Center for Federal Accountability

Treasury proposes statutory outbound investment rules with broader notifications; its privacy records describe a narrower collection

Treasury's proposed rules for the statutory Outbound Investment Security Program would widen what U.S. investors must report, including the citizenship of individuals and their key personnel, and add a public tip channel, while its 2024 privacy notice and 2025 privacy assessment describe a narrower collection. Comments close December 7, 2026.

2026-10-27 · Office of Investment Security, Treasury Department · Information · Docket TREAS-DO-2026-0595

On October 26, 2026, the Treasury Department's Office of Investment Security proposed new rules for the Outbound Investment Security Program, the program that requires U.S. investors to notify Treasury of some investments in companies tied to countries of concern and bars others (91 FR 67396, FR Doc. 2026-21786, RIN 1505-AC94, docket TREAS-DO-2026-0595). Comments are due December 7, 2026. The Federal Register record saved on October 26 lists no comment count.

## What would change

The program has run since January 2, 2025, under regulations at 31 CFR part 850 that implemented Executive Order 14105. On December 18, 2025, Congress put it into statute: the Comprehensive Outbound Investment National Security (COINS) Act, part of the fiscal 2026 defense authorization, added Title VIII to the Defense Production Act (91 FR 67396-97). Treasury proposes a new 31 CFR part 851 to carry it out. Part 850 would keep applying to activity before the final rule takes effect.

Title VIII adds two sectors, high-performance computing and supercomputing, and hypersonic systems, to the three already covered: semiconductors and microelectronics, quantum information technologies and artificial intelligence. It also adds Cuba, Iran, North Korea, Russia and Venezuela "under the regime of Nicolás Maduro Moros" to China, Hong Kong and Macau as countries of concern (91 FR 67397). Using authority in Title VIII, Treasury would also make certain biotechnology activities prohibited technologies (91 FR 67403, 67405). Following Executive Order 14434, the rule replaces "AI system" with "super intelligence (SI) system" (91 FR 67406).

Other changes: a $50,000 de minimis exception that applies only to transactions that would otherwise be notifiable, not to prohibited ones (91 FR 67410); a $2 million threshold for limited partners (91 FR 67409); civil penalties only, with no criminal penalty provision (91 FR 67411); a process for asking Treasury for confidential, non-binding feedback on a specific deal (91 FR 67411-12); and a channel for anyone to send Treasury information about a foreign company (91 FR 67412).

## What a notification would contain

Notifications stay due within 30 calendar days of closing (proposed § 851.404, 91 FR 67427). Treasury says the content list in proposed § 851.405 adds items it has "typically" asked for in follow-up requests (91 FR 67407). Compared with the current § 850.405, the new list adds, among other things:

For the investor: citizenship of individual filers; the "identity and citizenship" of board members, officers and "other key personnel" who will oversee or work with the target; foreign beneficial owners holding more than 5 percent; and all principal places of business. For the deal: plans for involvement in the target, any staff to be transferred or seconded, how the investor learned of the opportunity, a negotiation timeline, copies of "all transaction documentation" including side agreements, and any past, current or future commercial dealings with the target. For the foreign company: products, annual revenue and profitability, total assets, customers, markets and key suppliers (91 FR 67427-28).

Filers would keep the notification and supporting files, including pitch decks and due diligence materials, for ten years. Answers to Treasury's later questions, including questions asked "on behalf of other relevant Federal departments or agencies," become part of the notification (91 FR 67427-28).

## Confidentiality, tips and a possible public list

Material filed under the rule would be exempt from the Freedom of Information Act under 5 U.S.C. 552(b)(3). Treasury could still disclose it in legal proceedings, to Congress, to domestic agencies and to "any foreign governmental entity of a U.S. ally or partner" for national security purposes, or whenever the Secretary determines disclosure is "in the national interest," including as anonymized data (proposed § 851.801, 91 FR 67431).

Under proposed § 851.1001, anyone may send Treasury information about whether a foreign person is covered. Each submitter must give their full legal name, occupation, employer and contact information, and Treasury may limit people it finds make "frivolous or bad faith" submissions (91 FR 67432-33). Treasury is still weighing whether to publish a non-exhaustive database of covered foreign persons and what evidentiary standard would put a company on it or take it off (91 FR 67412).

## The numbers

Treasury estimates 200 notifiable transactions a year from 150 investors, double the annual averages it took from PitchBook data for 2023 to 2025 (about 230 investors and 300 transactions over three years). It uses blended hourly costs of $231 and $293. CFA recomputed each line: understanding the rule ($462,000 to $586,000), diligence and records ($0 to $2,344,000), filing ($2,310,000 to $2,930,000), and the totals of $2,772,000 to $5,860,000 and about 20,000 hours (91 FR 67413-15). The Paperwork Reduction Act section's 18,000 hours and $2,310,000 to $5,274,000 also reproduce, at 50 to 90 hours per response (91 FR 67416-17). Treasury puts its own costs at $4 million to $5 million to build the systems, $2 million to $3 million to maintain them, and under $1 million in staff for fiscal 2027 (91 FR 67415).

For comparison, Treasury reports about 100 notifications in the program's first 21 months, roughly 57 a year (91 FR 67396). The collection OMB approved on February 24, 2025 (control number 1505-0282) allows 318 responses and 28,620 hours a year and expires February 29, 2028.

## CFA's observations

The proposal never mentions the Privacy Act, a system of records notice or a privacy impact assessment. The records exist. Treasury's system of records notice, DO .413, "Outbound Investment Security Program Notification System" (89 FR 76917, Sept. 19, 2024), covers "individual U.S. persons that are party to or otherwise involved in a transaction notified to Treasury," lists six contact details as its records (while saying records "may not be limited to" them), and cites Executive Order 14105 as its purpose. A December 2024 final rule exempts the system from the Privacy Act's access, amendment and accounting provisions. In it, Treasury answered a privacy concern by calling the notification contents "a limited universe of information related to the relevant transaction" (89 FR 101888).

Treasury's privacy and civil liberties impact assessment for the program, dated March 20, 2025, says filers register through ID.me and file in a Microsoft Dynamics 365 system. Among the data types it lists as collected, "Citizenship" and "Nationality" are not checked. The proposal would require both the citizenship of individual filers and that of key personnel. CFA also observes that neither the notice nor the assessment describes members of the public who send information under proposed § 851.1001, people the rule would require to give their name, employer and contact details. A Federal Register search on October 27 found no notice revising DO .413.

The two documents also give different retention authorities: General Records Schedule 5.2, item 020 in the notice, and Treasury schedule N1-056-03-10, item 1a in the assessment.

On the numbers: the text calls the $116.73 Washington lawyer figure both an "average hourly attorney billing rate" and a BLS mean wage that it then tripled, and does not reconcile the two (91 FR 67414). Its small-business section divides $1.58 trillion by 11,263 firms to get $140.4 million per firm; the division gives $140.3 million (91 FR 67417-18).

## CFA's records on Treasury

Treasury holds a "Minor" grade on CFA's agency scoreboard, with a composite score of 79.91, based on 5 scored areas. The grade does not measure this program. CFA's privacy-records linkage page for the Investment Security Office counts 7 "linked" documents, but all 7 are rules or proposed rules, including this proposal. DO .413 appears on the Treasury-wide page instead. Both pages show 0 privacy assessments found, although Treasury posts this program's assessment on its website.

## What to watch

Whether Treasury revises DO .413 and updates the 2025 assessment to cover the statute, citizenship data, feedback requests and public submissions before the final rule takes effect.

The revised information collection request under 1505-0282. As of October 27, reginfo.gov listed only the two 2024 requests, and the proposal's 200 responses are below the 318 now approved.

Whether Treasury creates the public database of covered foreign persons, and what standard it sets for listing and removal.

How often Treasury uses the "national interest" disclosure power and the power to share with foreign governments.

## How to comment

Comment on regulations.gov under docket TREAS-DO-2026-0595 by December 7, 2026, citing "Outbound Investment Security Program Regulations." Treasury says all comments, including any personal or confidential business information in them, will be made public. Comments on the information collection go to reginfo.gov by the same date (91 FR 67396, 67417).

Authorities