If Congress starts reviewing licensing deals, diligence gets a documentation problem

Historically, national security reviews were not a topic of conversation in biotech licensing deals. Things are changing.

The bipartisan Biotech Investment National Security Act of 2026 would amend the COINS Act by adding biotechnology as a covered sector, expand reviewable transactions to include licensing deals, and give the U.S. Treasury a year to write rules for implementation. This change follows two recent multi-billion-dollar licensing deals between the U.S. and China. Kivo has taken a deep dive into the imminent BINSA, leveraging data from the U.S. Food and Drug Administration, the U.S. Treasury, Congress, and more, to cover what documentation and review changes will be needed.

The framework today

The process today works differently from how it will look after BINSA is implemented. The Committee on Foreign Investment in the United States, or CFIUS for short, reviews capital inflow to U.S. companies, not outflows. They are housed in the U.S. Treasury and were expanded by the Foreign Investment Risk Review Modernization Act of 2018. CFIUS can require mitigation agreements among firms or recommend that the President take apart a deal.

Every year, they review thousands of filings. With biotech increasing globally, regulators have begun to point to the outflow of funds as a gap that needs to be addressed.

There is already a playbook for the outflow of funds, but it’s limited. Executive Order 14105 created the Outbound Investment Security Program (OISP), which has been operating since early 2025. Their mandate is to prevent U.S. individuals from engaging in transactions with entities in China, Hong Kong, or Macau in the semiconductor, quantum information technology, or artificial intelligence industries.

The COINS Act serves as a statutory layer. It was enacted in December 2025 and codified the framework from the OISP into statute. It preserves the same prohibited structure, expands knowingly directing provisions, and gives the Treasury until early 2027 to issue new regulations. Currently, biotechnology is not included within any of that. That’s precisely what BINSA would change.

The effect of BINSA

BINSA defines covered biotechnology as pharmaceutical and biological product development. This includes drug discovery platforms, clinical R&D, biologics manufacturing, and more. It is worth noting that agricultural biotechnology is excluded, as is industrial fermentation and academic research. It’s a broad amendment that would cover the multi-billion-dollar licensing deals that have made headlines in years past.

Outbound review today is mostly built around equity. Licensing deals being pulled into the fold for the first time is what makes BINSA so consequential. Historically, it is the industry’s least regulated path because it avoids a CFIUS inbound review and narrowly falls outside the scope of OISP.

BINSA, when implemented, will direct the Treasury to implement regulation changes within one year. Separately, the Secretary of Defense will need to assess within 60 days whether current capital flowing into Chinese biotechnology has an impact on military readiness.

Neither of those deadlines tells an active deal team what the rules will ultimately be. However, they do create legal uncertainty, because deals signed off today could be judged against future rules.

Anatomy of the file

With the new rules on the horizon, knowing how to prepare and adhere to existing best practices will reduce potential future bumps in the road. There are six main areas to address:

1. Scope and decision record: All files that stand to be reviewed need to establish a scope, including what the deal is and why it was structured as it was. This encompasses written records of the transaction’s purpose, all parties involved, those rejected, and the ultimate decision path that led to the deal’s final structure.

2. Parties and ownership: Every party involved in a transaction, particularly those with meaningful stakes, needs to be researched thoroughly, all the way up the ownership chains. Indirect and direct ownership, any state investment, and any ties to sanctioned entities need to be made clear.

3. Transaction mechanics: Your review files need to show the flow of any money. Upfront payments, milestone payments, royalties, extended terms, and anything else are all in scope.

4. Technology and data map: This is the only gray area of the requirements. Part 850’s semiconductor and AI rules already require identifying specific covered activities that a target company engages in, but applying them to biotechnology is more challenging. It typically would mean documenting whether a licensed asset involves a drug discovery platform, manufacturing process, and whether technical information flow was mainly going to a U.S. partner or away from them.

5. Diligence evidence: Any diligence needs to be attributable. It also needs to follow a timeline. Rather than assembling a diligence file only after a regulator asks, aim to draft one well in advance.

More from this section

Fishermen use floating scarecrow to save sea birds from drowning

David Bowie’s ‘lifetime’ ban from venue lifted posthumously

New test spots drinks spiked with ‘Devil’s Breath’ in minutes

6. Filing and monitoring: If a transaction is notifiable, Part 850 requires submission through the Treasury’s Outbound Notification System within a set window. They can also request supplemental information after the fact, meaning you need to be able to produce it. Any submission is not a one-time event.

Why FDA teams care

Any well-run regulatory affairs team won’t be surprised by the process. FDA’s data integrity guidance for drug CGMP (current good manufacturing practice) compliance builds on the ALCOA framework. This framework mandates that records need to be attributable, easy to read, original, and accurate. A later expansion to ALCOA+ mandated that they also be complete, consistent, enduring, and readily available.

However, this overlap isn’t absolute. FDA cares about the integrity of the manufacturing and clinical data. Regulatory review files will also be looking at ownership, sanctions, and technology transfer directions. But the discipline of adhering to FDA guidelines will get your company most of the way there.

The substantive dispute

There is a precedent for the new screenings. The sponsors of BINSA note that cross-border licensing deals between U.S. and Chinese companies, specific to the biopharma sector, grew by $131 billion from 2020 to 2025. The bill’s House sponsor, Rep. John Moolenaar, has also argued that a large share of U.S. pharmaceutical licensing-in deals are now originating in China. He cited Bristol Myers Squibb’s collaboration with Hengrui Pharmaceuticals as a key example. The main point of concern was the level of know-how and capital moving to external parties without any national security checks.

The Michigan Biosciences Industry Association argues for a more targeted approach. It says licensing a Chinese drug candidate usually moves development rights, responsibilities, and commercialization towards the U.S. partner, even as payments flow to China. The group argues that this distinction matters when assessing national security risk.

The Michigan Biosciences Industry Association also warns that broad restrictions could redirect transactions through European or Asian companies, disadvantaging U.S. firms without eliminating the underlying activity.

Both sides have a point, and the stakes are high. One side of the fight sees an unregulated capital channel going to a strategic competitor, and the other sees a functional pipeline threatened by a broad label that will disrupt deals the bill isn’t even aimed at. Where BINSA will actually land will depend on just how narrowly the U.S. Treasury defines covered biotechnology.

Build now, regardless

Predicting exactly where and what BINSA will look like is impossible. Fortunately, companies don’t need to wait for the final rules to be published to prepare. A near-term checklist should include the following:

1. Develop a standing ownership list and entity-list screening process for any China-linked counterparty.

2. Establish a documented decision record for deals already in your pipeline.

3. Set up both a technology and data map for licensed assets, regardless of whether your biotechnology deals get covered.

4. Name a single owner inside your organization who is responsible for keeping all data current so you’re not playing catch-up.

By exercising the discipline already established, you can better prepare your organization for inquiries in the future. You may even find issues that previously were swept under the rug. You’d rather find a red flag that wasn’t escalated now through a data review rather than when regulators come knocking at your door.

Preparing your organization for regulation

The biopharma and biotech space is in a state of flux right now. BINSA may not become law. The U.S. Treasury may end up covering biotechnology through its existing COINS Act authority.

Either way, the direction of the industry is undeniable. Cross-border biotech licensing has grown into a large and visible channel of capital. That visibility alone warrants an extra look from regulators and an expanded mandate regarding the scope of a deal review. In any case, what BINSA seeks to address from a documentation standpoint may be something that more life science companies could benefit from.

This story was produced by Kivo and reviewed and distributed by Stacker.