1. What Is Foreign Ownership Control and Influence?
Foreign ownership control and influence is governed by the National Industrial Security Program Operating Manual (NISPOM), codified at 32 C.F.R. Part 117, and administered by the Defense Counterintelligence and Security Agency (DCSA). A company is considered to be under FOCI when a foreign interest has the ability to direct or decide matters affecting the company's management or operations in a way that may result in unauthorized access to classified information.
How Is Foci Determined?
FOCI does not require formal majority ownership. DCSA applies a broad "indicia of control" standard — a concept also recognized in U.S. .usiness law frameworks — that includes power over employment decisions, access to assets or equipment, authority over contracts, and influence over the business decisions of the relevant entity. Even minority shareholders, foreign creditors, or overseas board members can trigger a FOCI finding if their role grants meaningful operational leverage.
What Factors Does Dcsa Evaluate?
DCSA conducts a multi-factor analysis that considers the foreign interest's record of compliance with U.S. .aws, its business relationships with U.S. .overnment agencies, and whether the foreign party holds equity stakes, board appointment rights, or financing arrangements that could translate into control. Any one of these channels — without proper mitigation — can result in a FOCI determination that suspends or revokes a facility security clearance.
2. What Happens after a Foci Determination?
A FOCI finding does not automatically terminate a company's security clearance. DCSA and the affected company negotiate a formal mitigation instrument tailored to the level of risk the foreign relationship presents. Selecting the right mitigation structure requires careful legal analysis of the foreign interest's country of origin, ownership percentage, and the sensitivity of classified programs involved.
What Mitigation Instruments Are Available?
The most common tools are the Security Control Agreement (SCA), the Special Security Agreement (SSA), and the Proxy Agreement or Voting Trust. An SCA restricts the foreign parent's access to classified information while preserving normal business operations. An SSA allows limited foreign parent involvement under government oversight through a U.S.-citizen Government Security Committee (GSC). A Proxy Agreement or Voting Trust transfers all voting rights to government-approved U.S. .itizen proxies, creating a fully insulated domestic governance layer for the most sensitive cases.
What Are the Consequences of Non-Compliance?
Failure to disclose a FOCI condition — or operating under undisclosed foreign influence — exposes a company and its officers to contract termination for default, debarment from future government contracting, and criminal liability under statutes governing false statements to federal agencies. The severity of penalties escalates significantly when the nondisclosure is deemed intentional.
3. How Does Foci Intersect with Cfius and Antitrust Review?
Foreign ownership control and influence issues frequently arise alongside parallel federal review processes that carry their own timelines, filing obligations, and potential remedies. Managing these concurrent review tracks without coordinated legal strategy is one of the most common and costly mistakes companies make during cross-border transactions.
What Is the Relationship between Foci and Cfius?
While CFIUS (50 U.S.C. § 4565) evaluates whether a foreign acquisition threatens national security at the transactional level, FOCI specifically addresses the ongoing operational impact of foreign control on companies embedded in the defense industrial base. A transaction that clears CFIUS review may still trigger a new or revised FOCI mitigation agreement if the company holds or subsequently acquires an FCL, requiring coordinated legal strategies across both processes. Related practice area: CFIUS & U.S. National Security
How Does Antitrust Law Apply to Foci-Related Transactions?
Under Section 7 of the Clayton Act (15 U.S.C. § 18), any acquisition that "may substantially lessen competition or tend to create a monopoly" is prohibited — a review that runs concurrently with FOCI and CFIUS processes when a foreign entity acquires a U.S. .efense contractor. Pre-merger notification under Hart-Scott-Rodino (15 U.S.C. § 18a) may also impose mandatory waiting periods before closing, meaning companies must simultaneously satisfy antitrust regulators, CFIUS, and DCSA. Related practice area: Antitrust and Competition Law
4. How Can Companies Manage Foci Risk Effectively?
Proactive legal preparation is the most effective way to manage foreign ownership control and influence exposure before it becomes a compliance crisis. Companies that assess FOCI risk during deal structuring — rather than after closing — retain far greater flexibility in designing governance arrangements that satisfy both business objectives and national security requirements.
What Should Companies Do before a Foreign Investment?
Before closing any transaction involving a foreign investor or acquirer, companies should conduct a FOCI risk assessment covering ownership thresholds, board composition, and the scope of rights granted to the foreign party. Structuring deal terms to limit foreign influence — through restricted voting rights, board representation caps, or technology control provisions — can reduce the likelihood of a formal FOCI finding and preserve FCL eligibility.
What Steps Are Required for Ongoing Foci Compliance?
Companies already operating under a mitigation instrument — whether an SCA, SSA, or Proxy Agreement — must implement technology control plans, visitor access procedures, and board meeting protocols that exclude foreign representatives from classified discussions. Annual government certifications and periodic DCSA audits are standard requirements, and companies should reassess their mitigation instrument whenever the foreign parent's ownership stake, financial condition, or geopolitical relationships materially change. Related practice area: Corporate Compliance & Risk Management
03 Jun, 2026
