TL;DR: NIH’s foreign-risk review extends beyond your cap table. Consultants, contractors, research partners, service providers, and vendors can introduce risks that prevent an otherwise competitive SBIR/STTR application from receiving an award. Review the entire project network before submission because HHS will not allow applicants to resolve an identified security risk during the pre-award process.
A clean ownership structure does not make an NIH Small Business Innovation Research (SBIR) or Small Business Technology Transfer (STTR) application clear of foreign risk. The agency examines the people and organizations that will contribute to the proposed project, including relationships that may sit several steps away from the applicant.That distinction has real consequences. Data presented to the Senate Committee on Small Business and Entrepreneurship showed that the National Institutes of Health (NIH) flagged 144 SBIR/STTR applications for foreign risk during fiscal years 2023 and 2024. NIH denied all 144.
NIH added another important data point in August 2026: more than half of foreign-risk denials across the Department of Health and Human Services (HHS) since assessments began in 2023 involved consultants or contractors.
The practical lesson is straightforward. Foreign-risk diligence must cover the project’s working network, not merely the company applying for funding.
Consider mapping every person and organization touching the proposed project before the scientific narrative reaches its final draft.
NIH Reviews the Project Network
HHS defines a covered individual broadly. The definition includes anyone who contributes in a substantive, meaningful way to the scientific development or execution of the project, as well as senior or key personnel named in the application.
That scope can reach:
- Owners, officers, and key personnel
- Consultants and advisors
- Contract research organizations (CROs)
- Contract development and manufacturing organizations (CDMOs)
- Research institutions and laboratory partners
- Information technology and data-service providers
- Contractors, vendors, and other service companies
- Commercialization or development partners
NIH’s published case studies illustrate how these relationships create risk. One scenario involves a company with no foreign ownership that proposes using a research contractor whose parent company is owned by an entity in a foreign country of concern. Another involves an applicant using an IT provider controlled by such an entity. Both scenarios result in denial.
The cap table may be spotless while the project structure remains exposed.
A Foreign-Risk Finding Cannot Be Repaired During Pre-Award Review
HHS policy makes the timing especially consequential. Applicants do not receive an opportunity to replace a problematic collaborator or otherwise mitigate an identified security risk before the award decision.
The agency will identify the applicable risk category, but the applicant must remove the risk and submit a new application during a later cycle. A denial does not make the company or its personnel permanently ineligible, and every new submission receives an independent assessment. The lost cycle, however, can affect development milestones, staffing, follow-on financing, and commercialization plans.
Foreign-risk screening therefore belongs near the beginning of proposal preparation. Treating it as a Just-in-Time paperwork exercise leaves little room to restructure the project if a concern emerges.
Six Checks to Complete Before Submission
1. Build a Complete Covered-Party Map
List the applicant, owners, officers, senior or key personnel, and every individual or organization making a substantive contribution. Include proposed consultants, subcontractors, CROs, CDMOs, laboratories, IT providers, manufacturers, vendors, research institutions, and partners.
Ask project leaders, scientific personnel, finance staff, and operations staff to review the list. Different teams often know different parts of the relationship network.
2. Screen the Official Restricted-Party Lists
NIH directs applicants to review eight federal restricted-party sources. These include the Department of Defense Section 1260H List, the Department of Commerce Entity List and Military End User List, the Section 889 Prohibition List, and four additional lists maintained by the Department of Homeland Security, Department of the Treasury, Federal Communications Commission, and U.S. Customs and Border Protection.
A name search is only the starting point. NIH provides a consolidated screening resource, but applicants remain responsible for checking the official source lists because they can change.
3. Investigate Ownership and Control
Review parent companies, subsidiaries, affiliates, investors, operating locations, and controlling interests for every external organization. A U.S.-based contractor may still introduce risk when its parent company or controlling owner has a prohibited connection.
Repeat the review when a company has changed names, merged, accepted new investment, or reorganized. Corporate structure can conceal the relationship that matters most.
4. Apply the Correct Lookback to Each Risk Category
Avoid using one five-year window for every question. NIH currently describes different periods and conditions for different risks:
- Patent applications and patents may require a five-year review.
- Certain recent foreign affiliations receive a one-year review.
- Investment, licensing, joint venture, financial, and business relationships may depend on whether they remain active.
- The Foreign Disclosure Form requires disclosure of applicable funded and unfunded foreign relationships.
Review appointments, honorary roles, consulting arrangements, research collaborations, foreign funding, in-kind support, licensing, joint ventures, patent activity, and talent recruitment program participation. Current NIH instructions and the active disclosure form should control the final scope.
5. Replace Problematic Collaborators Before Applying
NIH’s case studies show that pre-submission remediation can work. One example describes a company that discovered its intended CRO on the Section 1260H List. The applicant ended the relationship, selected an alternate provider, verified the new provider’s ownership and affiliations, documented the termination, and applied with the revised team.
The sequence matters. Ending a risky relationship before submission may preserve the company’s ability to compete. Discovering the same relationship during HHS review can cost an application cycle.
6. Reconcile Every Disclosure Document
Biosketches, Other Support documentation, the Foreign Disclosure Form, subaward materials, consultant agreements, facilities descriptions, budgets, and project narratives should describe the same relationship network.
A role that appears in one document but disappears from another can create an avoidable credibility problem. Titles, dates, effort, support, affiliations, and organizational names should align across the package.
Create one verified source list for personnel and partners, then use it to review every application component. Consistency will not guarantee an award, but it reduces the chance that fragmented proposal preparation creates a disclosure concern.
Screening Is More Than a Database Search
A clean restricted-list result does not establish that a party presents no foreign risk. HHS also assesses cybersecurity practices, patents, employees, ownership, financial obligations, investments, foreign affiliations, licensing agreements, joint ventures, and active business relationships.
Applicants should also distinguish citizenship or personal background from covered risk. NIH’s examples explain that citizenship in a foreign country of concern, education there, or family travel does not automatically require denial when no current prohibited affiliation or other security risk exists.
The goal is a documented, fact-specific assessment of the proposed project network. Overlooking relationships creates risk; treating every foreign connection as disqualifying creates unnecessary disruption.
Make Foreign-Risk Review Part of Proposal Readiness
Strong NIH SBIR/STTR preparation connects scientific strategy, commercialization planning, budgets, collaborators, disclosures, and compliance. Foreign-risk review cannot sit apart from those decisions because changing a CRO, advisor, research partner, or technical provider may affect the work plan, budget, facilities, letters, and timeline.
EBHC can support proposal readiness, document coordination, and consistency review, while applicants remain responsible for compliance determinations, legal advice, factual accuracy, institutional approvals, and final submission authority.
A short working session to pressure-test the relationship map can expose gaps while there is still time to change the team.
The most useful question before the next application is not simply, “Does our company have foreign ties?” Ask, “Does anyone who will touch this project have an ownership, affiliation, funding, technology, business, or data-access relationship that HHS may need to examine?”
That broader question is much closer to the one NIH will ask.
Further Reading
NIH Restricted Entity Search Tool for SBIR/STTR applicants
Senate hearing record containing the fiscal year 2023 and 2024 foreign-risk data
NIH guidance on addressing potential foreign risks
NIH Foreign Disclosure and Risk Management guidance and case studies
Driving Innovation and Growth with Non-Dilutive Funding and Expert Evaluation
