Introduction
On October 22, 2026, the U.S. Department of the Treasury (“Treasury”) issued a Notice of Proposed Rulemaking (NPRM) proposing regulations to implement the outbound investment provisions of the Comprehensive Outbound Investment National Security Act of 2025 (the “COINS Act”). If finalized in its current form, the NPRM would establish a new regulatory framework under 31 C.F.R. Part 851, replacing the existing outbound investment security program (OISP) regulations under 31 C.F.R. Part 850 (the “Existing Rule”). Until the new regulations take effect, the Existing Rule remains in force.
In addition to implementing changes mandated by the COINS Act, the NPRM proposes broader technology definitions, expanded prohibitions, and more extensive reporting obligations. Companies should assess how these changes could affect their investment strategies, transaction diligence, compliance procedures, and related contractual obligations, and consider whether to seek clarification or raise technology- or industry-specific considerations through the public comment process. Comments on the NPRM are due by December 7, 2026.
Background
The OISP was established pursuant to the August 9, 2023 Executive Order 14105, “Addressing United States Investments in Certain National Security Technologies and Products in Countries of Concern,” issued under the International Emergency Economic Powers Act (IEEPA).
Treasury currently implements the OISP through the Existing Rule, which has been in effect since January 2, 2025. As discussed in our previous client alert, the program currently covers specified transactions by U.S. persons involving covered foreign persons in three technology sectors: (i) semiconductors and microelectronics, (ii) quantum information technologies, and (iii) artificial intelligence systems. Building on this regulatory framework, Congress enacted the COINS Act on December 18, 2025, establishing a specific statutory foundation for the OISP while also introducing certain expansions.
Overview of the NPRM
Same Structure, Broader Scope
The NPRM preserves the Existing Rule’s transaction-based structure, under which certain covered investments by U.S. persons in entities associated with countries of concern are either prohibited or subject to notification, depending on the specified sensitive technologies and activities.
At the same time, the NPRM incorporates several changes mandated by the COINS Act, including expanding the list of countries of concern and adding new covered technology sectors. Specifically, the NPRM would expand the list of identified countries of concern beyond China (including Hong Kong and Macau), to include Cuba, Iran, North Korea, Russia, and Venezuela under the regime of Nicolás Maduro Moros. The NPRM notes, however, that the Maduro regime has ended and that the United States recognized Delcy Rodríguez as Venezuela’s head of state in March 2026.
The NPRM would also expand the scope of covered technologies to include “high-performance computing and supercomputing,” including AI (i.e., “super intelligence”) data center clusters and other high-performance computing applications, and “hypersonic systems,” which generally involve technologies designed to operate at speeds exceeding five times the speed of sound (Mach 5). The NPRM would further establish technical thresholds for determining which investments in these sectors would be subject to notification requirements or prohibitions.
Expansions Under the NPRM
Beyond the changes explicitly required by the COINS Act, Treasury has proposed several additional measures and clarifications based on discretionary authority provided for under the COINS Act that expand the current scope of the OISP. Key measures are highlighted below.
Expanded Prohibitions
- Biotechnology: Treasury utilized its authority under the COINS Act to propose adding “biotechnology” to the list of prohibited technologies, based on its determination that certain biotechnology applications would enable the military, intelligence, surveillance, or cyber-enabled capabilities of countries of concern. The prohibition would bar covered investments involving: (1) biological systems used to develop specified agents and toxins, energetic materials, high-performance functional materials, pharmaceutical compounds, or biofuels; and (2) certain brain-computer interfaces, biological sequencing technologies, flow cytometers and cell sorters, mass spectrometry instruments, computational and bioinformatics tools, and lab automation or cloud lab tools.
- Super Intelligence (SI) Systems: Whereas the Existing Rule’s AI restrictions distinguish between prohibited and notifiable transactions based on specified computational thresholds and end-use factors, the NPRM would replace AI controls in the Existing Rule with new controls on SI systems and generally prohibit covered transactions involving the development of any SI System. The proposed definition of “SI System” is expansive, as the prohibition would incorporate AI to the extent already covered in the Existing Rule and extend it to cover machine-based systems that generate content. The definition would also extend to any software, hardware, application, or other technology that uses such systems, including agentic SI tools, robotics, and autonomous or unmanned systems.
- U.S. Government Lists: Under the NPRM, an otherwise notifiable transaction would become prohibited if the relevant covered foreign person, or any affiliate or subsidiary, appears on specified U.S. government lists. Beyond lists incorporated in the Existing Rule, the NPRM adds the Department of War’s Section 1260H list of Chinese military companies and the BIOSECURE Act list of biotechnology companies of concern. The NPRM also proposes that these provisions apply to the affiliates and subsidiaries of a covered foreign person or relevant joint venture that engages in a notifiable transaction, further expanding the provision.
Notification and Knowledge Requirements
- Notification Requirements: For notifiable transactions, the NPRM would impose more extensive reporting requirements than the Existing Rule, including detailed disclosures concerning ownership (such as foreign beneficial owners holding more than 5% of a U.S. person’s voting or economic interests), transaction documentation, and the commercial rationale for the investment. Consistent with the Existing Rule, notifications generally would remain due within 30 calendar days after completion of a transaction. The NPRM would also retain notification requirements for certain post-transaction discoveries and the existing 10-year recordkeeping requirement.
- Knowledge Standard: The NPRM largely retains the Existing Rule’s knowledge standard, under which Treasury may find that a U.S. person had knowledge of relevant facts or circumstances if it failed to conduct a “reasonable and diligent inquiry” before undertaking a transaction. However, under the NPRM, Treasury would also consider whether a U.S. person appropriately evaluated information provided by Treasury before the transaction, including any assessments that a covered foreign person may be engaged in notifiable or prohibited technologies. The NPRM would also clarify that the knowledge standard applies to controlled foreign entities for purposes of certain notification requirements.
Refinements to Existing Technology Coverage
- Expanded Definition of “Develop”: The NPRM largely retains the Existing Rule’s definition of “develop,” while introducing three clarifications that apparently broaden its scope. Specifically, the NPRM clarifies that “develop” includes (i) activities conducted through or in collaboration with affiliates, (ii) transforming blueprints, schematics, or other plans into a product, and (iii) providing high-level oversight, direction, approval, conceptual input, or strategic planning. Notably, the definition still limits “development” to activities and stages prior to serial production, which could have implications for activities that trigger only on “development” or “production” activities (but not either).
- Semiconductor Equipment and High-Bandwidth Memory: The NPRM would retain existing controls on electronic design automation (i.e., EDA) chip design tools, designated “front-end” fabrication equipment, advanced packaging technologies, and specified advanced integrated circuits. The NPRM proposes to add a prohibition covering high-bandwidth memory, with memory-bandwidth density greater than 2 gigabytes per second per square millimeter, consistent with control thresholds in Export Control Classification Number (ECCN) 3A090.c on the Commerce Control List (CCL) in the Export Administration Regulations (EAR), though without any corresponding exceptions or technical notes. Investments in businesses that develop or produce other equipment used to design, fabricate, or package integrated circuits, beyond the equipment covered by § 851.226(b), would also be notifiable.
Enforcement
The NPRM would retain the Existing Rule’s civil penalty framework, including penalties up to the maximum amount authorized under IEEPA. Consistent with the COINS Act, the NPRM would eliminate references to criminal penalties, although criminal exposure could still arise under other statutes. Beyond monetary penalties, the NPRM would expressly authorize Treasury to unwind a prohibited transaction by requiring divestment. A timely voluntary self-disclosure would remain a potential mitigating factor in determining penalties, but the disclosure would need to include a plan to remedy any resulting harm, such as divestment or voluntary disgorgement of profits.
These proposed enforcement changes follow Treasury’s first enforcement action under the OISP, in which Treasury imposed a $200,000 penalty on Amidi, LLC for failing to notify Treasury of an investment made by its controlled foreign subsidiary into a private Chinese artificial intelligence company, which we described in our recent prior client alert.
Key Takeaways and Considerations for Public Comment
- New prohibitions could reach a wide range of commercial activities. The proposed prohibitions involving biotechnology and SI systems could capture companies engaged in a broad range of commercial activities, including those without an apparent military or national security application. Investors may wish to seek clarification regarding the scope of these definitions and whether additional limitations or exclusions are warranted for commercial or civilian applications. Notably, Treasury acknowledges in the NPRM the potential harm to public health and commerce and has asked for comment on whether to narrow the biotechnology provision.
- More extensive diligence and reporting requirements could increase transaction costs. The NPRM would require additional information concerning ownership, transaction documentation, investment rationale, and commercial relationships. The NPRM’s expanded guidance on the knowledge standard would also emphasize consideration of information provided by Treasury before undertaking a transaction. These requirements could present challenges where investors have limited access to information about foreign counterparties.
- New list-based prohibitions could expand counterparty screening obligations. The NPRM would add the Section 1260H and BIOSECURE Act lists to the U.S. government lists already incorporated in the Existing Rule, making otherwise notifiable transactions involving listed companies prohibited and extending the OISP’s bright-line prohibitions to additional Chinese military-linked and biotechnology companies. Because the prohibitions would apply even where only an affiliate or subsidiary of a covered foreign person or joint venture appears on one of these lists, investors may need to screen the target’s broader corporate group, not just the target itself, and continue screening through closing.
- Refined definitions could extend coverage to indirect participants in technology development. The NPRM’s expanded definition of “develop” could bring additional companies within the scope of the OISP, including those that provide strategic oversight or collaborate with affiliates on covered technology development without directly performing the underlying technical work. Coupled with expanded restrictions on semiconductor equipment and high-bandwidth memory, these changes could require investors to assess a target’s broader business activities, affiliate relationships, and role in the technology development process.
- Enhanced enforcement authorities underscore the importance of compliance procedures. The NPRM would expressly authorize Treasury to compel divestment of prohibited transactions and would require voluntary self-disclosures to include proposed mitigation measures, such as divestment or disgorgement of profits. Treasury’s first OISP enforcement action also demonstrates the potential consequences of failing to identify and notify covered transactions, including those undertaken through controlled foreign entities. Companies should consider whether existing investment screening, diligence, recordkeeping, contractual commitments, and escalation procedures adequately address the proposed requirements, including mechanisms for identifying potential violations after closing.
- Expanded technical thresholds could complicate transaction diligence. The NPRM’s expanded scope and technical thresholds could make it challenging for investors to determine whether a target’s technologies or activities are subject to notification requirements or prohibitions. Although the NPRM would establish a process for requesting non-binding feedback from Treasury regarding specific prospective transactions that may be prohibited, that process would not provide a standalone classification mechanism. Investors may therefore wish to involve advisors experienced in both outbound investment restrictions and U.S. export controls, particularly in close cases where a formal export classification or other technical analysis may be warranted.
Conclusion
Although the NPRM remains subject to change, it signals a significant expansion of the OISP. Companies and investors should begin assessing its potential implications for their investment activities, diligence procedures, and compliance programs, particularly in newly covered technology sectors. The public comment process also presents an important opportunity for affected stakeholders to seek clarification regarding the scope and practical implementation of the proposed requirements before they are finalized.
Haylee Levin, an associate in the Washington, D.C. office, contributed to the writing of this article.