What allied-controlled defense tech companies actually did to structure DCSA compliance, and what NorthAI needs to know before closing any allied raise or acquisition discussion.
Authorization is an investment in trust infrastructure. The first authorization is expensive; subsequent customer acquisitions leverage that investment through reciprocity.
FOCI mitigation is the same logic applied to ownership structure: it is trust infrastructure that gates participation in the classified defense market. Just as FedRAMP authorization transforms sales cycles from 9-18 months to 4-8 weeks, a DCSA-approved FOCI mitigation structure transforms an allied-investment round from a classified-contract disqualifier into a compliant operating model. The question is which structure fits the raise, not whether to have one.
Foreign Ownership, Control, or Influence (FOCI) is the legal framework under 32 CFR Part 117 that governs whether a defense contractor can hold classified contracts when foreign parties have equity, board seats, or operational influence over the company. DCSA (Defense Counterintelligence and Security Agency) administers the framework and determines the appropriate mitigation structure on a risk-adjusted basis.
The FOCI question becomes acute for NorthAI when any of the following occurs: (a) an allied investor (UK, Canadian, Australian, European) acquires 5% or more equity with board representation; (b) a foreign defense prime acquires NorthAI / CHN; (c) multiple allied investors collectively cross a governance threshold. All three scenarios are realistic given NorthAI's current PE/VC raise and allied-market ambitions.
FOCI structure: Proxy Agreement (the highest-level mitigation instrument available under NISP). DCSA-approved proxy holders exercise all voting rights and governance prerogatives independently of the French/UK parent company. A Government Security Committee (GSC) composed entirely of cleared US citizens oversees internal classified-contract compliance.
History: Original agreement established in 1986 (as Racal Communications, Inc.). Continuously active since 1986. Among the longest-standing proxy agreements in the National Industrial Security Program. Thales Group (French/UK multinational) has never directly controlled Thales Defense & Security, Inc. on classified matters despite being 100% beneficial owner.
Annual compliance obligations: Ownership update, board composition report, classified-contract list, GSC meeting minutes, certification of outside director independence. Filing due to DCSA annually.
FOCI structure: Proxy Agreement. Original agreement with DoD dated October 26, 2017. Amended and restated by 2021 (IPO period when the structure was disclosed in SEC filings). DRS, US Holding (100% owned by Leonardo S.p.A.) delegates all key stock ownership prerogatives to cleared US citizens acting as proxies.
Parent ownership: Leonardo S.p.A. is approximately 30.2% beneficially owned by the Italian state (Ministero dell'Economia e delle Finanze). A state-linked foreign parent in a NATO ally country still triggered the Proxy Agreement rather than the lighter-touch SSA, because the classified-contract portfolio included Top Secret/SCI work.
Source documentation: Proxy Agreement mechanics disclosed in Leonardo DRS, Inc. Form S-1/A (2021 SEC filings), including exhibit 10.2 and exhibit 10.3. Publicly available at SEC EDGAR under CIK 0001833756.
FOCI structure: Special Security Agreement (SSA), NOT Proxy Agreement. This is a critical distinction: BAE Systems plc is one of the six largest US DoD suppliers, majority UK-owned, operating on classified contracts. Yet DCSA determined an SSA (with outside director oversight and Government Security Committee) was sufficient rather than requiring the most restrictive Proxy Agreement.
Why SSA rather than Proxy: DCSA applies a risk-based discretionary assessment. BAE Systems' 50+ year operational history in the US, deep compliance track record, and relationship with DoD allowed the lower mitigation tier. Majority foreign ownership alone does not automatically trigger a Proxy Agreement. DCSA's holistic assessment determines the appropriate level.
| Structure | When used | Ownership threshold | Approval timeline | Foreign parent retains | Foreign parent transfers |
|---|---|---|---|---|---|
| Board Resolution (BR) | Minimal foreign involvement; no board seat | <5% voting stock; no board rights | 30-60 days | Economic interest; minority information rights | Nothing (no governance rights exist at this level) |
| Security Control Agreement (SCA) | Minority foreign investor with board representation | 5-49%; board seat | 6-9 months | Economic interest; minority board representation (through independent outside directors approved by DCSA) | Direct operational control; access to classified information |
| Special Security Agreement (SSA) | Foreign-controlled entity; majority ownership; lower-to-moderate risk profile | 50%+ (majority or 100%) | 6-12 months | Economic interest; residual economic governance via DCSA-approved outside directors | Board control; access to classified information; direct operational direction |
| Proxy Agreement / Voting Trust (PA/VT) | Highest-risk: pervasive classified involvement (TS/SCI) OR DCSA determines SSA inadequate | Any level (triggered by classification level, not just ownership %) | 12-18+ months | Economic interest only (dividends, valuation upside); no governance whatsoever | All voting rights; all governance rights; transferred to DCSA-approved US citizen proxy holders |
Trigger: Foreign investor takes 5%+ equity with board seat (or board observation rights).
FOCI path: SCA (6-9 month DCSA approval). Outside directors appointed. Classified contract eligibility gated pending mitigation clearance.
Timeline impact: Add 6-9 months to classified-contract eligibility after close. HARBOR retainer work proceeds; milestones tied to DCSA approval.
Trigger: 100% acquisition by UK/EU/allied-headquartered defense contractor.
FOCI path: Acquirer's existing Proxy Agreement or SSA likely extends to NorthAI/CHN as a new subsidiary. Subsidiary-status finalization: 3-4 months. DCSA reviews the extension but the acquirer's existing track record accelerates approval.
Best case: BAE Systems acquires NorthAI. BAE's SSA extends. NorthAI becomes BAE Systems Inc. subsidiary within 3-4 months. Classified contracts accessible under BAE's existing cleared facility network.
Trigger: Foreign equity event, then a Top Secret/SCI program award within the same fiscal period.
FOCI path: NorthAI / CHN must file FOCI mitigation plan within 90 business days of classified award. DCSA likely requires Proxy Agreement (highest tier) given TS/SCI classification level and foreign ownership combination.
Timeline: 90-day filing window + 12-18 month Proxy Agreement approval cycle. Program held in escrow pending mitigation clearance.
Trigger: UK VC + Canadian VC + Australian VC combined ownership reaches 30%+ with consolidated board representation.
FOCI path: SCA (if board seat granted to investor syndicate representative) or SSA (if collective ownership crosses 50%). Full investor chain-of-custody due diligence by DCSA. Annual GSC reporting required.
Timeline: 6-12 months. Board restructuring required per DCSA outside-director requirements.
CFIUS (Committee on Foreign Investment in the United States) operates a separate but related framework. Under recent rulemakings, CFIUS established an "Excepted Foreign State" designation that provides streamlined review for investors from: United Kingdom, Australia, Canada, New Zealand, Japan, and Germany. (France is under consideration but not yet designated.)
The CFIUS fast-track applies to CFIUS review of the investment transaction itself (i.e., whether the acquisition or investment creates a national-security risk). It does NOT eliminate the FOCI mitigation requirement for classified-contract eligibility under DCSA. The two reviews are parallel and both required:
Reviews the investment transaction. Excepted foreign states get faster processing (30 days vs 45). Outcome: CFIUS clearance for the transaction itself.
Reviews classified-contract eligibility. Excepted foreign state designation does NOT apply; full FOCI mitigation structure still required. Processing timeline unchanged (6-18 months depending on structure).