China-Taiwan Conflict Threatens to Strain US Compliance Teams

In recent weeks, the People’s Republic of China conducted a wide-ranging military exercise simulating strikes across Taiwan and formally arrested a Taiwanese political activist. All while PRC incursions into airspace and territorial waters claimed by Taiwan are increasing. As tensions rise, U.S. military and national security leaders have expressed growing concern about the strong possibility of a war in Taiwan with some senior military leaders warning that the PRC could initiate hostilities as early as 2025, if not sooner.

It was just over a year ago that similar tensions played out in Eastern Europe. After years of aggression along its borders that led to de facto annexations of South Ossetia and Abkhazia (from Georgia) and Crimea (from Ukraine), Russia launched a massive invasion of Ukraine in February 2022. Despite the recent history of Russian aggression and the overt warnings from the U.S. government in the weeks leading up to the invasion, the war seemed to catch many U.S. businesses off-guard and unprepared.

Last week, in the midst of the rising China-Taiwan tensions, Rob Joyce — the National Security Agency’s head of cybersecurity — emphasized that “you don’t want to be starting that planning the week before an invasion, when you’re starting to see the White House saying it’s coming, right? You want to be doing that now and buying down your risk and making those decisions in advance.”

Joyce’s advice applies to compliance professionals and in-house counsel just as much as other corporate stakeholders. A war in Taiwan could be one of the most disruptive geopolitical events in decades. With that unprecedented disruption will inevitably come new compliance risks, challenges and needs — ones that will require substantial planning and preparation to navigate effectively. Now is the time for forward-looking organizations to prepare.

How to plan for geopolitical conflict

The first step involves working with stakeholders across the company to understand how a conflict might affect your business and operations. Those effects will depend on a number of variables, including how and where a war is likely to develop, as well as first-order and second-order consequences. There is a growing literature on the likely military dynamics of a potential war in connection with Taiwan, including detailed reports of wargaming exercises by leading think tanks. In addition to kinetic activity in and around Taiwan, many experts also expect increased cyber activity and industrial espionage directed at the U.S. 

These military and security events would have significant economic and political consequences.  Discussions of the economic impact of a war in Taiwan often focus on supply-chain disruption — and for good reason. Almost any military scenario would dramatically curtail trade with Taiwan and the PRC, as well as impacting the trillions of dollars in commerce that flows through the South China Sea and through ports worldwide over which PRC-aligned entities exercise control.  While these supply-chain disruptions would likely be most acute in particular sectors — such as semiconductors and processed rare-earth minerals — no company’s supply chain will remain unscathed in the event of a conflict.

The Russia-Ukraine conflict has provided a model — at least, in miniature — for understanding how military conflict can disrupt supply chains, as witnessed by the scarcity and extreme volatility experienced in Europe and the Mideast over the past year in connection with natural gas, fertilizer and food. A war in Taiwan would easily exceed what we have seen in the past year, both in terms of scope and intensity.

The U.S. government’s response to Russia’s invasion of Ukraine gives a glimpse of some possible trade policy consequences of a war in Taiwan. In the event of a PRC attack, it is very likely that the U.S. will impose substantial sanctions against the PRC, as well as additional export controls aimed at the PRC’s ability to maintain the war effort. On the home front, the U.S. government’s purchasing needs would increase substantially, and the military (and other government agencies) would likely seek to expand their manpower rapidly.

Because these variables will impact every company differently, corporate stakeholders must carefully consider how the possible consequences of a war in Taiwan might impact their company’s particular business and operations. What alternate sourcing strategies will the firm pursue if its primary supply chains are cut off? What key operations, personnel or business partners may need to be relocated or replaced? How will the conflict — and ensuing sanctions or export controls — affect the company’s customer base?  Will the firm seek out new government contracting opportunities?

Once a company has projected the likeliest impacts of war, it is necessary to assess the compliance implications of those likely impacts.  These will differ substantially between companies, and while it is impossible to compile a comprehensive list, several potential risk areas warrant particular attention:

• Anti-bribery/FCPA compliance: Worldwide supply chains and overseas operations are a substantial source of compliance risk, particularly under the FCPA and other anti-bribery regimes. The DOJ and SEC have emphasized that effective compliance plans should account for country-specific risks and be updated in light of new developments. As firms adjust their supply chains and global operations to avoid fallout from a war in Taiwan, they must also review and revise their compliance programs to account for changes in their risk profile.
• Government procurement compliance: As firms pivot to meet the U.S. government’s ballooning procurement needs, it is essential that they have appropriate controls in place to limit risk under the False Claims Act (FCA) and similar anti-fraud provisions. Here, the Covid experience is telling. The federal government launched or expanded a host of programs with the specific goal of finding new private-sector partners. But as DOJ’s investigative and prosecution approach demonstrates, the government expects even those new to large-scale government contracting to meet the most stringent compliance standards, even under emergency conditions.
• Cybersecurity and privacy: The PRC has some of the most fearsome cyber capabilities in the world. In the event of a large-scale conflict, the PRC may deploy those capabilities against critical infrastructure in the U.S. Companies must be prepared for this heightened cyber risk environment, particularly those operating in critical industries or that handle sensitive data and especially in light of the government’s recent push to expand FCA enforcement into the area of cybersecurity-related procurements.
• Sanctions, export controls and AML: In the event of a PRC attack against Taiwan, the U.S. and its allies are likely to respond with stiff sanctions and export controls against the PRC, as well as companies and individuals associated with the PRC. Firms need to be prepared to promptly implement those measures and ensure compliance. The government will have both strategic and political incentives to pursue violations of those measures extremely aggressively.

Conclusion

As is usually the case in the compliance world, this comprehensive planning is just the beginning, not the end. Companies must continue to monitor the situation and adapt as potential contingencies evolve. As the likely dynamics of a conflict — and the second- and third-order consequences — change over time, so too must the compliance and legal strategies needed to respond to those changes. It is also worth monitoring the likely economic, military and social indicators of an impending invasion or blockade of Taiwan.