US Congress finalizes 2026 NDAA, making key changes to the Outbound Investment Security Program

The United States House and Senate have unveiled the conference report of the 2026 National Defense Authorization Act (NDAA), which includes significant updates to the Outbound Investment Security Program (OISP).

Released on December 7, 2025 and signed by President Donald Trump on December 18, 2025, the proposed legislation is a compromise between separate versions of the NDAA passed by the House and Senate earlier this year. The changes contained in the NDAA follow multiple bipartisan attempts to expand the scope of the OISP and have received widespread support in both the House and Senate.

With the executive and legislative branches apparently aligned on the policy goals and direction for modification of the OISP, in tandem with the revisions contained in the NDAA reflecting President Trump’s America First Trade Policy and America First Investment Policy (collectively, Administration Directives), the OISP is positioned to expand to more covered technology sectors, increase the information gathered on transactions and technologies, and potentially include additional forms of covered transactions.

It is expected that a significant timeframe for implementing regulations will be issued. Any future OISP requirements are also subject to the influence of future modifications from the Administration Directives.

In this alert, we discuss the NDAA and its implications for the OISP.

Implementing regulations timeline and what to expect next

The NDAA requires new OISP regulations within 450 days of the effective date of the NDAA. The US Department of the Treasury, US Department of Commerce, and other relevant federal agencies will update the existing regulations to incorporate the NDAA requirements, which will require significant efforts across the executive branch. The NDAA also appropriates $150 million to the Treasury for implementation and enforcement of the program, which the Treasury can direct to the Department of Commerce for each of the next two years for both resources and to conduct industry outreach (see below for additional appropriations information).

The changes are expected to be implemented through a public notice and comment process, as is explicitly required in portions of the legislation. In addition, outside stakeholders will have the opportunity to provide feedback via industry outreach and, through that engagement, develop an understanding of the technical aspects of the new regulations.

Changes to the OISP

The NDAA includes – once implemented – key changes to the current OISP. These changes expand the scope of the OISP, establish new processes for administering the OISP, and generally expand the funds available to the US government to effectuate the goals of the regulations.

The NDAA modifies the following key operational aspects of the OISP:

• Covered sectors: The NDAA proposes to add high-performance computing and supercomputing and hypersonic systems to the existing covered sectors of semiconductor technology and microelectronics, artificial intelligence systems, and quantum information technologies. While aspects of supercomputing are captured in existing quantum computing parameters, the NDAA appears to focus on supercomputing as a sector in its own right. Further, it appears that quantum computing will be regulated differently, as it only gives rise to prohibited transactions in the current OISP, and the NDAA references notifiable transactions for quantum computing.

• The NDAA calls on the Treasury, in consultation with the Department of Commerce, the Department of State, and other federal agencies as appropriate, to determine what specific technologies within the high-performance computing and supercomputing and hypersonic systems sectors will be regulated as prohibited and notifiable technologies.
  
  

• The NDAA also gives the Secretary of the Treasury, in consultation with the Department of Commerce and, as applicable, the Departments of War, State, and Energy; the Director of National Intelligence; and other relevant agencies, the ability to add additional sectors that enable the military, intelligence, surveillance, or cyber-enabled capabilities of countries of concern.

• Covered foreign persons: The NDAA will expand the definition of a “covered foreign person” to include a person who is a member of the Central Committee of the Chinese Communist Party or member of the political leadership of a country of concern. Note, as the definition of a covered foreign person already includes any entity 50-percent or more owned by a covered foreign person, any entity 50-percent or more owned by a member of the Central Committee of the Chinese Communist Party or member of the political leadership of a country of concern will also be a covered foreign person.
  
  

• Additional excepted transactions: The legislation expands excepted transactions to include “a transaction secondary to a covered national security transaction.” Secondary transactions include, among other things, contractual arrangements, bank lending, the processing by a bank, underwriting services, debt rating services, prime brokerage, global custody, equity research or analysis, or other ordinary or administrative business transactions. The NDAA does not replace the existing OISP excepted transactions.

 

Current excepted transactions	Excepted transactions added by the NDAA
Investments into publicly traded securities as defined in section 3(a)(10) of the Securities Exchange Act of 1934	Secondary transactions which include, but are not limited to, contractual arrangements, bank lending, processing by a bank, underwriting services, debt rating services, prime brokerage, global custody, equity research or analysis, or other ordinary or administrative business transactions
Investments made as a limited partner in a venture capital fund, private equity fund, fund of funds, or other pooled investment fund where the committed capital is not more than $2 million	Any transaction that the Secretary of the Treasury has deemed de minimis
Investments made as a limited partner in a venture capital fund, private equity fund, fund of funds, or other pooled investment fund where the limited partner has received a binding contractual assurance that its capital in the fund will not be used to engage in prohibited or notifiable transactions	Ancillary transactions undertaken by a financial institution
Acquisition of an equity or other interest in an entity held by one or more persons of a country of concern provided that (1) the US person acquires all equity or other interests held by persons of a country of concern and, (2) following the acquisition, the entity does not constitute a covered foreign person
A transaction between a US person and its controlled foreign entity to support activities the controlled foreign entity was engaged in before January 2, 2025
A transaction made after January 2, 2025, pursuant to a binding, uncalled capital commitment entered into before January 2, 2025
Acquisition of a voting interest in a covered foreign person upon default

• Publication of a database of covered foreign persons: The Treasury and Department of Commerce are authorized (but not required) to create a publicly accessible non-exhaustive database that identifies covered foreign persons. The database will also allow for covered foreign persons to petition for removal, and for public stakeholders to submit evidence on a confidential basis as to whether a foreign person is a covered foreign person.
  
  

• Countries of concern: The list of countries of concern will be expanded to include – in addition to China, Hong Kong, and Macao – Cuba, Iran, North Korea, Russia, and Venezuela under the Nicolás Maduro presidential regime. The expansion of outbound investment restrictions on these countries complements already widespread US sanctions and export controls on these countries.
  
  

• Formalization of non-notified transactions outreach: The NDAA also provides the Treasury authority to formalize certain existing operations under the OISP. For example, the regulations call on the Treasury to establish a “non-notified” process to identify covered national security transactions that were not notified to it and conduct outreach to the US entities party to such transactions. Interagency participation in this “non-notified” process, similar to processes in the Committee on Foreign Investment in the US, may be expected. Per public reporting, the Treasury has already engaged in such outreach. However, the codification of a requirement for the Treasury to do so may lead to an uptick in such outreach.

Executive versus legislative branch OISP policy considerations

These parameters appear fully aligned with the stated original policy intent of the OISP: to address US national security from countries of concern further developing certain sensitive technologies and products by exploiting, or having the ability to exploit, outbound US investments. However, the changes to the OISP included in the NDAA highlight the potentially different implementation paths being contemplated by the executive and legislative branches. For example, the NDAA suggests that the Treasury and Department of Commerce create a public database of covered foreign persons, a concept similar to an OFAC list for a respective sanctions program. In comments to the original regulations implementing the OISP, the Treasury contemplated and rejected the idea of creating such a list.

The proposed expansions do not include all of the potential considerations highlighted in the Administration Directives – such as the directed review of the existing OISP and consideration of additional sectors/restrictions for any recommended modifications – which are required by the implementation of Executive Order 14105 within one year of the original OISP’s effective date.

Notably, the Administration Directives specifically ordered a review of current excepted transactions, such as certain investments in publicly traded securities and investments made by limited partners into funds. The NDAA, however, did not reduce the scope of those exceptions. President Trump further directed relevant agencies to consider adding sectors such as biotechnology, aerospace, advanced manufacturing, and directed energy. Once again, the NDAA did not include these additional sectors, but did address a related core pillar in advanced military capabilities by including hypersonics in the list of covered technology sectors (for both notifiable and prohibited transactions).

Conclusion

Once implemented, the provisions included in the NDAA will result in significant changes to the OISP. However, the 450-day implementation window and impending public notice and comment will provide companies and other key stakeholders time to review the changes and update relevant compliance processes.

DLA Piper will continue to monitor the progress of this legislation and any updates from the Trump Administration on outbound investment given the implications of these restrictions for strategic corporate planning and risk management.

For guidance on the OISP, please contact the authors of this alert or any Partners within the firm’s National Security and Global Trade practice.