ARTICLE
8 November 2024

Digital Asset Mergers And Acquisitions

WS
Winston & Strawn LLP

Contributor

Winston & Strawn LLP is an international law firm with 15 offices located throughout North America, Asia, and Europe. More information about the firm is available at www.winston.com.
As the digital asset industry matures, so does interest in acquiring the expertise and innovations driving its growth. While many of the considerations for digital asset mergers...
Worldwide Corporate/Commercial Law

Introduction

As the digital asset industry matures, so does interest in acquiring the expertise and innovations driving its growth. While many of the considerations for digital asset mergers and acquisitions (M&A) are common to acquisitions of other emerging technology companies, the digital asset industry presents unique hurdles. Industry participants often operate worldwide and many cannot, or will not, restrict access to their technology, entangling them in a global web of laws. A common reliance upon open-source software and networks with third parties only adds to the intricacy. Regulatory uncertainty remains ubiquitous and, in some jurisdictions, regulation remains untested. Despite these complexities, there is continued allure in digital asset company acquisitions.

Industry M&A activity has recovered during the first half of 2024 after a significant downturn in 2023.1 Ninety-five transactions were announced through June 2024 compared with 148 announced for all of 2023. The aggregate announced transaction amount of $2.9 billion for the first half of 2024 is considerably greater than the $1.3 billion aggregated in 2023. Certain activity with substantial value has come among bitcoin miners and could be driven by repurposing low-cost power contracts for artificial intelligence (AI),2 and the bitcoin halving in April 2024 as miners seek to consolidate costs and upgrade equipment. While halving-driven activity will likely abate, activity for brokers and exchanges and investing and trading infrastructure may be more sustainable. Further, transactions involving non-crypto native buyers or sellers continue to be a meaningful contributor.3

The EU digital assets market remains the second largest in the world, accounting for 17.6% of global transaction volume4 with a projected target of 218.60 million users by 2025.5 Current year M&A activity has increased, albeit not as quickly as in the United States (US). In the United Kingdom (UK), the government continues to strive for recognition as a global hub for crypto-asset technology and innovation.

In this chapter, we explore key considerations for buyers and sellers navigating such acquisitions. We focus first on transactional considerations, many of which are unique to the industry. We then turn to laws and regulations that should be considered in the context of M&A. While comprehensive treatment is impractical, we seek to explore those selected considerations by focusing on particular laws of the US, UK and European Union (EU).

Transactional considerations

Form of the transaction

Subject to the target's jurisdiction, acquisitions may be consummated through asset acquisition,6 equity purchases or statutory processes such as mergers or schemes of arrangement.7 Each method has distinct benefits and downsides.

Asset acquisitions enable the acquiror to select specific assets and liabilities. Commonly, assumed liabilities are restricted to those disclosed to the acquiror or more limited identified obligations,8 and are thus advantageous where a target has undesirable liabilities or non-core business. However, asset acquisitions can have unfavourable tax consequences, potentially subjecting both the entity and its equity holders to taxation on transaction proceeds. Further, asset acquisitions often trigger contractual counterparty consent rights as they transfer individual assets (including contracts).

Equity purchases, by contrast, utilise the acquisition of a target's equity interests, transferring control and ownership over the target while leaving its business and assets intact. This may minimise the effect of the acquisition on the business, but also leaves all liabilities in place. Equity purchases can also have tax advantages, since the sellers are equity holders, and the target is not directly involved in the sale. However, obtaining the agreement of all equity holders can be difficult, especially where there is no shareholders' agreement or statutory procedure to compel participation.

In the US and certain offshore jurisdictions, merger is a statutory process that combines two companies. A merger automatically converts shares into the right to receive merger consideration, forcing recalcitrant or unresponsive minority shareholders to participate if statutory requirements are otherwise met. A merger automatically combines the assets and liabilities of the constituent corporations. In the US, tax treatment can differ based upon which constituent entity survives.

In the UK and certain offshore jurisdictions, a scheme of arrangement allows for a solvent reorganisation of a company or group, including to effect an acquisition or debt restructuring with flexibility. A UK scheme requires the approval of 75% in value and a majority in number of each class of voting members, followed by court sanction. Once sanctioned, the scheme binds the target and all members and creditors, making it particularly useful for public company acquisitions. The scheme of arrangement is not available in many EU jurisdictions or in the US.

Proper parties

Identifying the correct parties in a transaction can be straightforward in most industries, where a holding company controls subsidiary companies that hold all material assets. The path to acquisition runs through the holding company's directors or similar decision-makers and controlling equity holders, except where high leverage or near insolvency necessitates active negotiation with debtholders or where independent ownership of material intangible assets requires negotiation with the asset holder.

Decentralisation and distribution complicate party evaluation. In the digital asset industry, key business elements are often open source with their value dependent upon the continued involvement of numerous actors. Network processes and tokens may be distributed among independent actors with different or no owners. Sometimes key assets cannot be acquired at all due to decentralisation. Further, issued tokens might represent debt, security interests, pure utility or other rights.

Post-closing adjustments and locked-box mechanisms

Fluctuating digital asset prices complicate valuation mechanisms during a split signing and completion. A post-closing adjustment allows re-assessment of working capital or net assets, helping the purchaser mitigate risks if a target's financial position deteriorates before closing. Conversely, a locked-box mechanism fixes the purchase price based on the target's accounts at a specified pre-signing date (the "locked-box date"), with the purchaser relying on contractual protections (often indemnified) to prevent value "leaking" from the target before closing. With this approach, the purchaser assumes economic exposure at the locked-box date, rather than at closing, subject to the seller demanding a share of any interim profits. While 85% of US M&A deals in 2023 featured post-closing price adjustments,9 locked-box structures are more prevalent in the UK. When using a locked-box mechanism, parties must consider protections such as carve-outs or adjustments for significant price fluctuations in digital assets.

Tokens and convertible instruments

Additional considerations stem from business models with tokens. Token holders often control key aspects of the network, requiring critical evaluation of their role in any target. Any store of utility tokens held by a target must be valued and could change dramatically following consummation. Conversely, an acquiror's store of tokens might be used as M&A consideration. Where the target has issued a token, in addition to regulatory concerns discussed below, an acquiror must assess the potential market impact if sellers dispose of token reserves post-closing.

Many digital asset companies turned to convertible instruments, including Simple Agreements for Future Equity (SAFEs), to obtain capital. Digital asset-specific Simple Agreements for Future Tokens (the SAFT, or token pre-sale agreements), and the hybrid Simple Agreements for Future Equity and Tokens (SAFE+T), are also utilised. Buyers must carefully account for any unconverted instruments when pricing, factoring in the effects on the capitalisation table of any caps or discounts.

Representations and warranties

Representations and warranties provide key information about the target, its assets and business. In addition to ubiquitous warranties, digital asset acquirors should be mindful of security vulnerabilities, wallet mechanics, intellectual property and regulatory compliance.

Many acquisitions rely upon representations and warranties insurance (US) or warranty and indemnity insurance (UK and EU) for recovery in the event of breaches.10 In the EU especially, this has been a growing trend. This often expedites the negotiation of representations and warranties as insurance coverage substantially limits sellers' contingent liabilities. However, in the authors' experience, insurance is not available for many digital asset transactions. We hope this changes as specialist due diligence providers in the digital asset industry increase.

Due diligence

Due diligence is a comprehensive review process to assess a target's financial condition, business operations and legal rights and obligations. Due diligence can lead to price adjustments, changes in transaction structure, call for indemnities to allocate risk, invite purchase price contingencies or even a determination not to proceed.

Legal due diligence is only one element of comprehensive due diligence, and a purchaser must balance the desire to identify all liabilities and the impact of M&A on the target with the cost of leaving no stone unturned. In a digital asset acquisition, effective due diligence not only identifies intellectual property shortfalls and required third-party consents, but also assesses issues discussed elsewhere such as the proper parties to a transaction and regulatory uncertainty. Purchasers may be minded to engage specialist third-party due diligence providers, including to conduct code and security audits, review any tokenomics to ensure longevity, verify any digital assets held, and review network scalability and development.

Taxes

Sellers in M&A transactions are usually motivated by gain. With proper counsel, the sellers will consider the proceeds available to them after taxes. In the digital asset community, sellers frequently experience different tax implications, complicating tax evaluation and transaction structuring to minimise tax liabilities.

In the US, there is often an inverse relationship between a seller's tax recognition and the acquiror's ability to attribute substantial value to acquired assets in order to maximise tax depreciation deductions in future years. This dynamic is impacted by the target's form of entity and the acquiror's tax situs.

An emerging consideration is the future tax reporting and withholding obligations of the acquired business. In the US, the Internal Revenue Service (IRS) has finalised its regulations relating to US digital asset brokers.11 The range of digital asset businesses that may be captured is broad.12 The IRS intends to wait to coordinate rules for ex-US brokers with the OECD's Crypto-Asset Reporting Framework (CARF). Forty-eight countries, including the US, Canada, UK and many EU members, have adopted a joint statement of intent to adopt CARF by 2027.13

Personnel

Retaining key personnel is essential for business functions and intellectual property development. While traditional businesses rely upon employment agreements and restrictive covenants (e.g., confidentiality, non-solicitation and non-competition) to protect their business and goodwill, digital asset companies often heavily rely upon independent contractors and network relationships, for which restrictive covenant enforcement may be difficult and the application of statutory employee protections is uncertain.14 Further, restrictive covenants are generally disfavoured by the digital asset industry.

As noted above, asset purchases can be used to "cherry pick" target assets, particularly intellectual property and digital assets, while mitigating assumed liability. However, purchasers of assets from companies with UK and EU employees should be wary of the UK's Transfer of Undertakings (Protection of Employment) Regulations15 and EU Council Directive 2001/23/EC (ARD).16 Both regulations aim to protect the rights of employees when their business is transferred from one employer to another, by ensuring that employees working in a business sold in an asset sale, automatically transfer to the new owner of that business, and have their conditions of employment protected. In each case, the rules are complex and fact-intensive.

Blockchain networks and open-source software

Digital assets are founded on principles of openness and cooperation, though the degree to which these principles apply varies by business model.

Blockchain networks are generally defined as decentralised, peer-to-peer networks that use distributed ledgers to store and record transactions in linked blocks. In principle, blockchains are not controlled by a central authority, but instead are shared among a network of computers. Recorded data is immutable, and thereby difficult to change. Public blockchains offer transparency, with data generally accessible. Security is obtained by requiring authorisation through a digital signature to authenticate transactions.

Open-source software is characterised by publicly accessible source code and permissive licensing. Open-source software offers a business cost savings, flexibility, and access to a broad developer community, exemplified by the ubiquity of Linux. Open-source licences vary widely, ranging from permissive licences like MIT and Apache to the more restrictive GNU General Public License (GPL) and others. Importantly, some open-source licences, such as the GPL, require derivative works to be released under open-source terms.

Digital asset companies often leverage open-source licensing and network effects by publishing foundational elements under open-source licence on GitHub, GitLab or similar repositories. Some build proprietary applications on top of these open-source foundational elements and encourage others to do the same through social media platforms.

Legal due diligence in this space requires evaluation of open-source licences, means of software distribution and the governance mechanisms pronounced for the network. However, the technical evaluation of software and network operations is critical to assessing value and even viability. These open and cooperative elements of digital asset business models challenge evaluation under traditional regulatory principles, requiring fact-intensive analysis.

Regulatory uncertainty

Any emerging technology struggles with uncertainty since its emergent nature means that existing laws and regulations will not explicitly address the technology. Typically, emerging technology businesses will consult with counsel, and counsel will in turn analogise from existing pronouncements and may seek to engage with regulatory authorities for guidance. Of course, regulators have discretion over how and whether to meaningfully engage.

In the UK, the Financial Conduct Authority (FCA) has been proactive in issuing guidance and consulting with industry players, but reluctant to grant registrations. In the US, regulatory authorities have adopted widely differing approaches to engagement, with the US Department of the Treasury Financial Crimes Enforcement Network (FinCEN) providing guidance in 2013 that business transactions in many digital assets would constitute money services business subject to its regulation17 and federal taxing authorities determining proactively that cryptocurrency is property such that transactions in cryptocurrency would be taxed as such in 2014.18 On the other hand, financial regulators were slower to engage, and jurisdiction over digital assets was complicated by the shared jurisdiction over financial assets by the US Commodity Futures Trading Commission (CFTC) and the Securities and Exchange Commission (SEC).

As a result, US digital asset companies and non-US companies approaching the US market must evaluate the possibility that their business model cannot be definitively determined not to require some sort of registration but have limited ability to achieve this registration. Many choose to lawfully avoid the jurisdiction of US regulators by imposing customer or counterparty restrictions on US persons and maintaining their operations outside of the US. Others segregate and independently operate their US and non-US businesses. However, these approaches are not possible for open networks and business platforms that have no "gatekeeping" mechanism.

Jurisdiction

Courts and regulatory authorities cannot exercise their powers without jurisdiction. Determining applicable jurisdiction is complex for digital asset companies utilising borderless technologies and networks comprising companies operating and individual residents in many jurisdictions. Acquirors are well advised to evaluate the applicable jurisdictions of a target as the acquiror may become subject to these jurisdictions through the transaction. Additionally, further jurisdictional evaluation is necessary to determine the applicability of various transaction-specific statutes and regulations.

In the US, a court may exercise personal jurisdiction based on a defendant's general or specific contacts with the forum.19 General jurisdiction is based upon the defendant's "continuous and systematic contacts" with the forum20 and permits a court to hear all claims against the defendant. Specific jurisdiction is appropriate only if the cause of action arises out of a defendant's forum-related activities, where the defendant should reasonably expect being haled into court in that forum.21 Specific jurisdiction is established where the defendant purposefully directs activities at residents of the forum and the alleged injuries relate to those activities.22 Generally, a non-US company may not be subject to jurisdiction in a US court if it has no meaningful contacts to the forum. When a civil case arises under federal law and a federal statute authorises nationwide service of process such as US securities laws,23 the courts will apply a "national contacts test" to determine whether the defendant has sufficient contacts with the US.24

Several cases have applied these tests to digital asset companies. For example, courts have found jurisdiction over a Singaporean company and its CEO because they promoted the digital assets at issue to US-based consumers and investors25 and over a defendant who distributed coins that were allegedly unregistered securities primarily based on its English-language, US-hosted website, and the decision to structure an initial coin offering accommodating US-based participation.26 A court also found personal jurisdiction over the CEO of a platform of decentralised applications because he resided in the US at the time of the relevant events and specific jurisdiction based his alleged repeated contacts with the US related to the promotion of the company and its tokens.27 However, another court held that it lacked specific jurisdiction over defendants engaged in promotional activities worldwide, including through touting the company's services and soliciting sales of the tokens at conferences across the US.28

The reach of US federal securities antifraud provisions29 where there are non-US elements is defined by a separate body of case law. These provisions apply only to transactions in securities listed on domestic exchanges and domestic transactions in other securities.30 Non-listed securities domestic transactions are further defined under the domestic transaction test to require that irrevocable liability was incurred or that title was transferred within the US.31 A third test, the predominantly foreign test, provides that the jurisdiction would not attach even where the domestic transaction test is satisfied if claims are so predominantly foreign as to be impermissibly extraterritorial.32 The claims of US financial regulators are separately governed by tests referred to as conduct and effects, domestic transaction and predominantly foreign.

Regulatory considerations

Financial regulation

EU

The EU has developed a comprehensive digital asset-specific framework. The regulation of digital assets in the EU is overseen by competent Member State authorities who have broad supervisory and investigative powers and implement technical standards and guidelines that are ultimately published by the European Securities and Markets Authority and the European Banking Authority (EBA).

In April 2023, the European Parliament greenlighted a harmonised framework governing crypto-assets, the Markets in Crypto-Assets Regulation (MiCA).33 Regulations on stablecoins took effect in June 2024 and those affecting crypto-asset service providers take effect in December 2024.34 The intent of MiCA is to provide legal certainty for crypto-assets not covered by existing EU legislation. MiCA does not apply to security tokens that would qualify as transferable securities and other crypto-assets that qualify as financial instruments for the purposes of the Markets in Financial Instruments Directive (MiFID) II, deposits, securitisation positions, insurance or pension products.

In May 2024, the European Commission published delegated acts supplementing MiCA including the Capital Requirements Package.35 These requirements institute measures for managing crypto-asset exposures and introduced definitions such as "tokenised traditional assets" and "crypto-asset exposure".

In August 2024, the Artificial Intelligence Act (AI Act), the first regulation on AI in the world, entered into force,36 focused on ensuring that AI marketed within the EU is used ethically safely and respects EU fundamental rights, while allowing for innovation. All entities involved in supplying, distributing, or deploying AI systems and models, operating within or outside the EU, are required to adhere to the regulations outlined in the AI Act if they intend to market their AI products within the EU. The AI Act does not apply to military AI systems nor to AI systems used for the sole purpose of scientific research and development. Furthermore, it does not apply to open-source AI, if it is not banned or classified as high-risk.37 The AI Act will become effective two years after its entry into force; however, prohibitions will already apply after six months, while the rules on General Purpose AI will apply after 12 months. Codes of Practice should be ready nine months after the AI Act takes effect. Obligations for high-risk AI systems will apply after three years.38

UK

In contrast to jurisdictions that have opted to develop digital asset-specific legislation, the UK has taken a more integrated approach. The regulation of digital assets in the UK is overseen by the FCA, which has expanded its scope to cover various aspects of digital asset activities, including anti-money laundering (AML), financial promotions, and general market oversight.

The UK's existing financial regulation, the Financial Services and Markets Act 2000 (FSMA), regulates certain activities, such as custody, advising and arranging deals that relate to "specified investments". The definition of "specified investments" has not been expressly expanded to include digital assets. However, certain digital assets may fall within, for example, tokenised equity, a derivative or collective investment scheme. Specified investments may exist, in particular, where token holders are entitled to profits or income based on the management by others. In 2022, the FCA published guidance to assist the industry in identifying digital assets that fall within "specified investments". Where triggered, persons wishing to carry out business activities in the UK require authorisation from the FCA and compliance with the existing FSMA regime, which includes obligations related to consumer protection, market conduct and financial promotion.

The UK's existing financial promotion regime was extended effective October 2023 to cover qualified crypto-assets. A financial promotion refers broadly to any invitation or inducement to engage in an investment activity, which could have an effect in the UK, regardless of where that promotion is made. The definition of "qualified" crypto-asset is wide, and in practice captures most cryptocurrencies but not non-fungible tokens (NFTs), central bank digital currencies, digitally issued fiat, or assets that meet the definition of electronic money. Under this regime, it is a criminal offence to make a financial promotion of digital assets unless made or approved by a person authorised by the FCA to do so, made by a digital asset business registered with the FCA under the MLRs (defined below), or an exemption applies. There are several exemptions available, though the most utilised involve promotions directed at investment professionals, high-net-worth individuals, or sophisticated investors. Even valid promotions must meet minimum standards of transparency and fairness, providing balanced information that includes potential risks and fees. Promotions must also not promise incentives for investing, including free sign-up bonuses, cashback or referral programmes, and customers must be offered a 24-hour cooling-off period. Non-compliance can result in severe penalties, including unlimited fines, imprisonment for up to two years, and the unenforceability of investment contracts. Following a slew of enforcement activity,39 a number of digital asset businesses restricted access to UK users.40

The English courts have recognised digital assets as a form of property since 2019,41 despite not neatly fitting in the traditional two categories of personal property under English law (being "things in possession" (i.e., tangible things) and "things in action" (i.e., a legal right or a claim enforceable by action)). The recognition of digital assets as such is important for a number of reasons, including to provide owners certainty regarding their rights, especially in disputes, insolvency or cases of interference. In September 2024, the UK government proposed the Property (Digital Assets etc) Bill,42 which would provide the statutory grounding for digital assets being considered personal property in the UK, despite being neither obviously a thing in possession nor a thing in action, and would lay rest to any such debate.

US

At September 2024, no financial law specifically regulating digital assets has been passed in the US, and regulation has proceeded by applying existing laws and by regulatory authorities with existing jurisdiction. Jurisdiction over financial assets is shared by the CFTC and the SEC.43 The jurisdiction of the CFTC over spot trading of commodities such as bitcoin and other virtual currencies44 is limited to antifraud jurisdiction except in the case of retail commodity transactions.45 However, the CFTC has direct supervisory authority over commodity and derivatives exchanges, clearing organisations, large traders and those handling customer funds and advising trades.46 The SEC has supervisory and antifraud authority over offers and sales of securities, which must be registered or qualify for exemption.47 Further, the SEC regulates numerous securities intermediaries, including exchanges, brokers and dealers, transfer agents, investment companies and investment advisers.48

The SEC has initiated many investigations since 2017, beginning with a defunct decentralised autonomous organisation, to warn that virtual organisations utilising blockchain, automated functions through smart contracts and secondary trading of tokenised rights would be viewed through their underlying economic realities.49 The SEC staff noted in 2018 that a digital asset security could become a non-security through decentralisation50 and provided a framework for evaluating whether a digital asset is a security.51 Since the appointment of Gary Gensler as Chair of the SEC in 2021, the SEC has taken an expansive view of the SEC's jurisdiction52 and maintained an active enforcement programme. An extremely limited number of tokens and market intermediaries have successfully registered or qualified with the SEC. As a result, standards are developing through case law.

The starting point is generally whether a digital asset is a security, which is evaluated under the US Supreme Court's Howey test of investment contracts.53 Several cases have held that certain digital assets, together with related activities, are securities, while others have found that they are not given certain economic realities.54 Further, at least one district court decision suggests that even tokens that are investment contracts when sold directly by the allocator are not investment contracts upon their resale by unaffiliated acquirors to third parties.55 The same court found that distributions to employees as compensation and to third parties as part of a development initiative were not an investment of money required to find an investment contract.56 Another court found Howey investment contracts where token purchasers were led to believe they would earn return due to marketing that tokens would increase in value with increased use of the associated blockchain maintained and developed by the company and related parties.57

The CFTC has also been active in regulating digital assets and blockchain businesses, though this regulation has often been through enforcement action to date,58 and the CFTC has taken some positions generally perceived to be quite expansive. For example, the CFTC proceeded against Ooki DAO for activities of the Ooki Protocol smart contract because Ooki DAO had "administrator keys" that allowed it to control the smart contract and the funds held within.59 In September 2023, the CFTC issued enforcement orders against three developers and operators of decentralised finance (DeFi) protocols, charging them with illegally offering retail commodity transactions in digital assets through those protocols.60

AML obligations

UK

In response to recommendations from the Financial Action Task Force (FATF), the UK expanded the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs)61 to include crypto-asset service providers. Under the MLRs, companies engaged in, broadly, digital asset custody services, the operation of digital asset ATMs, or exchanging digital assets for cash (or vice versa) or for other digital assets, in each case by way of business in the UK, are required to register with the FCA.

In line with FATF recommendations, the MLRs set a high bar for compliance. Meeting the obligations of the MLRs has proven challenging for many emerging digital asset companies, given the stringent requirements for monitoring, transparency, and recordkeeping. The FCA has been selective in approving applications, with only 14% approved since the introduction of the expanded regulations.62

US

In the US, AML obligations are imposed upon a variety of financial institutions and intermediaries, including money services businesses within the meaning of FinCEN regulations.63 FinCEN's regulations do not differentiate between real currencies and digital assets constituting convertible virtual currencies, so accepting and transmitting these digital assets constitutes money transmission.64 Money services businesses must register with FinCEN within 180 days of transmission commencement65 and comply with recordkeeping, reporting, and transaction monitoring obligations.66 If the money services business's transactions constitute a transmittal of funds67 under FinCEN regulations, it must also comply with broad obligations known as the Funds Transfer Rule68 and the Funds Travel Rule.69

Money services businesses are obliged to maintain effective AML programmes that are reasonably designed to prevent them from being used to facilitate money laundering or financing terrorist activities. At a minimum, these programmes must: incorporate policies, procedures and controls reasonably designed to assure ongoing compliance; designate a programme compliance administrator; train personnel to detect suspicious transactions; and implement programme policies and contemplated independent review.70 AML compliance programmes should be risk-based, and money services businesses should know enough about their customers to be able to determine their risk levels.71

EU

MiCA includes provisions that combat money laundering and terrorist financing through digital assets by implementing strict AML and counter-terrorist financing measures. MiCA integrates with the broader EU Anti-Money Laundering Directive (AMLD) and requires compliance with existing EU and Member State AML regulation. MiCA does not duplicate the AML provisions as set out in the Transfer of Funds Regulation, which makes it possible to trace transfers of digital assets.72

It should be noted that in July 2024, the EBA published new guidelines on the "Travel Rule", in alignment with the FATF recommendations, which requires digital asset transactions to include certain information with their transmission.73 Furthermore, crypto-asset service providers will need to collect information in a transaction that includes, among other things, the originator and beneficiary.74 The new rule integrates with MiCA and furthermore carries on with the high compliance standards of AML.

Sanctions

Although many nations and extranational bodies such as the United Nations and the EU maintain economic sanctions programmes, the US is noteworthy for the breadth of its programmes. US sanctions are imposed both upon specific countries and jurisdictions75 as well as specific individuals, organisations and blockchain wallet addresses. Specific sanctions can change rapidly, and a searchable list is maintained by the Office of Foreign Assets Control (OFAC) of the US Department of the Treasury.76 US sanctions are applicable to transactions and other activities occurring in the US or involving US individuals or entities (sometimes called primary sanctions) and transactions and other activities occurring outside of the US and not involving US individuals or entities that would be prohibited if a US person was involved (sometimes called secondary sanctions).77 OFAC has been active in evaluating sanctions compliance by the digital asset industry, providing sanctions compliance guidance78 and taking enforcement actions against digital asset companies.79 Sanctions policies and procedures are an important part of the compliance programmes of many digital asset companies.

Privacy

EU and UK

The EU's General Data Protection Regulation (GDPR),80 which came into effect on May 25, 2018, and similar regulations such as the UK GDPR, which came into effect in the UK on January 1, 2021,81 require strict controls on transferring personal data outside their borders. Even though GDPR is a European regulation and considered to be the gold standard of data privacy laws, it impacts US companies who may not be located in the EU if they process personal data located in the EU. Violations may entail fines of up to 4% of annual global turnover or €20 million, whichever is greater.82

It should be noted regarding blockchain technology:

A recurring argument has been that this class of technologies may, by its very nature, be unable to comply with European data protection law, which in turn risks stifling its own development to the detriment of the European digital single market project.83

The issues that come into conflict with digital assets and GDPR legislation include control, the right to modification and erasure, anonymisation and encryption, and data minimisation and purpose limitations.

US

As of the date of this chapter, the US has no comprehensive data protection law.84 In light of this, 20 states have adopted some form of comprehensive data protection law, with California being first in 2018.85 Some US companies have universally adapted their operations to GDPR regardless of applicability to particular data transfers.

Regulation of transactions

US

Acquisitions subject to US jurisdiction may be required to file notices about a transaction with federal government authorities based upon the size of the transaction and the parties under the Hart-Scott-Rodino Antitrust Improvements Act (HSR)86 or based upon the nature of the target's business and the acquiror's jurisdiction under laws and regulations relating to the Committee on Foreign Investment in the US (CFIUS).87

HSR filings are mandated prior to completing M&A transactions meeting certain monetary thresholds (adjusted annually) and made with the Federal Trade Commission and Department of Justice. For 2024,88 acquisitions with a value of greater than $119.5 million but less than $478 million are reportable only if an additional size-of-person threshold is met. This size-of-person threshold is met if one transaction party has annual net sales or total assets of at least $239 million and the other has at least $23.9 million. HSR filings must be made at least 30 days before closing. This waiting period can be extended if the antitrust authorities request additional information or if they impose a "second request" for more detailed documentation. Parties failing to notify an HSR-reportable transaction may be subject to civil penalties and enforcement actions. Antitrust authorities are empowered to investigate transactions not subject to HSR filing and to evaluate the anti-competitive effects of completed transactions and can impose a variety of mitigating obligations.

Filing with CFIUS is required where the target is a US business that produces one or more critical technologies, performs certain functions with respect to critical infrastructure or maintains or collects sensitive personal data of US citizens. CFIUS is an interagency committee of the US government tasked with reviewing the national security implications of foreign acquisitions of and direct investments in US businesses. Due to current definitions of critical technologies and critical infrastructure, personal data of US citizens is the likeliest trigger of a CFIUS filing for digital asset M&A. Where CFIUS identifies national security risks relating to a particular transaction, it has sweeping authority to mitigate such risks by blocking or modifying pending transactions. CFIUS may also unwind transactions that have already closed.

UK

FCA approval is required for any acquisition of control of an FCA-authorised firm under FSMA and, since August 2022, registered digital asset businesses under the MLRs. Control is generally defined as over 25% of the shares or voting rights, directly or indirectly, in an MLR-registered digital asset business,89 and starting at 10% or more for FCA-authorised entities.90 Following application, the FCA has 60 business days to make a determination (with the option to extend for a further 30 business days if the FCA requires more information). Completion cannot occur until authorisation is given.

Enacted in 2022, the UK's National Security and Investment Act 2021 (NSIA)91 significantly strengthens the UK government's ability to intervene in acquisitions and investments that it considers pose a risk to national security. Unlike CFIUS, the NSIA is agnostic as to the jurisdiction of the acquirer. Above certain ownership thresholds (being as low as 25%), both foreign and domestic transactions can be reviewed, and a mandatory notification required, where the target operates in the UK in certain specified sectors. While those sectors do not include digital assets directly, digital asset businesses could very well reach into specified sectors. Where a mandatory notification is required, the UK government has 30 working days (extendable in certain circumstances) to review the acquisition and provide clearance or call in the transaction for further review. Completion cannot occur before clearance is obtained. The UK government may agree to accelerate an application only in exceptional circumstances. If called in, the government can impose remedies or block an acquisition entirely, if deemed necessary.

EU

The EU's Foreign Direct Investment (FDI) Regulation92 has fully applied since October 2020.93 If the target company is in the EU, the acquiror must file an FDI application with the relevant authority in the relevant Member State. There is no standalone FDI screening on the EU level, and the Member State mechanisms are not harmonised but are increasingly coordinated in approach. As an example, in France, the review process is carried out by the CIEF Bureau (the Bureau of Foreign Investment Control in France)94 of the French Treasury in collaboration with and under the supervision of the Ministry of Economy.95 The process in France, like other Member States, is constantly evolving. The most important steps to screening were embodied in the PACTE Law (2019/2020)96 and the Decree Le Maire,97 and in the past year, there have been amendments where the scope of review now includes investments in French branches (unincorporated bodies under French law) of foreign entities that are engaged in sensitive activities.98

Widening of national security concerns has increased the number and types of M&A transactions sensitive enough to be screened by the Member States, especially with deals containing intellectual property.

When a Member State screens an FDI, it must notify the European Commission and other Member States as soon as possible with certain details.99 The process of obtaining an authorisation without conditions, approval with conditions or mitigating measures or in some cases blocking of the transaction will take months, depending on the Member State.

Acknowledgments

The authors wish to express their gratitude for the assistance of Toran Kaul and Jessica Garay in preparing this chapter.

Footnotes

1. Risley, E.F. (2024) Q2 2024 Crypto M&A and Financing Report. Available at: https://architectpartners.com/q2-2024-crypto-ma-and-financing-report (Accessed: September 24, 2024).

2. Canny, W. (2024) Bitcoin miners with attractive power contracts are potential M&A targets, JPMorgan says. Available at: https://www.coindesk.com/markets/2024/06/05/bitcoin-miners-with-attractive-power-contracts-are-potential-ma-targets-jpmorgan-says (Accessed: September 24, 2024).

3. Risley, E.F. (2024) Q2 2024 Crypto M&A and Financing Report. Available at: https://architectpartners.com/q2-2024-crypto-ma-and-financing-report (Accessed: September 24, 2024).

4. Shah, P. (2024) Europe's Blossoming Admiration for Crypto. Available at: https://www.cmegroup.com/articles/2024/europes-blossoming-admiration-for-crypto.html (Accessed: September 17, 2024).

5. Statista (2024) Digital Assets – Europe. Available at: https://www.statista.com/outlook/fmo/digital-assets/europe#revenue (Accessed: September 17, 2024).

6. In lieu of purchase, rights to key assets may be obtained by licence, exclusive contract or other transfer of fewer than all rights to selected assets.

7. This list is exemplary rather than exhaustive.

8. Through these means, an acquiror hopes to avoid assuming unknown and contingent liabilities. The success of this strategy may be limited due to doctrines of successor liability, statutory liability and obligations to employees and scheme liability.

9. SRS Acquiom (2024) 2024 M&A Deal Teams Study. Available at: https://info.srsacquiom.com/2024-ma-deal-terms-study (Accessed: September 17, 2024).

10. SRS Acquiom (2024) 2024 M&A Deal Teams Study. Available at: https://info.srsacquiom.com/2024-ma-deal-terms-study (Accessed: September 17, 2024).

11. Federal Register (2024) Gross Proceeds and Basis Reporting by Brokers and Determination of Amount Realized and Basis for Digital Asset Transactions. Available at: https://www.federalregister.gov/documents/2024/07/09/2024-14004/gross-proceeds-and-basis-reporting-by-brokers-and-determination-of-amount-realized-and-basis-for#page-56480 (Accessed: September 24, 2024).

12. IRS regulation provides that a US digital asset broker is a person that effects sales of digital assets on behalf of others and that is . . . A US payor or US middleman . . . that is not a foreign branch or office of such person, . . . or that is not a territory financial institution. Federal Register (2024) Gross Proceeds and Basis Reporting by Brokers and Determination of Amount Realized and Basis for Digital Asset Transactions. Available at: https://www.federalregister.gov/documents/2024/07/09/2024-14004/gross-proceeds-and-basis-reporting-by-brokers-and-determination-of-amount-realized-and-basis-for#page-56480 (Accessed: September 24, 2024).

13. HM Treasury (2023) Collective engagement to implement the Crypto-Asset Reporting Framework. Available at: https://www.gov.uk/government/publications/international-joint-statement-on-the-crypto-asset-reporting-framework/collective-engagement-to-implement-the-crypto-asset-reporting-framework (Accessed: September 24, 2024).

14. The enforceability of restrictive covenants is not assured even for employees and may be jurisdiction-dependent. Federal Trade Commission, Non-Compete Clause Rule, 89 FR 38342 (May 7, 2024); 16 CFR § 910 et seq.; Ryan, LLC v. FTC, Case No. 3:24-cv-00986 (N.D. Tex 2024).

15. Transfer of Undertakings (Protection of Employment) Regulations 2006 (SI 2006/246). Available at: http://www.legislation.gov.uk/uksi/2013/2996/made (Accessed: September 22, 2024).

16. Council Directive 2001/23/EC on the approximation of the laws of the Member States relating to the safeguarding of employees' rights in the event of transfers of undertakings, businesses or parts of undertakings or businesses (2001) Official Journal L082. Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32001L0023 (Accessed: September 2, 2024).

17. Department of the Treasury Financial Crimes Enforcement Network (2013) Application of FinCEN's Regulations to Persons Administering, Exchanging, or Using Virtual Currencies. Available at: https://www.fincen.gov/sites/default/files/shared/FIN-2013-G001.pdf (Accessed: September 24, 2024).

18. See I.R.S. Notice 2014-21, 2014-16 I.R.B. 938.

19. Walden v. Fiore, 571 U.S. 277 (2014).

20. Helicopteros Nacionales de Colombia, S.A. v. Hall, 466 U.S. 408, 414–416 (1984).

21. World-Wide Volkswagen Corp. v. Woodson, 444 U.S. 286, 297 (1980).

22. Burger King Corp. v. Rudzewicz, 471 U.S. 462, 472 (1985).

23. Securities Act of 1933, 15 U.S.C.A. §§ 77a to 77mm; Securities Exchange Act of 1934, 15 U.S.C.A. §§ 78a to 78qq.

24. Gucci Am., Inc. v. Weixing Li, 768 F.3d 122, 142 n.21 (2d Cir. 2014).

25. United States Sec. & Exch. Comm'n v. Terraform Labs Pte Ltd., No. 22-368, 2022 WL 2066414, at *3 (2d Cir. June 8, 2022), cert. denied sub nom. Terraform Labs Pte Ltd. v. Sec. & Exch. Comm'n, 143 S. Ct. 1020, 215 L. Ed. 2d 188 (2023).

26. In re Tezos Sec. Litig., No. 17-CV-06779-RS, 2018 WL 4293341, at *6 (N.D. Cal. Aug. 7, 2018).

27. Owen v. Elastos Found., No. 1:19-CV-5462-GHW, 2021 WL 5868171, at *8 (S.D.N.Y. Dec. 9, 2021).

28. Holsworth v. BProtocol Found., No. 20 CIV. 2810 (AKH), 2021 WL 706549, at *2 (S.D.N.Y. Feb. 22, 2021).

29. 15 USC § 78j; 17 CFR § 240.10b-5.

30. Morrison v. National Australia Bank Ltd., 561 U.S. 247 (2010).

31. Absolute Activist Value Master Fund Ltd v. Ficeto, 677 F. 3d 60 (2d Cir. 2012).

32. Parkcentral Glob. Hub Ltd. v. Porsche Auto. Holdings SE, 763 F.3d 198 (2d Cir. 2014).

33. European Parliament (2023) Crypto-assets: green light to new rules for tracing transfers in the EU. Available at: https://www.europarl.europa.eu/news/en/press-room/20230414IPR80133/crypto-assets-green-light-to-new-rules-for-tracing-transfers-in-the-eu (Accessed: September 22, 2024).

34. MiCA is part of the larger digital finance package, which aims to develop a European approach that fosters technological development and ensures financial stability and consumer protection. Jasperse, J. and Hammer, S. (2024) The State of Stablecoin Regulation and Emergence of Global Principles. Available at: https://businesslawtoday.org/2024/09/state-of-stablecoin-regulation-emergence-of-global-principles/#:~:text=MiCA%20establishes%20a%20comprehensive%20regulatory,effect%20on%20June%2030%2C%202024 (Accessed: September 22, 2024).

35. European Council (2024) Basel III reforms: new EU rules to increase banks' resilience to economic shocks. Available at: https://www.consilium.europa.eu/en/press/press-releases/2024/05/30/basel-iii-reforms-new-eu-rules-to-increase-banks-resilience-to-economic-shocks (Accessed: September 22, 2024).

36. European Commission (2024) AI Act enters into force. Available at: https://commission.europa.eu/news/ai-act-enters-force-2024-08-01_en#:~:text=On%201%20August%202024%2C%20the,and%20deployment%20in%20the%20EU (Accessed: September 22, 2024).

37. Id.

38. Id.

39. Within the first three months of the rules coming into effect, the FCA had issued 450 consumer alerts against firms. Financial Conduct Authority (2024) Annual Report and Accounts 2023–24. Available at: https://www.fca.org.uk/publication/annual-reports/annual-report-2023-24.pdf (Accessed: September 24, 2024).

40. Browne, R. (2024) Crypto firms introduce risk assessments and finance tests in response to strict new rules in UK. Available at: https://www.cnbc.com/2024/01/05/coinbase-gemini-plan-user-risk-assessments-in-uk-ahead-of-new-rules.html (Accessed: September 24, 2024).

41. AA v. Persons Unknown [2019] EWHC 3556 at [55].

42. Property (Digital Assets etc) Bill (2024). Parliament: House of Lords. Bill no. 31. Available at: https://bills.parliament.uk/bills/3766 (Accessed: September 24, 2024).

43. Taylor A. Moffett, CFTC & SEC: The Wild West of Cryptocurrency Regulation, 57 U. Rich. L. Rev. 713 (2023). As a result of the complexity, the regulatory authorities have developed protocols for cooperation. See, e.g., Memorandum of Understanding Between the U.S. Securities and Exchange Commission and the U.S. Commodity Futures Trading Commission Regarding Coordination in Areas of Common Regulatory Interest (March 11, 2008).

44. Order, In re Tether Holdings Ltd., CFTC No. 22-04 (Oct. 15, 2021); Complaint, SEC v. Binance Holdings Ltd., No. 1:23-cv-01599 (D.D.C June 5, 2023); Complaint, CFTC v. Ehrlich, No. 1:23-cv-08962 (S.D.N.Y. Oct. 12, 2023).

45. Quintez, B.D. (2020) Retail Commodity Transactions Involving Certain Digital Assets. Available at: https://www.cftc.gov/PressRoom/SpeechesTestimony/quintenzstatement032420 (Accessed: September 24, 2024).

46. Commodity Futures Trading Commission (no date) The CFTC's Role in Monitoring Virtual Currencies. Available at: https://www.cftc.gov/media/4636/VirtualCurrencyMonitoringReportFY2020/download (Accessed: September 24, 2024).

47. 15 USC § 77e.

48. 15 USC § 78e; 17 CFR § 240.3b-16; 15 USC § 78o; 17 CFR § 240.15a-1 et seq.; 15 USC § 80b-1 et seq.; 15 USC § 80a-1 et seq.

49. Report of Investigation Pursuant to Section 21(A) of the Securities Exchange Act of 1934; SEC Release No. 81207 (July 25, 2017). Available at: https://www.sec.gov/litigation/investreport/34-81207.pdf (Accessed September 28, 2021).

50. Hinman, W. (2018) Digital Asset Transactions: When Howey Met Gary (Plastic). Available at: https://www.sec.gov/newsroom/speeches-statements/speech-hinman-061418#_ftn1 (Accessed: September 24, 2024).

51. US Securities and Exchange Commission (2024) Framework for "Investment Contract" Analysis of Digital Assets. Available at: https://www.sec.gov/about/divisions-offices/division-corporation-finance/framework-investment-contract-analysis-digital-assets (Accessed: September 24, 2024).

52. Gensler, G. (2021) Gary Gensler to Elizabeth Warren, August 5. [Letter]. Available at: https://www.warren.senate.gov/imo/media/doc/gensler_response_to_warren_-_cryptocurrency_exchanges.pdf (Accessed: September 24, 2024).

53. SEC v. W.J. Howey Co., 328 U.S. 293, 299 (1946). In Howey, the Supreme Court concluded that an investment contract exists when all three of the following elements are present: (1) the investment of money; (2) in a common enterprise; (3) with a reasonable expectation of profits to be derived from the efforts of others.

54. See, e.g., Balestra v. ATBCOIN LLC, 380 F. Supp. 3d 340 (S.D.N.Y. 2019) (security); SEC v. Kik Interactive Inc., 492 F. Supp. 3d 169 (S.D.N.Y. 2020) (security); SEC v. Telegram Grp. Inc., 448 F. Supp. 3d 352 (S.D.N.Y. 2020) (security); SEC v. LBRY, Inc., 639 F. Supp. 3d 211 (D.N.H. 2022) (security); SEC v. Terraform Labs Pte. Ltd., 2023 U.S. Dist. LEXIS 132046 (S.D.N.Y. July 31, 2023) (security); SEC v. Ripple Labs, Inc., 2023 U.S. Dist. LEXIS 120486 (S.D.N.Y. July 13, 2023) (sometimes a security).

55. Ripple, 2023 U.S. Dist. LEXIS 120486.

56. Id. at *40-41.

57. Terraform, 2023 WL 48582999, at *15.

58. See CFTC v. Ooki DAO, No. 3:22-cv-05416-WHO, 2022 U.S. Dist. LEXIS 228820 (N.D. Cal. Dec. 20, 2022); Order, In re iFinex Inc., CFTC No. 22-05 (Oct. 15, 2021); In re Opyn, Inc., CFTC No. 23-40 (Sept. 7, 2023); In re ZeroEx, Inc., CFTC No. 23-41 (Sept. 7, 2023); In re Deridex, Inc., CFTC No. 23-42 (Sept. 7, 2023).

59. Ooki DAO, 2022 U.S. Dist. LEXIS 228820, at *4, *6, *12-13.

60. See In re Opyn, Inc., CFTC No. 23-40; In re ZeroEx, Inc., CFTC No. 23-41; In re Deridex, Inc., CFTC No. 23-42.

61. Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (SI 2017/692). Available at: https://www.legislation.gov.uk/uksi/2017/692/contents (Accessed: September 23, 2024).

62. Financial Conduct Authority (2024) Cryptoasset AML / CTF regime: feedback on good and poor quality applications. Available at: https://www.fca.org.uk/firms/cryptoassets-aml-ctf-regime/feedback-good-poor-applications (Accessed: September 17, 2024).

63. Under the US federalist system, most states maintain state money transmitter regulations that impose separate registration, qualification and operation requirements upon affected business. The applicable requirements can differ materially from FinCEN obligations and those of other states.

64. 31 CFR § 1010.100(ff)(5)(i)(A); Department of the Treasury Financial Crimes Enforcement Network (2013) Application of FinCEN's Regulations to Persons Administering, Exchanging, or Using Virtual Currencies. Available at: https://www.fincen.gov/sites/default/files/shared/FIN-2013-G001.pdf (Accessed: September 24, 2024).

65. 31 CFR § 1022.380.

66. Parts 1010 and 1022 of 31 CFR Chapter X.

67. 31 CFR § 1010.100(ddd).

68. 31 CFR § 1010.410(e).

69. 31 CFR § 1010.410(f).

70. 31 USC § 5318(g)(1); 31 CFR § 1022.320(a)(2).

71. Financial Crimes Enforcement Network (2020) Application of FinCEN's Regulations to Certain Business Models Involving Convertible Virtual Currencies. Available at: https://www.fincen.gov/sites/default/files/2019-5/FinCEN%20Guidance%20CVC%20FINAL%20508.pdf (Accessed: September 24, 2024).

72. Global Legal Insights – Blockchain & Cryptocurrency Regulation (2024). 6th Edition, p. 87. Available at: https://www.acc.com/sites/default/files/resources/upload/Blockchain%20and%20Cryptocurrency%20Regulation%202024.pdf (Accessed: September 24, 2024).

73. European Banking Authority (2024) The EBA issues 'travel rule' guidance to tackle money laundering and terrorist financing in transfers of funds and crypto assets. Available at: https://www.eba.europa.eu/publications-and-media/press-releases/eba-issues-travel-rule-guidance-tackle-money-laundering-and-terrorist-financing-transfers-funds-and (Accessed: September 9, 2024).

74. European Banking Authority (2024) The EBA issues 'travel rule' guidance to tackle money laundering and terrorist financing in transfers of funds and crypto assets. Available at: https://www.eba.europa.eu/publications-and-media/press-releases/eba-issues-travel-rule-guidance-tackle-money-laundering-and-terrorist-financing-transfers-funds-and (Accessed: September 9, 2024).

75. Sanctioned countries and regions as of the date of this chapter are Cuba, the Democratic People's Republic of Korea (North Korea), Iran, Syria, Crimea (Ukrainian region), the Donetsk People's Republic (Ukrainian region), the Kherson People's Republic (Ukrainian region), the Luhansk People's Republic (Ukrainian region) and the Zaporizhzhia People's Republic (Ukrainian region).

76. Office of Foreign Assets Control (no date) Sanctions List Search. Available at: https://sanctionssearch.ofac.treas.gov (Accessed: September 24, 2024).

77. Federal Register (2023) Executive Order: Taking Additional Steps With Respect to the Russian Federation's Harmful Activities. Available at: https://ofac.treasury.gov/media/932441/download?inline (Accessed: September 24, 2024).

78. Office of Foreign Assets Control (2021) Sanctions Compliance Guidance for the Virtual Currency Industry. Available at: https://ofac.treasury.gov/media/913571/download?inline (Accessed: September 24, 2024).

79. Office of Foreign Assets Control (2020) OFAC Enters Into $98,830 Settlement with BitGo, Inc. for Apparent Violations of Multiple Sanctions Programs Related to Digital Currency Transactions. Available at: https://ofac.treasury.gov/media/50266/download?inline (Accessed: September 24, 2024); OFAC (2020) OFAC Enters Into $507,375 Settlement with BitPay, Inc. for Apparent Violations of Multiple Sanctions Programs Related to Digital Currency Transactions. Available at: https://ofac.treasury.gov/media/54341/download?inline#:~:text=Digital%20Currency%20Transactions-,BitPay%2C%20Inc.,violations%20of%20multiple%20sanctions%20programs (Accessed: September 24, 2024).

80. Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the on the free movement of such data, and repealing Directive 95/46/EC. Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679 (Accessed: September 22, 2024).

81. Information Commissioner's Office (no date) Overview – Data Protection and the EU. Available at: https://ico.org.uk/for-organisations/data-protection-and-the-eu/overview-data-protection-and-the-eu (Accessed: September 22, 2024).

82. Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the on the free movement of such data, and repealing Directive 95/46/EC. Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679 (Accessed: September 22, 2024).

83. European Parliament (2019) Blockchain and the General Data Protection Regulation. Available at: https://www.europarl.europa.eu/RegData/etudes/STUD/2019/634445/EPRS_STU(2019)634445_EN.pdf (Accessed: September 22, 2024).

84. US federal laws applicable to businesses operating in specific industries include the Gramm-Leach-Bliley Act, see 15 USC § 6801 et seq., and the Health Insurance Portability and Accountability Act, Pub. L. 104-191. See 65 FR 82462 (Dec. 28, 2000) and 67 FR 53182 (Aug. 14, 2002).

85. California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq.

86. 15 USC § 18a et seq.; 16 CFR § 801 et seq.

87. Defense Production Act § 721; Executive Order 11858; 31 CFR Chapter VII.

88. Federal Trade Commission (2024) Revised Jurisdictional Thresholds for Section 7A of the Clayton Act. Available at: https://www.federalregister.gov/documents/2024/02/05/2024-02227/revised-jurisdictional-thresholds-for-section-7a-of-the-clayton-act (Accessed: September 24, 2024).

89. Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (SI 2017/692). Available at: https://www.legislation.gov.uk/uksi/2017/692/contents (Accessed: September 23, 2024).

90. Financial Services and Markets Act 2000, c. 8. Available at: https://www.legislation.gov.uk/ukpga/2000/8/section/181 (Accessed: September 23, 2024).

91. National Security and Investment Act 2021, c. 25. Available at: https://www.legislation.gov.uk/ukpga/2021/25/contents (Accessed: September 23, 2024).

92. European Commission (no date) Investment screening. Available at: https://policy.trade.ec.europa.eu/enforcement-and-protection/investment-screening_en (Accessed: September 9, 2024).

93. European Union (2022) Screening framework for foreign direct investments. Available at: https://policy.trade.ec.europa.eu/enforcement-and-protection/investment-screening_en (Accessed: September 2, 2024).

94. République Francaise (2024) Bureau du contrôle des investissements étrangers en France – CIEF. Available at: https://policy.trade.ec.europa.eu/enforcement-and-protection/investment-screening_en (Accessed: September 22, 2024).

95. Ministère de l'Économie et des Finances (no date) Foreign Direct Investment Screening in France. Available at: https://www.tresor.economie.gouv.fr/Articles/84d2a0ee-c6f4-4e3a-9dfb-3e048b7f76b8/files/3a44e5f8-2ef5-43d1-9243-6bef3d9be0e4 (Accessed: September 22, 2024).

96. UNCTAD (2019) France – Strengthens its FDI screening mechanism with "PACTE Act". Available at: https://investmentpolicy.unctad.org/investment-policy-monitor/measures/3386/france-strengthens-its-fdi-screening-mechanism-with-pacte-act- (Accessed: September 22, 2024).

97. Ministère de l'Économie, des Finances et de la Souveraineté industrielle et numérique (2020) Update of the foreign direct investment screening procedure in France. Available at: https://www.tresor.economie.gouv.fr/Articles/2020/04/30/covid-19-update-of-the-foreign-direct-investment-screening-procedure-in-france (Accessed: September 22, 2024).

98. UNCTAD (2024) France – Makes the foreign investment control regime permanent and further expands its scope. Available at: https://investmentpolicy.unctad.org/investment-policy-monitor/measures/4513/makes-the-foreign-investment-control-regime-permanent-and-further-expands-its-scope (Accessed: September 22, 2024).

99. Council Directive 2001/23/EC on the approximation of the laws of the Member States relating to the safeguarding of employees' rights in the event of transfers of undertakings, businesses or parts of undertakings or businesses (2001) Official Journal L082. Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32001L0023 (Accessed: September 2, 2024).

Originally published by Global Legal Group Ltd.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Find out more and explore further thought leadership around Business Law and Corporate Law
See More Popular Content From

Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.

Learn More