed the deposit. Whether a product falls within an order is decided by the Department of Commerce through a scope ruling, not by CBP, and a ruling that a product is covered means it has always been covered. A target importing products near the scope of an order should be asked how it has treated its entries.
IEEPA tariff refunds
Following the Supreme Court's February 2026 decision on tariffs imposed under IEEPA, CBP is refunding those duties through its Consolidated Administration and Processing of Entries (CAPE) process. CBP pays the refund to the importer of record or to the party the importer designates on CBP Form 4811. In a stock deal that is the target. In an asset deal it is the seller, unless the seller designates the buyer. The purchase agreement should state who keeps refunds on pre-closing entries and who bears the cost of claiming them, and diligence should quantify the amount, which can be material to price.
Export controls due diligence
Classification and licensing history
The review should confirm the export classification of the target's products, software, and technology and whether past exports required licenses that were never obtained. That includes exports to destinations for which the item's classification requires a license under the Commerce Country Chart of the Export Administration Regulations (EAR), and to end users and end uses the EAR restricts, including parties on the Entity List and certain military end users. A non-U.S. target needs the same review for the U.S.-origin items it reexports.
Deemed exports
The issue most often missed is technology released to foreign national employees in the United States, which the EAR treats as an export to the employee's most recent country of citizenship or permanent residency. Few targets track these releases.
Defense trade registrants
A target registered with the Directorate of Defense Trade Controls (DDTC) under the International Traffic in Arms Regulations (ITAR) must notify DDTC at least 60 days before any sale or transfer of ownership or control to a foreign person, and must report a change in ownership or control within five days after it occurs. Both dates belong on the closing timeline.
Sanctions due diligence
The ten-year look-back
Sanctions diligence should cover ten years to match the limitations period. The review should identify sales to sanctioned jurisdictions and dealings with persons on OFAC's Specially Designated Nationals and Blocked Persons List (SDN List) or with entities they own. Banks and payment routes deserve the same attention as customers, because dollar clearing brings a foreign transaction within reach of U.S. sanctions.
Foreign subsidiaries
Many European and Canadian companies do business with Cuba or Iran that is lawful under their own law. If a U.S. buyer acquires such a target, that business can become a U.S. sanctions violation on the day of closing, because the Iran and Cuba sanctions programs reach foreign entities owned or controlled by U.S. persons. Under the Iran rules, the U.S. parent is liable for civil penalties if the subsidiary continues.
CFIUS due diligence for foreign buyers and private equity funds
Technology, infrastructure, and data businesses
CFIUS reviews foreign acquisitions of, and certain foreign investments in, U.S. businesses, including through a fund whose foreign limited partners hold governance or information rights. The threshold question is whether the target is a technology, infrastructure, and data (TID) U.S. business, which the regulations define as a U.S. business that produces, designs, tests, manufactures, fabricates, or develops critical technologies, performs specified functions for covered investment critical infrastructure, or maintains or collects sensitive personal data of U.S. citizens. The request should cover ITAR-controlled products, items with an Export Control Classification Number (ECCN), government contracts and facility clearances, data on U.S. citizens, unnotified prior foreign investment, and any mitigation agreement, which binds the business rather than the seller.
Mandatory filings and penalties
A filing is mandatory where a foreign government holds a substantial interest in the acquirer, or where the target produces critical technologies that would require a license to export to the acquirer's country. The declaration is due at least 30 days before closing, and failure to file carries a civil penalty of up to $5,000,000 or the value of the transaction, whichever is greater. CFIUS may also request information on a transaction that was never filed, and the regulations place no time limit on that authority.
Outbound Investment Security Program (OISP) due diligence for private equity and venture capital funds
OISP runs in the opposite direction. It applies to U.S. persons, including private equity and venture capital funds, that invest in companies connected to a country of concern and engaged in semiconductors, quantum computing, or artificial intelligence. Some transactions are prohibited and others must be notified to Treasury within 30 days after completion. A U.S. investor's limited partner interest in a non-U.S. fund can itself be covered, as can a target outside a country of concern that derives more than half of its revenue, net income, capital expenditure, or operating expenses from covered foreign persons.
Diligence is the compliance obligation under OISP. Treasury measures what an investor knew by what a reasonable and diligent inquiry would have revealed, including the questions put to the target and the representations obtained. An investor that files a notification must retain the diligence file for ten years. The Comprehensive Outbound Investment National Security Act of 2025 (COINS Act) directs Treasury to issue new regulations within 450 days of its December 2025 enactment, and the current rules remain in effect until then. A transaction signed in 2026 should be structured under the current rules, with a reopener in case the new rules change the result.
Restricted party screening due diligence
The review should confirm that the target's screening software covers the U.S. government's restricted party lists and ownership, that it screens customers, suppliers, banks, and investors, and that each hit was resolved and documented. Under OFAC's 50 percent rule, an entity owned 50 percent or more, in the aggregate, by blocked persons is itself blocked. The Bureau of Industry and Security (BIS) adopted the same test for the Entity List and the Military End-User List in its Affiliates rule and suspended the rule through November 9, 2026, and as of the date of this article has not extended the suspension. Counterparties the rule would reach should be identified now.
Voluntary disclosure after closing
A disclosure bounds a liability the buyer now owns and separates the seller's conduct from the buyer's. A customs prior disclosure filed before CBP opens a formal investigation limits the penalty for negligence or gross negligence to interest on the unpaid duties, if the duties are tendered. OFAC's enforcement guidelines set the base penalty for a voluntarily disclosed, non-egregious violation at one-half of the transaction value, subject to a cap, and BIS treats a deliberate decision not to disclose a significant apparent violation as an aggravating factor.
For criminal violations, the Justice Department presumes it will decline to prosecute an acquiror that discloses misconduct found in diligence, generally within 180 days after closing, and remediates it, generally within one year. An OISP notification based on post-closing knowledge is due within 30 days. Because an escrow can expire before the violation is resolved, the disclosure plan and seller consent rights should be settled before signing.
Supply chain due diligence
Origin and transshipment
Many importers moved final assembly out of China after Section 301 duties on Chinese goods took effect in July 2018. If the operation abroad did not substantially transform the product, its origin remains China and the Section 301 duties remain owed. The review should test each relocated product against CBP's substantial transformation rulings, not only the country named on the shipping documents. CBP investigates evasion of antidumping and countervailing duties on allegations from domestic competitors and requests from other federal agencies and treats transshipment, misclassification, and undervaluation as evasion.
Forced labor and the Uyghur Forced Labor Prevention Act
The Tariff Act prohibits the entry of goods made wholly or in part with forced labor, and the Uyghur Forced Labor Prevention Act (UFLPA) presumes that goods made wholly or in part in Xinjiang, or by an entity on the UFLPA Entity List, were made with forced labor. An importer can overcome that presumption only with clear and convincing evidence. The buyer should ask for a supplier map that reaches past the tier-one vendor to the source of the cotton, polysilicon, metal, or component, the target's history of CBP detentions, and the traceability records it would produce if a shipment were detained tomorrow. Without a supplier map, the exposure cannot be priced.
Trade compliance findings in the purchase agreement
Trade compliance findings affect the price, the structure, and the closing timeline of a transaction, so the review should begin early enough to shape the purchase agreement. Duty underpayments and open antidumping liabilities are typically addressed through a special indemnity or escrow, and required CFIUS or DDTC filings through closing conditions. A review completed before signing leaves time to negotiate these terms, rather than discovering the issues after closing.
