Regulatory Frameworks and Legal Compliance Flashcards

A multinational corporation discovers that its EU subsidiary has been processing employee biometric data under a legitimate interest lawful basis rather than explicit consent. Under GDPR Article 9, which of the following best describes the legal position?

Answer: Processing is unlawful because Article 9 prohibits special category data processing under legitimate interest; explicit consent or another Article 9(2) exception is required

GDPR Article 9 establishes a higher protection regime for special category data (which includes biometric data used for unique identification). Unlike Article 6 lawful bases for general personal data, Article 9 does not include legitimate interest as a permissible ground. Processing must rely on an explicit exception under Article 9(2), such as explicit consent (9(2)(a)), employment law obligations (9(2)(b)), or vital interests (9(2)(c)). A DPIA or DPO documentation does not cure the absence of a valid Article 9(2) basis.

Under the U.S. Bank Secrecy Act (BSA) and FinCEN regulations, a compliance officer at a money services business learns that a customer structured three cash transactions of $4,500 each on consecutive days to avoid triggering a Currency Transaction Report. The transactions occurred across two branch locations. Which regulatory obligation is MOST directly triggered?

Answer: Filing a Suspicious Activity Report, because structuring to evade CTR thresholds is itself a federal crime under 31 U.S.C. § 5324, regardless of whether any underlying transaction is illicit

Structuring — deliberately breaking up transactions to stay below the $10,000 CTR threshold — is a standalone federal crime under 31 U.S.C. § 5324, irrespective of whether the underlying funds are legitimate. This pattern triggers a mandatory SAR filing obligation. CTRs apply to single-day cash transactions aggregating over $10,000, but the criminal act here is the structuring behavior itself. Critically, SAR 'tipping off' prohibitions under 31 U.S.C. § 5318(g)(2) expressly prohibit notifying the customer that a SAR has been or may be filed — eliminating option D.

A compliance manager at a publicly traded company is reviewing a proposed share buyback program. Outside counsel advises that the company is currently in possession of material non-public information (MNPI) related to pending merger discussions. Which of the following represents the most defensible compliance posture under SEC Rule 10b5-1 and Rule 10b-18?

Answer: Suspend the buyback program immediately, because Rule 10b-18 does not provide an affirmative defense against insider trading liability and possession of MNPI disqualifies the company from the Rule 10b5-1 safe harbor for any new or modified plan

Rule 10b-18 provides a safe harbor against market manipulation claims (Rule 10b-5 manipulation prong) for repurchase mechanics, but it explicitly does not provide an affirmative defense against insider trading liability. A 10b5-1 plan entered into while the company is aware of MNPI is invalid from inception under the 'awareness' standard of Rule 10b5-1(c). The 2023 SEC amendments further require cooling-off periods and good-faith adoption — but no cooling-off period cures a plan adopted with existing MNPI awareness. The only defensible posture is suspension until the MNPI is either disclosed or no longer material.

Under the EU Corporate Sustainability Reporting Directive (CSRD) and the European Sustainability Reporting Standards (ESRS), which of the following describes the 'double materiality' assessment that a CCM must oversee?

Answer: An assessment evaluating both the financial materiality of ESG risks to the company and the company's impact materiality on the environment and society, both of which must be reported if material under either dimension

CSRD's double materiality concept, operationalized through ESRS 1, requires companies to assess materiality from two perspectives simultaneously: (1) 'impact materiality' — the company's actual or potential impacts on people and the environment (inside-out view); and (2) 'financial materiality' — sustainability-related risks and opportunities that affect the company's financial position, performance, or prospects (outside-in view). A topic is reportable if it is material under either dimension, not only both. This dual lens is a distinctive departure from purely investor-focused materiality frameworks like those under IFRS S1/S2.

A compliance officer discovers that the company's third-party vendor, which processes personal data on behalf of the company, has suffered a data breach affecting EU data subjects. The breach was contained within 48 hours of discovery by the vendor. The vendor notified the company 36 hours after their own discovery. Under GDPR Articles 33 and 28, which statement most accurately describes the controller's obligations and timeline?

Answer: The controller's 72-hour notification clock under Article 33 runs from when the controller becomes aware of the breach; the controller is deemed aware when the processor (as its agent) discovered it, making the effective deadline approximately 36 hours from the vendor's notification to the company

Under GDPR Article 33, the controller must notify the competent supervisory authority within 72 hours of becoming 'aware' of a breach. EDPB guidelines (Guidelines 9/2022 on personal data breach notification) clarify that a controller is deemed 'aware' when it has a reasonable degree of certainty that a breach has occurred — and importantly, awareness of the processor is attributed to the controller for this purpose, since processors act on the controller's behalf. The processor's obligation under Article 33(2) is to notify the controller 'without undue delay.' With the processor discovering at T=0, notifying the controller at T+36h, the controller's 72-hour window effectively began at T=0, leaving approximately 36 hours from receipt of the vendor's notification. The controller — not the processor — bears the Article 33 notification duty to the supervisory authority.

Under the U.S. Foreign Corrupt Practices Act (FCPA), a compliance manager is reviewing a situation where the company paid $15,000 to a foreign government official to expedite a customs clearance that the company was legally entitled to receive. The payment was accurately recorded in the company's books as 'expediting fees.' Which analysis is MOST accurate?

Answer: The payment likely qualifies for the facilitating payments exception to the anti-bribery provisions, but accurate recordkeeping alone does not insulate the company — the exception's scope has been narrowed by DOJ/SEC enforcement to exclude payments where the official exercises any discretion

The FCPA's facilitating payments exception (15 U.S.C. § 78dd-1(b)) does exempt payments to expedite or secure the performance of 'routine governmental actions' — including customs clearances — from the anti-bribery prohibition. Accurate, transparent recordkeeping as 'expediting fees' does satisfy the books-and-records prong for these payments. However, DOJ and SEC enforcement guidance and recent cases have significantly narrowed the exception's practical scope: where the official exercised any discretion (e.g., could have rejected or delayed the clearance), the payment may not qualify. The exception is narrow, fact-specific, and does not provide the blanket protection option A implies. Option B correctly captures the nuanced enforcement posture without the inaccuracies in C or D.