Can a Non-U.S. Company Win SBIR/STTR Funding?

A non-U.S. company cannot win SBIR or STTR funding directly. Phase I and Phase II awards go only to small businesses based in the United States and majority owned and controlled by U.S. citizens, permanent residents or qualifying U.S. entities. Allied founders reach the programs through a U.S. company that meets those tests, or through partners and routes outside SBIR.

Who is eligible for SBIR and STTR awards?

An SBIR or STTR Phase I or Phase II awardee must be a for-profit small business with a place of business in the United States, more than 50% directly owned and controlled by U.S. citizens or permanent residents (or qualifying U.S. entities), and no more than 500 employees including affiliates. The Small Business Administration (SBA) sets them in 13 CFR 121.702.

The Small Business Innovation Research (SBIR) and Small Business Technology Transfer (STTR) programs are funded through 11 participating federal agencies, according to SBIR.gov. As of October 16, 2026, agencies may award up to $335,937 for Phase I and $2,239,578 for Phase II without seeking SBA approval. Eligibility is tested at the time of each Phase I and Phase II award. The tests:

SBA counts ownership on a fully diluted basis: options, warrants, convertible securities and preferred stock count as if converted (13 CFR 121.702(d)). A cap table that is U.S.-majority on common stock alone can fail once a non-U.S. investor's convertible notes are counted.

Does a U.S. subsidiary of a foreign company qualify?

A wholly owned U.S. subsidiary of a non-U.S. parent does not qualify. The owner must be U.S. citizens, U.S. permanent residents or U.S.-owned small businesses, and a foreign parent is none of these. Affiliation rules also add the parent's employees to the subsidiary's headcount, so a large parent pushes the subsidiary over the 500-employee limit as well.

Under 13 CFR 121.702(c), companies are affiliates when one controls or has the power to control the other. SBA presumes control above 50% of voting equity and may find it at 40% or more. Common management, identity of interest (including 70% or more of receipts from one customer), the newly organized concern rule and the ostensible subcontractor rule can also create affiliation. A new U.S. company staffed by a foreign company's officers and supported by its contracts or facilities is the pattern the newly organized concern rule targets.

The venture-backed route does not open the door to foreign funds either. Under 13 CFR 121.701, a venture capital operating company, hedge fund or private equity firm must have a place of business in the United States and be organized under U.S. or state law to count.

Is the SBIR/STTR program authorized right now?

Yes. SBIR and STTR authority expired on September 30, 2025, the termination date then written into 15 U.S.C. 638(m). Congress restored it with the Small Business Innovation and Economic Security Act, signed April 13, 2026 as Public Law 119-83, which extends both programs through September 30, 2031.

The Senate passed the bill (S. 3971) by voice vote on March 3, 2026, and the House passed it 345–41 on March 17, 2026. Changes that matter to new applicants:

1. Proposal limits. From fiscal year 2027, each agency must set an equal limit on how many Phase I (and Direct to Phase II) proposals one company may submit, by fiscal year, solicitation or topic.
2. Strategic breakthrough awards. Agencies with SBIR budgets above $100 million may make Phase II awards of up to $30 million over no more than 48 months to companies with a prior Phase II and at least 100% matching funds.
3. Carry-over. Agencies may use unspent fiscal year 2026 SBIR and STTR funds in fiscal year 2027.
4. Phase III training. SBA must train contracting officers on Phase III awards, data rights and sole-source Phase III contracts.
5. Research security. New grounds for denying awards, described below.

What foreign-risk rules apply to SBIR and STTR applicants?

Since the SBIR and STTR Extension Act of 2022, every applicant must disclose its foreign ties in the proposal, and each agency must run a due diligence program that assesses foreign ownership and financial ties. The 2026 reauthorization widened that review and added denial grounds tied to U.S. restricted-party lists.

The 2022 law requires each proposal to disclose, among other things:

1. Owners and covered individuals in a foreign talent recruitment program of a "foreign country of concern" (defined as China, North Korea, Russia, Iran or any other country the Secretary of State designates).
2. Joint ventures or subsidiaries based in, funded by or affiliated with a foreign country of concern.
3. Any current or pending contractual or financial obligation with an enterprise owned by a foreign state or any foreign entity.
4. The share of venture or institutional investment from funds whose general partners or leaders have affiliations with a foreign country of concern.
5. Technology licensing or IP sales to a foreign country of concern in the previous five years.
6. Any foreign business entity, offshore entity or entity outside the United States related to the company.

Items 3 and 6 reach allied relationships, not only adversary ones. A U.S. company formed by an allied founder will list its non-U.S. affiliate, distribution agreements and foreign investors. Agencies may ask for copies of those agreements covering the previous five years.

Public Law 119-83 broadened the due diligence assessment to cover cybersecurity practices, patents, employees, foreign ownership and financial ties (surety, equity and debt), and relationships with foreign countries of concern. An agency may not make an award if it determines that the company has a security risk connecting it to an entity on any of eight U.S. lists, including the Commerce Entity List and Military End User List, the Section 1260H Chinese military companies list, the Section 889 prohibition list and the FCC Covered List. The same law removed the earlier conditions on the 2022 denial grounds, so a parent, subsidiary or business entity located in a foreign country of concern is now itself a ground for denial once the agency makes that determination. A denied applicant may apply again in a later cycle.

The 2022 law also lets agencies demand repayment of an award if a material misstatement or a later change in ownership or structure poses a national security risk, and requires awardees to report changes to their disclosures for the life of the award.

What are the realistic paths for allied founders?

Allied founders have four realistic paths: build a U.S. company that is majority owned by U.S. persons, partner as a subcontractor to an eligible U.S. small business, acquire or partner with an SBIR awardee for Phase III work, or sell through U.S. defense routes outside SBIR. Each one changes how much control and ownership the founder keeps.

Two of these need more explanation. On Phase III, the SBA Policy Directive states that "the small business size limits for Phase I and Phase II awards do not apply to Phase III awards" and that there is no limit on the number, duration, type or dollar value of Phase III awards. Phase III is a follow-on right of the company that developed the technology, not a door open to any company.

On non-SBIR routes, the Department of Defense (DoD) Foreign Comparative Testing (FCT) program, run by the Office of the Under Secretary of Defense for Research and Engineering under 10 U.S.C. 2350a(g), tests mature foreign-developed technology against U.S. military requirements. Its public overview targets technology readiness level 6 and above, and project proposals are submitted to the program by the military Services and combatant commands. As of January 2024, it listed 875 projects and 307 technologies transitioned. Other solicitations and agreements are covered in How the DoD Buys Commercial Space Technology.

Do I need a U.S. subsidiary to win U.S. defense contracts?

Not always. A non-U.S. company can register in SAM.gov with an NCAGE code and hold U.S. defense contracts directly. A U.S.-based company becomes necessary for SBIR/STTR and other SBA small-business programs, and a U.S.-organized entity located in the United States is required for any work that needs a facility security clearance.

FAR 4.1102 requires offerors to be registered in the System for Award Management (SAM) when they submit an offer, with narrow exceptions, including contract actions of $40,000 or less awarded to foreign vendors for work outside the United States when registration is impractical. FAR 4.1802 requires a Commercial and Government Entity (CAGE) code before award and the CAGE code of any entity that owns or controls the offeror. The SAM.gov registration checklist says an entity based outside the United States must request an NCAGE code through the NCAGE Request Tool before starting a SAM.gov registration, and must also give its immediate owner's NCAGE code if that owner is outside the United States.

When you need a U.S. entity, and when you do not:

Three further rules shape the decision. First, a U.S. subsidiary owned by a foreign parent is under foreign ownership, control or influence (FOCI) when the foreign interest can direct decisions in a way that could affect classified information or contracts. Under 32 CFR 117.11, such a company cannot access classified information until FOCI is mitigated or negated to the government's satisfaction. Second, DFARS 252.209-7002 bars awarding a national security contract to an entity controlled by a foreign government if it needs access to proscribed information (such as Top Secret or communications security material), unless waived. Third, product origin and cybersecurity are separate questions from corporate nationality: rules such as the Trade Agreements Act (TAA) and the Cybersecurity Maturity Model Certification (CMMC) clause DFARS 252.204-7021 apply through the contract, whichever entity signs it.

Clause numbers can change, so check them in the solicitation itself. Export controls also apply separately; see ITAR vs. EAR for Space Hardware Suppliers.

What this means for allied companies

SBIR and STTR are U.S. small-business programs, and the 2026 reauthorization made the foreign-ties review stricter, not looser. For most allied founders the question is not how to qualify the existing company, but whether a genuinely U.S.-owned and U.S.-run company is the right vehicle, with clear licensing terms, documented independence from the non-U.S. parent and disclosures prepared before the first proposal. If that structure does not fit, the faster routes are usually Phase III partnerships, FCT and supplying U.S. primes, which we cover in Selling to U.S. Prime Contractors.