United States

The FCPA anti-bribery provisions (15 U.S.C. 78dd-1) bar corruptly offering or paying anything of value to a foreign official, using the mails or interstate commerce, to influence the official, induce an unlawful act or gain an improper advantage in obtaining or keeping business.

Sec. 101(c) of the E-SIGN Act allows an electronic record to satisfy a written-notice requirement only if the consumer affirmatively consents after clear disclosures (including the right to paper copies and to withdraw consent), is told the hardware and software needed, and consents in a way that shows access to the electronic format.

Covered businesses must honour California consumers' rights to know, delete, correct, opt out of sale or sharing (including through a global privacy control) and limit use of sensitive personal information, without discriminating against those who exercise them. Thresholds: revenue over US$25 million, data of 100,000 or more residents or households, or 50 per cent of revenue from selling personal information.

Covered non-exempt employees must be paid at least the federal minimum wage (US$7.25 an hour), overtime at not less than one and one-half times the regular rate for hours over 40 in a workweek, and employers must post the official poster and keep time and pay records. Where state law is higher, the higher rate governs.

31 CFR 501.603(b)(1) requires a US person holding blocked property to report it to OFAC within 10 business days of the date it becomes blocked.

31 CFR 1020.210(a)(2) requires a bank's AML programme to include internal controls, independent testing, one or more designated individuals to coordinate and monitor day-to-day compliance, training, and risk-based customer due diligence (para. (a)(2)(v)). Banks with a federal functional regulator must also meet that regulator's programme rule.

31 CFR 1010.430(d) requires all records that Chapter X requires to be retained to be kept for five years. Orders under 1010.370 may set a shorter period, not above five years.

12 CFR 53.3 requires a banking organization to notify the OCC of a notification incident as soon as possible and no later than 36 hours after determining one has occurred. Under 53.4 a bank service provider must tell affected bank customers as soon as possible after a disruption lasting four or more hours.

31 CFR 1010.311 requires financial institutions other than casinos to report each deposit, withdrawal, exchange of currency or other payment or transfer involving more than US$10,000 in currency. 31 CFR 1010.306(a)(1) sets filing within 15 days after the transaction.

31 CFR 1010.230(b) requires covered institutions to identify beneficial owners of legal entity customers when a new account is opened and to verify their identity using risk-based procedures. Ongoing monitoring and customer profile updating sit in the AML programme under 31 CFR 1020.210(a)(2)(v). Identification records are kept five years after the account closes and verification records five years after they are made (1010.230(i)(2)).

31 CFR 1020.220(a) requires a written, risk-based CIP. Before opening an account the bank must obtain name, address, identification number and, for individuals, date of birth, and must verify identity within a reasonable time. Identifying information is kept for five years after the account closes; other CIP records for five years after they are made (para. (a)(3)(ii)).

31 CFR 1020.320(a)(2) requires a SAR for a transaction involving or aggregating at least US$5,000 where the bank knows, suspects or has reason to suspect illegal funds, evasion of BSA duties, or no apparent lawful purpose. Copies and supporting documents are kept five years from filing (para. (d)).

The interagency guidance expects banks to manage risk across the third-party life cycle, scaled to the risk and criticality of each relationship. It is guidance rather than a rule, and the agencies proposed replacing it in September 2026.

16 CFR 314.4(j) requires electronic notice to the FTC of a notification event involving at least 500 consumers. An event is treated as discovered on the first day it is known to anyone in the organisation other than the person who committed the breach.

16 CFR 314.4 requires a Qualified Individual, a written risk assessment, encryption in transit and at rest, multi-factor authentication, annual penetration testing and vulnerability assessments at least every six months unless continuous monitoring is in place, a written incident response plan and at least annual written reporting to the board.

Sec. 3(a) of the GENIUS Act allows only a permitted payment stablecoin issuer to issue payment stablecoins in the US. Eligible issuers are US-formed subsidiaries of insured depository institutions, Federal qualified issuers or State qualified issuers (Sec. 2(23)), approved under Sec. 5.

Sec. 4(a) requires reserves of at least 1-to-1 in eligible assets such as US currency, insured deposits and short-dated Treasuries, a published redemption policy and monthly reserve composition reports examined by a registered public accounting firm and certified by the CEO and CFO. Issuers may not pay yield solely for holding the stablecoin (Sec. 4(a)(11)). Issuers are also treated as BSA financial institutions (Sec. 4(a)(5)).

23 NYCRR 200.3(a) bars Virtual Currency Business Activity without a licence from the Superintendent. DFS says an out-of-state business needs a BitLicense where its activity involves New York or people located there; a New York limited purpose trust charter is an alternative route.

31 CFR 1022.380 requires each money services business to register with FinCEN whether or not a state licenses it; the initial form is due by the end of the 180-day period after the business is established, with renewal every two calendar years. A foreign-located MSB must name a US agent for legal process. FinCEN's 2019 guidance treats CVC administrators and exchangers as money transmitters. 18 U.S.C. 1960 criminalises operating without registration.

Issuers with securities listed in the US must make and keep books and records that accurately and fairly reflect transactions, and devise and maintain an adequate system of internal accounting controls, under the FCPA's accounting provisions.

15 U.S.C. 78j-1(m)(4) requires each audit committee to set up procedures for receiving, retaining and treating complaints about accounting, internal accounting controls or auditing, and for confidential, anonymous submission by employees of concerns about questionable accounting or auditing matters.

An Item 1.05 Form 8-K must be filed within four business days of determining an incident was material, and the determination must be made without unreasonable delay. The Attorney General can authorise delays for national security or public safety, initially up to 30 days.

18 U.S.C. 1514A prohibits covered companies and their officers, employees, contractors and agents from discharging, demoting, threatening or otherwise discriminating against an employee for reporting fraud or securities violations. An employee must file with the Secretary of Labor no later than 180 days after the violation or after becoming aware of it.