Foreign Investment in Defense Contractors: What Triggers FOCI and What Doesn't

Most defense contractors think about FOCI in terms of ownership: is there a foreign company or foreign national on our cap table? If the answer is no, they assume they're clean. This assumption causes problems — often discovered at the worst possible time, during a contract action, a DCSA review, or a transaction closing.

Foreign Ownership, Control, or Influence is not a single test. It is four distinct vectors, any one of which can result in a FOCI determination by DCSA. I've spent 16 years inside a FOCI-mitigated contractor navigating this framework, and the surprises almost never come from the ownership vector. They come from control and influence — the vectors that legal and compliance teams without FOCI-specific experience consistently underestimate.

Here is what actually triggers FOCI, and what doesn't, under the NISPOM framework and the DCSA guidance that governs these determinations.

The Four FOCI Vectors

The National Industrial Security Program Operating Manual (NISPOM) defines FOCI through four vectors: ownership, control, influence, and access. Understanding each one separately is the starting point for any honest FOCI risk assessment.

Ownership is where most people start, and it's the most concrete of the four. A foreign entity owning 25% or more of a contractor's voting securities creates a rebuttable presumption of FOCI. But "rebuttable" is doing a lot of work in that sentence — the presumption can theoretically be rebutted, but in practice DCSA applies a totality-of-circumstances analysis that goes well beyond the 25% line. A foreign entity at 20% of voting securities with a board seat is very likely FOCI. Two separate foreign entities each holding 15%, both with contractual rights around major decisions, may collectively create FOCI. The 25% threshold is the bright line that triggers mandatory inquiry, not the only ownership position that can result in a determination.

Indirect ownership matters as much as direct ownership. If a foreign company owns 60% of a holding company that owns 100% of a defense contractor, that defense contractor has FOCI — the ownership is foreign even though the immediate parent may be a domestic entity. DCSA traces ownership chains. Attempting to insert a domestic holding company between a foreign investor and the cleared contractor, without also restructuring governance rights, does not resolve FOCI.

Control is where the private equity industry routinely underestimates its exposure. Control under NISPOM refers to the legal capacity to determine or direct the management or policies of the contractor. Foreign nationals on boards of directors with voting rights constitute control. A foreign parent company with contractual approval rights over major business decisions — capital expenditures above a threshold, executive hiring and termination, strategic direction — constitutes control.

Observer rights are frequently treated as benign. Board observer rights alone — the right to attend board meetings without voting — may not constitute control. But observer rights combined with information rights, combined with veto rights on specific decisions, combined with a foreign entity holding a meaningful economic stake, often do. DCSA looks at the substantive rights, not the label. A "non-voting observer" who has the right to veto the hiring of the CEO is not without control.

Influence is the most fact-specific vector and the one most commonly missed in FOCI analyses conducted by generalist counsel. Influence includes foreign-origin financing arrangements with performance covenants that give foreign entities de facto leverage over operations — credit facilities where a foreign bank has cross-default triggers tied to U.S. government contract performance, for example. It includes exclusive technology licensing agreements with foreign entities that constrain what the contractor can do with its own products. It includes foreign government contracts that create financial dependency — where losing a foreign government customer would materially impair operations.

Influence is also where foreign LP interests in PE funds can surface. A PE fund's general partner typically has complete discretion over portfolio company governance. LP interests are passive. But when a foreign sovereign wealth fund or foreign pension fund represents a substantial portion of LP capital, and when the fund's governing documents include side letters or reporting obligations to those foreign LPs, and when those obligations touch on portfolio company operations or strategy, the analysis gets complicated. The question is not whether the foreign LP has a board seat — they typically don't. The question is whether the totality of the LP's economic interest, the fund's obligations to that LP, and the fund's control over the portfolio company collectively constitute FOCI. This is a fact-specific analysis that needs to be done by someone who has actually run it with DCSA, not someone applying a generic securities law framework.

Access addresses foreign national key management personnel — executives and senior staff in positions that give them access to classified information or the ability to affect the company's security posture. This is not about having a foreign-national employee in a non-sensitive role. It is about having foreign nationals in positions where they could affect classified programs — the FSO, the CIO, a VP of Operations with facility access to classified areas, a CFO with signature authority over classified contracts. DCSA evaluates the position, not just the person.

What Private Equity Needs to Know Before Closing

The PE angle is where FOCI surprises happen most frequently in my experience, and where the cost of getting it wrong is highest. An acquisition that closes without a FOCI analysis can result in 18 to 24 months of mitigation process after the fact — during which the target company's ability to perform on or bid for new classified contracts is constrained.

Domestic PE funds with foreign LP capital are not automatically FOCI. LP interests in a fund are generally passive, and passivity is the key distinction. But "passive" has a specific meaning in this context, and LP agreements that include information rights, reporting obligations, co-investment rights, or any approval rights tied to specific portfolio company decisions are moving away from passivity.

The practical rule is straightforward: if a PE firm is considering acquiring a cleared defense contractor — or a contractor seeking a facility clearance — the FOCI analysis needs to happen before the letter of intent, not after closing. The cost of a pre-LOI FOCI assessment is a fraction of the cost of unwinding a post-closing FOCI-impacted transaction, and the business disruption of a post-closing mitigation process is significant. I have seen companies lose contract award opportunities while a mitigation agreement was being negotiated after a transaction that should have been analyzed before it closed.

The same logic applies to investment rounds at portfolio companies that are already cleared contractors. A new investor whose LP structure creates a FOCI issue triggers the same disclosure and mitigation obligations as an acquisition. Middle-market defense contractors that take on growth equity without FOCI analysis face the same exposure.

The National Interest Determination Pathway

Not every FOCI determination results in a full mitigation agreement. In cases where the foreign interest is genuinely passive — a small foreign investor with no governance rights, no board representation, and no contractual leverage — and where the work being performed is not particularly sensitive, DCSA may accept a National Interest Determination (NID). A NID allows a FOCI-impacted contractor to hold a facility clearance with a more limited mitigation framework, effectively a documented acknowledgment that the FOCI exists but does not create an unacceptable security risk given the totality of circumstances.

NIDs are not commonly granted and are not available where the nature of the FOCI or the sensitivity of the cleared work makes them inappropriate. But for contractors with limited, clearly passive foreign investment in a context where the FCL supports lower-sensitivity work, the NID pathway is worth exploring. It requires the same initial disclosure process — SF 328, DCSA review — but may result in a lighter outcome than a full SSA or proxy arrangement.

How FOCI Interacts With Facility Clearances

The downstream consequence of a FOCI determination that cannot be resolved is straightforward: the facility clearance cannot be granted or maintained. A contractor cannot hold an FCL with unmitigated FOCI. For contractors whose revenue depends on performing classified work — system integration on classified programs, providing personnel into classified facilities, holding classified contracts — an unresolved FOCI determination is existential.

The mitigation agreement is the instrument that allows DCSA to grant an FCL despite the existence of FOCI. The agreement establishes the governance and security framework that DCSA believes adequately addresses the risk — outside board members, a Government Security Committee, restrictions on foreign national access, annual reporting, and in some cases insulation of the board from the foreign parent's influence on security-relevant decisions.

The type of mitigation instrument depends on the nature and degree of FOCI. Security Control Agreements are the lightest instrument. Special Security Agreements are more demanding and used where the FOCI is more direct or the work is more sensitive. Proxy agreements and voting trusts — where practical control of the company is placed in the hands of U.S. persons approved by DCSA — are the most restrictive and typically reserved for contractors where foreign ownership is dominant and classified work is central to the business.

Before the Next Transaction

Any transaction that changes the ownership or control structure — an acquisition, a new investment round, a board composition change, a key management hire into a senior role — should trigger a FOCI review before the transaction closes. This is not a legal nicety. It is practical risk management.

The question is not just "do we have FOCI today." The question is "will this transaction create FOCI, and if it does, what is the mitigation path, and how long will it take, and what is the impact on our ability to perform on current contracts and pursue new awards during that process." Getting that analysis done before closing — before the consideration is paid, before the investor is on the cap table, before the board member is seated — gives the parties options. After closing, the options narrow significantly.

If your corporate transaction team does not include someone who has actually negotiated FOCI mitigation agreements with DCSA, add one before the next deal closes.