When a company is under foreign ownership or control

← All Insights

1. Why the rule allows foreign investment

The National Industrial Security Program Operating Manual (NISPOM), 32 CFR part 117, opens its foreign ownership section with a statement of purpose. Foreign investment can play an important role in maintaining the vitality of the U.S. industrial base, so the government intends to allow it consistent with national security interests (32 CFR 117.11(a)). The procedures on foreign ownership, control or influence (FOCI) mitigate the risks by ensuring that foreign firms cannot undermine U.S. security to gain unauthorized access to classified information.

2. When an entity is under FOCI

The cognizant security agency (CSA) applies a two-part test (32 CFR 117.11(a)(1)). A U.S. entity is under FOCI when a foreign interest has the power to direct or decide issues affecting its management or operations in a way that could have one of two results (32 CFR 117.11(a)(1)(i)). The power could result in unauthorized access to classified information, or adversely affect performance of a classified contract or agreement.

The power may be exercised now or prospectively, directly or indirectly (32 CFR 117.11(a)(1)(ii)). It may come through ownership of the entity’s securities, contractual arrangements or other means. It may also come through the ability to control or influence the election or appointment of members of the governing board.

3. What follows from a FOCI finding

Once the CSA decides an entity is under FOCI, the primary consideration is protecting classified information (32 CFR 117.11(a)(2)). The CSA takes whatever action is necessary, coordinating with other affected agencies as appropriate. An entity in process for eligibility that is found to be under FOCI is ineligible for access until effective measures negate or mitigate the FOCI to the CSA’s satisfaction (32 CFR 117.11(a)(3)).

A cleared contractor negotiating an acceptable mitigation or negation measure in good faith may keep its existing determination, as long as there is no indication that classified information is at risk (32 CFR 117.11(a)(4)). That judgment is made in consultation with the government contracting activity (GCA). The CSA may still invalidate the determination until an acceptable mitigation plan is in place.

An existing determination is invalidated if the contractor is unable or unwilling to negotiate and implement an acceptable measure (32 CFR 117.11(a)(5)). It is revoked if no security measures can remove the possibility of unauthorized access or adverse effect on classified contracts.

4. Changed conditions and reserved powers

Changed conditions, such as a change in ownership, indebtedness or a foreign intelligence threat, may justify adjusting the security terms or using a different mitigation method (32 CFR 117.11(a)(6)). A significant change might even lead to a finding that the contractor is no longer under FOCI, or that it is no longer eligible. The government reserves the right, and has the obligation, to impose any security method, safeguard or restriction it believes necessary (32 CFR 117.11(a)(7)). That includes denial, termination or revocation of eligibility. Nothing in the section affects a federal agency head’s authority to limit, deny or revoke access under its own jurisdiction (32 CFR 117.11(a)(8)).

5. The factors weighed

The CSA considers factors relating to the entity, the foreign interests and their governments in the aggregate (32 CFR 117.11(b)). It weighs them to decide whether the entity is under FOCI, whether it is eligible and what protective measures are needed. The factors include any record of economic or government espionage against U.S. targets, and any record of enforcement actions for unauthorized technology transfer (32 CFR 117.11(b)(1) and 32 CFR 117.11(b)(2)).

They also include the record of compliance with U.S. laws, regulations and contracts, and the type and sensitivity of the information involved (32 CFR 117.11(b)(3) and 32 CFR 117.11(b)(4)). The source, nature and extent of FOCI are considered, including majority or minority foreign positions at the immediate, intermediate and ultimate parent levels (32 CFR 117.11(b)(5)). So are relevant bilateral and multilateral security agreements, and any direct or indirect ownership or control by a foreign government (32 CFR 117.11(b)(6) and 32 CFR 117.11(b)(7)). The last factor is anything else showing that foreign interests can control or influence operations or management (32 CFR 117.11(b)(8)).

6. The SF 328 and foreign deals

An entity completes the SF 328, the Certificate Pertaining to Foreign Interests, during the eligibility process and when significant changes occur (32 CFR 117.11(c)). A corporate family may give a consolidated response under CSA guidance. Affirmative answers, or other information suggesting FOCI, lead the CSA to make a risk-based determination (32 CFR 117.11(c)(1)). It decides whether the entity is under FOCI, how far that is a risk to national security or contract performance, and what actions would bring it to an acceptable level. The CSA advises the entity of its appeal channels.

When a cleared entity begins negotiating a merger, acquisition or takeover by a foreign interest, it notifies the CSA (32 CFR 117.11(c)(2)). The notice gives the type of transaction, the identity of the potential foreign investor and a plan to negate or mitigate the FOCI (32 CFR 117.11(c)(2)(i)). The entity also submits loan, purchase and shareholder agreements, annual reports, bylaws, articles and other organizational documents, and reports filed with other federal agencies (32 CFR 117.11(c)(2)(ii)).

7. The CFIUS review

The Committee on Foreign Investment in the United States (CFIUS) is an interagency committee chaired by the Treasury Department (32 CFR 117.11(j)(1)). Under 50 U.S.C. 4565, it reviews transactions that could result in foreign control of a U.S. business, and certain non-controlling investments and real estate transactions involving foreign persons. Where the U.S. business needs access to classified information, the CFIUS process and the CSA’s FOCI review run in parallel but separately, with different time constraints and considerations (32 CFR 117.11(j)(2)).

The CSA promptly advises the parties to submit a FOCI mitigation plan if the transaction would need one (32 CFR 117.11(j)(3)). If agreement on material terms looks unlikely, or a U.S. party fails to meet the FOCI reporting requirements, the CSA may recommend a full CFIUS investigation. The mitigation methods themselves are covered in FOCI mitigation agreements.

Key terms

FOCI	Foreign ownership, control or influence over a U.S. entity.
Negation	Measures that remove the effect of FOCI.
Mitigation	Measures that reduce the risk of FOCI to an acceptable level.
SF 328	The Certificate Pertaining to Foreign Interests.
CFIUS	The Treasury-chaired committee that reviews foreign investment.

Every statement above links to the document behind it. The full source list for this piece is on the sources page.

This page describes public United States government programs for general information. It is not legal, regulatory or procurement advice, and it does not address the facts of any particular case.

How Sentfore supports this

Ownership structure matters to every cleared partner. Sentfore works at the delivery end of defense programs in difficult environments, providing secure movement, protective security, facilities and life support. Requirements can be sent through the contact page.