by Anna Bleazard

In-house counsels across Asia-Pacific are increasingly operating at the intersection of two powerful forces. Under the current Trump administration, U.S. enforcement priorities are shifting, while the regional regulatory environment is becoming more complex. Together, these dynamics are reshaping how companies assess and manage enforcement risk, particularly as U.S. regulators continue to assert jurisdiction beyond their borders.

Organisations face a growing challenge: how to navigate the evolved posture of U.S. regulators, particularly the U.S. Department of Justice (DOJ), Securities and Exchange Commission (SEC), and Office of Foreign Assets Control (OFAC), while also meeting local enforcement expectations. Compliance strategies must now account for overlapping enforcement priorities, cross-border investigations, and increasingly coordinated regulatory scrutiny.

The Regulatory Pivot

Shifts in DOJ and SEC leadership have resulted in changed enforcement priorities in areas such as corporate cooperation, voluntary self-disclosure, sanctions enforcement, and the treatment of recidivism. When Foreign Corrupt Practices Act (FCPA) enforcement was paused in February last year[1], much speculation ensued as to what this would mean both in the immediate and the longer term for U.S. and foreign companies.

The subsequent publication, in June 2025, of updated FCPA guidance[2] described a more targeted approach to FCPA enforcement with individual accountability identified as a top priority, signalling that the DOJ would take more aggressive action against individual executives for FCPA misconduct.

Additionally, there would be increased focus on cases involving “cartels”, transnational criminal organisations, and foreign terrorist organisations as well as heightened scrutiny of companies operating in, or adjacent to, sectors advancing U.S. national security. For foreign companies the guidance focuses on whether their actions harmed a U.S. company or “deprived” a U.S. company or individual of an economic opportunity.  

In-house counsel in Asia-Pacific therefore need to remain alert to the risk of FCPA enforcement as the landscape pivots. This is further highlighted by the continuation of enforcement actions throughout 2025, including in Asia-Pacific. Indeed, the first publicly announced corporate resolution involving bribery allegations since the DOJ resumed overseas corruption probes was the Liberty Mutual declination, under which the company agreed to pay back $4.7 million in profits arising from bribery by its Indian subsidiary, Liberty General Insurance. Even under the narrower approach, the DOJ has demonstrated that it will still take action on foreign allegations involving U.S. multinationals.

Most recently, leading Democratic U.S. senators introduced a bill seeking to extend the statute of limitations for FCPA violations from five to ten years[3]. Companies should take this as a warning that the legal risks associated with the FCPA are long-term and not tied to any single administration. The strategic question for in-house counsel therefore remains not whether U.S. enforcement will reach into the region — but how prepared organisations are when it does.

Forensic Readiness

Whistleblower regimes have matured globally, and allegations now move faster, and more publicly, than ever before. Cross-border government inquiries frequently involve parallel regulators, overlapping information requests, and conflicting legal obligations.

Robust forensic readiness requires:

• Pre-defined investigative protocols.
• Clear governance over decision-making and reporting lines.
• Cross-border data transfer strategies that account for privacy, state secrets, and data localised laws.
• Early preservation and defensible collection of digital evidence.

On 10 March 2026, the DOJ launched its first ever department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP), consolidating and standardising how prosecutors handle corporate criminal cases, regardless of subject matter. The updated CEP establishes a standard set of incentives for companies that voluntarily self-disclose, fully cooperate, and remediate issues in a timely and appropriate manner. It signals increased expectations that companies will proactively detect and report potential misconduct instead of waiting for regulators or whistleblowers to surface issues.

Meeting the high bar for “timeliness” is often a challenge for in-house counsel in the region, not least due to language barriers and local culture nuances, which can obscure the facts and extend investigation timelines, increasing the risk of premature or incorrect disclosures. In some jurisdictions, there is also limited familiarity with U.S. reporting expectations, especially when compared to local regulatory regimes, which differ in their level of robustness, responsiveness, and effectiveness.

Companies that continue to treat investigations simply as episodic events often find themselves exposed or scrambling in these high-pressure situations. By contrast, companies that embed investigative resilience into governance frameworks are better positioned to demonstrate credibility with regulators.

Mitigation and Remediation

Regulators expect compliance programmes to be risk-based, dynamic, and demonstrably integrated into business operations. Tone from the top is scrutinised alongside incentive structures, disciplinary frameworks, and data-driven monitoring. With far greater transparency and accountability, there is little room to hide and even less room to get it wrong.

Timely and appropriate remediation is another requirement set by the DOJ, and the latest CEP retains the same requirements as in prior iterations. These include the need for companies to have conducted a root cause analysis, implement tailored and effective compliance and ethics programmes, identified and disciplined employees responsible for misconduct, retained records, and undertaken other additional steps to demonstrate taking responsibility and recognising the seriousness of the misconduct.

For companies operating across Asia-Pacific, in-house counsel need to ensure that compliance programmes are effective and appropriately calibrated. This includes reflecting U.S. enforcement benchmarks, local anti-corruption rules and regulations, expanding sanctions and export control obligations and sector-specific supervisory expectations.

The Digital Smoking Gun

The modern investigation is digital-first, however whilst the “digital smoking gun” may exist, it is often buried within terabytes of data.

Data volumes continue to grow exponentially; data sources continue to diversify in both structured and unstructured forms and the way we communicate is less linear. Business communications now extend beyond emails and phone calls to instant messaging, video conferencing and chat apps such as WhatsApp and WeChat. Throw in the use of ephemeral messaging platforms – communication apps that automatically delete messages, photos or videos immediately or after a set period – and other business collaboration tools, and it is clear that the evidentiary landscape is being fundamentally reshaped.

Compliance and investigation tools are evolving to keep pace, and generative artificial intelligence (AI) is increasingly being utilised in investigations to identify and surface key potential evidence. Companies are increasingly investing in preventative AI monitoring tools to proactively identify potential red flags and strengthen their compliance controls. While such tools drive efficiencies, in their ability to rapidly analyse large datasets and identify patterns that humans may miss, they are not without their limitations, for example, in misreading context and generating large volumes of false positives. Asia-Pacific presents additional challenges with its language diversity and cultural communication nuances. Keeping the human in the loop therefore remains essential.

In addition, cross-border data collection is becoming more legally complex, particularly in jurisdictions with strict data privacy and data localisation laws. In-house counsel must remain current on the legal requirements across the jurisdictions that they oversee.

When it comes to investigations in this digital age, this demands:

• Advanced digital forensics capabilities
• Clear policies on business communications, ephemeral messaging, and record retention
• Strong governance over AI-driven decision systems
• Early engagement with regulators on data transfer challenges

From Reaction to Strategic Anticipation

In summary, enforcement risk in Asia-Pacific cannot be managed in silos. U.S. priorities influence regional regulators. Regional enforcement actions influence U.S. scrutiny. Geopolitical dynamics amplify sanctions exposure. Technology accelerates both misconduct and its detection.

For in-house counsel, the mandate is evolving and requires anticipating regulatory pivots. Companies need to ensure that they are aligning global and local compliance strategies, building forensic readiness into the operating model, and treating digital risk as a core governance risk.

---

[1] On 10 February 2025, Executive Order 14209 was signed pausing FCPA enforcement for 180 days.
[2] FCPA guidance was published on 9 June 2025.
[3] On 9 March 2026, 14 Democratic U.S. senators introduced the FCPA Reinforcement Act.