National Defense Authorization Act Introduces New Outbound Investment Regime

On December 18, 2025, President Trump signed into law the National Defense Authorization Act (NDAA) for fiscal year (FY) 2026, which incorporates outbound investment provisions that prohibit or require notification to the U.S. Department of the Treasury (Treasury) for “knowingly” engaging in covered transactions. The NDAA’s Comprehensive Outbound Investment National Security Act of 2025 (COINS Act or the Act) codifies and broadens the existing Outbound Investment Security Program established under 31 C.F.R. Part 850 (“existing regulations”) (discussed in our November 2024 Advisory), while also creating additional responsibilities for U.S. persons. Among other changes, the COINS Act expands (1) prohibited and notifiable technology coverage to include high-performing computing and hypersonic systems, (2) the scope of “covered transactions” (termed “covered national security transactions” in the COINS Act), (3) the list of “countries of concern,” as well as (4) exceptions and exemptions to the covered transactions, as discussed below.

To alleviate the compliance burden on U.S. persons, the Act also requires Treasury to create a publicly accessible, non-exhaustive list of covered foreign persons. However, because the list is not comprehensive, U.S. persons must continue to conduct diligence to satisfy the Act’s knowledge standard. Additionally, under a separate subtitle, the COINS Act codifies and expands the Chinese Military Companies Sanctions authority by allowing the president to broadly prohibit investments by U.S. persons in equity or debt instruments in covered persons in the People’s Republic of China (PRC) (including Hong Kong and Macau).

Framework and Implementation

The COINS Act amends the existing Defense Production Act of 1950. The Act requires that Treasury issue implementing regulations within 450 days of enactment and authorizes $150 million annually for FY26 and FY27 for Treasury, as well as provides expedited hiring authority to establish and operate the outbound investment program.

Prohibited and Notifiable Transactions

The existing regulations prohibit or require a notification of certain types of outbound investments by U.S. persons or their controlled foreign entities. The COINS Act preserves this structure, but modifies and expands the key definitions, as discussed below.

Prohibited and Notifiable Technologies

The COINS Act expands the scope of covered technologies under existing regulations, although the specifics will need to be determined in the implementing regulations. Notably, in addition to the areas already covered by the existing regulations, the COINS Act identifies high-performing computing and hypersonic systems in defining the prohibited and notifiable technologies. The COINS Act also expands on the existing regulations requiring notification to Treasury for covered transactions involving such technology areas that do not meet the technical threshold of prohibited technologies, unless specifically carved out. In contrast, the existing regulations’ notification requirements only cover the semiconductor and microelectronics, as well as the artificial intelligence systems (AI) sectors.

The following chart compares the technologies covered under the existing regulations and the COINS Act:

Covered National Security Transactions

The COINS Act’s definition of “covered national security transactions” is similar to the definition of “covered transactions” in the existing regulations, but also provides specific authority to cover other transactions that contribute to a country of concern’s military, surveillance, or cyber capabilities. “Covered national security transactions” is defined to include the direct or indirect:

• Acquisition of equity interest or contingent equity interest
• Conversion of an equity interest
• Provision of certain kinds of debt financing
• Greenfield or brownfield investment that engages with or results in the creation of a covered foreign person
• Entrance into a joint venture, wherever located, with a party the U.S. person knows is engaging or plans to engage in a covered activity (prohibited or notifiable transaction)
• Knowledge of the direction of the above-listed transactions
• Acquisition of a limited partner interest in a non-U.S. person pooled investment fund that invests in a covered foreign person
• Participation in any other transactions determined by regulation to be contributing to the military, intelligence, surveillance, or cyber-enabled capabilities of a country of concern

Covered Foreign Person

The COINS Act defines “covered foreign person” to mean a foreign person that is:

• Incorporated in, has a principal place of business in, or is organized under the laws of a country of concern
• A member of the Chinese Communist Party or in the political leadership of a country of concern
• A state, political subdivision, agency, or political subdivision of a country of concern
• Subject to the direction of the above-listed covered foreign persons
• Owned in the aggregate, directly or indirectly, 50% or more by any entity falling under the above definitions that knowingly engaged in significant defense or related materiel operations or surveillance technology sector of a country of concern

Although similar to the definition of “a person of a country concern” in the existing regulations, the COINS Act’s definition of “covered foreign person” is broader. The COINS Act definition captures entities subject to the direction of a “covered foreign person,” without the existing regulations’ requirement that the “covered foreign person” derive 50% of its annual revenue or net income, or incur 50% of its annual capital expenditure or operating expenses from the directed entity.

Countries of Concern

Relative to the existing regulations, which designated the PRC (including Hong Kong and Macau) as “countries of concern,” the COINS Act expands the list of “countries of concern” to add the following (in addition to the PRC):

• Cuba
• Iran
• North Korea
• Russia
• Venezuela (under the regime of President Nicolas Maduro)

U.S. Persons and Controlled Foreign Entities

The COINS Act directly prohibits U.S. persons and controlled foreign entities from engaging in prohibited transactions, expanding on the existing regulations’ requirement that U.S. persons take “all reasonable steps” to prohibit and prevent their controlled foreign entities from engaging in prohibited transactions. The Act preserves the existing requirement that U.S. persons notify Treasury of notifiable transactions by their controlled foreign subsidiaries.

Notification Process

The COINS Act does not provide notification procedures; instead, specific procedures are to be prescribed by Treasury in the implementing regulations. As with the existing regulations, within 30 days of completion, U.S. persons must notify Treasury if they acquire knowledge of a covered national security transaction in a prohibited technology or notifiable technology.

Exceptions and Exemptions

The COINS Act creates exceptions for the following transactions that were also available under the existing regulations. These include:

• A transaction that is in the national interest of the United States, as determined by the Treasury secretary
• An investment by a U.S. person in any publicly traded security
• An investment by a U.S. person in a security issued by an investment company, such as an index fund, mutual fund, or exchange-traded fund
• Certain investments made by a U.S. person limited partnership into a venture capital fund, private equity fund, fund of funds, or other pooled investment funds
• Certain derivatives, as long as they do not confer the right to acquire equity or any rights associated with equity
• A U.S. person’s full buyout of all interests of any person of a country of concern in an entity, such that the entity would not constitute a covered foreign person following the transaction
• An intracompany transaction between a U.S. person parent and its subsidiary to support ongoing operations (or other activities that are not covered activities)

The COINS Act also creates exceptions for the following transactions:

• De minimis transactions (threshold to be determined by the Treasury secretary)
• Secondary transactions, such as contractual arrangements (excluding technology/technical knowledge transfer) or the procurement of material inputs for covered national security transactions; bank lending; payment processing, clearing, or sending; underwriting services; debt rating services; prime brokerage; global custody; equity research or analysis; and other similar services
• Ancillary transactions such as processing, settling, clearing, or sending of payments; underwriting services; credit rating services; and ordinary course banking services
• Ordinary or administrative business transactions (as defined by the regulations)
• Transactions completed before enactment of the implementing regulations

When issuing the existing regulations, the Treasury Department declined to specifically exclude secondary and ancillary transactions. However, it provided guidance that such transactions would ordinarily not meet the definition of “covered transactions.” The COINS Act explicitly includes such secondary and ancillary transactions as excepted transactions.

In addition to the above exceptions, the COINS Act exempts (1) transactions determined by the president, in consultation with the Treasury secretary, to be in the national interest of the United States, and (2) authorized intelligence activities.

Due Diligence

Similar to the existing regulations, the COINS Act defines the term “knowledge” broadly to include not only actual knowledge, but also reasons to know. Therefore, U.S. persons will need to engage in due diligence to determine whether a given transaction is prohibited or notifiable.

Despite a comment requiring Treasury to publish a list of covered foreign persons to facilitate due diligence efforts, Treasury declined to do so when issuing the existing regulations. As noted, the COINS Act mandates the creation of a publicly accessible (though non-exhaustive) list of covered foreign persons, which would ease some of the diligence burdens on market participants. Because the database is non-exhaustive, however, U.S. persons will still need to engage in additional diligence efforts, especially when an investment target is not identified on the list of covered foreign persons to be created pursuant to the COINS Act.

Violations

As with the existing regulations, violations of the outbound investment provisions under the COINS Act may result in civil and criminal penalties under the International Emergency Economic Powers Act. The Treasury may also require U.S. persons to divest from prohibited transactions. The Act also requires that the implementing regulations provide procedures for voluntary self-disclosures.

Congressional Reporting and Multilateral Cooperation

The COINS Act requires the Treasury secretary to report to Congress on the establishment, administration, and enforcement of the regulatory regime. The Treasury secretary must, within 18 months of enactment, submit a report to congressional committees listing all enforcement actions in the prior year (including a description of the prohibited or notifiable technology, covered national security transaction, covered foreign person, and the relevant U.S. person), assessing the definition of “prohibited technology,” listing and describing all notifications during the prior year, and providing broader program assessments. Additionally, there are requirements for annual testimony by the Treasury secretary and secretary of commerce for five years after enactment, and an obligation to respond to requests by congressional committees.

Treasury is also required to engage with “allied and partner countries” on coordinating and harmonizing outbound investment controls. Treasury must submit a report to Congress within 180 days of enactment proposing a strategy for multilateral engagement. Additionally, within one year of enactment, it must submit a report providing an update on the status of multilateral engagement.

Expansion of Chinese Military Companies Sanctions Authority

The existing Chinese Military Companies Sanctions under 31 C.F.R. Part 586 prohibit the purchase or sale of any publicly traded securities or derivatives designed to provide investment exposure to such securities of persons listed on the Non-SDN Chinese Military-Industrial Complex Companies List. Subtitle B of the COINS Act expands the existing Chinese Military Companies Sanctions by authorizing the president, effective immediately, to prohibit any U.S. person from investing in or purchasing significant amounts of equity or debt instruments of a “covered foreign person.” Unlike the definition of “covered foreign person” in Subtitle B (relating to the outbound investment security program), Subtitle B applies only to covered foreign persons in the PRC (including Hong Kong and Macau).

Conclusion

Companies and individuals should closely monitor Treasury’s implementing regulations for the COINS Act, which are likely to impose additional restrictions, diligence requirements, or procedural obligations, and provide clarification for existing requirements. In the interim, U.S. persons with existing or contemplated investments in sensitive technologies located in or involving countries of concern should carefully review the COINS Act and assess its implications for their businesses.

Please contact any author of this Advisory or your Arnold & Porter relationship attorney if you have any questions or to seek further guidance or advice.