FOCI Compliance and the Supplier Ownership Problem

For decades, FOCI compliance has been a defense industry requirement. If you wanted to work with the US Department of Defense, you had to prove your company, and your suppliers, weren't secretly controlled by a foreign government. That rule is specific, well established, and strictly enforced. 

Now the same question is showing up in industries that have never had to answer it before. 

What FOCI Actually Asks 

Knowing the name of your supplier isn't the same as knowing who's behind it. 

FOCI compliance asks a harder question: who owns this company? Who controls it? And is any ownership tied to a foreign government, a state-owned enterprise, or someone politically connected? 

Here's why that's harder than it sounds. A supplier might be incorporated locally, but its parent company sits in another country. That parent might be majority-owned by a sovereign wealth fund. One board member might hold a senior political position somewhere else entirely. None of that shows up when you check the company name or where it's registered. 

Regulators don't want a list of suppliers you happen to know are government-owned. They want proof you have a real process for finding out. 

Why This Is Spreading  

This isn't a hypothetical. FOCI-style requirements are already expanding into new sectors and new countries, and each one is coming at the problem from a different angle. 

In Australia, regulators are working directly with electrical companies on new rules that would require them to map their supply chains and flag foreign ownership risk. In the US, FERC and CISA are building similar supply chain requirements for critical infrastructure, on top of what's already required in defense. The CHIPS Act is putting the same pressure on manufacturers to understand who owns their suppliers. 

In the EU, DORA requires financial institutions to understand who owns and controls their technology vendors. And anti-bribery laws around the world already require screening for politically exposed people in third-party relationships, regardless of industry. 

Different regulators, different angles, same underlying demand: show us you know who's behind your suppliers, and show us you're still checking.

Why Checking Once Isn't Enough 

Most procurement and compliance teams handle this the same way they handle most things outside their core workflow: they go with what they happen to know. 

Someone on the team knows a supplier is government-owned because they've been around long enough to know. The team scans the news for ownership changes. The annual risk review is treated as the safety net. 

The problem is that ownership doesn't stay still. A supplier that was privately owned when you signed them might be owned by a foreign state-owned company today. A board member who was a private citizen during your last review might hold a government position now. 

A team relying on memory and news alerts can't catch that kind of change at scale, and it can't produce what regulators are starting to ask for: documented ownership entities, risk scores, match details, and a record showing the review actually happened.