By: Margaret M. Cassidy & Jelena Tasic
Soon a new DFARS, Mitigating Risks Related to Foreign Ownership, Control, or Influence, will require defense contractors and subcontractors to disclose their owners and any foreign ownership, control, or influence (FOCI) to the Department of Defense if they want to do business with DoD directly or through the supply chain.
DoD is estimating these requirements will impact about 41,000 contractors and subcontractors.
The FY2020 NDAA and the FY2021 NDAA directed DoD to implement acquisition regulations requiring these disclosures. The proposed rule implementing these requirements were finally published and should go into effect soon.
Although the rule is not final yet, the direction of travel is clear, contractors and subcontractors need to prepare disclosures related to beneficial ownership and FOCI or risk not being eligible for DoD contracts and subcontracts.
Disclosure Requirements.
The new DFARS will require covered contractors and subcontractors to disclose to the Defense Counterintelligence and Security Agency (DCSA):
- Beneficial ownership: Beneficial owner is bigger than who is on a cap table.It looks at not only traditional equity ownership but at voting and investment rights and powers.
- Foreign ownership, control or influence: If a foreign entity or foreign person has the power, directly or indirectly, exercised or not, to direct, control or influence, for example:
- operations;
- management or governance;
- finances; or
- contract performance.
Logistically, contractors and subcontractors will be required to complete Standard Form 328, Certificate Pertaining to Foreign Interests (SF 328) and submit the form through the existing DSCA managed National Industrial Security System (NISS).
The SF 328 is designed to reveal any FOCI by requiring that foreign relationships with customers, suppliers, board members, joint venture partners, banking or financial relationships—virtually any business relationship be disclosed along with the records that inform on the relationship, such as supplier or customer agreements, joint venture operating agreements, cap tables, etc. Completing the SF 328 usually requires input from finance, legal, business development, procurement, and others to make sure that all information is accurately disclosed and a complete set of supporting documents is provided. Most contractors who are currently required to complete the SF 328 because they hold a facility clearance have a lawyer complete the final review to disclosures are not inadvertently misrepresenting a relationship.
Once the new DFARS is in place, and included in RFPs and contracts, when a contractor/subcontractor submits an offer to DoD they will be representing that they have submitted the SF 328 and that the information in the SF 328 on beneficial-owners and FOCI is current, accurate, and complete.
Failing to register in NISS or to submit a completed SF 328, risks not being awarded a contract or subcontract. And submissions that are inaccurate, incomplete or signing a contract with the new DFARS when you did not register or submit the SF 328 risks investigation and prosecution for making false statements to the government.
Risk Mitigation.
If DCSA and the contracting activity determine that a contractor’s/subcontractor’s beneficial ownership or FOCI pose a risk or potential risk to national security, and determine that the risk can be mitigated, the contractor/subcontractor must agree to:
- Risk mitigation strategies at time of award
- Implement the mitigation requirements within 90 calendar days of the contract award.
FOCI risk mitigation often requires voting trusts, board resolutions, security control agreements as well as policies, procedures and training specifically designed to each company’s operations and risks.
The mitigation plan will require time to develop, negotiate and implement; and will become part of any prime contract or subcontract and must be followed.
Ongoing Compliance
The new DFARS will also require contractors and subcontractors to update ownership and FOCI information with DCSA within three business days of any changes. Once a disclosure is filed, if DCSA determines that there is FOCI and it poses a risk to national security, a contractor/subcontract has ten days to initiate a mitigation plan to implement DCSA’s directives to mitigate the risk.
Who is Covered
Contracts and subcontracts valued over $5 million, regardless of what tier in the supply chain will include the new DFARS.
The requirements purposefully reach into the supply chain. It’s the purpose of the regulation to know who owns and controls the companies in the U.S. defense industrial base. Prime contractors will have to make sure that their subcontractors and the subcontractors’ subs, and so on, have filed their SF 328 and that they are eligible for subcontract award.
As a result, lower-tier subcontractors or suppliers who have never dealt directly with DoD will still be required to comply since prime contractors and higher tier subcontractors will flow the requirements down through subcontract clauses.
The proposed rule exempts commercial contracts and commercial subcontracts from the requirements.
However, the regulations authorize DoD to determine if the commercial contract involves a risk or potential risk to national security because the contract involves sensitive data, systems, or processes, and if so, even though a commercial contract it will include the new DFARS disclosure requirements.
Contracting officers have already started putting this clause in commercial contracts. Expect contracting officers to err on the side of caution by including the clause, even in commercial contracts.
Contracting officers and others across DoD understand that national security risks attach to the defense contractor, not what it is selling.
What to Do Now
Even though the rule is not final, it will not change much; get ready now:
- Identify covered contracts. Review current DoD contracts and pipelines of DoD contracts and subcontracts over $5 million to identify the contracts/subcontracts that will include the clause. Review commercial contracts and subcontracts because the clause will likely be included in many commercial contracts.
- Analyze beneficial ownership. Determine who beneficial owners, including indirect and layered ownership, and document ownership, to include gathering information on owners.
- Assess FOCI. Undertake review and analysis of all foreign relationships: investments, board seats, suppliers, customers, landlords, lenders, banks, etc. Gather the documents that define these relationships and depending on the relationship, even due diligence on ownership of these entities. Plan on this taking a couple of weeks.
- Register in NISS. Register in NISS. Track registration so status is clear. An eligible status is a pre-condition for contract award. A stalled registration jeopardizes contract or subcontract award.
- Complete the SF 328 package. Complete the SF 328 form, assemble and organize all supporting documents and upload the information to NISS. Treat these materials as a living file, not a one-time filing.
- Determine if mitigation is required. If under FOCI, be prepared to submit a mitigation plan to be eligible for defense contracts or subcontracts. Remember, a mitigation plan won’t be effective the day it is submitted; it is effective when DSCA approves it. If required to mitigate FOCI risk, plan on developing a risk mitigation approach before submitting an RFP or signing a contract because the 90-day window to develop and implement a mitigation plan will come fast.
- Develop controls for ongoing compliance. Develop internal controls and define who owns the obligation to keep filings in NISS current, accurate, and complete and who update when changes occur.
- Update subcontracts. Update subcontract templates to include the new DFARS clauses and get subcontractors’ NISS-eligibility confirmations. Develop controls to oversee subcontractor compliance. Be prepared to modify subcontracts once the DFARS is final.
The Bottom Line
Visibility into the defense industrial base is the whole objective.
DoD now has the regulatory teeth to demand information on who owns contractors and subcontractors and if there is any foreign ownership, control, or influence. Ownership and FOCI are now a gating conditions for contract award. Treat it as a standing readiness posture and to remain eligible for award and to meet growth objectives. Wait, and a manageable disclosures and risk mitigation may become a contract-performance issue at exactly the wrong moment.
