Ownership traced to natural persons, investors vetted before the term sheet, suppliers screened beyond the watchlist. Every finding linked to its source.
DFARS Case 2021-D011, published 7 May 2026, would require FOCI and beneficial ownership disclosure to DCSA on unclassified, non-commercial contracts and subcontracts over $5 million, at any tier, with flowdown. DoD estimates 37,740 affected entities, 57% of them small businesses. Changes that may create FOCI are reported within 3 business days; mitigation is due within 90 days of award.
The revised Certificate Pertaining to Foreign Interests, mandatory in NISS since 12 May 2025, asks for the structure, governance and ownership of venture and private equity funds, side letters and grants, foreign debt and foreign-source revenue. A US fund with foreign limited partners can trigger review.
Entity List and Military End-User List restrictions extend to any company owned 50% or more, directly, indirectly or in aggregate, by listed parties. Issued 29 September 2025 and suspended for one year from 10 November 2025. It returns by default on 10 November 2026; an extension to 10 January 2027 has been announced but not yet published.
Since 30 June 2026 DoD may not contract with entities on the Section 1260H list or entities they control, using the CFIUS control test. From 30 June 2027 the ban extends to goods and services that include items produced by a listed entity, however indirectly sourced. The list was expanded to 188 entities on 8 June 2026.
The Pentagon's own supply-chain risk framework treats name screening as necessary but insufficient. Foreign control usually sits two or three layers above the company you contract with: a fund, a holding company, a parent abroad.
The SF-328 and the proposed DFARS clause ask who owns you, who lends to you, who pays you and who sits on your board. They ask the same of your subcontractors. Self-certification is giving way to independent verification with evidence attached.
The 3-business-day reporting window in the proposed rule turns a one-off questionnaire into a standing obligation. A file assembled by hand once a year cannot meet it.
Each module produces findings into the same disclosure file, so the SF-328 package, the investor memo and the supplier register share one evidence base.
This is the view your counsel, your FSO and DCSA work from. One row per check, the rule it answers, the result, and the source record behind it. Illustrative data.
| Check | Basis | Result | Evidence | Date |
|---|---|---|---|---|
| Foreign ownership of 5% or more, direct, indirect or beneficial | SF-328 · 32 CFR 117.11 | None found | Cap table v14 · Delaware stock ledger | 30 Oct 2026 |
| Fund look-through: GP, manager and LPs of each investor | SF-328 (funds) · DFARS 2021-D011 | 1 fund with 18% foreign LP capital | LPA, side letters, LP register extract | 29 Oct 2026 |
| Foreign directors, officers and key management personnel | SF-328 · 32 CFR 117.11 | None found | Board consents · passport records | 30 Oct 2026 |
| Foreign debt, foreign-source revenue, side letters and grants | SF-328 (revised May 2025) | Venture debt facility, US lender | Loan agreement · revenue ledger FY25 | 28 Oct 2026 |
| Immediate and highest-level owner, CAGE codes | FAR 52.204-17 | Consistent with SAM.gov | SAM.gov representation · cap table v14 | 30 Oct 2026 |
| CFIUS: foreign person test and mandatory declaration analysis | 31 CFR 800 · critical technologies | Fund exception conditions not met for 1 investor | LPA §4.2 · advisory board rights | 29 Oct 2026 |
| Suppliers: Entity List and MEU List, 50% aggregate ownership | BIS Affiliates Rule · 15 CFR 744 | 1 tier-2 supplier at 52% listed ownership | Registry extracts, 3 layers · Entity List 14 Oct 2026 | 30 Oct 2026 |
| Suppliers: Section 1260H entities and entities they control | NDAA FY2024 §805 · 1260H list 8 Jun 2026 | None found | Supplier register, 41 entities | 30 Oct 2026 |
| Covered telecommunications equipment and services | FAR 52.204-25 · Section 889 | None found | Bill of materials · FCC Covered List | 27 Oct 2026 |
| Change in ownership or control since last submission | 32 CFR 117.8(c) · 3 business days (proposed) | Series B closed 14 Oct 2026, reported | Stock purchase agreement · DCSA notice | 15 Oct 2026 |
Four steps. Your team stays in control of every finding and every submission.
Import from your equity management tool and procurement system, or upload the registers. Investor documents and LPAs attach to the entities they describe.
Each entity is resolved through registries and filings to the natural persons behind it. Aggregate ownership, control rights and list matches are flagged with the path that caused them.
Counsel and the FSO see each flag next to its record, add their determination and the mitigation position. Open questions go to the investor or supplier from inside the file.
SF-328 package, beneficial ownership disclosure and supplier register export with evidence attached. Monitoring re-runs the checks on every change and every list update.
One file for the SF-328, the DFARS disclosure and the next financing memo, with the evidence counsel would otherwise assemble by hand.
Changed conditions dated and reported, supplier ownership traced below the name, and a log DCSA can read.
Know before the term sheet whether an investor creates FOCI, CFIUS or ITAR exposure, and what mitigation would cost.
Enterprise intelligence platforms are built for agencies and large primes. Law firms do it by hand, by the hour.
Verifica is built for the growing defense company that has to get this right without a 20-person compliance team.
Verifica provides compliance software and does not provide legal advice. FOCI determinations, mitigation instruments and submissions to DCSA, CFIUS or DDTC stay with your counsel. Verifica produces the ownership, screening and audit file they rest on.
No. It gives counsel a complete, sourced file to work from. The FOCI determination, the mitigation negotiation and the submission stay with your lawyers. What changes is how long it takes them to get to a defensible position, and whether the file is still current when DCSA asks.
Yes. Ownership chains are followed through foreign registries and filings to the natural persons behind them.
Screening matches a name against a list. FOCI readiness answers who owns, lends to, pays and governs a company, through every layer, and whether any of them is a foreign person, a listed party or an entity one controls. The flag usually sits in a holding company or a fund, not on the name you screened. Verifica screens the names and traces the structure, and records both.
Once the Affiliates Rule is back in force, a supplier or partner that is 50% or more owned by Entity List or Military End-User List parties, directly, indirectly or in aggregate, carries the same restrictions as the listed party. The ownership has to be summed across shareholders and traced up the chain. Verifica does the tracing and the sum and shows the holdings that make it.
The affected checks run again. The change is dated, the new ownership path is traced, and if the result could create FOCI the alert is sized to the 3-business-day report in the proposed DFARS rule and to the 60-day ITAR notice when a foreign person is taking ownership or control. The changed-condition log keeps the trigger, the date and the evidence.
Cap tables, LPAs and investor documents are the most sensitive data a venture-backed company holds and are treated that way. Hosting, encryption, access controls and data residency are covered in the walkthrough.
A 30-minute walkthrough with the team, on your structure and your supplier list, not a slide deck.
Book a 30-minute walkthrough