28 CFR § 202.1001 - Due diligence for restricted transactions.

---
identifier: "/us/cfr/t28/s202.1001"
source: "ecfr"
legal_status: "authoritative_unofficial"
title: "28 CFR § 202.1001 - Due diligence for restricted transactions."
title_number: 28
title_name: "Judicial Administration"
section_number: "202.1001"
section_name: "Due diligence for restricted transactions."
chapter_name: "DEPARTMENT OF JUSTICE"
part_number: "202"
part_name: "ACCESS TO U.S. SENSITIVE PERSONAL DATA AND GOVERNMENT-RELATED DATA BY COUNTRIES OF CONCERN OR COVERED PERSONS"
positive_law: false
currency: "2026-04-05"
last_updated: "2026-04-05"
format_version: "1.1.0"
generator: "[email protected]"
authority: "50 U.S.C. 1701  50 U.S.C. 1601  E.O. 14117, 89 FR 15421."
regulatory_source: "90 FR 1706, Jan. 8, 2025, unless otherwise noted."
cfr_part: "202"
---


# 202.1001 Due diligence for restricted transactions.

(a) *Data compliance program.* By no later than October 6, 2025, U.S. persons engaging in any restricted transactions shall develop and implement a data compliance program.

(b) *Requirements.* The data compliance program shall include, at a minimum, each of the following requirements:

(1) Risk-based procedures for verifying data flows involved in any restricted transaction, including procedures to verify and log, in an auditable manner, the following:

(i) The types and volumes of government-related data or bulk U.S. sensitive personal data involved in the transaction;

(ii) The identity of the transaction parties, including any ownership of entities or citizenship or primary residence of individuals; and

(iii) The end-use of the data and the method of data transfer;

(2) For restricted transactions that involve vendors, risk-based procedures for verifying the identity of vendors;

(3) A written policy that describes the data compliance program and that is annually certified by an officer, executive, or other employee responsible for compliance;

(4) A written policy that describes the implementation of the security requirements as defined in § 202.248 and that is annually certified by an officer, executive, or other employee responsible for compliance; and

(5) Any other information that the Attorney General may require.