FTC Finalizes Major Rewrite of HSR Filing Requirements

Last week, the Federal Trade Commission (FTC) voted unanimously to issue a final rule that implements significant changes to the Hart-Scott-Rodino (HSR) premerger notification form and accompanying instructions. While the final rule includes numerous modifications from the draft proposal that was announced in June 2023 (see our previous client alert), this still represents the most substantial change to the HSR filing requirements in decades, and will require parties to HSR-reportable transactions to gather and provide considerably more information and documents than under the current rules. The final rule will take effect 90 days after publication in the Federal Register (unless there is a successful court challenge in the interim).

Under the HSR Act, parties to certain mergers and acquisitions are required to submit premerger notification forms that disclose information about their proposed deal and business operations. The FTC and the Antitrust Division of the US Department of Justice (DOJ) use this information to conduct a competitive impact assessment within the statutory HSR waiting period, which is typically 30 calendar days. According to the FTC’s press release accompanying the final rule, the new requirements are a necessary response “to changes in corporate structure and deal-making, as well as market realities in the ways businesses compete, that have created or exposed information gaps that prevent the agencies from conducting a thorough antitrust assessment of transactions subject to mandatory premerger review.”

Key Changes to HSR Filing Requirements

Some of the main changes will require the following:

  • A description of each party’s strategic rationales for the transaction, with cross-references to documents submitted with the HSR filings that support the stated rationales.
  • A new Overlap Narrative section that will require the buyer and target to identify and provide (i) a written description of current or planned products or services where they compete (or could compete) with each other, (ii) actual or projected revenues for each such product or service, (iii) a description of all categories of customers that purchase or use the product or service, and (iv) the top 10 customers for each customer category (e.g., retailer, distributor, broker, national account, local account, etc.).
  • A narrative describing supply relationships between the transaction parties or between the buyer and any other business that competes with the target, including the amount of revenue involved and the top 10 customers or suppliers.
  • In addition to requiring documents discussing the competitive aspects of the proposed transactions that were prepared by or for officers and directors (current Item 4(c)), filing persons must also submit (i) transaction-related documents prepared by or for a “supervisory deal team lead”, and (ii) ordinary course business plans and reports about overlapping products and services that were provided to the CEO or Board of Directors within a year prior to filing.
  • Acquiring persons must list all current and recent officers and directors (or in the case of unincorporated entities, individuals exercising similar functions) in cases where those individuals hold similar positions in entities that have overlapping operations with the target.
  • Identification of minority holders of additional entities related to the transaction parties, as well as more information about minority interest holders, including limited partners in partnerships where the limited partner has certain rights related to the board (or similar bodies) of the acquiring entity and its related parties, and in some cases, the target. (Currently, the HSR form only requires disclosure of the general partner.)
  • Additional information regarding certain prior acquisitions by both the buyer and the target. (Currently, only buyers must provide information regarding prior acquisitions.)
  • If an HSR filing is being made based on an executed letter of intent or term sheet rather than a definitive agreement, the filing must include a dated document containing sufficient details about the transaction.
  • Parties must submit the entirety of all agreements related to the transaction (not just the principal transaction agreement).
  • All foreign-language documents must be accompanied by English-language translations.
  • Filing parties must disclose economic subsidies received from certain foreign governments or entities of concern to the United States.
  • Information related to certain contracts with defense or intelligence agencies. 

    It is worth noting that a few particularly onerous or controversial proposals from the initial draft rule were not adopted, including the proposal to require collection and production of all drafts of responsive documents (rather than just final versions), as well as specific information about labor markets and each filing party’s workers.

    Related Changes to the Merger Review Process

    Significantly, the FTC announced that, following the final rule coming into full effect, it will lift its suspension on early termination of the waiting period for HSR filings involving transactions that clearly raise no competitive issues. According to the FTC, “[b]ecause the final rule will provide the agencies with additional information necessary to conduct antitrust assessments, the rule will help inform the processes and procedures used to grant early terminations.”

    The FTC also stated that it is introducing a new online portal for market participants, stakeholders, and the general public to directly submit comments on proposed transactions that may be under review by the FTC (it is unclear if the DOJ will follow suit). According to its press release, the FTC “welcomes information on specific transactions and how they may affect competition from consumers, workers, suppliers, rivals, business partners, advocacy organizations, professional and trade associations, local, state, and federal elected officials, academics, and others.”

    Practical Implications for Deals

    The final rule issued by the FTC marks a sea change in the preparation of filings for HSR-reportable transactions. The new requirements will significantly increase the time, effort and cost of preparing all HSR filings, with the impact likely to be magnified for deals where the buyer and target are competitors or operate within the same supply chain. Transaction parties will need to account for this new reality in their deal timelines and budgets. Transaction agreements will need to allow for more time to file HSR, and it may be advantageous for some parties to begin filing preparations much earlier in the deal process. In addition, the new transaction agreement requirements mean that key terms of deals will need to be more fully fleshed out before parties can file HSR and start the 30-day clock.

    Also, since filing parties will now have an affirmative obligation to disclose competitive overlaps as well as supplier-customer relationships, careful consideration will need to be given to how those are described, since statements made in the HSR filing could later be used against the parties in an in-depth investigation (if the reviewing agency issues a “Second Request”) or in litigation (if the agency challenges the deal). Moreover, for serial acquirors, descriptions of products and overlaps in one filing could have consequences for future HSR-reportable transactions.

    Additionally, the new obligation on filers to provide customer and/or supplier information in the HSR filing may cause parties to re-evaluate their approach towards third party outreach regarding proposed transactions, given the possibility of earlier and more frequent FTC/DOJ calls to those customers and suppliers.

    © 2024 Bracewell LLP
    For more on HSR, visit the NLR Antitrust Trade Regulation section.

Are We There Yet? DoD Issues Final Rule Establishing CMMC Program

The US Department of Defense (DoD) published a final rule codifying the Cybersecurity Maturity Model Certification (CMMC) Program. The final CMMC rule will apply to all DoD contractors and subcontractors that will process, store, or transmit Federal Contract Information (FCI)[1] or Controlled Unclassified Information (CUI)[2] on contractor information systems. The final CMMC rule builds on the proposed CMMC rule that DoD published in December 2023, which we discussed in depth here.

The final CMMC rule incorporates DoD’s responses to 361 public comments submitted during the comment period and spans more than 140 pages in the Federal Register. Many responses address issues raised in our prior reporting, and DoD generally appears to have been responsive to several concerns raised by the industry. In the coming weeks, we expect to update our separate summaries of CMMC Level 1, Level 2, and Level 3 to reflect the final rule. This OTS summarizes the key changes to the CMMC Program in the final rule.

In Depth

THE CMMC PROGRAM

The final CMMC rule adopts in large part the new Part 170 to Title 32 of the Code of Federal Regulations proposed in 2023. The final rule formally establishes the CMMC Program and defines the security controls applicable to each of the three CMMC levels; establishes processes and procedures for assessing and certifying compliance with CMMC requirements; and defines roles and responsibilities for the Federal Government, contractors, and various third parties for the assessment and certification process. 32 C.F.R. § 170.14 codifies the three CMMC levels outlined in CMMC 2.0, which are summarized as follows in an updated CMMC Model Overview included in Appendix A to the final CMMC rule:

CMMC Model 2.0
Model Assessment
Level 3 134 requirements based on NIST SP 800-171 and 800-172 Triennial government-led assessment and annual affirmation
Level 2 110 requirements aligned with NIST SP 800-171 Triennial third-party assessment and annual affirmation; Triennial self-assessment and annual affirmation for select programs
Level 1 15 requirements Annual self-assessment and annual affirmation

See Cybersecurity Maturity Model Certification (CMMC) Model Overview, Version 2.11 – DRAFT at 3-4 (Sept. 2024).

CMMC Level 1 is required for contracts and subcontracts that involve the handling of FCI but not CUI. The security requirements for CMMC Level 1 are those set forth in FAR 52.204-21(b)(1)(i)-(xv), which currently governs contracts involving FCI. Contractors must conduct and report a CMMC Level 1 Self-Assessment in DoD’s Supplier Performance Risk System (SPRS) prior to award of a CMMC Level 1 contract or subcontract. Thereafter, contractors must make an annual affirmation of continued compliance. The final CMMC rule requires compliance with all CMMC Level 1 requirements at the time of the assessment and does not allow contractors to include a Plan of Action and Milestones (POA&M) to comply with unmet requirements in the future.

CMMC Level 2 is required for contracts and subcontracts that involve the handling of CUI. The security requirements for CMMC Level 2 are identical to the requirements in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Rev 2, and the final CMMC rule adopts the scoring methodology for compliance with those requirements that is currently employed by DFARS 252.204-7020. The final CMMC rule establishes a minimum required score of 88 out of 110 for Conditional Level 2 status with a POA&M. The final CMMC rule allows for certain CMMC Level 2 requirements that are not met at the time of assessment to be addressed through POA&Ms if the contractor meets the minimum required score. A contractor with Conditional status is subject to close out of all POA&Ms, which must be reported in SPRS within 180 days of Conditional status. Conditional status must be achieved prior to the award of any contract subject to CMMC Level 2. If the contractor does not close out all POA&Ms within 180 days of Conditional status, the contractor becomes ineligible for additional awards of CMMC Level 2 contracts.

The final CMMC rule retains the proposed rule’s distinction between CMMC Level 2 Self-Assessments and CMMC Level 2 Certification Assessments. CMMC Level 2 Certification Assessments are issued by CMMC Third-Party Assessment Organizations (C3PAOs) and fulfill one of the primary goals of the CMMC Program: independent verification of contractor compliance with CMMC security requirements. Whether a CMMC Level 2 Self-Assessment or Certification Assessment will apply to a particular contract will be determined by DoD based on the sensitivity of the CUI involved with that contract. When the final CMMC rule is fully implemented, DoD expects that the vast majority of CMMC Level 2 contractors will eventually undergo a Certification Assessment. Under the phased implementation of the CMMC Program discussed below, however, CMMC Level 2 Certification Assessment requirements will not regularly appear in solicitations or contracts until one year after the start of implementation. Contractors that achieved a perfect score with no open POA&Ms on a Defense Contract Management Agency (DCMA) Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) High Assessment under DFARS 252.204-7020 prior to the effective date of the final CMMC rule will be eligible for a CMMC Level 2 Certification for three years from the date of the High Assessment.

CMMC Level 3 applies to contracts that involve the handling of CUI, but for which DoD has determined that additional safeguarding requirements are necessary. The additional CMMC Level 3 requirements consist of 24 requirements from NIST SP 800-172 listed in Table 1 to Section 170.14(c)(4) of the final CMMC rule. These additional CMMC Level 3 requirements include various “Organization-Defined Parameters” that can be used to tailor these requirements to a particular situation. The applicability of CMMC Level 3 requirements will be determined by DoD on a contract-by-contract basis based on the sensitivity of the CUI involved in the performance of that contract.

CMMC Level 3 assessments are performed exclusively by DCMA DIBCAC. The proposed CMMC rule establishes a scoring methodology for assessing compliance with CMMC Level 3 security requirements and allows for Conditional Level 3 status with POA&Ms for unmet requirements, subject to certain limitations and a general requirement that POA&Ms must be closed within 180 days. To achieve CMMC Level 3, contractors will need to have a perfect CMMC Level 2 score (110) and achieve a score of 20 out 24 for the additional CMMC Level 3 controls, with each control worth one point.

PHASED IMPLEMENTATION

The proposed rule contemplated a four-phase implementation over a three-year period, starting with the incorporation of self-assessment levels in Phase 1 through the full incorporation of CMMC requirements in all contracts in Phase 4. The final CMMC rule keeps the phases substantially the same, except it extends the time between Phase 1 and Phase 2 by six months, providing a full year between self-assessment and certification requirements:

  • Phase 1 – 0-12 Months: Phase 1 will begin when the proposed DFARS rule implementing CMMC is finalized. Our summary of the proposed DFARS rule can be found here. DoD has stated that it expects the final DFARS rule in “early to mid-2025.” During Phase 1, DoD will include Level 1 Self-Assessment or CMMC Level 2 Self-Assessment requirements as a condition of contract award and may include such requirements as a condition to exercising an option on an existing contract. During Phase 1, DoD may also include CMMC Level 2 Certification Assessment requirements as it deems necessary for applicable solicitations and contracts.
  • Phase 2 – 12-24 Months: Phase 2 begins one year after the start date of Phase 1 and will last for one year. During Phase 2, DoD will include CMMC Level 2 Certification Assessment requirements as a condition of contract award for applicable contracts involving CUI and may include such requirements as a condition to exercising an option on an existing contract. During Phase 2, DoD may also include CMMC Level 3 Certification Assessment requirements as it deems necessary for applicable solicitations and contracts.
  • Phase 3 – 24-36 Months: Phase 3 begins one year after the start date of Phase 2 and will also last for one year. During Phase 3, DoD intends to include CMMC Level 2 Certification Assessment requirements, not only as a condition of contract award but also as a condition to exercising an option on an existing contract. DoD will also include CMMC Level 3 Certification Assessment requirements for all applicable DoD solicitations and contracts as a condition of contract award, but DoD may delay inclusion of these requirements as a condition to exercising an option as it deems appropriate.
  • Phase 4 – 36+ Months: Phase 4 begins one year after the start date of Phase 3 and involves the inclusion of all CMMC Program requirements in all DoD solicitations and contracts, including option periods.

    APPLICABILITY TO PERFORMANCE OF DOD CONTRACTS

    The DoD has clarified that CMMC only applies to “contract and subcontract awardees that process, store, or transmit information, in performance of the DoD contract, that meets the standards for FCI or CUI on contractor information systems.” 32 C.F.R. § 170.3(a)(1). Given that CMMC will be implemented through a DFARS clause that is included in DoD contracts and subcontracts, the addition of the italicized language does not appear remarkable at first glance. However, it may prove an important qualification for companies that receive FCI and CUI in different circumstances. A company that receives CUI from the Government in the performance of one contract may also receive CUI from another entity independent of any contract or subcontract. For example, several categories of CUI reflect information that is contractor proprietary and, as such, can ordinarily be disclosed by the contractor that owns that information as that contractor deems appropriate. This can occur when teammates for a new opportunity share audit and business systems information for purposes of submitting a proposal, which information may be marked CUI by DoD to protect the proprietary information of the contractor being audited or whose business system was reviewed. The final CMMC rule’s clarification that it only applies to FCI and CUI handled in performance of the DoD contract may help clarify that the CMMC program does not restrict a contractor’s ability to process, store, or transmit its own information.

    CMMC STATUS BEGINS ON THE EARLIER OF CONDITIONAL STATUS OR FINAL STATUS

    DoD has clarified that although contractors have 180 days to finalize their CMMC certification if they do not originally achieve a passing score, the additional time to finalize does not extend the period for CMMC renewals. Thus, if a contractor’s CMMC certification status was conditionally granted on January 1, 2025, and its final status occurs 180 days later, the contractor’s renewal date will still be three years from the conditional date (January 1, 2028), not the later anniversary of the final status date.

    TEMPORARY AND ENDURING EXCEPTIONS

    DoD will now allow contractors to obtain permanent and temporary variances that have the status of a “MET” requirement when assessed as part of CMMC. These variances are separate from unmet controls that must be addressed within the contractor’s POA&M and completed within 180 days. The final CMMC rule introduces “enduring exceptions” and “temporary deficiencies,” which are defined as follows: An enduring exception is “a special circumstance or system where remediation and full compliance with CMMC security requirements is not feasible.” The final CMMC rule definition includes examples such as “systems required to replicate the configuration of ‘fielded’ systems, medical devices, test equipment, OT, and IoT.” Enduring exceptions must be documented within a system security plan.

    A temporary deficiency is “a condition where remediation of a discovered deficiency is feasible, and a known fix is available or is in process.” Temporary deficiencies would arise after the implementation of a particular security requirement, not during its implementation. The example provided is “FIPS-validated cryptography that requires a patch and the patched version is no longer the validated version.” A temporary deficiency must be documented in an “operational plan of action.”

    An operational plan of action is a contractor’s formal documentation of temporary vulnerabilities and temporary deficiencies in the contractor’s implementation of the CMMC security requirements. The operational plan of action documents how these temporary vulnerabilities and deficiencies are to be “mitigated, corrected, or eliminated.”

    The proposed DFARS rule requires 72-hour notification for “any lapses in information security or changes in the status of CMMC certification or CMMC self-assessment levels during the performance of the contract.” Proposed DFARS 204.7503(b)(4)). As we pointed out in our summary of the proposed DFARS rule, it does not define “lapses in information security,” but that term appears substantially broader than the term “cyber incident,” which contractors must also report within 72 hours. Because the CMMC rule in C.F.R Title 32 establishes the cybersecurity controls that form the foundation of the CMMC Program, we expected that the final CMMC rule might provide the clarity missing from the proposed DFARS rule; however, the final CMMC rule does not discuss lapses, and it is unclear whether a temporary deficiency is the same as a lapse. The scope of a contractor’s notification obligations under the CMMC Program and the contractor’s DoD contracts and subcontracts therefore remains unclear, particularly whether a contractor must notify the Government every time a measure for complying with a particular CMMC control does not function as planned.

    DEFINITION OF SECURITY PROTECTION DATA

    In the interim rule, DoD introduced Security Protection Data (SPD) as an undefined term. The final CMMC rule defines SPD as follows:

    Security Protection Data (SPD) means data stored or processed by Security Protection Assets (SPA) that are used to protect [a contractor’s] assessed environment. SPD is security relevant information and includes but is not limited to: configuration data required to operate an SPA, log files generated by or ingested by an SPA, data related to the configuration or vulnerability status of in-scope assets, and passwords that grant access to the in-scope environment. (Emphasis added).

    In our earlier analysis, we discussed the concern that the ambiguous nature of SPD would make it difficult for contractors to determine which external service providers (ESPs) were in-scope for CMMC. The definition of SPD in the final CMMC rule retains this ambiguity, thus missing an opportunity for further clarity in the use of ESPs.

    DIBCAC ASSESSMENTS

    For Level 2 and Level 3 CMMC assessments, DoD now reserves the right to conduct a DCMA DIBCAC assessment of any contractor, in addition to other investigative evaluations of an OSA. The results of an investigative DCMA DIBCAC assessment will supersede any preexisting CMMC status, and DoD will update SPRS to show that the OSA is out of compliance. This replaces previous language in the proposed CMMC rule that allowed DoD to merely revoke CMMC status after its investigation. Notably, the final CMMC rule removes the ability to revoke CMMC Level 1 status and does not substitute a DCMA DIBCAC assessment in its place. These changes bring the CMMC program into alignment with the DoD Self-Assessment methodology required in DFARS 252.204-7019/7020.

    CSPS AND ESPS

    Of significant interest to service providers will be the changes to the requirements for cloud service providers (CSPs) and other ESPs. The final CMMC rule is less prescriptive than the proposed rule with respect to how these service providers fit into the scope of a contractor’s CMMC certification.

    First, as before, the final CMMC rule allows the use of CSPs to process, store, or transmit CUI where the CSP is Federal Risk and Authorization Management Program (FedRAMP) Authorized at FedRAMP Moderate baseline or higher, or where the CSP meets FedRAMP Equivalency. The final CMMC rule, however, states that FedRAMP Moderate and FedRAMP Moderate Equivalent determinations will be “in accordance with DoD Policy,” thereby incorporating the DoD Chief Information Officer policy memo on FedRAMP Moderate equivalency issued after the proposed rule. This reference may also allow DoD to change this policy in the future without further notice-and-comment rulemaking.

    Second, for ESPs that process, store, or transmit CUI or SPD, CMMC certification is no longer required in advance of the contractor’s certification. Instead, ESPs will be assessed as in-scope for the contractor itself against all of the relevant requirements. This change may relieve pressure not only on ESPs but also on contractors and CMMC C3PAOs if non-contractor ESPs do not need to be at the front of the line for certifications. Although many ESPs with significant Federal contracting customer bases will likely choose to obtain CMMC certification directly, smaller ESPs may choose to support Federal contractor customers in the customer’s own certifications on a case-by-case basis.

    Notably, this is a model that many service providers may be familiar with from a different context and standard. In practice, it seems similar to the method for service providers to comply with Payment Card Industry Data Security Standards (PCI DSS). Under PCI DSS, a service provider may obtain its own Attestation of Compliance (AOC) or may participate in the compliance efforts of each merchant it supports. Also, like the PCI DSS model, there now is a requirement to document the roles and responsibilities between ESPs and the contractors. 32 C.F.R. § 170.19(c)(2)(ii) (“documented in the OSA’s SSP and described in the ESP’s service description and customer responsibility matrix (CRM)”).

    APPLICABILITY TO SUBCONTRACTORS

    The final CMMC rule updates the applicability of the CMMC requirements to subcontractors by incorporating requirements not only for CMMC compliance but also explicitly to flow down CMMC requirements for both CMMC level and assessment type through the supply chain. There is again a helpful clarification that such flow-downs are only required for the performance of a “DoD contract” rather than the prior language that did not specify what types of contracts required flowing down. Id. § 170.23(a).

    MISREPRESENTATION AND FALSE CLAIMS ACT RISK

    Although the CMMC Level 1 and Level 2 security requirements are the same requirements in FAR 52.204-21 and NIST SP 800-171 that contractors have been required to follow for years, the final CMMC rule will require all contractors that handle FCI and CUI on their systems – even contractors subject to CMMC Level 1 – to make periodic affirmative representations regarding their cybersecurity programs and controls, in addition to the initial assessments and certifications reported in SPRS. Contractors must vet these representations carefully as any potential inaccuracy or ambiguity could generate litigation risk under a variety of criminal and civil laws, including the False Claims Act (FCA).

    Since the inception of the CMMC Program, the US Department of Justice (DOJ) has increasingly made cybersecurity an enforcement priority. In 2021, DOJ launched its Civil Cyber-Fraud Initiative, which seeks to leverage DOJ’s expertise in civil fraud enforcement to combat cyber threats to the security of sensitive information and critical systems. Deputy Attorney General Lisa Monaco stated at the time: “We are announcing today that we will use our civil enforcement tools to pursue companies, those who are government contractors who receive federal funds, when they fail to follow required cybersecurity standards — because we know that puts all of us at risk. This is a tool that we have to ensure that taxpayer dollars are used appropriately and guard the public fisc and public trust.” As CMMC is implemented, it will provide the “required cybersecurity standards” that DOJ will seek to enforce and a record of statements of compliance that DOJ will use to leverage the FCA in enforcement.

    THE ELEPHANT (STILL) IN THE ROOM

    The final CMMC rule, like the proposed rule, does nothing to address the fundamental uncertainty regarding what constitutes CUI and the widespread overmarking of CUI. We continue to see emails from Government officials with CUI markings embedded in signature blocks that automatically attach to every email that official sends out – even when the email is sent to private entities and individuals who do not hold a contract subject to CMMC. Multiple commentators expressed concerns regarding the mismarking and overmarking of CUI, but DoD generally responded by pointing to its existing guidance on CUI marking, without addressing whether that guidance is sufficient or is actually being followed.

    CONCLUSION

    The final CMMC rule makes several significant changes to the proposed rule, but it largely keeps the structure, content, and format of the proposed rule in place. We will continue to analyze the final CMMC rule, including updating our in-depth analyses of each CMMC certification level, in the weeks to come.

    But are we there yet? No, and if you don’t stop asking, DoD will turn this car around! DoD must still finalize the companion DFARS rule before the CMMC can be fully implemented by DoD for new contracts. Once that final DFARS rule is released, we expect a gradual, phased approach that will take three to four years before CMMC is a reality for all Federal prime contractors and subcontractors that store, process, or transmit FCI or CUI in performance of DoD contracts.

    © 2024 McDermott Will & Emery
    For more on the CMMC Program, visit the NLR Consumer Protection section

FTC Finalizes “Click-to-Cancel” Rule

The Federal Trade Commission (FTC) has finalized amendments to the Negative Option Rule, now retitled the “Rule Concerning Recurring Subscriptions and Other Negative Option Programs“ (“Rule”), which represents a significant overhaul of the regulatory framework governing how companies handle subscription services and automatic renewals.

Over the years, the FTC has received numerous complaints about deceptive practices related to negative option programs, prompting the need for updated regulations. The original rule, established in 1973, was focused primarily on protecting consumers from deceptive practices in physical goods such as book and record clubs. However, with the rise of e-commerce, the need for more robust protections for online subscriptions has grown significantly. The FTC’s amendments aim to address these issues and bring more transparency and fairness to this business model.

“Negative option marketing” is a broad term that encompasses a variety of subscription and membership practices. The Rule expands coverage to apply broadly to all forms of negative option marketing in any form of media, including, but not limited to, electronic media, telephone, print, and in-person transactions. It defines the negative option feature as “a contract provision under which the consumer’s silence or failure to take affirmative action to reject a good or service or to cancel the agreement is interpreted by the negative option seller as acceptance or continuing acceptance of the offer.” Negative option programs generally fall into four categories: prenotification plans, continuity plans, automatic renewals, and free trial (i.e., free-to-pay or nominal-fee-to-pay) conversion offers.

Most provisions of the Rule will go into effect 60 days after its publication in the Federal Register, except the provisions regarding disclosure of important information (§ 425.4), consent (§ 425.5) and simple cancellation (§ 425.6), which will become effective 180 days after publication in the Federal Register, thus providing businesses with a period to adapt their subscription practices to these new requirements.

Key Updates

  • Clear and Conspicuous Disclosures: The FTC now requires businesses to present subscription terms in a clear and conspicuous manner before any billing occurs. Sellers must provide the following “important information” prior to obtaining the consumer’s billing information: (1) that consumers’ payments will increase or recur, if applicable, unless the consumer takes steps to prevent or stop such charges; (2) the deadline by which consumers must act to stop charges; (3) the amount or ranges of costs consumers may incur, and frequency of the charges; (4) information about the mechanism consumers may use to cancel the recurring payments. Each of the required disclosures must be clear and conspicuous, and failure to provide this information is a deceptive or unfair practice.
  • Consent: The Rule requires negative option sellers to obtain consumers’ express informed consent before charging the consumer. The failure to obtain such consent is a deceptive or unfair practice. Sellers must keep or maintain verification of the consumer’s consent for at least three years.
  • Click-to-Cancel Requirement: One of the most notable changes in the Rule is the introduction of the “click-to-cancel” provision. This new requirement mandates that companies provide a straightforward and user-friendly method for consumers to cancel their subscriptions. At a minimum, the simple mechanism for cancellation must be provided through the same medium the consumer used to consent to the Negative Option Feature. For example, for services that are subscribed to online, the cancellation process must also be available online and must be as easy as signing up for the service in the first place. This is especially significant because many businesses have been criticized for making cancellation intentionally difficult, such as by requiring consumers to call a customer service line or navigate multiple steps just to cancel their service.
  • Removal of Annual Reminder Requirement: During the rulemaking process, the FTC had initially proposed requiring businesses to send consumers an annual reminder of their ongoing subscription services and provide information on how to cancel. However, this provision was ultimately removed from the final Rule. While consumer advocates had supported the inclusion of annual reminders, which would have provided an extra layer of protection for consumer, businesses argued that this requirement would be overly burdensome, especially for companies with large subscriber bases. However, the Rule still mandates that sellers must provide consumers with clear and timely notifications regarding recurring charges.
  • Removal of Prohibition on Upsell Offers: Another key provision of the proposed version of the Rule was the regulation of upsell offers during the cancellation process, which would have required sellers to immediately effectuate cancellation unless they obtained the consumer’s unambiguously affirmative consent to receive a save prior to cancellation. Companies often attempt to retain customers by offering lower-priced alternatives or special deals when a consumer tries to cancel a subscription. While these offers are not inherently problematic, the FTC has expressed concern that some businesses use upsell tactics to confuse consumers or prevent them from successfully canceling their service. However, the finalized version did not adopt this amendment. The FTC has determined that revisions to this proposed provision are necessary, for which it would need to seek additional comment. This means that while businesses are free to present alternatives to consumers, they also must provide a clear and direct path to cancelation without requiring consumers to navigate multiple steps or reject numerous offers.
  • Enforcement and Penalties: To ensure compliance with the new Rule, the FTC has increased the potential penalties for violations. Businesses that fail to adhere to the new requirements can face significant fines. The FTC has the authority to pursue penalties of up to $51,744 per violation, which could quickly add up for companies with large subscriber bases. This enforcement mechanism underscores the seriousness of the FTC’s efforts to crack down on deceptive subscription practices and provides a strong incentive for businesses to comply with the Rule.
  • Relation to Other Laws: The Rule does not preempt state laws that require more protection for consumers. Rather, it reflects the FTC’s intention to align with other laws and regulations, such as the Restore Online Shoppers’ Confidence Act (ROSCA), The Telemarketing Sales Rule, and state-level automatic renewal laws.

Industry Impact

The new regulatory landscape for Negative Option Programs will have several notable impacts on industries that rely heavily on subscription-based revenue models, such as e-commerce, streaming platforms, Software as a Service providers, health and fitness subscriptions, and other online services. Companies will need to reassess their subscription practices, ensure that their cancellation processes are in line with the new requirements, and update their disclosures to meet the transparency standards set by the FTC. Businesses will also need to invest in employee trainings and possibly make changes to their subscription systems and software. This could lead to increased compliance and operational costs as companies try to come into compliance with these new requirements, on top of the potential for lost revenue due to less automatic renewal income.

© 2024 Foley & Lardner LLP
For more on the FTC, visit the NLR Antitrust Trade Regulation section

Texas-Sized Fraud: Corporate Relator Takes on Laboratory Referral Kickback Scheme

17 October 2024. In a qui tam whistleblower settlement, Jeffrey Madison, the former CEO of Little River Healthcare in Rockdale, Texas, has agreed to pay over $5.3 million to resolve alleged violations of the Anti-Kickback Statute. This successful whistleblower lawsuit illustrates the critical role of whistleblowers in uncovering fraudulent schemes and upholding ethical standards within the healthcare industry. The corporate whistleblower in this qui tam action, STF LLC, could be rewarded between 15-25% of the government’s recovery.

Understanding the Case

The allegations against Madison stem from violations of the False Claims Act, specifically linked to illegal payments made to physicians to induce laboratory referrals. These actions contravened the Anti-Kickback Statute, a federal law designed to ensure that medical decisions, particularly those about Medicare, Medicaid, or TRICARE beneficiaries, are based on patient welfare rather than financial incentives.

Key Allegations:

Kickback Scheme: The lawsuit alleged that between January 2015 and June 2018, Little River Healthcare, under Madison’s leadership, engaged in a scheme involving paying commissions to recruiters. These recruiters, using management service organizations (MSOs), funneled kickbacks to physicians who referred laboratory tests to Little River.

False Certifications: Madison was accused of knowingly falsely certifying compliance with the Anti-Kickback Statute in Medicare cost reports, resulting in fraudulent claims to federal healthcare programs, including Medicare, Medicaid, and TRICARE.

Disguised Payments: An additional component involved Dr. Doyce Cartrett Jr., who was allegedly paid $2,000 monthly to refer his laboratory testing business to Little River. These payments were allegedly disguised as “medical director fees” despite Dr. Cartrett rendering no medical director services.

The Importance of the Anti-Kickback Statute

Violations of the Anti-Kickback Statute can significantly harm patients by distorting medical decision-making priorities and eroding trust in healthcare providers. When healthcare decisions are influenced by financial incentives rather than patient welfare, there is a risk that unnecessary or substandard care is administered, potentially leading to adverse health outcomes. Patients may receive treatments not based on their individual needs but on the financial gains of unscrupulous providers. This not only affects the quality of care but also contributes to rising healthcare costs, ultimately burdening patients and taxpayers financially. Upholding the statute is crucial in ensuring that patient care is determined by medical necessity and clinical expertise.

This case underscores the vital role of whistleblowers in identifying and exposing fraudulent activities. By coming forward, whistleblowers not only protect taxpayer dollars but also ensure that healthcare decisions remain focused on patient care. As the Acting Special Agent in Charge of the Department of Defense Office of Inspector General, Defense Criminal Investigative Services, Southwest Field Office said about the case, “Our nation’s uniformed military service members and their families should never have to question the integrity of their healthcare providers. Medical decisions influenced by greed destroy the fundamental element of trust in patient care.” Healthcare fraud whistleblowers reporting unlawful kickback schemes under the False Claims Act can help restore that trust.

© 2024 by Tycko & Zavareei LLP
For more news on Kickback Fraud Settlements, visit the NLR Criminal Law & Business Crimes section.

How to Develop an Effective Cybersecurity Incident Response Plan for Businesses

Data breaches have become more frequent and costly than ever. In 2021, the average data breach cost companies more than $4 million. Threat actors are increasingly likely to be sophisticated. The emergence of ransomware-as-a-service (RaaS) has allowed even unsophisticated, inexperienced parties to execute harmful, disruptive, costly attacks. In this atmosphere, what can businesses do to best prepare for a cybersecurity incident?

One fundamental aspect of preparation is to develop a cyber incident response plan (IRP). The National Institute of Standards and Technology (NIST) identified five basic cybersecurity functions to manage cybersecurity risk:

  • Identify
  • Protect
  • Detect
  • Respond
  • Recover

In the NIST framework, anticipatory response planning is considered part of the “respond” function, indicating how integral proper planning is to an effective response. Indeed, NIST notes that “investments in planning and exercises support timely response and recovery actions, resulting in reduced impact to the delivery of services.”

But what makes an effective IRP? And what else goes into quality response planning?

A proper IRP requires several considerations. The primary elements include:

  • Assigning accountability: identify an incident response team
  • Securing assistance: identify key external vendors including forensic, legal and insurance
  • Introducing predictability: standardize crucial response, remediation and recovery steps
  • Creating readiness: identify legal obligations and information to facilitate the company’s fulfillment of those obligations
  • Mandating experience: develop periodic training, testing and review requirements

After developing an IRP, a business must ensure it remains current and effective through regular reviews at least annually or anytime the business undergoes a material change that could alter either the IRP’s operation or the cohesion of the incident response team leading those operations.

An effective IRP is one of several integrated tools that can strengthen your business’s data security prior to an attack, facilitate an effective response to any attack, speed your company’s recovery from an attack and help shield it from legal exposure in the event of follow-on litigation.

© 2024 Varnum LLP
For more on Cybersecurity, visit the NLR Communications Media Internet section.

The Murky Waters of Wash Trading Digital Assets – DOJ Charges 18 Individuals and Entities

The United States Attorney’s Office for the District of Massachusetts recently unsealed what it described as the “first-ever criminal charges against financial services firms for market manipulation and ‘wash trading’ in the cryptocurrency industry.” The SEC also filed parallel civil charges alleging violations of Securities for the same alleged schemes.

The government has charged eighteen individuals and companies, including four cryptocurrency market makers, with engaging in illegal market manipulation through “wash trading” digital assets. According to the DOJ and SEC filings, although these individuals purported to offer “market making services,” they were actually engaged in offering “market-manipulations-as-a-service” by engaging in artificial trading of digital assets to give the false appearance that there was an active (and heavily traded) market for those tokens.

How this case came to the DOJ’s attention is as novel as the legal theory behind the charging documents. According to DOJ spokespeople, the investigation started with a tip from the SEC about one of the companies at issue. Further investigations into that company—along with the help of cooperating witnesses—led authorities to set up a sham crypto firm, NextFundAI, and create a token associated with the firm. Posing as NextFundAI, the government communicated with the defendants—market makers who allegedly offered to trade and manipulate the price of NextFundAI’s token by wash trading, or trading the token back-and-forth between crypto wallets they controlled.

While there may be rules against wash trading in traditional securities markets (see, e.g., 26 U.S. Code § 1091), the rules are as clear in the digital asset space. Indeed, the regulatory vacuum facing the digital asset industry makes it difficult for those in the industry to avoid eventual regulatory action, and what many have referred to as “regulation by enforcement.” This is particularly true where the technological realities of digital assets do not fit squarely within the existing legal framework. There may be disagreement about the purpose or intent behind a cryptocurrency transaction where one individual is transferring cryptocurrency between wallets that person or entity controls. But there may not be a misrepresentation or fraudulent act inherent in this type of transaction. Indeed, the transaction itself (including the wallet address of the sender and recipient) is likely immediately and accurately recorded on the public blockchain. So, according to the government, the “fraud” is the intent behind the trades – to manipulate the market by artificially generating trade volume to signal interest and activity in the token.

The government’s allegations are also interesting because in addition to the wire fraud charges (18 U.S.C. § 1343), which generally do not require proof that the digital asset at issue is a security, the government has charged the defendants with conspiracy to commit market manipulation (18 U.S.C. § 371), which requires the government to prove that the token at issue is a security. This charge is significant because it will require the DOJ to prove at trial that the tokens at issue are securities.

Although several individuals involved have already pleaded guilty, there are several defendants who appear to be testing the government’s novel theory in court. We anticipate that this will be the first of many similar investigations and enforcement actions in the digital asset space.

©1994-2024 Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C. All Rights Reserved.
For more on Digital Assets, visit the NLR Securities SEC section.

TCPA Rules on Revoking Consent for Unwanted Robocalls and Robotexts Effective April 2025

On October 11, 2024, the Federal Communications Commission announced that the effective date for Telephone Consumer Protection Act (TCPA) rules on revoking consent for unwanted robocalls and robotexts is set for April 11, 2025.

On February 15, 2024, the FCC adopted the TCPA Consent Order in the above-captioned proceeding. In that rulemaking, the FCC adopted rules making it simpler for consumers to revoke consent to receive unwanted robocalls and robotexts. Callers and texters must honor these opt-out requests in a timely manner.

The TCPA Consent Order established that these rules would become effective six months following publication in the Federal Register that the Office of Management and Budget has completed its review of the modified information collection requirements under the Paperwork Reduction Act of 1995. OMB approved these modified information collection requirements on September 26, 2024.

On October 11, 2024, the FCC announced in the Federal Register that compliance with the amendments and new rules set forth in the TCPA Consent Order as contained in 47 CFR §§ 64.1200(a)(9)(i)(F), (10), (11) and (d)(3) is required as of April 11, 2025.

Background of the TCPA Rules on Revoking Consent for Unwanted Robocalls and Robotexts

The TCPA restricts robocalls and robotexts absent the prior express consent of the called party or a recognized exemption. The FCC has made clear that consumers have a right to decide which robocalls and robotexts they wish to receive by exercising their ability to grant or revoke consent to receive such calls and texts.

The FCC has now adopted new rules to strengthen the ability of consumers to decide which robocalls and robotexts they wish to receive, codified the FCC’s past guidance on consent to make these requirements easily accessible and apparent to callers and consumers, and closed purported loopholes that allow wireless providers to make robocalls and robotexts without the ability for the subscriber to opt out.

What is the Practical Impact of the TCPA Revocation Rules?

As previously discussed by FTC defense and telemarketing compliance attorney Richard B. Newman, in March 2024 the Federal Communications Commission announced that it adopted new rules and codified previously adopted protections that make it simpler for consumers to revoke consent to unwanted robocalls and robotexts (specifically, autodialed and/or artificial/ prerecorded voice calls and texts) while requiring that callers and texters honor these requests in a timely manner.

In pertinent part:

  • Revocation of prior express consent for autodialed, prerecorded or artificial voice calls (and autodialed texts) can be made in any reasonable manner (callers may not infringe on that right by designating an exclusive means to revoke consent that precludes the use of any other reasonable method).
  • Callers are required to honor do-not-call and consent revocation requests within a reasonable time not to exceed ten (10) business days of receipt.
  • Text senders are limited to a prompt one-time text message confirming a consumer’s request that no further text messages be sent under the TCPA (the longer the delay, the more difficult it will be to demonstrate that such a message falls within the original prior consent).
  • Revocation of consent applies only to those autodialed and/or artificial/prerecorded voice calls and texts for which consent is required.
  • A revocation to marketing messages precludes all further telephone calls or text messages unless an enumerated exemption exists.

Telemarketers and lead generators should consult with an experienced FTC defense lawyer to discuss the scope of the new rules and protections, including, but not limited to, the scope and applicability of a revocation for one purpose to other communication purposes.

© 2024 Hinch Newman LLP

by: Richard B. Newman of Hinch Newman LLP

For more news on FCC TCPA Regulations, visit the NLR Communications, Media, & Internet section.

IRS Issues FAQs Regarding Long-Term Part-Time Employees in 403(b) Plans

The IRS recently issued Notice 2024-73, which provides much-needed guidance on long-term, part-time (“LTPT”) employees in ERISA-governed 403(b) retirement plans. Following passage of the SECURE 2.0 Act, an employee is generally considered a LTPT employee if he or she works at least 500 hours per year for two consecutive years.

Among other items, the Notice sets forth the IRS position on the following key issues on which the benefits community has been seeking clarification:

  • A part-time employee who qualifies as a LTPT employee must have the right to make elective deferrals to an ERISA 403(b) plan (unless some other statutory exemption applies), notwithstanding the Tax Code’s permitted exclusion for employees who normally work less than 20 hours per week.
  • An ERISA 403(b) plan may continue to exclude from the plan part-time employees who do not qualify as LTPT employees, notwithstanding the “consistency requirement,” which generally prevents a plan from excluding some part-time employees and not others.
  • An ERISA 403(b) plan is not required to provide the right to make elective deferrals to certain student employees, even if they qualify as LTPT employees. This is because the student employee exclusion is based on an employee classification (a student performing the service), rather than an amount of service (not an hours-based exclusion).

The guidance in the Notice is effective for plan years beginning after December 31, 2024. Importantly, the Notice also provides that a previously promulgated proposed regulation relating to the handling of LTPT employees in 401(k) plans, once finalized, will apply no earlier than plan years beginning on or after January 1, 2026 (i.e., a two-year extension).

© 2024 Miller, Canfield, Paddock and Stone PLC
For more on Long-Term Part-Time Employees, visit the NLR Labor Employment section.

Common Mistakes When Applying for the Diversity Immigrant Visa Program

The Diversity Immigrant Visa Program, commonly referred to as the green card lottery, was established by the U.S. government to provide individuals from countries with low immigration rates a chance to live and work in the U.S.

Each year, the U.S. Department of State conducts a random lottery drawing to select 55,000 applicants who will be given the opportunity to apply for a Diversity Visa (DV). This selection process is based on a computer-generated random lottery system, ensuring fairness and equal opportunities for all participants.

To qualify, applicants must be a citizen of a country deemed eligible by the U.S. government and have either a high school education or its equivalent or possess two years of work experience in a qualifying occupation.

Applying for the DV Program is an exciting opportunity for those looking to immigrate to the United States. However, even a minor mistake when filling out the entry form can lead to a major complication in the registration process.

By understanding the most common mistakes and learning how to avoid them, applicants can improve their chances of submitting a successful entry to the green card lottery.

The seven “deadly sins” of the Diversity Visa application process

Green card lottery entries are submitted electronically via the Electronic Diversity Visa (E-DV) website during the specified registration period. Although the DV instructions provide detailed guidance for completing the online entry form, there are seven common mistakes — aka “deadly sins” — that could result in delays or even rejection of the application.

1. Submitting multiple entries

The law allows only one entry by or for each person during each registration period. The Department of State uses advanced technology to detect multiple entries. Submissions of more than one entry will be disqualified. Applicants should take the time to review and double-check their information before submitting it.

2. Missing the deadline

No late entries or paper entries are accepted. Applicants must use the E-DV website for submission and must submit their application by the specified deadline.

The online registration period for the 2026 DV Program is open now through Nov. 5, 2024, at 12 p.m. Eastern Standard Time (EST) (GMT-5).

3. Inputting inaccurate personal information

Applicants should ensure their name and surname are entered exactly as they appear on their passport or other identification documents. They should avoid using nicknames or name variations to prevent discrepancies that could raise concerns during the review process. Applicants should also double-check the date of birth and make sure the correct day, month and year are entered. Inaccuracies in this section can lead to delays or even rejection of the entry form.

4. Omitting family members

Applicants should make sure to include all immediate family members in the entry, including a spouse and any unmarried children under the age of 21. Failure to list any eligible family members can result in their exclusion from the program.

5. Using third-party websites for assistance

Be cautious of third-party websites claiming to assist with the entry process. These sites often charge unnecessary fees and may provide inaccurate information. It is recommended to visit the official Department of State website or trusted government portal for the application.

6. Leaving entry fields blank

As we outlined above, to avoid rejection or delays applicants should ensure that all required fields are filled out. Missing information or leaving any mandatory fields blank can result in disqualification. It’s important to take the time to carefully review the form and provide accurate and complete responses.

7. Not meeting mandatory requirements

To qualify, an applicant must either have a high school education or equivalent, defined as the successful completion of a 12-year course of formal elementary and secondary education. Alternatively, an applicant must have at least two years of work experience within the past five years in an occupation that requires a minimum of two years of training or experience.

Avoid leaving it all to luck with BAL

Being aware of these common reasons for disqualification and learning how to avoid them can help ensure the Diversity Immigrant Visa Program entry is filled out correctly, providing applicants the chance of selection in the green card lottery.

While this is one route to a green card, there are more paths that don’t rely on luck. For example, a National Interest Waiver (NIW) is an immigrant visa that creates a path to a green card without a job offer or labor certification. The NIW is an alternative to the traditional PERM process and is available to those whose work is deemed to be in the national interest of the United States.

There are many ways to get a green card in the United States and the process generally involves a petition, an application, a biometrics appointment, interviews with immigration officials and decisions that potentially come with requests for more information and documents. The processing time for a green card can also vary from one to six years, depending on demand.

©2024 Berry Appleman & Leiden. All Rights Reserved.
For more news on Diversity Immigrant Visa, visit the NLR Immigration section.

Department of Defense Issues Final CMMC Rule

On October 11, 2024, the Department of Defense (“DoD”) issued the first part of its final rule establishing the Cybersecurity Maturity Model Certification (“CMMC”) program. As expected, the final rule requires companies entrusted with national security information to implement cybersecurity standards at progressively advanced levels, (CMMC level 1, CMMC level 2, and CMMC level 3) depending on the type and sensitivity of the information. While the final rule largely tracks the proposed rule issued in December 2023, we outline below several notable updates DoD included in the final rule and their potential impacts on DoD contractors.

Updated Implementation Timeline

DoD extended the timeline for CMMC implementation. DoD will now roll out the CMMC program in a four-phased approach:

  • Phase 1 will begin in early to mid-2025 when DoD finalizes the second part of its CMMC rule under 48 C.F.R. Part 204. Once that rule is finalized, DoD will begin including CMMC level 1 and CMMC level 2 self-assessment requirements in new solicitations. That is, while DoD contractors will not need to obtain a CMMC certification by Phase 1, they will need to self-assess and affirm compliance with CMMC level 1 and/or level 2 security requirements when competing for new DoD contracts.
  • Phase 2 will begin one year after the start of Phase 1 (~early to mid-2026). During Phase 2, DoD will begin including CMMC level 2 certification requirements in applicable solicitations. Contractors who expect to bid on solicitations requiring a CMMC level 2 certification should plan to obtain that certification by early 2026 to avoid losing out on DoD opportunities.
  • Phase 3 will begin one year after the start of Phase 2 (~early to mid-2027). During Phase 3, DoD will begin requiring contractors to meet the CMMC level 2 certification requirements as a condition to exercise option periods on applicable contracts awarded after the effective date of the CMMC rule. DoD will also begin including CMMC Level 3 requirement in applicable solicitations.
  • Phase 4 will begin one year after the start of Phase 3 (~early to mid-2028). During Phase 4, DoD will include CMMC program requirements in all applicable CMMC solicitations and as a condition to exercise option periods on applicable contracts regardless of when they were awarded.

Narrower Assessment Scope for Security Protection Assets

The final rule narrows the assessment scope for contractors’ Security Protection Assets (“SPA”). Under the proposed rule, certain contractor assets that provide security functions or capabilities (i.e., SPAs) for the protection of controlled unclassified information (“CUI”) had to meet all security requirements of CMMC level 2. The final rule reduces that assessment scope so now SPAs only need to be assessed against “relevant” security requirements. This change should reduce the regulatory burden on contractors because they will no longer need to show how SPAs meet CMMC security requirements that are not applicable to the SPAs being assessed.

External Service and Cloud Service Providers

The final rule provides greater clarity as to when External Service Providers (“ESPs”) are within the scope of a contractor’s CMMC assessment. Under the final rule, if an ESP deals with CUI, then it must be assessed against all CMMC level 2 security requirements and must obtain a CMMC level 2 assessment or certification. By contrast, ESPs that only deal with security protection data (“SPD”)—data used to protect a contractor’s assessed environment—are subject to a more limited assessment and do not require a full CMMC level 2 assessment or certification. A service provider that does not deal with CUI or SPD does not meet the CMMC definition of ESP and presumably is outside the scope of any CMMC assessment.

For Cloud Service Providers (“CSPs”) dealing with CUI, the final rule tracks current DoD security requirements, which require CSPs to meet security requirements equivalent to the FedRAMP moderate baseline. Like with ESPs, CSPs that only deal with SPD are subject to a more limited assessment and CSPs that do not deal with CUI or SPD are outside of the CMMC scope.

© 2024 Blank Rome LLP