On Thursday, October 22, 2026, the U.S. Department of the Treasury (Treasury) issued a notice of proposed rulemaking (the Proposed Rule) to replace and expand the current Outbound Investment Security Program (the OISP). The Proposed Rule would implement Subtitle C of the Comprehensive Outbound Investment National Security Act of 2025 (the COINS Act) enacted last December, which we previously discussed here. The Proposed Rule would establish new regulations (to be codified at 31 C.F.R. Part 851) that prohibit U.S. persons from making certain investments, and require them to notify Treasury of others, when the target is a company or other person tied to the People’s Republic of China (PRC, including Hong Kong and Macau), Cuba, Iran, North Korea, Russia, or (in specified circumstances) Venezuela (each such company or other person being a “covered foreign person”) that is engaged in specified technologies. Comments on the Proposed Rule are due December 7, 2026.

The current OISP limits U.S. equity investments, joint ventures, asset acquisitions, and other forms of investment that might help grow a sensitive technology business under the influence of a country of concern. However, OISP concerns can be eliminated by determining that a given investment target either (a) does not have covered activities in a relevant technology sector or (b) has no relevant connections to a country of concern. The Proposed Rule would make assessing both (a) and (b) more difficult. With respect to sensitive technologies, the Proposed Rule would, among other changes, expand coverage to include a prohibition on covered investments in all artificial intelligence (AI) systems and in a number of broadly defined areas of biotechnology. With respect to relationships with a country of concern, the Proposed Rule keeps the relatively clear set of 50 percent ownership and economic relationship tests in the OISP but adds a much more subjective “subject to the direction or control” test.

If the Proposed Rule is implemented in its current form:

• U.S. investors could face an elevated diligence bar and more blocked transactions; investment targets—and their preexisting investors—will need to be evaluated for links to the relevant country of concern or checked against lengthy lists of sensitive technology, some of which are broadly defined.
• In sectors new to the rules, most prominently biotechnology, operations and collaborations in the PRC and other countries of concern through wholly foreign-owned enterprises (WFOE), joint ventures, and new entities formed by non-PRC investors to in-license candidate pharmaceuticals all will become more complex to newly implement or manage.
• Although licensing of technology from the PRC will not be directly impacted, many common corporate structures that have been used to support such licensing may become disfavored.
• Transactions involving funds with existing investments in relevant sectors, such as secondary acquisitions of positions in biotechnology funds, will face additional diligence requirements.

Further discussion of specific changes under the Proposed Rule and their potential impacts is provided below. However, until a final rule takes effect in the first quarter of 2027 (with additional clarifications, new frequently asked questions, etc.), the existing OISP will continue to govern. In the meantime, investors and companies with investments or operations in or with a nexus to a country of concern should evaluate the Proposed Rule now and consider whether to provide comments to Treasury before December 7, 2026.

Key Changes from the Current OISP

1. Expansion of Covered Sectors: Biotechnology, AI, and More

Several new categories of covered biotechnology are among the most notable additions in the Proposed Rule. U.S. persons would be prohibited from investing in a covered foreign person that uses, develops, or engineers a biological system (or a component of one) to modify, enhance, produce, or control restricted agents and toxins, energetic materials, novel functional materials, biofuels, or (perhaps most importantly) pharmaceutical compounds. While early reporting has suggested all research into pharmaceutical compounds—including small molecules, vaccines, cell and gene therapies, and monoclonal antibodies—is thereby covered, the Proposed Rule makes clear that use or development of a “biological system” must be involved. However, that term is undefined; as a result, it is unclear whether, e.g., only bioengineering organs to produce pharmaceutical compounds is covered, or whether the use of a cultured cell could be sufficient to trigger the U.S. investment prohibition.

The Proposed Rule also covers companies that develop or produce brain-computer interfaces, biomanufacturing equipment, and certain research tools, such as sequencing technology, bioinformatics software, and laboratory automation. Because those activities—and the use of AI systems, discussed immediately below—are often undertaken to develop internal tools ancillary to pharmaceutical research, these tool-based barriers may also function as broader restrictions on U.S. investments in the biotech research sector.

Under the existing OISP, transactions in which the investment target is engaged in the development of AI systems are often not covered, or, if they are covered, may be either prohibited or notifiable based largely on intended use of those AI systems. The Proposed Rule does not retain that approach, reasoning that no single benchmark distinguishes advanced models of AI systems (referred to under the Proposed Rule as super intelligence, or SI, systems). Instead, U.S. persons would be prohibited in all cases from investing in any covered foreign person that develops any SI system. The definition of covered transactions involving SI is broad, encompassing any machine-based system that can generate content or make predictions, recommendations, or decisions, along with software and hardware built using one—i.e., everything from AI agents to AI-enabled robots. A company that builds on a third party’s model is treated as developing an SI system if it enhances or extends that model’s capabilities, although using an off-the-shelf model strictly for internal and non-commercial purposes, including fine-tuning, is not considered development of an SI system for purposes of the Proposed Rule.

The Proposed Rule would also add or increase controls in the following technology sectors:

Sector	Prohibited Technologies	Notifiable Technologies
Semiconductors	Chip design software; most advanced chip design, fabrication, and packaging; front-end and packaging equipment; high-bandwidth memory above a set density (new addition)	Other chip design, fabrication, and packaging; related equipment
Quantum Computing	Computers, components, and software; sensing and networking for military or surveillance uses; algorithms and applications (new addition)	None
High-Performance Computing	Supercomputers above existing thresholds (now in a separate category under OISP)	High-speed, low-latency interconnects (new addition)
Hypersonics (new)	Military or civilian systems (Mach 5+), propulsion, fuels, materials, test facilities, digital twins	Sensors, guidance, and control systems; software and materials usable in hypersonic systems

 

2. Expanded Definition of “Covered Foreign Person”

Another set of changes concerns who is covered. Both the OISP and the Proposed Rule define investment that is either covered or notifiable by reference to the target’s nexus to countries of concern or persons of such countries. Whereas the PRC is the only country of concern under the current OISP, the Proposed Rule (in accordance with the COINS Act) adds Cuba, Iran, North Korea, Russia, and Venezuela “under the regime of Nicolás Maduro Moros.”

The Proposed Rule also redefines the relationship an entity must have with a country of concern or a person of such country for an investment in that entity to be prohibited or notifiable. Under both the OISP and the Proposed Rule, an entity may be covered even if it is not established under the laws of, located in, or operated in the territory of a country of concern. More specifically, an entity of any nationality—including a U.S. entity—may be covered if, for example, it is majority owned by a person of a country of concern or if its relationship to an entity of a country of concern meets certain metrics defined in regulation (e.g., a majority of its revenue or net income is derived from such an entity). The Proposed Rule largely preserves the OISP’s approach to defining the relationship a person must have to a person of a country of concern in order to be a covered foreign person, but it also expands that approach. Notably, under the Proposed Rule, a person will be a covered foreign person if it is “subject to the direction or control” of a covered foreign person. A person is “subject to the direction or control” of another person if the latter “has the power, directly or indirectly, to direct or cause the direction of the management or policies of such entity.” As with the definition of “control” in the Committee on Foreign Investment in the United States (CFIUS) regulations pertaining to inbound investment, this is not a bright-line test. Ascertaining whether one person has “direction or control” over another often will require significant effort.

3. Expanded Definition of “Excepted Transactions”

The Proposed Rule also expands the scope of transactions that ordinarily would be notifiable or prohibited but instead are not covered at all by operation of an exception. Significantly, transactions secondary to a covered investment (such as underwriting, bank lending, payment processing, credit rating, prime brokerage, custody, and equity research) are newly excepted, as are similar ancillary services provided by financial institutions and professional advisors. In addition, a new de minimis exception applies to otherwise notifiable transactions (but not prohibited transactions) totaling $50,000 or less (including the fair market value of non-cash consideration), aggregated across covered national security transactions or provision of funds to the relevant covered foreign person in the preceding 12 months.

Most of the existing OISP exceptions are maintained. For example, the Proposed Rule keeps the public market investment exception for investment in a security that “trades on an exchange or the over-the-counter market in any jurisdiction.” There are, however, a number of changes to the OISP exceptions, including the elimination of the exception for business development companies under the Investment Company Act of 1940. Treasury also adds one notable point of clarification: the OISP includes an exception for intracompany transfers (e.g., from a U.S. parent to a subsidiary in a country of concern) that support non-covered activities or maintain covered activities that were engaged in prior to the OISP’s effective date. The Proposed Rule retains that exception but solicits comments on how to construe the concept of “maintaining” an activity. At its broadest, that exception might allow a U.S. business to continue to expand in-country operations in the PRC and elsewhere as long as it does not enter into any new covered activities, but at its narrowest, it might simply allow the business to keep the lights on but not to buy new equipment, expand production, etc., for existing covered activities.

4. Expanded Due Diligence Requirements

For a transaction to be either prohibited or notifiable, a U.S. person must have knowledge (including imputed knowledge) of relevant facts and circumstances. A person’s actual or presumed knowledge is a function of multiple factors, including information in the public domain and information that reasonably could be acquired through an exercise of due diligence.

The Proposed Rule adds to considerations bearing on a determination of a person’s actual or presumed knowledge. First, Treasury will ask whether an investor appropriately considered information Treasury itself made available before closing, including Treasury’s assessments that a target may be engaged in a covered technology. Although the Proposed Rule does not say exactly how Treasury will communicate such information, Treasury indicates that it is considering a new publicly available database of covered foreign persons. Second, the Proposed Rule would impute to a U.S. person knowledge in the possession of its controlled foreign entities. If, for example, a U.S. company or investment fund’s foreign subsidiary knew that an investment target of the U.S. parent engages in a notifiable activity, such knowledge and resulting obligations would be imputed to the U.S. parent.

5. Other Important Changes

A few other key changes in the Proposed Rule include:

1. Like the OISP, the Proposed Rule would deem an otherwise notifiable transaction to be prohibited if it involves a person on certain U.S. government restricted lists (e.g., the Specially Designated Nationals and Blocked Persons (SDN) list of sanctioned persons, or the “biotechnologies companies of concern” list to be published by the Office of Management and Budget (OMB) under the BIOSECURE Act). Under the Proposed Rule, however, an otherwise notifiable transaction would be deemed prohibited not only if a party to the transaction is on such a list, but also if an affiliate or subsidiary of such a party is on such a list.
2. Under both the OISP and the Proposed Rule, a violation may result in a per violation civil penalty of up to the greater of $250,000 (inflation-adjusted) or twice the transaction value, and if Treasury determines that a person has engaged in a prohibited transaction, it may compel divestment. In contrast to the OISP, however, the Proposed Rule does not provide for criminal penalties. That is in accordance with the COINS Act, which provides for civil penalties only. However, other laws, including the statute making it a crime to make false statements to the federal government, will continue to apply.
3. Treasury’s tip line remains available, and the Proposed Rule adds a confidential channel for submitting evidence that a foreign person is a covered foreign person, though submitters must identify themselves.
4. The Proposed Rule introduces a new mechanism for investors to request pre-closing confidential feedback, or anonymized public guidance, on whether a proposed transaction would be prohibited.
5. Treasury is considering the creation of a public database of covered foreign persons, which could assist transaction parties in performing due diligence and in identifying persons with respect to whom obligations may apply.

Developments to Watch as Treasury Finalizes the Rule

Treasury is accepting comments until December 7, 2026, and will take those comments into account in finalizing the rule. Key topics on which we expect parties will comment include:

1. Defining “biological system.” Treasury has not defined the term, which is a key condition to determining whether transactions involving biotechnology are covered. Treasury has invited stakeholders to propose definitions. Proposals could make reference to a novelty threshold for pharmaceuticals and functional materials, a carve-out for conventional fuels, or a focus on work that uses specified equipment.
2. The scope of AI. Even though Treasury has proposed a broad approach to covered transactions involving “super intelligence,” it has acknowledged that this approach could create ambiguity. That acknowledgment may prompt comments urging a more nuanced approach.
3. Subject to “direction or control.” Under the Proposed Rule, covered foreign persons include those that are directly or indirectly “subject to the direction or control” of a country of concern or other covered foreign person. The Proposed Rule defines this term broadly, as the power to direct an entity’s management or policies, whether through ownership, by contract, or otherwise, and offers no objective indicators of control. Commenters may seek clarification of what constitutes direction or control.
4. The meaning of “develop.” Under the Proposed Rule, several categories of activity by a covered foreign person that could cause a transaction to be notifiable or prohibited involve “development.” The proposed definition of the related term “develop” covers, among other activities, work done with affiliates and even high-level oversight or strategic planning, which could capture targets that are several steps removed from the activity of concern, with only managerial or advisory roles. Commenters may seek to clarify that the definition requires the target company to play a technical role in development in order for an investment in the target to be notifiable or prohibited.
5. The scope of the “intracompany transfer of funds” exception. For U.S. biotechnology, semiconductor, and other businesses with subsidiaries in a country of concern, the scope of this exception may have a significant impact on continuing operations at those subsidiaries. A particularly narrow version of the exception may limit the ability to continue those operations.
6. Preexisting fund investments. The Proposed Rule makes it more explicit than the OISP did that investing in a fund that already holds positions in covered foreign persons may itself be an indirect covered investment. Absent a more detailed set of examples in the regulations, buyers of secondaries and investors in continuation, fund-of-funds, and evergreen vehicles may feel compelled to undertake portfolio-level diligence. For funds with investments in sectors not previously covered by the rules, such as commercial AI and biotechnology, this may in turn limit access to capital.

Key Takeaways for Investors, Financial Institutions, and Companies

The Proposed Rule represents a familiar but materially expanded outbound investment security regime. Investors, financial institutions, and companies alike should assess their exposure under the Proposed Rule, consider commenting by December 7, 2026, and begin updating their compliance programs in anticipation of these rules coming into effect within the next six months. If you have questions, please contact any member of Wilson Sonsini Goodrich & Rosati’s National Security and Trade practice.