2026 NDAA Updates to Outbound Investment Rule

On December 18, 2025, President Donald Trump signed the National Defense Authorization Act for Fiscal Year 2026 (the “NDAA”). The NDAA includes the Comprehensive Outbound Investment National Security Act of 2025 (“COINS”), which codifies updates to the existing Outbound Investment Regulations (“OIR”) at 31 CFR Part 850. We discussed the contents of the OIR in our November 2024 Legal Update.

COINS Details

Key elements of COINS updates are summarized below:

• The 2026 NDAA authorizes $150 million for implementation of the new OIR regulations and requires that implementation occur within 450 days of NDAA passage.
• Congress added an “intelligence exemption” to the OIR. Pursuant to this exemption, “authorized intelligence activities” will not be subject to OIR restrictions.
• In a critical update, Congress added an ability for parties to seek “non-binding feedback” from the US government to determine the OIR’s application to a contemplated transaction. Applicants would receive feedback on “a confidential basis, or as anonymized guidance to the public,” and the process would be similar to “advisory opinion” processes available under some other regulatory regimes.
• The NDAA adds to the current list of covered sectors (semiconductor technology and microelectronics, quantum information technology, and AI systems) by including two new sectors: high-performance computing and supercomputing and hypersonic systems.
• The NDAA does not require direct action, but states that the Secretary of Treasury “may establish a publicly accessible, non-exhaustive database that identifies covered foreign persons that are either engaged in a prohibited technology or a notifiable technology.” If published, this publicly available tool would be a powerful resource for investors.
• Notably, the 2026 NDAA expands the definition of “Country of Concern” (from the PRC (including Macau and Hong Kong SARs)) to also include Cuba, Iran, North Korea, Russia, and Venezuela (under the Maduro regime).
• The NDAA streamlines the defined term “Covered Foreign Person” to mean: “a non-US person that is: a) incorporated in, has a principal place of business in, or is organized under the laws of a country of concern; b) a member of the Central Committee of the Chinese Communist Party or is a member of the political leadership of a country of concern; c) is subject to the direction or control of a country of concern  an entity described in (a) or (b), or the state or the government of a country of concern (including any political subdivision, agency, or instrumentality thereof); or d) owned in the aggregate, directly or indirectly, 50 percent or more by a country of concern, an entity described in a) or b), or the state or the government of a country of concern (including any political subdivision, agency, or instrumentality thereof).”  It is not clear how the COINS and existing OIR definitions will be reconciled.
• The NDAA definition folds in the OIR’s existing concept of “knowingly directing” by adding the following to the definition of a “covered national security transaction;” “knowingly directing prohibited transactions or notifiable transactions by foreign persons that the US person has knowledge at the time of the transaction would constitute a covered national security transaction if engaged in by a US person.”
• The NDAA definition adds a “de minimis exception,” stating that “any transaction the value of which the Secretary determines is de minimis” is not a covered national security transaction.
• The NDAA further excepts “ancillary transactions undertaken by a financial institution.” (“Ancillary transaction” means: (i) the processing, settling, clearing, or sending of payments and cash transactions; (ii) underwriting services, including the temporary acquisition of an equity interest for the sole purpose of facilitating underwriting services; (iii) credit rating services; and (iv) other services ordinarily incident to and part of the provision of financial services, such as opening deposit accounts, direct custody services, foreign exchange services, remittances services, and safe deposit services.)
• Also excepted are:
• Intracompany transfer of funds from a US parent company to a subsidiary located in a country of concern or a transaction that, but for this clause, would be a covered national security transaction between a US person and its controlled foreign person that supports operations that are not covered national security transactions, or that maintains covered national security transactions that the controlled foreign person was engaged in prior to the effective date of the implementing regulation; and
• Certain transactions that are secondary to a covered national security transaction (e.g., contractual arrangements, bank lending, bank payments, underwriting, debt rating, prime brokerage, global custody, equity research/analysis, or similar services).

Interested parties should watch carefully for the required updates to the OIR in the coming weeks and months.