U.S. sanctions and trade controls that target “countries of concern” – including Russia, Iran, North Korea, Venezuela and China (including Hong Kong and Macau) – are poised to have a more significant impact on international investment flows in 2026.  Fund managers, investment advisers, joint venture partners, investors and other persons subject to US jurisdiction will need to screen investments carefully to ensure compliance with these rules and mitigate growing enforcement risks.  Understanding the scope of these regulations can also help navigate distortions in affected markets or identify potential investment opportunities.

Specifically, the Comprehensive Outbound Investment National Security Act of 2025 (the “Act”) was enacted into law on December 18, 2025 as part of the FY 2026 National Defense Authorization Act (the “NDAA”).  This legislation has authorized a staggering $150 million¹ annually to the U.S. Treasury Department for FY 2026 and FY 2027 to build out a permanent Outbound Investment Security Program, including authority to appoint and hire additional staff to administer and enforce that program, signaling that Treasury plainly intends to deploy significant enforcement and implementation resources. This program is also no longer subject to abrupt cancellation or modification by executive order, as it has now been passed into law.

NDAA Expands the Statutory Framework for Outbound Investment Controls

 The NDAA’s expansion of the U.S. outbound investment security framework is part of the U.S. government’s efforts to restrict or require U.S. persons to report certain investments in sensitive technologies into covered foreign persons, which began in 2023 under Executive Order 14105, resulting in a final rule that went effective in January 2025 following a lengthy rulemaking process.  See 31 CFR Part 850 et seq. (the “Outbound Investment Rule” or “OIR”).  Some of our previous coverage of the rule is available here.

The Act grants the Treasury Department authority to issue regulations prohibiting U.S. persons (and their controlled foreign entities) from knowingly engaging in covered national security transactions involving a prohibited technology.  At the same time, the Act directs Treasury, within 450 days, to issue regulations requiring a notification when a U.S. person or its controlled foreign entity knowingly engages in a covered national security transaction in a prohibited or a notifiable technology.  These regulations will – as detailed below – expand the types of technologies and countries covered by the Act, among other things.  The Act also grants Treasury broad discretion to prohibit or require notification concerning new categories of transactions through future rulemaking.

Key Provisions and Changes From Existing Law

Until Treasury issues new regulations under the Act, the existing rules contained at 31 CFR Part 850 remain in effect, including requirements to avoid engaging in prohibited transactions or otherwise to submit a notification through Treasury’s Outbound Notification System (ONS) Portal for any notifiable transactions. The expansion of the program and new funding for rulemaking and enforcement highlights the importance of understanding where these regulations are headed, when an investment may be prohibited, or when a notification to Treasury may be required.

Key amendments and other provisions under the Act include the following:

New Geographic Coverage

• Existing law covers a variety of equity and other investments in companies located in or connected to China (including Hong Kong and Macau) which was the only identified “country of concern”.
• Under the amendments in the Act, the term “country of concern” will expand to include Cuba, Iran, North Korea, Russia, and Venezuela under the Maduro government once regulations are implemented.

New Technology Coverage

• Existing law applies prohibitions or notification requirements for investments in the semiconductors and microelectronics, quantum information technologies, and artificial intelligence sectors, and defines technical parameters that define what is a “prohibited” and a “notifiable” transaction.
• Under the amendments in the Act, “prohibited” and “notifiable” technologies will expand to include covered investments in “high-performance computing and supercomputing” and “hypersonic systems” in addition to the sectors above. Specific technical parameters are expected to be developed by Treasury by regulation.
• The legislation also permits the Treasury department to “add and define” additional categories for any additional technologies “that enable the military, intelligence, surveillance, or cyber-enabled capabilities of a country of concern.”

Confidentiality, Self-Disclosure and Non-Binding Feedback Provisions

• A variety of amendments help integrate the outbound investment program into existing law, including provisions that provide confidentiality protection, leniency in the event of voluntary self-disclosures, and a framework for non-binding feedback for grey areas concerning the regulations.
  • Confidentiality: The Act provides for an explicit FOIA exemption under 5 U.S.C. 552(b)(3), providing a default rule of confidentiality for submissions to Treasury regarding “notifiable investments” under the program, with the limited exceptions as stated in new Section 808 of the Defense Production Act.
  • Self-Disclosure: The Act calls for regulations to implement a voluntary self-disclosure program that would include some measure of enforcement relief in the event a person self-discloses a prohibited investment with a proposal for mitigation of harm.
  • Non-Binding Feedback and Anonymized (FAQ) Guidance: The Act also requires that the forthcoming regulations include a process under which a person can request to receive non-binding feedback on a confidential basis, or as anonymized guidance to the public, as to whether a transaction would constitute a covered national security transaction in a prohibited technology.

Non-Notified Activity

• The Act includes a provision that requires Treasury to develop regulations to identify covered transactions in the affected sectors for which “a notification is not submitted” and “information is reasonably available.”
• In other words, the Act is creating a mechanism for Treasury to seek to detect and review for any unreported transactions. Treasury will be using its new funding in part by seeking to monitor for – and enforce against – those unreported transactions.

New Exceptions and Exemptions

• The Act expands the scope of available exceptions beyond existing law to permit ancillary transactions by financial institutions, as well as certain secondary transactions (including lending, primary brokerage, custody, credit rating and underwriting services), and other “ordinary or administrative business transactions.”
• The exception for publicly traded securities continues, as well as an exception for certain smaller LP investments that are “not more than a de minimis amount” (set at USD $2 million under existing law), or where a binding contractual assurance is provided to the investor that its capital will not be used to engage in a covered national security transaction.

Covered Foreign Persons

• The Act authorizes Treasury to establish a non-exhaustive public database of “covered foreign persons” that are engaged in a prohibited or notifiable technology. If created this would include a process for such persons to petition for removal (or inclusion) on that list; and would assist stakeholders in the diligence process in connection with potential investments in countries and sectors that might be affected by the Act.
• The Act also modifies the definition of a “covered foreign person” to limit the 50% rule to direct or indirect 50% ownership by a person of a country of concern, instead of the more complex inquiry under current law that looks to whether an entity (wherever located) derives more than 50% of its revenue, net income, capital expenditures, or operating expenses from a person of a country of concern.

Divestment Authority

• In addition to civil penalties equivalent to the amounts permitted under the International Emergency Economic Powers Act (“IEEPA”) for transactions determined to be in violation of the Act, the Act also provides Treasury with the authority to require a U.S. person to divest or unwind a prohibited transaction.

New Sanctions Authorities Expanding the Non-SDN CMIC Program

• There is already a sanctions program that prohibits U.S. persons from engaging in any purchase or sale of publicly traded securities, or any publicly traded securities that are derivative of such securities or are designed to provide investment exposure to such securities, of any company identified as a Chinese Military Industrial Complex (“CMIC”) company on OFAC’s “Non-SDN Chinese Military-Industrial Complex Companies List.” (the “CMIC List”)
• Now, the Act permits new sanctions to be imposed against any person identified as a “covered foreign person” to the extent necessary to “prohibit any United States person from investing in or purchasing significant amounts of equity or debt instruments” from that person, and including civil and criminal penalties under the IIEPA for any persons that violate or “cause” a violation of those provisions.
• Within one year from enactment, and for the following seven years, the Act also requires the President to submit a report stating whether any CMIC company is a “covered foreign person.”
• These provisions lay the groundwork for a notable expansion of the CMIC program which will involve broadening the investment restrictions on the companies on that list. Any company identified as a “covered foreign person” would be subject to restrictions on a broader range of equity and debt investments – and not just the purchase and sale of securities or derivatives providing equity exposure to those companies.
• Finally, the Act includes a new biannual reporting requirement requiring that the President report to Congress whether a broad array of other Chinese companies identified in any one of several other U.S. restricted lists would qualify for inclusion on the CMIC List.²

Continued Pressure on “Countries of Concern”

The Act signals the U.S. government’s efforts to continue to apply sustained pressure on other “countries of concern” in addition to China – i.e., Cuba, Russia, North Korea, Iran, and Venezuela. Although this designation may be symbolic in part, given the breadth of existing sanctions programs against countries like Cuba, Iran, and North Korea which remain comprehensively sanctioned, outbound foreign investment reviews will likely become an additional lever for enforcing sanctions objectives; and any investments in these sectors in or connected to Russia or Venezuela – which are subject to broad but not all-encompassing sanctions programs – may well be implicated by this new legislation.

As Treasury continues to expand its sanctions and trade controls toolkit, all persons subject to U.S. jurisdiction should continue to carefully assess outbound investment compliance requirements in their investments and corporate transactions.