An important step in verifying people and businesses is assessing foreign ownership, control, or influence (FOCI). Overt control through documented investors and relationships is easy to spot. Influence, the indirect ways a foreign entity shapes decisions or operations, is much harder, because capable governments avoid leaving a paper trail when they embed themselves in another country's supply chain. That is why identity verification sits at the center of FOCI compliance: hidden influence shows up in the people behind an owner, a funder, or a key position, long before it shows up in a filing.
FOCI and identity, in brief:
- The risk: a foreign interest with the power to direct or decide a company's affairs, openly or through proxy owners, disguised funding, or a few people in key positions.
- Why paperwork misses it: a document review can find no foreign relations at all. The links surface when you verify who the people are and how they connect.
- What is changing: FedRAMP RFC-0036 proposes four FOCI indicators for 20x Class D. See the October 2026 update below.
What FOCI Means
For cleared defense contractors, FOCI has a legal definition. Under the NISPOM rule at 32 CFR 117.11, a U.S. entity is under FOCI when "a foreign interest has the power to direct or decide issues affecting the entity's management or operations" in a way that could lead to unauthorized access to classified information or adversely affect performance of a classified contract. That power counts whether it is exercised directly or indirectly: through owning the company's securities, through contracts or other means, or through influence over who sits on its board. The test is who holds the power, whatever the paperwork says, and FedRAMP has now proposed the same idea for federal cloud services (see the update below).
How Hidden FOCI Works
FOCI often begins with ownership and control, routed through proxies. Individuals or entities stand in as owners or investors to disguise where the ownership or financing really comes from. Building a fresh, clean funding source takes time, but it keeps the real backer out of every record a reviewer is likely to check.
Influence needs even less. Only a few individuals in key positions have to help a foreign nation, and they rarely act as its declared agents. They exert subtle, unofficial influence that a foreign government can exploit when it matters.
The timelines are long. Building a front that passes as free of foreign ties can take years of planning and investment, and when national security and intellectual property are at stake, a foreign government will spend those years, because the payoff of embedding in another government's systems is enormous. The most sensitive programs run in isolated, compartmented groups. The suppliers, subcontractors, and service providers around them are more exposed, and that is where influence tends to enter.
Case Study: Hidden Russian Owners Behind a Federal Software Supplier
A criminal complaint filed in September 2026 shows how hidden FOCI reaches federal agencies, and how identity exposes it. According to the complaint, a Virginia digital forensics software company sold its software to the U.S. Secret Service, Homeland Security Investigations, the DHS Office of Inspector General, and the Department of Defense while representing that no foreign person owned or controlled it. The complaint alleges that:
- A holding company hid the real owners. Five Russian nationals owned the U.S. company through a holding company in Cyprus. They also owned a Russian sister company whose customers included the FSB and other Russian security services.
- Stand-ins took their places. After U.S. sanctions on Russia tightened in 2022, the owners removed themselves from the company's public filings, installed a new chief executive, had two U.S. citizens listed as directors, and amended the charter so that, in one owner's words, "fateful decisions" would still be theirs.
- The forms said no foreign owner. In four annual certifications from 2022 to 2025, the company's federal contracting registration stated that it had no highest-level owner. In July 2024, its Certificate Pertaining to Foreign Interests (SF-328) for the Department of Defense answered "No" to every question.
- Identity gave it away. In November 2024, a Russian national who had been removed from the filings in 2022 returned to them as the company's President under a Turkish name. A comparison of his Russian and Turkish passports showed they were the same person.
Procurement officials have stated that they would not have awarded or renewed the contracts had they known who owned the company. The charges are allegations, and the defendants are presumed innocent unless proven guilty. The pattern is the one this post describes: every document said no foreign owner, and only the identities behind the documents told a different story.
Finding Hidden Links with Identity Network Graphs
A review can examine every person involved and still find no foreign relations on paper, because current FOCI detection methods cannot correlate data and intelligence at the raw data level. Historical and identity network graphs do better. They connect people, companies, addresses, and payments over time, and finding just one foreign influence operation or bad actor can expose an entire hidden campaign. The signals worth mapping:
- First-level relations. Direct connections between individuals and foreign interests are the riskiest and deserve the deepest scrutiny.
- Location and contact history. Where a person has lived and worked, and their interactions with countries of concern, help identify hidden operations.
- Vendors and money flows. Look at customers, and also at where money goes for expenses. Vendor and relationship choices often carry the clearest signs of foreign influence.
- Repeated patterns. Governments run FOCI operations for years, so the same methods recur, and the repetition becomes an identifier.
- The whole story. Someone who invests in or develops technology in a field has a different history from someone who appeared fully formed. A business's motivations and exact identity show whether it acts in good faith or as a front.
The best identifiers look at the whole person, piecing together multiple data points into one consistent story, or exposing the gaps where the story breaks.
Where Identity Verification and AI Fit
Asking a bad actor to reveal themselves never works. Detection comes from evidence: verified identities, relationship data, and the record of how past operations behaved. AI models can synthesize large datasets into risk scores that point reviewers at the relationships worth a closer look, and experienced practitioners still catch much of what the tools miss.
At Trust Swiftly, we use this approach in our verification workflows, which place bad actors in their own sandboxed verification environment. For the people who can direct or decide matters, such as owners, executives, and privileged staff, attended NIST IAL3 identity proofing confirms that each person is who the records say before you map their relationships. The same discipline applies across the federal supply chain, where foreign-directed workers and fronts target contractors.
The cases that reach the public record are small next to what governments must protect. A foreign adversary might spend billions on a single operation when the return from the most sensitive programs could be far larger.
Update, October 2026: FOCI Comes to FedRAMP 20x Class D
In October 2026, FedRAMP opened RFC-0036, which proposes two new definitions and four FOCI indicators for 20x Class D:
- KSI-PIY-DFC, Detecting FOCI Changes: "Changes in foreign ownership, control, or influence are detected and appropriate actions are taken."
- KSI-PIY-RFP, Reviewing Foreign Persons: "Foreign persons able to direct or decide matters affecting the cloud service offering are persistently reviewed."
- KSI-PIY-RFB, Reviewing Foreign Businesses: "Foreign business relationships that support the cloud service offering are persistently reviewed for ongoing risks."
- KSI-PIY-MFD, Maintaining FOCI Determinations or Mitigations: "Foreign ownership, control, or influence determinations and/or mitigation agreements, issued by U.S. government agencies covering the entity that operates the cloud service offering, are persistently reviewed and maintained."
FedRAMP will not collect FOCI details or rule on them. Under the proposed FRC-FRA-FOD, agencies decide whether a provider's FOCI is acceptable, and FedRAMP verifies only that providers know and track it. Each indicator asks for persistent review of people and relationships, which is identity work. Our RFC-0036 breakdown covers the full proposal, which is open for comment until November 19, 2026.
Frequently Asked Questions
What is foreign ownership, control, or influence (FOCI)?
FOCI is a condition in which a foreign interest has the power, directly or indirectly, to direct or decide matters affecting a company's management or operations. For cleared contractors, the NISPOM rule at 32 CFR 117.11 ties that power to risks to classified information and contracts. FedRAMP's proposed definition applies the same idea to cloud services that agencies use or rely on.
How does identity verification help detect FOCI?
Hidden FOCI is built to pass a document review, so the evidence sits in people and relationships. Verifying the identity of owners, funders, executives, and key staff, then mapping how they connect to each other and to foreign interests, surfaces the proxy owners and disguised funding that paperwork hides.
Does FedRAMP require FOCI reviews?
Not yet as a final rule. FedRAMP RFC-0036 proposes four FOCI indicators for 20x Class D and is open for comment until November 19, 2026. FedRAMP says it will not request FOCI details or decide whether a provider's FOCI is acceptable; agencies make that determination.
Talk to Us
Hidden foreign influence is designed to look clean on paper. If your program needs to verify the people behind owners, vendors, and key positions, contact us to see how Trust Swiftly verifies identities and maps the relationships around them.
