Adelicia Cliffe, Michael Samuels, Allison Skager
Preserving small business status and understanding foreign ownership, control, or influence (FOCI) disclosure obligations and associated requirements and restrictions are two common early challenges for venture-backed companies. This article outlines these key considerations and risks to keep top of mind for VC investments in early-stage companies that are seeking or have been awarded federal contracts or grants.
Avoiding Impacts on Small Business Status
The Small Business Administration (SBA) sets size standards measured by annual revenue or number of employees under applicable North American Industry Classification System (NAICS) codes. These NAICS size standards determine whether a business is considered “small” for certain federal small business programs and award preferences.
The highest SBA size thresholds are currently 1,500 employees and $47 million in annual revenue. Many NAICS codes and specific federal programs carry lower small business thresholds—for example, the Small Business Innovation Research (SBIR) program has a 500-employee eligibility ceiling.
Affiliation Rules
For contractors with VC backing, avoiding “affiliation” under applicable SBA rules can be key to maintaining small business status and eligibility. If a VC’s involvement is deemed to create affiliation, all the investor’s affiliated portfolio companies must be aggregated with the contractor’s employee/revenue numbers to calculate size.
- Definition of Affiliation: Under 13 C.F.R. § 121.103, affiliation exists when one party controls or has the power to control another, regardless of whether control is actually exercised. The SBIR program has its own largely similar, but in a few cases different, affiliation regulation (13 C.F.R. § 121.702).
- Basis for Affiliation: Common bases for affiliation include (but are not limited to):
- Ownership (including voting stock/equity holdings; majority ownership is de facto affiliation)
- Management (common directors, officers, or key personnel)
- Identity of Interest (family relationships, economic dependence)
- Control, e.g. via holding a majority of board seats but also “negative controls” as discussed below
- Totality of the circumstances (SBA may consider the totality of the circumstances, even if no one factor standing along is sufficient to constitute affiliation)
- Negative Controls: A key risk for VC investors is unintentionally triggering affiliation by granting themselves “negative controls” via specific veto rights or blocking powers over certain company decisions. SBA has historically interpreted many such rights as evidence of affiliation.
- 2025 Regulatory Update – Extraordinary Actions: New SBA regulations and recent SBA Office of Hearings and Appeals decisions (e.g., Blue Skye Foods, LLC, SBA No. VSBC-442-A) have clarified that certain minority investor rights do not create affiliation. The SBA no longer finds affiliation solely because a minority investor can block board or shareholder decisions if those decisions are limited to “extraordinary actions.”
- Extraordinary actions for which negative controls do not trigger affiliation include:
- Adding a new equity stakeholder or increasing an equity stakeholder’s investment
- Dissolution of the company
- Sale of the company or all assets of the company
- Merger of the company
- Company declaring bankruptcy
- Amendment of company governance documents to remove these block rights
- Any other extraordinary action crafted solely to protect the minority shareholder’s investment without impeding majority control of daily operations
- Negative controls that implicate affiliation: Day-to-day management or operational decisions such as approval of budgets, hiring and firing executives, selecting accounting methods, pricing, or entering regular contracts do not qualify as extraordinary actions. Minority veto power over these areas are likely to trigger affiliation.
- SBIR Affiliation Rules: If a VC owns a minority share of a SBIR awardee, and is found to be affiliated with the SBIR awardee, then the awardee is only affiliated with portfolio companies that are majority owned by that VC or if that VC holds a majority of seats on the board of the portfolio firm.
Risks of Miscertification
Inadvertently creating affiliation in connection with minority VC investment can result in ongoing miscertification as a small business. Miscertification introduces risks for federal contractors, including:
- Size Protest Risk: A disappointed competitor could challenge the small business subcontractor’s size to SBA. SBA would require the awardee small business to produce documentation regarding its ownership and potential bases of affiliation. If SBA ultimately finds affiliation that would render the Company “other than small,” the company will lose the challenged award and be rendered ineligible for any additional set-asides or small business status, unless the Company is able to correct the issue that resulted in the adverse decision.
- Civil Penalties: Incorrect certifications may result in fines under the False Claims Act, including up to five figure per-award penalties and treble damages.
- Contract Termination: Customers may terminate contracts awarded to incorrectly certified businesses, particularly where the customer relied on the company’s small business status for its own goaling purposes.
- Repayment of Funds: Agencies may seek repayment of grants or payments.
- Ineligibility for Future Programs: The business may be permanently or temporarily barred from SBA programs. In extreme cases, the company and its principals may be banned from receiving future government contracts (suspension/debarment).
- Reputational Damage: Loss of trust from government customers, partners, and investors; potential media exposure.
Navigating Key Disclosures on Foreign Ownership, Control, or Influence (FOCI)
Cleared Department of Defense contractors (as well as certain uncleared contractors operating in the intelligence or defense space or seeking certain types of grant awards) are subject to rigorous FOCI disclosure requirements, scrutiny, and potential mitigation by the Defense Counterintelligence and Security Agency (DCSA) or other Cognizant Security Agency (CSA), such as the Department of Energy. In particular, DCSA requires submission of the Standard Form 328 “Certificate Pertaining to Foreign Interests” (SF-328) along with supporting data and documentation to obtain and maintain facility security clearances, including in connection with material changes to ownership or control. As part of its review process, DCSA typically asks a series of detailed follow-up questions digging into investor identities and interests.
DCSA has broad discretion in administering facility clearances and its reviews are case-specific, often requiring substantial details beyond what is called out on the face of the SF328. As such, investors and cleared contractors should be prepared for extensive FOCI disclosures.
5% Threshold
VCs with a 5% or greater interest (including in the aggregate for affiliates, and direct or indirect) in a contractor that has or is seeking a facility clearance should be prepared to disclose identities, citizenships, and interest percentages for all limited partners with a 5% or greater interest in the relevant fund and to provide information on the nationality of the managers controlling the fund. When this level of detail from VC investors is required, investors generally may submit this data on a confidential basis directly to DCSA (or the relevant CSA) with the company’s coordination. VCs should also be prepared to provide citizenship and ownership data for general partner(s).
Increasingly, VCs are proactively requiring ownership and control information from limited partners as a condition to investing in the fund, to get out in front of anticipated DCSA requests and to mitigate the risk of jeopardizing a portfolio company’s facility clearance and contract awards.
SBIR Eligibility
SBIR awards are reserved for U.S.-owned and operated small businesses. A company must be more than 50% owned and controlled by U.S. citizens or permanent residents, or by other businesses that meets that criteria. For a company with VC backing, SBIR programs also require foreign affiliation disclosures, which include disclosing with respect to any VC investors (at any level), whether its general partners or any other individuals holding leadership roles are involved with any foreign country of concern (China, North Korea, Russia, or Iran).
