CCB Cross-Border Compliance Issues 2 — Questions and Answers
Question 1: Under the EU General Data Protection Regulation (GDPR), which mechanism allows a US company to legally transfer personal data from the EU without relying on Standard Contractual Clauses?
- Privacy Shield 2.0
- EU-US Data Privacy Framework (Correct answer)
- Safe Harbor Agreement
- Binding Arbitration Protocol
Correct answer: EU-US Data Privacy Framework
The EU-US Data Privacy Framework, adopted in 2023, is the current adequacy decision allowing certified US companies to receive EU personal data lawfully.
Question 2: A multinational company has subsidiaries in 12 countries. Which approach to cross-border compliance governance best balances local adaptability with global consistency?
- Fully centralized compliance managed only from headquarters
- Fully decentralized compliance with no headquarters oversight
- A hub-and-spoke model with central standards and local implementation teams (Correct answer)
- Outsourcing all compliance functions to a single global law firm
Correct answer: A hub-and-spoke model with central standards and local implementation teams
A hub-and-spoke model allows headquarters to set global standards while local teams adapt and implement those standards within their jurisdictions.
Question 3: Which US law requires companies to disclose payments made to foreign governments in the extractive industries, directly affecting cross-border compliance reporting?
- Foreign Corrupt Practices Act (FCPA)
- Dodd-Frank Section 1504 (Correct answer)
- Export Administration Regulations (EAR)
- International Emergency Economic Powers Act (IEEPA)
Correct answer: Dodd-Frank Section 1504
Dodd-Frank Section 1504 (the Cardin-Lugar amendment) requires resource extraction issuers to disclose payments made to foreign governments for extractive activities.
Question 4: When a company discovers that a foreign subsidiary violated local anti-bribery laws, what is the FIRST step the compliance officer should take?
- Immediately self-report to the US Department of Justice
- Preserve evidence and conduct a preliminary internal investigation (Correct answer)
- Terminate the employees involved without further inquiry
- Notify all local regulatory authorities in every operating country
Correct answer: Preserve evidence and conduct a preliminary internal investigation
Preserving evidence and conducting a preliminary internal investigation ensures facts are secured before any disclosure or enforcement decisions are made.
Question 5: The UK Bribery Act 2010 differs from the US FCPA primarily in which respect?
- The UK Bribery Act only applies to public officials, not private sector bribery
- The UK Bribery Act criminalizes commercial bribery between private parties, not just bribery of government officials (Correct answer)
- The FCPA applies globally while the UK Bribery Act applies only within the UK
- The UK Bribery Act does not require companies to have compliance programs
Correct answer: The UK Bribery Act criminalizes commercial bribery between private parties, not just bribery of government officials
Unlike the FCPA, the UK Bribery Act criminalizes private-to-private commercial bribery in addition to bribery of public officials.
Question 6: A US exporter wants to sell dual-use technology to a company in Country X. Which database should the compliance officer consult FIRST to assess export control risk?
- OFAC Specially Designated Nationals (SDN) List
- BIS Entity List and Country Chart under EAR (Correct answer)
- State Department Debarred Parties List
- Interpol Red Notice database
Correct answer: BIS Entity List and Country Chart under EAR
The BIS Entity List and the EAR Country Chart are the primary tools for determining export licensing requirements for dual-use items under Export Administration Regulations.
Question 7: A cross-border merger involves entities in the US, EU, and Brazil. Which competition authority has jurisdiction to review the transaction for antitrust concerns?
- Only the US Department of Justice Antitrust Division
- Only the European Commission DG Competition
- Each jurisdiction where the transaction meets local filing thresholds (Correct answer)
- The World Trade Organization (WTO)
Correct answer: Each jurisdiction where the transaction meets local filing thresholds
Merger control is jurisdictional—each country or bloc where transaction thresholds are met requires a separate filing and approval.
CCB Cross-Border Compliance Issues 2
Under the EU General Data Protection Regulation (GDPR), which mechanism allows a US company to legally transfer personal data from the EU without relying on Standard Contractual Clauses?