Key Takeaways:

• The Fiscal Year 2026 National Defense Authorization Act (the “NDAA”), passed by the U.S. House of Representatives on December 11, 2025, is expected to be passed by the Senate this week and signed into law by President Trump shortly thereafter.
• The NDAA authorizes a widely awaited expansion of the U.S. outbound investment regime, significantly broadening the scope of targeted countries, targeted technologies and targeted investment transactions, while introducing new categories of excepted transactions and additional procedural mechanisms for administering the regime.
• Separately, the NDAA provides for new sanctions authorities related to opioid trafficking, Haiti and the Western Balkans, repeals the Caesar Syria Civilian Protection Act of 2019 and authorizes designation of foreign states as so-called State Sponsors of Unlawful or Wrongful Detention.

---

On December 11, 2025, the U.S. House of Representatives passed the Fiscal Year 2026 National Defense Authorization Act (“NDAA”), generally considered annual, must-pass legislation to provide necessary U.S. government and defense funding. The NDAA includes important national security-related provisions, including a widely awaited expansion to the U.S. outbound investment control framework and measures expanding U.S. sanctions authorities. On December 15, 2025, the NDAA cleared a key procedural hurdle in the U.S. Senate by a bipartisan margin. The legislation is expected to pass the Senate this week and to be signed into law by President Trump shortly thereafter.

Outbound Investment Controls (Section 8521)

The Comprehensive Outbound Investment National Security Act (Title LXXXV of the NDAA) (the “Act”) authorizes the U.S. Treasury Secretary (the “Secretary”) to expand the current U.S. outbound investment control framework established in November 2024 by the U.S. Treasury Department (“Treasury”), 31 C.F.R. Part 850 (the “Outbound Investment Rule” or “OIR”).

The Act both provides discretionary rulemaking authority and mandates rulemaking regarding certain matters. First, the Act authorizes, but does not require, the Secretary to issue regulations prohibiting U.S. persons, including their controlled foreign entities, from knowingly engaging in covered national security transactions involving a prohibited technology. Separately and regardless of whether any such prohibitions are adopted, the Act directs the Secretary, within 450 days of enactment, to issue regulations requiring 30-day post-transaction notice if a U.S. person or its controlled foreign entity knowingly engages in a covered national security transaction in a prohibited technology (unless the transaction has been prohibited by the Secretary pursuant to the discretionary rulemaking authority noted in the preceding sentence) or a notifiable technology. The interplay of these restrictions is not entirely clear, but it would appear the Act only requires a notification regime, with Treasury to decide whether to prohibit any transactions.

Until Treasury issues regulations pursuant to the Act, the existing Outbound Investment Rule remains in effect. The Act does not amend the existing Outbound Investment Rule but, rather, authorizes the Secretary to amend, terminate or supersede the rule and requires any such rulemaking to provide a reasonable timeframe for compliance. Accordingly, any expansion of the scope of prohibited or notifiable transactions under the Act would occur through subsequent Treasury rulemaking. Notably, the Act provides that it will cease to have any force or effect seven years after the date of its enactment.

Below, we describe the scope of the outbound investment controls authorized under the Act and key differences from the Outbound Investment Rule. We then describe certain implications for firms’ existing policies and procedures for complying with U.S. outbound investment controls.

Expanded Scope of U.S. Outbound Investment Controls

Certain key terms under the Act differ from and expand on the operative definitions under the Outbound Investment Rule, including with respect to the targeted countries, targeted technologies, and targeted investment transactions by U.S. persons. We summarize these differences in the table below.

	Outbound Investment Rule	Comprehensive Outbound Investment National Security Act
Country of Concern	The OIR defines a “country of concern” to include only the People’s Republic of China, including the Hong Kong and Macau Special Administration Regions (together, “China”).	The Act expands the countries in scope to include not only China but also (i) Cuba, (ii) Iran, (iii)North Korea, (iv) Russia and (v) Venezuela under the regime of Nicolas Maduro.
Prohibited and notifiable technologies	The OIR targets a “prohibited transaction” or “notifiable transaction” with a covered foreign person engaged in a “covered activity,” which includes specified activities related to (i)semiconductors and microelectronics, (ii) artificial intelligence or (iii) quantum information technologies.	The Act does not include defined terms for a “prohibited transaction,” “notifiable transaction” or “covered activity.” The Act refers instead to “prohibited technology” and “notifiable technology,” which are defined in general terms to encompass technologies in the three areas covered under the OIR as well as two additional areas: (i) high-performance computing and supercomputing and (ii) hypersonic systems. The Act does not specify particular activities in these areas that would be considered to be in scope of a prohibited or notifiable technology.
Covered foreign persons	The OIR defines a “covered foreign person” as any of the following: a “person of a country of concern” engaged in a “covered activity”; a person that has a particular relationship (described below) with a person of a country of concern engaged in a covered activity; or a person of a country of concern participating in a joint venture engaged in a covered activity. As indicated above, a “covered foreign person” also includes any person that meets two conditions: the person holds a specified interest in one or more persons of a country of concern engaged in a covered activity, where such specified interests include voting or equity interests, board rights or control rights to direct management or policies; and the person receives, on an annual basis and as calculated in accordance with the Outbound Investment Rule, more than 50% of its revenue or net income from, or attributes 50% or more of its capital expenditure or operating expenses to, the persons of a country of concern engaged in a covered activity.	The Act does not include the terms “person of a country of concern” or, as noted above, “covered activity.” Rather, the Act would define a “covered foreign person” to include a non-U.S. person that: is incorporated in, has a principal place of business in or is organized under the laws of a country of concern; is a member of the Central Committee of the Chinese Communist Party or is a member of the political leadership of a country of concern; is subject to the direction or control of a country of concern, an entity described in (i) or (ii) or the state or the government of a country of concern (including any political subdivision, agency, or instrumentality thereof); or is owned in the aggregate, directly or indirectly, 50% or more by a country of concern, an entity described in (i) or (ii) or the state or the government of a country of concern (including any political subdivision, agency or instrumentality thereof).
Covered transactions	The Outbound Investment Rule defines a “covered transaction” to include generally: acquiring equity interests in, including by converting contingent equity interests in, a covered foreign person; providing debt financing to a covered foreign person that provides certain equity-like rights to the lending party; acquiring, leasing or developing operations, land, property or other assets in a country of concern resulting in the establishment of a covered foreign person or engagement of a person of a country of concern in a covered activity; entering into a joint venture with a covered foreign person to engage in covered activities; or passive investment in certain non-U.S. investment funds that engage in a transaction that would be a covered transaction for a U.S. person.	The Act instead uses the term “covered national security transaction.” This term generally encompasses the covered transactions under the Outbound Investment Rule but also includes a new covered national security transaction for “knowingly directing” prohibited technologies or notifiable technologies by non-U.S. persons that a U.S. person knows would constitute a covered national security transaction if engaged in by a U.S. person, except with respect to a covered national security transaction pertaining to investments by non-U.S. persons in non-U.S. funds.

Exceptions to Covered National Security Transactions

The Act generally authorizes the Secretary to exclude any category of transactions determined to be in the U.S. national interest or transactions below a de minimis value. The Act expressly provides for certain exceptions similar to, but not exactly the same as, many of those provided under the Outbound Investment Rule, including:

• investment in a security traded on an exchange or the over-the-counter market in any jurisdiction;

• investment in a security issued by an investment company registered with the Securities and Exchange Commission and, at the discretion of the Secretary, a security issued by a non-U.S. pooled investment vehicle with comparable supervision and regulation;

• investment in a pooled investment vehicle (i) below a de minimis amount of aggregate committed capital or (ii) where the investor has secured a binding contractual assurance that its capital will not be used to engage in a transaction that would be a covered national security transaction if engaged in by a U.S. person; 

• investment in a derivative of the securities described above;

• full buy-outs of interests held by a covered foreign person; or

• certain intra-company transactions that support operations that are not covered national security transactions or that maintain covered national security transactions that a controlled foreign person of a U.S. person was engaged in prior to the effective date of regulations implementing the Act.

The Act does not include reference to exceptions currently provided under the Outbound Investment Rule for (i) acquisition of a voting interest in a covered foreign person upon default or other condition involving a loan made by a syndicate of banks in a loan participation, subject to certain conditions on the U.S. person lender or (ii) a U.S. person individual’s receipt of employment compensation in the form of an award of equity or the grant of an option to purchase equity in a covered foreign person or the exercise of such option. As noted above, however, the Secretary has discretion to except categories of transactions determined to be in the U.S. national interest.

The Act specifies new exceptions not included under the Outbound Investment Rule for the following categories of transactions:

• A financial institution’s “ancillary transactions,” which include (i) the processing, settling, clearing or sending of payments and cash transactions; (ii) underwriting services, including the temporary acquisition of an equity interest for the sole purpose of facilitating underwriting services; (iii) credit rating services; and (iv) other services ordinarily incident to and part of the provision of financial services, such as opening deposit accounts, direct custody services, foreign exchange services, remittances services and safe deposit services.

• A “transaction secondary to a covered national security transaction,” which includes: contractual arrangements (not including contractual arrangements for technology transfer or technical knowledge transfer) or the procurement of material inputs for any covered national security transaction (e.g., raw materials); bank lending; the processing, clearing or sending of payments by a bank; underwriting services including, but not limited to, the temporary acquisition of an equity interest for the sole purpose of facilitating underwriting services; debt rating services; prime brokerage; global custody; equity research or analysis; and other similar services.

• “Any ordinary or administrative business transaction,” to be defined in the regulations implementing the Act.

Any transaction completed before the Act is enacted would be excluded.

Additional Procedures for Outbound Investment Control Framework

The Act introduces new procedural enhancements to the U.S. outbound investment control framework.

• Public Database. The Secretary, in consultation with the Secretary of Commerce, is permitted to establish a publicly accessible, non-exhaustive database identifying covered foreign persons engaged in a prohibited or notifiable technology.

• Identification of Non-Notified Activity. The Secretary will establish a process to identify covered national security transactions in a prohibited or notifiable technology for which a notification was not made and information is reasonably available.

• Low-Burden Regulations. In issuing any regulations under the Act, the Secretary is directed to balance the priority of protecting national security while, as may be practicable, minimizing compliance cost and complexity, adopting the least burdensome regulatory approach and prioritizing transparency and stakeholder participation in the rulemaking process.

• Burden of Proof in Enforcement Matters. For any enforcement action under the Act for violating the applicable prohibitions or notice requirements for covered national security transactions, the Secretary will bear the burden of proof.

Certain procedures under the Act would apply under regulations issued by the Secretary to prohibit covered national security transactions in a prohibited technology specifically, including the following:

• Non-Binding Feedback. The Act requires any such regulations to include a mechanism allowing for persons to request non-binding feedback, either confidentially or as public, anonymized guidance, as to whether a transaction would constitute a covered national security transaction in a prohibited technology.

• Self-Disclosure Letters. The Act directs that penalties for violations of any such regulations should take into account whether a U.S. person self-disclosed the violations under the Act pursuant to the required form and content of a self-disclosure letter specified in the implementing regulations.

The Act also mandates annual reporting by the Secretary, in consultation with other agencies, to specified congressional committees on, among other matters, the enforcement actions taken related to covered national security transactions, the notifications of covered national security transactions submitted to the Secretary during the preceding year under the existing Outbound Investment Rule or regulations issued under the Act and an assessment of the scope of the term “prohibited technology.”

Implications for Firm Compliance Efforts

Firms should consider appropriate steps to prepare for the expanded U.S. outbound investment controls authorized under the Act. Depending on a firm’s activities, these steps may include the following:

• revisit U.S. outbound investment risk assessments to determine the scope of firm activities that may implicate the rules Treasury is required to issue to expand the outbound investment control regime;

• consider revisions to U.S. outbound investment compliance programs to account for the expanded geographic scope under the Act, subject to further revision of relevant controls and exceptions once implementing regulations are issued;

• begin reviewing agreements with counterparties to determine the scope of representations, warranties or covenants under those agreements related to U.S. outbound investment controls, the potential impact to such provisions under the expanded rules and whether any revisions may be warranted once Treasury issues rules implementing the Act; and

• update key stakeholders and business teams regarding the updated scope of the outbound investment control framework and investment activity that may implicate the rules to be implemented by Treasury.

Additional Sanctions Authorities and Reports to Congress Related to Investments in Chinese Companies (Sections 8511-8513 and 8531)

Separate from the prohibitions and notice requirements for covered national security transactions authorized under the Act, the Act also authorizes the President to impose sanctions pursuant to the International Emergency Economic Powers Act to prohibit U.S. persons from investing in or purchasing “significant amounts” of equity or debt instruments of a foreign person that is determined to be a covered foreign person.

For purposes of these sanctions, a “country of concern” is defined only as China (including Hong Kong and Macau). Accordingly, a “covered foreign person” that may be targeted by sanctions under the Act would generally include covered foreign persons with respect to China that also are determined to “knowingly engage” in significant operations in the defense and related materiel or surveillance technology sectors of the Chinese economy.

The President also is required to report annually for a period of eight years regarding whether any persons designated on the Non-SDN Chinese Military-Industrial Complex Companies List (“NS-CMIC List”) maintained by Treasury’s Office of Foreign Assets Control (“OFAC”) is a covered foreign person. Further, the President must report biennially for a period of six years on whether Chinese covered foreign persons listed on the following lists qualify for inclusion on the NS-CMIC List: (i) the U.S. Department of Commerce’s Entity List or Military End-User List, (ii) the U.S. Department of Defense’s list of “Chinese military companies” identified pursuant to section 1260H of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021, (iii) the U.S. Federal Communications Commission’s Covered List or (iv) the U.S. Department of Homeland Security’s Uyghur Forced Labor Prevention Act Entity List.

These provisions, as with the outbound investment provisions discussed above, will cease to have any force or effect seven years after the date of enactment.

Repeal of the Caesar Syria Civilian Protection Act (Section 8369)

Following President Trump’s stated objective earlier this year to give the Syrian people a “chance at greatness,” the NDAA repeals the Caesar Syria Civilian Protection Act of 2019 (“Caesar Act”) (22 U.S.C. 8791 et seq.), following two earlier waivers of the related sanctions by Secretary of State Marco Rubio.

However, the NDAA requires the President to “certify” certain continued actions by the new Syrian government every 180 days for a four-year period, including as to taking steps to combat illicit narcotics proliferation and the threat posed by terrorist groups and providing security for religious and ethnic minorities in Syria. An inability to provide two certifications consecutively may result in a snap-back of the Caesar Act sanctions, subject to the President’s discretion. Nonetheless, the affirmative repeal of the Caesar Act, rather than a continuation of executive waivers and regardless of the potential snap-back, may provide greater comfort to the growing number of companies considering engagement with the new Syrian government or the Syrian financial system.

Break Up Suspicious Transactions of (BUST) Fentanyl Act (Sections 8311-8320)

Among other measures, the BUST Fentanyl Act expands the existing Fentanyl Sanctions Act (21 U.S.C. 2301 et seq.) by adding additional potential targets of U.S. sanctions, namely persons determined by U.S. authorities to:

• have knowingly engaged in a pattern of significant activity that has materially contributed to opioid trafficking;

• have knowingly engaged in a pattern of providing significant financial, material or technological support for, including the provision of goods or services in support of, opioid trafficking; or

• be owned, controlled or directed by, or have knowingly acted on behalf of, any non-U.S. person that has engaged in the aforementioned activities.

In addition, the BUST Fentanyl Act authorizes sanctions against any subdivision, agency or instrumentality of any foreign government, including a state-owned financial institution, that has been determined to have:

• engaged in significant activity or a significant financial transaction that has materially contributed to opioid trafficking; or

• provided significant financial, material or technological support for, including the provision of goods or services in support of, opioid trafficking.

The BUST Fentanyl Act also authorizes sanctions against any senior official of a foreign government subdivision, agency or instrumentality who is determined to knowingly engage in a significant activity described in the preceding two bullets, with these sanctions authorities related to agencies and instrumentalities of foreign governments subject to sunset after five years.

Finally, regarding China specifically, the BUST Fentanyl Act directs the President to prioritize consideration of whether any senior official of a Chinese anti-narcotics, regulatory, law enforcement, intelligence or customs body has facilitated or advanced opioid trafficking and authorizes U.S. sanctions against any such official, as well as any Chinese entity determined to produce, manufacture, distribute, sell or knowingly finance or transport goods targeted by the Fentanyl Sanctions Act and to demonstrate a pattern of failing to take credible steps to detect or prevent opioid trafficking.

The Fentanyl Sanctions Act authorizes a menu of potential restrictions against designated persons, including the loss of correspondent account access for non-U.S. financial institutions and blocking sanctions.

Haiti-Related Measures (Section 8319)

The NDAA addresses criminal activity and corruption in Haiti by requiring the Secretary of State, in coordination with other federal agencies, to submit an initial report within 180 days of enactment and annual reports for the following five years regarding criminal activity, corruption and threats to stability in Haiti. These reports must, among other matters, identify significant criminal gangs and their leadership, describe ties between such gangs and Haitian political or economic elites, and assess trafficking activity, illicit firearms flows and risks to U.S. national interests.

Based on the information identified in these reports, the NDAA requires the President to impose blocking sanctions and visa restrictions on certain foreign persons, including identified gang leaders and certain political elites, and authorizes the imposition of additional sanctions, including restrictions on certain financial transactions. The sanctions authorities under the NDAA include specified exceptions and licensing provisions and sunset five years after the date of enactment.

Western Balkans Democracy and Prosperity Act (Sections 8331-8341)

Declaring that the promotion of stable and sustainable economic growth and development in the Western Balkans (Albania, Bosnia and Herzegovina, Kosovo, Montenegro, North Macedonia and Serbia) and the encouragement of “business links and investment” between the United States and the region promotes U.S. interests, the NDAA sets out a range of economic development and anti-corruption programs focused on the region.

In doing so, the Act also authorizes new blocking sanctions and visa restrictions against persons determined to have engaged in a variety of activities that largely align with existing U.S. sanctions under Executive Order 13219 (as amended by E.O. 13304) and 14033 (as amended by E.O. 14140).  The Western Balkans sanctions provisions of the Act sunset after eight years.

State Sponsor of Unlawful or Wrongful Detention (Section 8351-8354)

The NDAA amends the Robert Levinson Hostage Recovery and Hostage-Taking Accountability Act (22 U.S.C. 1741 et seq.) to authorize the designation by the Secretary of State of any foreign state determined to have “provided support for or directly engaged in the unlawful or wrongful detention of a United States national as a State Sponsor of Unlawful or Wrongful Detention.”

The Secretary of State is required to provide an initial report within 60 days of the NDAA’s adoption identifying whether any of Afghanistan, Belarus, China, Iran, Russia or Venezuela should be designated as a State Sponsor of Unlawful or Wrongful Detention. The report also is to consider whether the Foreign Sovereign Immunities Act of 1976 should be amended to include an exception from asset seizure immunity for states subject to such a designation.

 

This publication is for general information purposes only. It is not intended to provide, nor is it to be used as, a substitute for legal advice. In some jurisdictions it may be considered attorney advertising.