SBIR and STTR Foreign Risk Review in 2026: What Reviewers Look For and What to Fix Before You Apply

Last updated: October 2026

SBIR and STTR are back and reauthorized through 2031. But the law that brought them back also raised the bar on one thing many founders never had to think about: foreign risk. Agencies now review your ownership, investors, team, intellectual property, and partners for ties to foreign countries of concern. If they find a problem, they can deny the award, and they may not tell you why.

The good news is that most companies that worry about this have nothing to fear. Having a foreign-born founder or an international collaborator does not disqualify you. What matters is whether specific ties exist, and whether you disclose them correctly. This guide explains what reviewers look at, which issues are real red flags, which ones are false alarms, and what to clean up before you apply.

What changed in 2026

Foreign risk reviews are not brand new. The SBIR and STTR Extension Act of 2022 first required agencies to run due diligence on applicants and introduced a standard disclosure of foreign affiliations and relationships. The 2026 reauthorization, signed in April 2026, kept that framework and expanded it.

Under the current rules, agencies review a wider set of risk factors, including:

• Foreign ownership and control of the company
• Investment relationships and funding sources
• Foreign affiliations of founders, officers, and key personnel
• Patents, licensing agreements, and technology transfer
• Joint ventures, subsidiaries, and parent companies
• Cybersecurity practices

Two practical consequences matter most. First, a finding in any of these areas can be grounds to deny an award, even if your science and your proposal are strong. Second, agencies may not always disclose the specific reason for a rejection, which means you may lose an award without learning what to fix. NIH has also published its own implementation of the process (NOT-OD-26-074), so biomedical applicants should expect it to be applied consistently.

Who the review applies to

Every small business applying for SBIR or STTR funding is subject to foreign risk review. It is not limited to defense work. Medtech, biotech, AI, energy, and aerospace companies all complete the same disclosures, and agencies such as NIH, NSF, DOE, NASA, and the Department of War all assess them. Defense and dual-use technologies tend to receive the closest look, but no agency treats this as optional.

What reviewers actually look at

Ownership and control

Reviewers want to know who owns and controls the company. A parent company, major shareholder, or board member tied to a foreign country of concern is one of the most serious red flags. Keep in mind that this is separate from basic SBIR eligibility, which generally requires the company to be majority owned and controlled by U.S. citizens or permanent residents, or by eligible U.S. entities.

Investors and funding sources

Foreign investment is not banned. Investment from an entity based in or controlled by a foreign country of concern draws scrutiny, especially if it comes with board seats, information rights, or influence over the technology.

Founders, officers, and key personnel

The biggest issue here is participation in a malign foreign talent recruitment program. Reviewers also look at current positions, appointments, and financial relationships with organizations in countries of concern. Where someone was born is not the question. What they are currently tied to is.

Patents, licensing, and technology transfer

Licensing or selling your technology or intellectual property to an entity in a country of concern, or having obligations to share it, is a significant risk factor. So are unclear IP ownership arrangements with foreign institutions.

Joint ventures, subsidiaries, and partners

Subsidiaries, joint ventures, manufacturing partners, and contractual obligations involving countries of concern all need to be disclosed and will be reviewed.

Cybersecurity practices

Agencies now look at whether you can protect the technology you are developing. Weak or undocumented security practices can count against you, particularly for defense and dual-use work.

Real red flags vs. common false alarms

These are the issues most likely to cause a denial:

• An owner, officer, or key team member currently participating in a malign foreign talent recruitment program
• A parent company, subsidiary, or joint venture based in or controlled from a foreign country of concern
• Investment from a country of concern that comes with control rights or access to the technology
• Licensing, selling, or committing to transfer your IP to an entity in a country of concern
• Undisclosed or inaccurately disclosed foreign relationships of any kind

These usually are not a problem on their own:

• A founder or team member who was born outside the United States
• Employees who are not U.S. citizens, as long as the company still meets SBIR ownership and principal investigator requirements
• Published academic collaborations with international researchers
• Investment from allied countries, properly disclosed
• Selling products to customers overseas, outside countries of concern

The common thread is disclosure. Many issues that look manageable become serious when they are left off the forms and discovered later.

Not sure where your company stands? On a free call, we walk through your ownership, investors, team ties, and IP agreements with you and flag anything that needs attention before you apply.

What to clean up before you apply

Run through this checklist before you start writing your proposal, not the week it is due:

• Map your cap table. Know every owner, investor, and their country of control, including fund limited partners where you have visibility.
• Collect team disclosures. Ask founders, officers, and key personnel to list current appointments, positions, and financial relationships, both domestic and foreign.
• Review your IP agreements. Confirm who owns your patents and know every license, option, and sponsored research agreement in place.
• List partners and suppliers. Identify any manufacturing, development, or distribution partners tied to countries of concern.
• Screen against restricted party lists. Check your company, partners, and investors against U.S. government restricted and denied party lists.
• Document your security practices. Write down how you protect sensitive data and technology, even if it is a short internal policy.
• Fix what you can, then disclose everything. Unwinding a problematic relationship takes time. Disclosing accurately always matters.

Free Download: Pre-Application Foreign Risk Checklist

Get this checklist as a one-page PDF covering ownership, investors, team, IP, partners, and security. Enter your details below and the download link appears right away.

What happens if you are flagged

If a reviewer finds an unresolved risk, the agency can decline to make the award regardless of your technical score. Because agencies are not always required to explain their reasoning, a denial can look like an ordinary rejection. That is why it pays to find and address issues before you submit rather than after.

The stakes continue after an award. Material misstatements in your foreign affiliation disclosures, or later changes that create ties to a country of concern, can lead to termination and to a requirement to repay award funds. Treat your disclosures as an ongoing obligation, not a one-time form.

Find out before the agency does. Book a free call and we will review your foreign risk exposure with you, so you can fix or disclose issues before you submit.

Frequently asked questions

Does having a foreign-born founder disqualify my company from SBIR or STTR?

No. Place of birth is not a factor in foreign risk review. Reviewers focus on current ties to foreign countries of concern, such as ownership, investment, IP agreements, and participation in malign foreign talent recruitment programs. Separately, your company must still meet SBIR ownership rules, which generally require majority ownership and control by U.S. citizens or permanent residents, or by eligible U.S. entities.

Which countries count as foreign countries of concern?

Foreign countries of concern include China, Russia, Iran, and North Korea, along with any other country designated under federal law. Ties to these countries receive the closest review.

Can my company accept foreign investment and still win an SBIR award?

Often, yes. Foreign investment is not banned, and investment from allied countries is common. Investment from an entity based in or controlled by a country of concern draws scrutiny, especially when it includes control rights or access to your technology. All foreign investment should be disclosed accurately.

Can my team collaborate with international universities or researchers?

Usually, yes. Ordinary scientific collaboration is not prohibited. The main risks are participation in malign foreign talent recruitment programs, undisclosed appointments or funding, and agreements that give a country of concern rights to your intellectual property.

Will the agency tell me if foreign risk was the reason I was not funded?

Not necessarily. Under the current rules, agencies may not always disclose the specific reason an application was denied on foreign risk grounds. That is why reviewing your risk before you apply matters.

What happens if I leave something off my foreign affiliation disclosure?

An incomplete or inaccurate disclosure can lead to denial of the application. If it is discovered after an award, it can lead to termination and a requirement to repay award funds.

When should I check my company for foreign risk issues?

Before you start writing your proposal, and ideally before you sign new investment, licensing, or partnership agreements. Some issues take months to resolve.

How BW&CO can help

BW&CO helps deep-tech, medtech, biotech, and dual-use founders win non-dilutive funding across NIH, NSF, the Department of War, NASA, DOE, and ARPA-H. Our Foreign Risk Scanner gives you a fast first read on potential issues, and our team can walk you through your agency fit, your eligibility, and what to address before you apply.

This article is for general information and is not legal advice. Foreign risk requirements vary by agency and solicitation. Review the current agency guidance and consult counsel for questions about your specific situation.