The Committee on Foreign Investment in the United States, and the royalty buyer

This piece treats the US side. The Chinese side is treated in the companion note, The Chinese gate.

A contractual entitlement leaves. The operating capability does not.

A fund organised outside the United States pays a US biotech for a percentage of net sales on a marketed product. It takes no equity, no board rights and no seat at any table. It takes audit rights over the royalty calculation and a backup security interest in case the transfer is recharacterised as a financing.

This is the standard shape of a third-party royalty purchase, and it is the shape of the transaction that the Committee on Foreign Investment in the United States has never been asked to review on the public record.

The question has been academic for most of the life of the asset class, because the buyers were American and the payors were American. Both are changing. On 2 March 2026 Royalty Pharma announced the appointment of Kenneth Sun as Senior Vice President and Head of Asia, effective May 2026, based in Hong Kong and hired out of Morgan Stanley's Asia Pacific healthcare investment banking practice.

On the regulatory side, the BIOSECURE Act became law in December 2025 inside the FY 2026 National Defense Authorization Act, the same statute expanded the outbound investment programme, and the Biotech Investment National Security Act is now before both chambers, introduced in the House on 2 June 2026 as H.R. 9102 by Representatives Moolenaar and Dingell, and in the Senate on 6 August 2026 by Senators Slotkin and Ricketts. It would put pharmaceutical licensing arrangements with Chinese entities in front of Treasury for the first time.

A licence signed in Suzhou this year creates a royalty on US sales that becomes monetisable toward the end of the decade. The buyer will be asked for a jurisdictional view, and there is no authority to give one from.

Three kinds of statement

This piece distinguishes three registers, and marks them where the distinction bears weight.

Settled covers the text of 31 CFR Parts 800 and 850, the worked examples in the regulations, and the dated facts of enacted statutes and disclosed transactions.

Inferred covers the application of that text to royalty structures. The reasoning is available to anyone reading the regulations, but the conclusion is an inference. CFIUS assesses substance over form and has published nothing at case level.

Untested covers structures on which no decision, guidance or public case exists. Those are identified individually rather than left to the reader.

The distinction has practical weight because the call-in authority does not expire. An inference relied on across a decade of deal practice is still an inference, and 31 CFR 800.501(a) permits the Committee to request a filing at any time in respect of a non-notified transaction.

The short version

• The dispositive question is not whether the buyer has taken assets. It is whether those assets constitute an entity engaged in interstate commerce. Section 800.252(a) defines a US business as any entity, irrespective of the nationality of the persons that control it, engaged in interstate commerce in the United States. Section 800.301(c) reaches assets only where those assets constitute a US business. A payment right is not an entity and does not become one by being large.
• Neither mandatory filing path can be engaged by a royalty purchase as ordinarily drafted. The critical technology path at 800.401(c) requires a person that could directly control the TID US business, is directly acquiring a covered investment, holds a direct investment whose rights are changing, or holds a voting interest. The foreign government path turns on substantial interest, defined at 800.244(a) exclusively in terms of voting interest. A royalty buyer holds none.
• The covenant package is where jurisdiction is actually created, and 800.245 is the list to check it against. Substantive decisionmaking is defined to include pricing, sales and specific contracts, supply arrangements, corporate strategy and business development, research and development including budget allocation, manufacturing locations, and access to critical technologies or material nonpublic technical information. Consent rights over any of those appear routinely in royalty documentation.
• True-sale drafting and CFIUS hygiene pull in opposite directions. The backup security interest that protects against recharacterisation is normally granted over the widest available collateral. The narrower that grant, the weaker the foreclosure argument under 800.301(c). This is a genuine trade-off rather than a drafting oversight, and it is rarely surfaced.
• For a China-origin royalty bought from the Chinese licensor, Example 2 to 800.252(b) does most of the work. A foreign corporation with no US branch, subsidiary or fixed place of business, which exports and licenses technology to an unrelated US company and provides remote services, is not a US business. The seller is not a US business, so there is no US business to acquire.
• The UK regime may bite where CFIUS does not. The National Security and Investment Act 2021 reaches qualifying assets including intellectual property, with control defined as acquiring a right or interest and being able to use, direct or control its use to a greater extent than before. There is no requirement that the assets amount to a business. Asset acquisitions are outside mandatory notification but within the call-in power.
• Biotechnology can be brought into outbound screening without new legislation. The Comprehensive Outbound Investment National Security Act, enacted alongside BIOSECURE in the FY 2026 NDAA, gives Treasury authority to designate further covered sectors by rulemaking, and final implementing regulations are due by 13 March 2027. BINSA would make the licensing point explicit rather than create the power.
• List-based designation is now being litigated successfully, which changes how a counterparty screen should be read. On 7 August 2026 Chief Judge Boasberg enjoined the Department of War from giving effect to WuXi AppTec's 1260H designation, finding all three stated rationales factually deficient under the Administrative Procedure Act.
• Buying an existing stream from a Chinese licensor is probably outside outbound screening even after biotechnology is added, and financing a Chinese biotech is probably inside. Section 850.210(a) enumerates equity, contingent equity, debt with equity-like rights, conversion, greenfield, joint ventures and fund interests. An asset purchase from a covered foreign person is not on that list. A revenue interest financing extended to one sits squarely within paragraph (a)(2). That distinction, if it survives the rulemaking, is the most consequential structuring fact in this market.
• The fork is cash against equity, and it runs the same way on both sides of the Pacific. A licence for cash, and the royalty it creates, sits outside the enumerated covered transactions at 850.210(a) and outside the Chinese outbound perimeter, because neither regime finds an investment element. A licence for equity, which is the NewCo template, sits inside both. One drafting variable now carries two regulators.
• The payor's manufacturing base is the channel that reaches cash flow, and it is the one least often modelled. A royalty is paid on net sales. Where the payor's contract manufacturer is designated, re-sourcing means technology transfer, comparability and regulatory variation, with supply interruption risk landing directly in the royalty base.
• The headline China deal figures overstate cash by roughly a factor of twenty and exclude the royalty entirely. Evaluate counts $5.6 billion of aggregate upfront across 93 cross-border deals in 2025 against a $137.7 billion announced total, or 4.1 percent. Announced value is upfront plus the undiscounted milestone stack. Royalties on net sales sit outside it by convention.

What is actually at stake

The jurisdictional question is the narrow one. It is worth answering because it determines whether a given transaction can close, but on its own it changes very little: the base case sits outside, most deals are the base case, and the market has priced it that way for a decade.

The consequential question is different. Between December 2026 and 2028 a series of dated regulatory decisions will run, none of which is about royalties, and each of which reaches royalty cash flow through a different channel. Those channels are worth naming, because they carry different magnitudes and land on different parties.

The supply channel. Ninety-three cross-border licensing transactions in 2025, with Chinese-originated assets accounting for 40 percent of everything big pharma in-licensed, is the origination funnel for royalties that become monetisable between 2030 and 2035. If in-licensing from Chinese entities becomes notifiable or prohibited, the funnel narrows at the top.

Nothing happens to existing streams, but the pipeline of future ones thins, and it thins with a five to ten year lag that will not show in anyone's deal count until well after the rule takes effect.

The payor channel. This is the one that reaches cash flow directly and the one most often left out. A royalty is paid on net sales of a product that has to be manufactured. Where that manufacture depends on a designated contract organisation, the payor faces a re-sourcing exercise involving technology transfer, comparability work and regulatory variation, with the attendant risk of supply interruption. Net sales are the royalty base.

A supply interruption is a royalty interruption, and it arrives without any change in the buyer's own regulatory position.

The transferability channel. A royalty is worth what the deepest bid will pay. If foreign buyers withdraw from China-linked paper on reputational grounds while US buyers face outbound constraints on the other side, bid depth falls on both sides at once. That is a discount rate effect rather than a cash flow effect, and it is the one a seller feels first.

The process channel. Data-transfer rules, foreign screening regimes outside the United States and CFIUS timetables all operate on the transaction rather than the asset. They add condition precedents, extend outside dates and occasionally break deals that would otherwise have closed on the economics.

How regulation reaches royalty cash flow. Four dated events, four channels, and only one of them touches the transaction.

Each of the four is discussed below, and the scenarios that drive them are set out toward the end. The jurisdictional analysis comes first because it is the precondition for everything else.

The entity requirement, and why it decides the case

Most commentary on asset-deal jurisdiction stops at 800.301(c), which extends coverage to a transaction resulting in control by a foreign person of any part of an entity or of assets, if such part of an entity or assets constitutes a US business. Read alone, that appears to make any asset acquisition a candidate.

It does not, because the operative term is defined.

Section 800.252(a) provides that a US business means any entity, irrespective of the nationality of the persons that control it, engaged in interstate commerce in the United States. Two elements have to be satisfied. There must be an entity, and it must be engaged in interstate commerce here.

The asset examples in 800.301(e) are consistent throughout: the question they ask is whether the assets acquired amount to a going concern capable of operating, not whether they are valuable or American in origin.

Example 13 confirms the point from the negative direction. Proprietary software acquired without customer lists, marketing material, other tangible or intangible assets or personnel is not a covered control transaction, because the software does not constitute an entity and is therefore not a US business. Example 10 says the same of an empty warehouse.

Example 9 supplies the positive case, treating the purchase of substantially all assets of a company that ceased production a week earlier as covered, because employees remained on payroll, know-how survived and customer and vendor relationships transferred with the assets. Example 11 marks the transition precisely: a facility that is not a US business becomes one when personnel, customer list, equipment and inventory management software are added.

Applied to a royalty, the analysis is short. The buyer acquires a contractual right to receive a percentage of net sales, together with the reporting and audit machinery necessary to verify it. No employees transfer.

No marketing authorisation transfers. No know-how, no manufacturing, no customer relationships and no capacity to supply anything. The seller continues to operate exactly as before, and the buyer's position is that of a payee. There is no entity, and nothing in the bundle is engaged in interstate commerce in its own right.

The same provision resolves the China-origin case, in the other direction. Example 2 to 800.252(b) describes a corporation organised under foreign law, wholly owned and controlled by a foreign national, with no branch office, subsidiary or fixed place of business in the United States, which exports and licenses technology to an unrelated US company and provides remote technical support to US customers without assets or personnel here.

The example concludes that it is not a US business. That is a close description of a Chinese licensor holding a royalty on US sales under an ex-China licence. The counterparty from whom a Western buyer would purchase is not a US business, so there is nothing for 800.301(c) to reach, whatever the buyer's nationality.

Formation of the acquisition vehicle does not change this. Royalty purchases are ordinarily made through a special purpose vehicle, frequently a Delaware LLC or an Irish designated activity company. Where a foreign person incorporates a new US subsidiary, Example 7 to 800.301(e) treats the arrangement as a greenfield investment and not a covered control transaction, on the reasoning that the foreign person has not acquired a US business because none existed.

Interposing a Delaware SPV therefore neither creates nor cures jurisdiction. It is worth confirming that the SPV acquires only the entitlement, since an SPV that also takes on operating assets is a different question.

Where a royalty transaction sits. Four gates in sequence, and where the flow leaves before reaching the last.

Why neither mandatory filing path can be engaged

Practitioners will want the mandatory analysis before the discretionary one, because the exposure is different in kind. A missed mandatory declaration is a violation carrying civil penalties. A transaction that is simply not filed voluntarily carries call-in risk but no penalty for the non-filing itself.

There are two mandatory paths, and a royalty purchase as ordinarily drafted fails the threshold conditions of both.

The critical technology path. Section 800.401(c) applies to a covered transaction involving a TID US business that produces, designs, tests, manufactures, fabricates or develops critical technologies for which a US regulatory authorisation would be required for export, reexport, transfer or retransfer to a person falling within one of five categories.

Those categories are a person that could directly control the TID US business as a result of the transaction, a person directly acquiring an interest that is a covered investment, a person with a direct investment whose rights are changing in a way that could result in a covered control transaction or covered investment, a party to a transaction or arrangement described in 800.213(d), and a person holding a voting interest for these purposes in one of the foregoing.

Every category presupposes either control or an equity interest. A royalty buyer with no equity and no governance rights is none of them.

The technology assessment is fixed as of the first date on which one of the conditions in 800.104(b)(1) through (4) is met, which for a royalty deal is normally execution of the binding purchase agreement, and the enquiry proceeds without giving effect to ITAR licence exemptions or most EAR licence exceptions. None of that machinery is reached if the threshold condition fails.

The foreign government path. This turns on substantial interest, and the definition is unusually clean. Section 800.244(a) defines substantial interest, in the context of an acquisition of an interest in a US business by a foreign person, as a direct or indirect voting interest of 25 percent or more, and, in the context of a foreign person in which the governments of a single foreign state have an interest, a direct or indirect voting interest of 49 percent or more.

Section 800.244(b) adds the fund-specific rule: where an entity's activities are primarily directed, controlled or coordinated by or on behalf of a general partner or equivalent, a foreign state has a substantial interest only if it holds 49 percent or more of the interest in the general partner.

The word is voting. A royalty entitlement confers no voting interest in anything, so the 25 percent limb cannot be satisfied on the buy side regardless of how large the cheque is or who stands behind the fund. This matters commercially, because it means a sovereign-backed royalty fund does not acquire a mandatory filing obligation by writing a larger royalty cheque. It acquires one by taking equity.

The residual exposure is therefore entirely discretionary: the call-in power, and the reputational and contractual screens that counterparties apply independently of it.

The caseload, and what a review costs in time

The 2025 Annual Report to Congress was released on 7 August 2026.

What happens to a filing. CFIUS caseload for calendar 2025, drawn to scale.

Summaries from Sullivan & Cromwell, White & Case, Cleary Gottlieb and Latham & Watkins agree on the figures. CFIUS reviewed 347 filings, comprising 207 notices and 140 declarations, the first annual increase since the 2022 peak of roughly 440.

Around 55 percent of notices proceeded to a second-stage investigation, and mitigation was imposed in 25 notices, or about 12 percent, up from 9 percent in 2024 and below the 21 percent of 2023.

Two figures deserve more attention than they usually get. Declarations cleared at 66 percent against 78 percent the previous year, with 36 of 140 pushed to a full notice, which materially weakens the case for the short-form route as a timing strategy.

And the Committee investigated 90 non-notified transactions, opened 62 formal inquiries and requested filings in nine, which is the empirical answer to anyone treating non-filing as an end state.

Japan led filings on an adjusted basis with 41, then China with 38 and Germany with 26. China accounted for 33 notices against only five declarations, a distribution that reflects protracted reviews and withdraw-and-refile cycles rather than a surge in new transactions.

Investigations averaged 82.8 days from acceptance to conclusion, and appropriations lapses tolled deadlines by more than 120 days across the year.

Is there precedent

There is none directly. The Committee does not publish case-level determinations, the Annual Report aggregates by sector and country, and what is known about individual matters comes from disclosure by listed parties or from reporting. What follows brackets the range.

Asset-only life sciences deals are reviewed, and can be unwound

In 2023 Mustang Bio agreed to sell its Worcester, Massachusetts cell and gene therapy manufacturing facility, together with associated equipment, contracts and personnel, to uBriGene (Boston) Biosciences, a Delaware company and indirect wholly owned subsidiary of UBriGene (Jiangsu) Biosciences.

The transaction was restructured before closing, and the amended version closed in July 2023 for $6 million in cash, with the facility lease and certain contracts held back pending landlord consent. No equity in Mustang Bio changed hands at any stage. The parties filed a voluntary joint notice on 10 August 2023, and clearance was expressly not a condition to closing.

Mustang Bio and uBriGene: how a $6m asset deal took nine months. Each withdraw-and-refile returns the statutory clock to its full ninety days.

The chronology is set out in the company's Forms 8-K. The initial 45-day review and subsequent 45-day investigation ran to 13 November 2023, when CFIUS requested a withdrawal and refiling. A second cycle began 14 November, ended 28 December and moved to investigation, concluding 12 February 2024. The parties withdrew and refiled again.

A third review ran from 13 February to 28 March 2024, and the Committee advised that its further investigation would conclude no later than 13 May.

On that date the parties executed a National Security Agreement providing for abandonment of the transaction, with uBriGene obliged to dispose of the purchased equipment within 180 days and a reduced obligation available on a sale back to Mustang Bio within 45 days.

Three points transfer. There is no de minimis floor, and a $6 million asset purchase consumed 277 days before being unwound. The jurisdictional hook was aggregation under 800.301(c), applying the Example 9 and Example 11 reasoning to a life sciences target, with no equity anywhere in the structure.

And a voluntary filing that was not a closing condition still produced a binding outcome, which disposes of the view that declining to condition closing preserves optionality once a filing has been made.

The case does not decide the royalty question. It does establish that the aggregation analysis is applied to life sciences assets in practice and not only in the examples, and it sets a realistic outer bound on timetable.

Data, not technology, drives the health-adjacent cases

In 2019 CFIUS required iCarbonX, a Shenzhen genomics company backed by Tencent, to divest its majority stake in PatientsLikeMe, which held health data on several hundred thousand US users and had not notified the 2017 investment. CNBC reported the order and STAT confirmed it.

In the same period Beijing Kunlun Tech was required to divest Grindr, and in March 2020 a presidential order required Beijing Shiji to divest StayNTouch, as Proskauer summarised. None of the three was subject to mandatory filing and none went through voluntary pre-closing review.

For royalty work the relevance is not the outcome but the trigger. Sensitive personal data under 800.241 carries no volume threshold for genetic test results, which means a clinical-stage payor holding sequencing data on a few hundred trial participants is a TID US business.

That does not create jurisdiction over a royalty purchase, because the covered investment limb still requires an equity acquisition. It does mean that the moment equity enters the structure, the TID characterisation is likely to be satisfied and the 800.211(b) analysis becomes live.

Revealed practice, and what it is worth

Foreign-organised vehicles have acquired US-linked pharmaceutical royalties for years, and CFIUS provisions do not appear in the filed agreements. The royalty purchase agreement between Milestone Pharmaceuticals and RTW Royalty I DAC, an Irish designated activity company, dated 27 March 2023 and filed as an exhibit, contains no CFIUS representation, covenant or condition.

Royalty purchase agreements as a class have not carried them, while equity purchase agreements involving foreign buyers almost invariably do.

This is evidence of a consistent reading by counsel on both sides across a large number of transactions. It is not authority, and it is not a defence to a call-in. Its practical value is as a signal about where the market's own risk assessment has settled, which matters when advising on whether to depart from it.

The definitional point that explains the pattern

Under 800.220, an entity organised under foreign law is a foreign entity only if its principal place of business is outside the United States or its equity securities trade primarily on one or more foreign exchanges, and an entity demonstrating majority ultimate ownership by US nationals is not a foreign entity at all.

Whether a given buyer is a foreign person is an ownership and management question, not a jurisdiction-of-incorporation question, and the answer often surprises.

The one executed China-origin monetisation

There is a single executed monetisation of a China-origin royalty on the public record: Royalty Pharma's agreement of 25 August 2025 to acquire rights to BeOne Medicines' royalties on worldwide ex-China sales of Imdelltra for up to $950 million. Its shape is the one the analysis predicts.

The seller had changed its jurisdiction of incorporation from the Cayman Islands to Switzerland by continuation effective 27 May 2025, three months before the sale. The stream was carved to ex-China sales. The companion note works through why that configuration clears both outbound perimeters and the withholding question at the same time, and why it is the only configuration that has traded.

What is untested

No published case tests a revenue interest financing against 800.306(b) in a life sciences context. No published case addresses foreclosure onto a royalty security package. And no published case addresses whether a NewCo formed around a China-origin licence, with the Chinese licensor taking equity in the US vehicle, is a covered control transaction under 800.301(d).

Given the volume of NewCos built on that template since 2024, the third gap is the one most likely to close, and it will close on a specific transaction rather than through rulemaking.

The covenant package is where jurisdiction is created

The base case is clean. Very few executed transactions are the base case, and the drift is almost always in the covenants rather than in the consideration.

The rights inventory test. Every right the buyer receives, against the limb it could engage.

Section 800.245 is the list to run the covenant package against. Substantive decisionmaking is defined as the process through which decisions regarding significant matters affecting an entity are undertaken, including pricing, sales and specific contracts, supply arrangements, corporate strategy and business development, research and development including location and budget allocation, manufacturing locations, and access to critical technologies, covered investment critical infrastructure, material nonpublic technical information or sensitive personal data.

That list should be read alongside a typical royalty purchase agreement, because the overlap is substantial and largely unintended.

Consent rights over amendment of the underlying licence are standard and generally benign. Consent rights over sublicensing, over the grant of further licences in the territory, over pricing or discounting policy, over changes to manufacturing site, or over settlement of patent litigation are also common, and each maps onto an enumerated category.

None of them creates jurisdiction on its own, because the covered investment limb still requires an equity acquisition. All of them become live the moment a warrant, a conversion right or a NewCo share is added, and the analysis is then conducted on the covenant package as executed rather than on the equity percentage.

The information covenant deserves separate treatment. Access to material nonpublic technical information is the first of the three 800.211(b) triggers, and 800.232 defines it by reference to information necessary to design, fabricate, develop, test, produce or manufacture critical technologies. Net sales, gross-to-net bridges, deduction schedules, rebate accruals and territory splits are not that.

Batch records, process descriptions, analytical methods and stability data are closer, and they appear in royalty data rooms more often than a buyer needs. Drafting the information covenant to exclude technical information removes the argument entirely at no commercial cost, and reduces exposure under the DOJ data rule at the same time.

Revenue interest financings with equity-like features. Section 800.306(a) provides that extending a loan or similar financing arrangement to a US business does not by itself constitute a covered transaction, with or without a security interest over securities or other assets. Paragraph (b) carves back where the arrangement affords an interest in profits of the US business, board appointment rights, or other comparable financial or governance rights characteristic of an equity investment but not of a typical loan.

The distinction that protects most royalty structures is between an interest in the revenue of a product and an interest in the profits of an enterprise. It is a good argument and it is untested. The structures that put it under pressure are those that drift toward enterprise economics: participations uncapped by reference to the financed asset, step-ups triggered by corporate rather than product events, and covenant packages reaching beyond the product into general operating decisions.

Example 4 under 800.306(d) shows the threshold is not high, treating a foreign bank with one seat of fifteen and a dividend right as holding rights characteristic of an equity interest, and the loan as a covered investment, notwithstanding that the bank had no power to determine, direct or decide important matters.

Contingent equity and the timing rule. Warrants convert the entitlement into a contingent equity interest, which is an investment under 800.227. Section 800.308 governs whether the post-conversion rights are counted at the outset, weighing the imminence of conversion, whether conversion depends on factors within the acquiring party's control, and whether the interest and rights acquired on conversion can reasonably be determined at the time of acquisition.

Debentures convertible only on an event outside the holder's control in an indeterminate amount are disregarded until conversion becomes imminent; debentures convertible at the holder's discretion after six months into a determinable 50 percent stake are counted immediately. The drafting of the exercise conditions, not the size of the coverage, decides which side of that line a warrant kicker falls.

The recharacterisation problem

This is the point at which royalty documentation and CFIUS hygiene come into direct conflict, and it is worth stating plainly because it is rarely surfaced.

Every royalty purchase agreement drafted as a true sale contains a backup grant. The Milestone and RTW agreement is representative: the parties state their intention that the transaction be a sale, and then, for the purposes of providing additional assurance in the event that, despite the intent of the parties, the sale, transfer, assignment and conveyance contemplated hereby is hereafter held not to be a sale, the seller grants a first priority security interest in the revenue participation right and the royalty payments, and a security interest in the product collateral, with authority to file UCC financing statements.

The commercial logic is unimpeachable. If a court recharacterises the transfer as a secured financing, the buyer wants a perfected first-lien position rather than an unsecured claim.

That logic pushes toward defining the collateral as broadly as the seller will accept, and product collateral definitions frequently extend to the regulatory approvals, the underlying patents, related know-how, supply agreements and books and records.

The CFIUS analysis runs the other way. Section 800.306(a)(1) contemplates that the Committee will accept a notice concerning a financing arrangement at the point where, because of imminent or actual default, there is a significant possibility that the foreign person may obtain control of a US business. The question at that point is what enforcement would actually deliver.

A collateral package limited to the patents and the licence is answered by Example 13 and does not constitute a US business. A package extending to the NDA or BLA, transferred know-how, supply agreements, customer relationships and personnel is answered by Example 9 and probably does.

So the broader the backup grant, the stronger the recharacterisation protection and the weaker the position on foreclosure. The syndicate carve-out at 800.306(c) offers no relief, since it requires either that the foreign lender need majority consent of US participants and be unable to initiate action independently, or that it hold no lead role and be contractually restricted from acquiring control or exercising 800.211(b) rights. A bilateral royalty note satisfies neither.

The recharacterisation trade-off. The backup security grant that protects against recharacterisation is the grant that creates foreclosure exposure.

There are workable answers. Carve personnel, know-how and regulatory approvals out of the collateral and rely on the patents and the licence. Or keep the broad grant and constrain the remedy, so that enforcement produces a sale to a qualified purchaser or an orderly liquidation rather than direct assumption of operating assets, supported where necessary by a voting trust, a US-person trustee holding the marketing authorisation, or forced-sale mechanics on a defined timeline.

These are the mitigation devices CFIUS has accepted in adjacent contexts, and they work considerably better when they appear in the transaction documents at signing than when they are proposed at the point of default.

The numbers, and what they leave out

Anyone underwriting China-origin royalty supply meets the same figures, and they measure something other than the cash at risk.

Announced value against cash paid at signing. Seven disclosed deals against iso-ratio reference lines, with the market aggregate drawn area-true alongside.

Royalty Pharma's own appointment release states that out-licensing of Chinese medicines comprised over $130 billion of announced transaction value in 2025, against roughly $14 billion in 2021. PharmCube puts 2025 cross-border out-licensing at roughly $137.7 billion, as Reuters reported, while IQVIA's mid-year update of 8 July 2026 puts therapeutic in-licensing involving Chinese-originated assets at $92 billion for the first half of 2026, or 88 percent of IQVIA's own full-year 2025 figure, and Chinese-originated assets at 40 percent of everything big pharma in-licensed in 2025.

The series are not comparable to one another; a narrower deal-scope methodology puts 2025 at $92.2 billion against PharmCube's $137.7 billion for the same period.

Announced deal value is upfront cash plus the entire development, regulatory and sales milestone stack, undiscounted and unweighted. Evaluate counts 93 cross-border licensing deals involving Chinese biotech products in 2025 carrying $5.6 billion in aggregate upfront, against 42 deals and $1.1 billion in 2022, per data shared with Fierce Biotech.

Against the $137.7 billion headline that is 4.1 percent. The disclosed deals corroborate the ratio: AstraZeneca and CSPC at $1.2 billion upfront against up to $18.5 billion, Bristol Myers Squibb and Hengrui at $600 million against $15.2 billion, GSK and Hengrui at $500 million against roughly $12 billion, Pfizer and Innovent at $650 million against $10.5 billion, Lilly and Innovent at $350 million against $8.8 billion.

Those five are $3.3 billion of cash against $65 billion of headline, or 5.1 percent.

Applying the range to IQVIA's $92 billion implies roughly $3.7 billion to $4.6 billion of upfront cash in the first half of 2026, which is an estimate rather than a reported figure.

Two caveats on the underlying data. Average upfronts are rising, from $102 million in 2024 to $141 million in 2025 and around $172 million in early 2026 on Evaluate's numbers, per PharmaVoice, so the ratio may be drifting. And Evaluate's aggregate and average do not reconcile, since $5.6 billion across 93 deals is about $60 million rather than $141 million, which suggests the average is computed only across deals with disclosed upfronts.

Undisclosed upfronts are common, so every series understates cash by an unknown margin. The wider arithmetic of contingent value is set out in the earlier p05.org piece on the gap between announced biobucks and milestones actually triggered.

The figure that matters most is absent from all of them. Announced value conventionally excludes royalties: the release quotes a number and adds "plus tiered royalties on net sales", and the royalty sits outside the total.

The headline is therefore not a measure of the asset being created. Deal count is. Ninety-three cross-border transactions in 2025 against 42 in 2022, each generating a long-dated royalty obligation on US sales payable to a Chinese counterparty, is the supply picture that matters to a buyer.

The China layer

Direction of travel determines the regime, and the two directions are not symmetrical.

Inbound: a China-linked buyer acquiring a US royalty. The jurisdictional analysis above applies unchanged, and the base case remains outside covered transaction jurisdiction on the text. What changes is the discretionary calculus.

The 2025 distribution of Chinese filings toward full notices, longer timelines and refiling cycles is the relevant datum, alongside the America First Investment Policy's identification of healthcare as a sector warranting closer scrutiny of adversary-linked investment. Any structure carrying equity, conversion or foreclosure features will be assessed against that background, and counterparty screens applied by payors, lenders and rating agencies will in practice bind before CFIUS does.

The list-based regimes operate independently. The NS-CMIC List prohibits US persons from transacting in the publicly traded securities of designated entities and does not by its terms reach a privately negotiated royalty purchase, though designation remains a screening signal.

The Entity List imposes licence requirements on transfers of items subject to the EAR, which is relevant where technical diligence involves foreign nationals. Mayer Brown's August 2026 survey sets out how these interact.

The 1260H List moved twice this year, in opposite directions. On 8 June 2026 the Department of War published an updated list adding 65 entities, comprising 17 parents and 48 subsidiaries, and removing 10, bringing the total to nearly 200. The biotechnology additions were WuXi AppTec, Complete Genomics and Novogene, alongside BGI Group and MGI Tech already listed. The consequence is not confined to Department of War procurement.

Section 805 of the FY 2024 NDAA bars that department from contracting with listed entities or any entity subject to their control, and it defines control by reference to 31 CFR 800.208, the CFIUS definition, with the direct contracting prohibition running from 30 June 2026 and a broader procurement prohibition from 30 June 2027.

Then the designation was enjoined. On 7 August 2026 Chief Judge James E. Boasberg of the District Court for the District of Columbia granted WuXi AppTec a preliminary injunction barring the Department from enforcing, implementing or otherwise giving effect to its 1260H designation, in WuXi AppTec Co., Ltd. v. US Department of Defense, No. 1:26-cv-02069.

As Ropes & Gray summarised, the court found a likelihood of success on the substantive Administrative Procedure Act claim and concluded that all three rationales offered by the Department were factually deficient. The designation had rested on a single-sentence justification asserting indirect SASAC ownership and indirect affiliation with SASTIND and the PLA. The bond was set at one dollar.

Two things follow for a buyer running a counterparty screen. Designation is no longer a terminal fact, and a screen treating a 1260H listing as dispositive will now produce false positives on entities whose designations are under challenge. But the injunction is preliminary, the merits are undecided, and it does not by its terms reach the separate BIOSECURE designation route through the OMB list.

Outbound: a Western buyer acquiring a China-origin royalty. This is the direction origination desks actually encounter, and CFIUS is the wrong instrument. The Outbound Investment Security Program took effect on 2 January 2025 under Executive Order 14105, covering semiconductors and microelectronics, quantum information technologies and artificial intelligence.

It was then placed on a statutory footing by the Comprehensive Outbound Investment National Security Act, enacted in December 2025 as part of the FY 2026 NDAA. Biotechnology is not currently a covered sector.

The statutory change matters more than the current sector list. The COINS Act extended country scope beyond China, Hong Kong and Macau to Cuba, Iran, North Korea, Russia and Venezuela, added high-performance computing, supercomputing and hypersonic systems, redefined covered foreign person to capture entities 50 percent or more owned by or subject to the direction or control of a person of a country of concern, and appropriated $150 million a year for two years, as Fenwick summarised.

It also granted Treasury authority to designate further covered sectors, biotechnology among them, without returning to Congress, and required final implementing regulations by 13 March 2027.

That authority is the point most likely to be missed. The question is not only whether BINSA passes. It is whether Treasury exercises a power it already holds, on a timetable that is already running.

The Chinese side has moved further than the American side. PRC State Council Order No. 837 took effect on 1 July 2026 and creates a standalone outbound investment security review whose disposal limb reaches transfers of assets and interests related to an outbound investment.

Whether a given royalty is within it turns on whether the licence that created it was itself an outbound investment, which is the analysis in the companion note, The Chinese gate. The relevant point here is that the answer aligns with the US one rather than cutting against it.

The mirror provision is the one to note. Section 850.210(a)(2) treats the provision of a loan or similar debt financing to a covered foreign person as a covered transaction where it affords an interest in profits, board appointment rights, or other comparable financial or governance rights characteristic of an equity investment but not typical of a loan.

That is 800.306(b) in substance, pointed outbound. If biotechnology is added, the same drafting distinctions that govern an inbound revenue interest will govern an outbound one, and firms that have solved the problem in one direction will find the work transfers.

The NewCo, and the fork that carries both regimes

The NewCo has carried the largest share of China-origin value since 2024, and it is the structure most exposed to what is coming. The Chinese-side analysis is treated at length in the companion note, The Chinese gate, which works through Order No. 837 and corrects two conclusions drawn in earlier drafts of this piece. What follows is the US-side analysis and the single structural variable that turns out to carry both regimes at once.

The mechanics, and why 19.9 percent is not an accident

A Chinese innovator licenses ex-China rights to one or more clinical assets into a newly formed offshore entity, usually Delaware or Cayman, funded by Western venture capital and run by an international management team.

The licensor takes an upfront payment, a milestone stack, a royalty on ex-China sales, and equity in the NewCo. The intended exit is a trade sale or an IPO.

The template is Hengrui's May 2024 licence of a GLP-1 portfolio to the entity then called Hercules, since rebranded Kailera Therapeutics: $110 million upfront, up to $200 million in clinical and regulatory milestones, up to $5.725 billion in sales milestones, and a 19.9 percent stake retained by the licensor.

Hengrui's $1.1 billion arrangement with Braveheart Bio, backed by Forbion and OrbiMed, has the same shape, as does Mabwell's licence of a dual-target siRNA candidate to Kalexo Bio.

Chinese stakes are usually under 20 percent, and the reason is regulatory rather than commercial. The outbound rules define a covered foreign person to capture entities 50 percent or more owned by a person of a country of concern. A NewCo in which the licensor holds 19.9 percent is not a covered foreign person, so a US venture firm funding it is not making a covered transaction and a US pharma acquiring it later is not either.

That threshold is doing a great deal of structural work, and Treasury is updating the programme's details as the COINS Act requires. Section 809 permits the designation of further covered sectors without new legislation, and the same rulemaking could revisit ownership thresholds and attribution rules. A book built on the permanence of 19.9 percent has a single point of failure with a known date.

The NewCo, and what each regime touches. Four instruments move in one transaction, and no two are regulated the same way.

Inbound, the formation answer is comfortable and temporary

At formation the NewCo is a newly incorporated entity with no operations, so the licensor's acquisition of equity in it is a greenfield investment rather than a covered control transaction, following Example 7 to 800.301(e).

The joint venture limb at 800.301(d) requires a party to contribute a US business, and at formation there is none.

What changes is that the NewCo becomes an operating company and, where it develops critical technologies or holds sensitive personal data, a TID US business. At that point the licensor's stake plus any board or observer right is a covered investment under 800.211(b), and 800.305 means each subsequent change in rights is tested afresh rather than covered by the formation analysis.

The NSCEB recommendation to extend jurisdiction to greenfield investments, if adopted, would remove the formation-stage answer entirely.

The fork is cash against equity, and it runs the same way on both sides

This is the finding that the companion note establishes on the Chinese side, and it aligns with the US analysis in a way that is worth stating plainly, because it collapses two regulatory questions into one drafting variable.

A licence for cash, and the royalty it creates, sits outside the Chinese outbound perimeter because Article 2 of Order 837 defines outbound investment by the presence of an investment element. A licensor taking cash and a royalty contributes nothing and obtains no interest in the licensee.

The same transaction sits outside the enumerated covered transactions at 850.210(a) on the US side, for the reason given earlier: an asset purchase from a covered foreign person is not on the list.

A licence for equity, which is the NewCo template, sits inside both. The licensor's stake is an outbound investment on the Chinese side, and the later disposal of that stake on the trade sale the structure exists to reach is a disposal of an interest related to an outbound investment. On the US side the equity is what makes the covered investment limb live once the NewCo becomes TID.

Two corrections to earlier drafts of this piece. The first is that the Article 15 disposal limb does not reach any Chinese licensor selling any royalty. The operative word is related, and a royalty arising from a licence that was never an outbound investment has no relation for the limb to attach to.

The second is that the NewCo layer does not clear the Chinese gate. Contributing intellectual property into an offshore vehicle for equity is the captured act, and the licensor's stake is inside the perimeter from formation. Both points are worked through in the companion note.

What that leaves for a buyer

The sellable configuration is narrower than the deal count suggests, and it is the same on both sides of the Pacific: a stream created by a licence for cash, held at the moment of sale by a seller that is not a PRC person.

Two consequences follow for US-side diligence specifically. Where a royalty is payable by a NewCo, the acquisition that usually crystallises or reassigns that royalty may require the Chinese licensor to clear its own disposal on an unknown timetable.

That is a Chinese regulatory dependency embedded in a Delaware payment obligation, and it will appear in neither the CFIUS memo nor the licence. And where the underlying licence conveyed restricted production technology, the export gate sits under the royalty rather than beside it, because a royalty is a claim on payments under a licence whose validity is the thing in question.

The UK asymmetry, and why it may matter more

A royalty on worldwide net sales is not a US instrument. It is a claim on sales in every territory the licence covers, and the screening regimes of those territories do not track the US analysis.

The National Security and Investment Act 2021 is the sharpest divergence. Its trigger events reach both qualifying entities and qualifying assets, and section 7 defines a qualifying asset to include land, tangible moveable property, and ideas, information or techniques which have industrial, commercial or other economic value, which expressly captures trade secrets, designs, source code, formulae and other intellectual property.

A foreign-located asset is within scope where it is used in connection with activities carried on in the United Kingdom or the supply of goods or services to persons in the United Kingdom.

The control test for assets is where the divergence bites. A person gains control of a qualifying asset where they acquire a right or interest in relation to it and are thereby able to use it, or direct or control its use, to a greater extent than before the acquisition. There is no requirement that the asset amount to a business, no entity requirement, no interstate commerce analogue and no turnover or deal value threshold.

Acquisitions of qualifying assets sit outside the mandatory notification regime, which is confined to qualifying entities in the seventeen specified sectors, but they remain within the Secretary of State's call-in power, and parties who want certainty may notify voluntarily.

Four regimes, four different tests. A royalty on worldwide sales is not a US instrument, and the analyses do not track each other.

The practical consequence for a royalty buyer is specific. A transaction structured to avoid any right that would allow the buyer to direct the use of the underlying patents is unlikely to engage the UK asset test.

A transaction that includes step-in rights over patent prosecution or enforcement, consent rights over sublicensing in the UK, or a security package that would deliver the patents on default, is a candidate for the call-in power in a way it is not for CFIUS, precisely because the UK test asks about control over an asset rather than acquisition of a business. Similar asset-deal coverage exists in a number of continental regimes.

A buyer running only the US analysis on a global royalty is running the analysis that is least likely to catch the deal.

Adjacent regimes that catch what CFIUS does not

Three regimes reach facts that CFIUS jurisdiction misses, and all three arise in ordinary royalty diligence.

The DOJ Bulk Sensitive Data Rule implements Executive Order 14117 and took effect on 8 April 2025. It prohibits covered data transactions with China, Cuba, Iran, North Korea, Russia and Venezuela involving bulk human omic data or biospecimens at a threshold as low as 100 US persons, and restricts transactions involving bulk personal health data affecting more than 10,000 US persons. The prohibitions apply regardless of whether the data has been anonymised, pseudonymised, de-identified or encrypted, on the stated reasoning that modern re-identification defeats those measures.

The rule separates outright prohibited transactions from restricted ones that may proceed subject to specified cybersecurity and compliance safeguards, and imposes diligence and recordkeeping obligations on covered businesses. This is the provision most likely to be triggered inadvertently in a royalty process, because data rooms for clinical-stage assets routinely hold patient-level trial data and access is routinely granted across jurisdictions.

The Protecting Americans' Data from Foreign Adversaries Act, enacted in 2024 and implemented by the FTC, reaches a narrower set of transactions but carries no bulk threshold at all.

BIOSECURE, enacted as Section 851 of the FY 2026 NDAA, prohibits federal agencies from procuring biotechnology equipment or services from a biotechnology company of concern, from entering into, extending or renewing a contract with any entity using such equipment or services in performing a federal contract, and from allowing loan or grant funds to be used for either.

The enacted text names no companies, departing from the original bill, and relies on the 1260H List together with an administrative designation process requiring findings of foreign adversary control or direction, involvement in biotechnology equipment or services, and a national security risk.

The implementation sequence is staged and runs longer than early summaries suggested. OMB must publish the initial list of biotechnology companies of concern within one year of enactment, by 18 December 2026. It then has up to 180 days to issue implementing guidance.

The Federal Acquisition Regulatory Council must revise the FAR within one year of that guidance, and the prohibitions take effect only after the FAR revision, on a further short delay. On that arithmetic the practical effect arrives in 2028.

One carve-out is easy to read backwards. The five-year safe harbour for pre-existing contracts runs from the FAR revision, and it is not available for existing contracts with companies that were on the 1260H List as of 18 December 2025. Entities added later, including the June 2026 cohort, fall inside the safe harbour. Entities listed on the date of enactment do not.

For a royalty buyer the exposure is indirect and runs through the payor. A product whose manufacture depends on a designated supplier, and whose commercial model includes federal channels, carries a revenue risk that belongs in the underwriting model rather than in the CFIUS memo.

The WuXi litigation is a reminder that the input to that model is contested rather than fixed.

Export controls on diligence. Release of controlled technology to foreign nationals in the course of technical diligence raises deemed export questions under the EAR, independently of any investment analysis. This is more likely in development-stage financings, where the buyer examines the manufacturing process, than in commercial royalty purchases.

Structuring practice

The following describes approaches observed in market practice and grounded in the regulatory text. It is not legal advice, and every point is fact-dependent.

Run the jurisdictional memo at term sheet. Three questions dispose of most of it. Is the buyer, or anyone upstream, a foreign person under 800.224 on the ownership and management tests rather than the domicile? Is any equity or contingent equity being acquired at any point in the structure, including at the SPV level or on conversion?

Would anything the buyer acquires, on any path including enforcement, constitute an entity engaged in interstate commerce under 800.252?

Run the covenant package against 800.245 line by line. The categories are enumerated and short. Pricing, sales and specific contracts. Supply arrangements. Corporate strategy and business development. Research and development including location and budget allocation. Manufacturing locations. Access to critical technologies, material nonpublic technical information or sensitive personal data.

Consent rights touching any of these should be justified commercially or removed, because they cost nothing to give up in the base case and carry the whole analysis if equity is ever added.

Resolve the recharacterisation conflict deliberately rather than by inheritance. Decide whether to narrow the backup collateral or to constrain the remedy, and record the reasoning. The default position, which is to take the broadest available grant because that is what the precedent document did, is a decision to accept foreclosure exposure without having priced it.

Diligence the ownership chain, not the domicile. Excepted investor status under 800.219 depends on ownership and nexus tests and on minimum excepted ownership thresholds, and it is lost where persons of non-excepted states hold above them.

For fund structures, test the six conditions of 800.307 against the limited partnership agreement and the side letters rather than the marketing materials, with attention to advisory committee powers, conflict waivers and any consent right reaching individual investments. Note that excepted status removes the covered investment limb only. The covered control limb applies to excepted investors in full.

Treat staged transactions as a series. Under 800.305, relief for a subsequent acquisition is available only where the same foreign person previously acquired direct control through a cleared covered control transaction. Where the earlier transaction was a covered investment, a later investment conferring a new 800.211(b) right is a fresh covered investment.

Tranched financings that add governance rights at each drawdown require testing tranche by tranche, not once at signing.

Decide between declaration, notice and neither on current data. Declarations carry no fee and a 30-day assessment, but the 2025 clearance rate of 66 percent with 36 of 140 escalated undercuts the timing rationale. Notices carry a fee scaled to transaction value, a 45-day review and a possible 45-day investigation, averaging 82.8 days from acceptance to conclusion in 2025 before tolling.

Repeat filers should monitor the Known Investor Program, in development since May 2025 and out for public comment in February 2026, which is aimed at repeat filers with a compliance record and limited exposure to China.

Allocate the risk expressly where a filing is contemplated. Condition precedent or efforts obligation. Who bears the fee. Outside date, and what a withdraw-and-refile does to it. Reverse break fee.

And the mitigation acceptance standard, including the point at which a demand becomes burdensome enough to release the parties. Royalty purchase agreements have not historically carried these provisions, which was defensible while every buyer was American.

Run the counterparty screen at first contact, and record status rather than a flag. An asset can sit entirely outside CFIUS and still carry exposure under 1260H, the Entity List, NS-CMIC or BIOSECURE.

After the WuXi injunction, a screen treating designation as terminal will generate false positives on entities whose listings are under challenge, and one ignoring designation will miss the OMB route. Record the designation, the litigation position and the date of each, and re-run before signing rather than only at first contact.

The full picture, in one table

Positions are drawn from the regulatory text and disclosed transactions and are indicative. They are not a substitute for advice on a specific structure.

Four scenarios, and what each does to a deal

The regulatory calendar between now and 2028 has four dated forks. None of them is about royalties. Each changes what a royalty is worth, or who can buy it, or whether the payor can keep manufacturing where it does.

[FIGURE: cfius-fig10-buildout.png]

The regulatory build-out, against CFIUS filing volume on the same time axis. What is in force, what is enacted but not yet biting, and what is only proposed.

Scenario one: Treasury adds biotechnology to the outbound programme by rulemaking

Trigger and date. Final COINS Act implementing regulations are due by 13 March 2027. The Act permits Treasury to designate further covered sectors without returning to Congress. This is the single most likely of the four, because it requires no legislative action and the deadline already exists.

What changes for a licensing deal. A US company in-licensing a China-origin asset would need to determine whether the arrangement is prohibited or notifiable. The current programme does not reach licensing at all, so the answer depends entirely on how the rulemaking is drafted. If it follows the existing structure, licensing is untouched and only equity investment into covered foreign persons is caught.

What changes for a royalty financing. This is where the drafting distinction bites hardest, and it cuts in opposite directions for two transactions that look similar on a term sheet.

Providing a revenue interest financing or a royalty-backed note to a Chinese biotech would fall to be assessed under 850.210(a)(2), which reaches a loan or similar debt financing arrangement affording an interest in profits, board appointment rights, or other rights characteristic of an equity investment but not typical of a loan.

That is the same test as 800.306(b) inbound, and the same drafting choices decide it. Synthetic royalty structures on a single product have the better argument, for the reason set out earlier: an interest in product revenue is not an interest in the profits of the enterprise. The argument is untested in both directions.

Buying an existing royalty from a Chinese licensor is a different transaction and probably a different answer. Section 850.210(a) enumerates its covered transactions: acquisition of an equity or contingent equity interest in a covered foreign person, provision of a loan or similar debt financing with equity-like rights, conversion of a contingent equity interest, greenfield investment, joint venture formation, and acquisition of a limited partner interest in a fund that then invests.

A purchase of a contractual entitlement from a covered foreign person, for cash, conferring nothing in that person, is not on the list. Untested, and the rulemaking could add it. But on the current architecture the secondary purchase of an existing China-origin stream sits outside outbound screening in a way that financing the same counterparty does not.

For an originator that distinction is close to the whole strategy, and the Chinese analysis reinforces rather than contradicts it. A royalty arising from a licence for cash is outside the outbound perimeter on both sides, because neither regime finds an investment element in it.

The configuration that clears both is a stream created by a licence for cash and held at the moment of sale by a seller that is not a PRC person. That is a narrower set than the deal count implies, and it argues for building the capability to identify it before the rulemaking closes.

Scenario two: BINSA is enacted in the FY 2027 NDAA

Trigger and date. H.R. 9102 was introduced on 2 June 2026 by Representatives Moolenaar and Dingell, with a Senate companion from Senators Slotkin and Ricketts on 6 August 2026. The FY 2027 NDAA, expected late in 2026, is the route BIOSECURE and the COINS Act both took.

Mechanism. BINSA would amend Title VIII of the Defense Production Act to classify pharmaceutical development, biologics manufacturing and clinical research capabilities as prohibited or notifiable technologies when transferred to covered foreign persons, and would expressly add the licensing of a prohibited technology from a covered foreign person to the definition of a covered transaction. Treasury would have to issue implementing rules within a year.

What changes. The direction of the licensing limb is the point. Reaching licensing from a covered foreign person captures in-licensing by a US company, which is the transaction that creates the royalty in the first place.

If enacted and implemented as drafted, the supply channel narrows at source: fewer new licences, therefore fewer new royalty obligations on US sales payable to Chinese counterparties, with the effect visible in origination pipelines around 2031 rather than 2027.

Existing streams are not directly affected. Amendments to existing licences might be, depending on the rulemaking, and that is worth checking in any purchase of a seasoned China-origin royalty where the underlying licence is likely to be amended during the buyer's hold.

Probability caveat. BIOSECURE took nearly two years of committee and floor consideration before enactment. BINSA has bipartisan sponsorship in both chambers and no comparable record. Treasury's rulemaking authority under the COINS Act makes the legislation less necessary rather than more, which cuts both ways on the likelihood of floor time.

Scenario three: BIOSECURE bites in 2028 with designated CDMOs in the supply chain

Trigger and dates. OMB must publish the initial list of biotechnology companies of concern by 18 December 2026, then has up to 180 days for implementing guidance, after which the Federal Acquisition Regulatory Council has a year to revise the FAR. Prohibitions take effect only after that, on a further short delay. The practical arrival is 2028.

What changes for a royalty. Nothing in the buyer's own position. Everything potentially in the payor's. Where the product is manufactured by a designated organisation and the payor's commercial model touches federal channels, the payor must re-source. Technology transfer for a biologic is a multi-year exercise involving comparability studies and regulatory variation, and the risk of supply interruption during it is real.

That risk lands in net sales, which is the royalty base. It is not a jurisdictional risk and no CFIUS analysis will surface it. It belongs in the underwriting model as a supply concentration question, asked of the payor rather than of the seller.

The carve-out that reads backwards. The five-year safe harbour for pre-existing contracts runs from the FAR revision and is not available for contracts with entities that were on the 1260H List as of 18 December 2025. Entities added in June 2026, including WuXi AppTec, fall inside the safe harbour. Entities listed at enactment do not. A payor whose CDMO was listed in June 2026 has materially more room than one whose CDMO was listed in 2024.

Scenario four: the designations do not hold

Trigger. The WuXi injunction of 7 August 2026 is preliminary and the merits are undecided. A final judgment for WuXi, or a similar challenge by another designated entity, would weaken the practical force of 1260H listing as a screening input.

What changes. The counterparty screen stops being binary. A royalty on a product manufactured by a designated organisation carries a supply risk that is now contingent on litigation rather than fixed, which is harder to model but smaller in expectation than a straight designation. It also means the BIOSECURE payor risk in scenario three may not materialise for the largest CDMO in the market.

The injunction does not reach the separate OMB designation route, so an entity can lose in one forum and be listed through the other. A screen should track both.

What the four have in common

None of them is decided by the jurisdictional analysis that occupies most of this piece, and none of them is triggered by anything a royalty buyer does. Three of the four operate on the counterparty or the payor. The fourth operates on the origination funnel with a lag long enough that it will be invisible in deal data until the streams it prevented were due to appear.

That argues for a specific reallocation of diligence effort. The jurisdictional memo is cheap and should be run at term sheet, but it is not where the exposure is. The exposure is in the payor's manufacturing base, in the counterparty's designation and litigation status, and in whether the transaction is a purchase from a covered foreign person or an extension of capital to one.

What it means

For a foreign buyer of US royalties. The jurisdictional position is defensible and rests on two textual requirements rather than on inference: a US business is an entity engaged in interstate commerce, and an investment is the acquisition of an equity interest. Neither is satisfied by a payment right.

Keep it that way. The features that would defeat the reading are all negotiated, and the two worth the most attention are the covenant package measured against 800.245 and the backup security interest measured against what enforcement would actually deliver.

For a buyer of China-origin streams. Two questions rather than one. Was the stream created by a licence for cash or a licence for equity? The first is outside both outbound perimeters and the second is not, and that single variable now carries two regulators. And who holds the entitlement at the moment of sale?

The seller's identity does more work than the asset's origin, and on existing paper the contracting licensor is frequently a PRC operating company even where the listed group is Cayman or Hong Kong incorporated. The companion note runs that test against the licensors that actually exist.

For a payor or a seller of its own royalty. The diligence question your buyers will start asking is about your contract manufacturer, not about your cap table. Concentration on a designated or designation-exposed organisation is now a valuation input, and the safe harbour asymmetry means the date of listing matters as much as the fact of it.

For an originator. The supply funnel is the exposure that compounds. Ninety-three cross-border licences in 2025 is the raw material for royalties monetisable from 2030, and every scenario that gates in-licensing thins that cohort with a lag long enough to be invisible while it happens. If the thesis depends on China-origin supply, the hedge is territorial and modality diversification started now rather than after a rule lands.

For anyone modelling the asset class. Announced value is upfront plus an unweighted milestone stack and excludes the royalty entirely, so it is not a measure of the asset being created. Deal count is. And the discount rate on China-linked paper should now carry an explicit transferability component, because the bid depth that supports it is exposed on both sides at once.

Where the question stands

The textual case is stronger than the absence of authority suggests. A US business is an entity engaged in interstate commerce, an investment is the acquisition of an equity interest, and a royalty is neither. Both mandatory filing paths turn on control or voting interest, and a royalty buyer holds neither. The seller in the China-origin case is described almost exactly by Example 2 to 800.252(b).

What is missing is confirmation that the Committee reads it the same way, and one adjacent case shows how the aggregation analysis behaves in practice. Mustang Bio was a $6 million equipment sale with no equity anywhere in it, and it took 277 days and a National Security Agreement to resolve.

But the jurisdictional question is not where this asset class is exposed, and treating it as the main event is the error worth avoiding. The base case sits outside, most transactions are the base case, and that has been true throughout.

The exposure is elsewhere and it is dated. On 18 December 2026 an OMB list appears. By 13 March 2027 Treasury either designates biotechnology as a covered outbound sector or does not, using an authority it already holds. Late in 2026 the FY 2027 NDAA either carries BINSA or does not.

Through 2027 and 2028 a FAR revision determines whether payors have to move manufacturing, and a district court determines whether the largest designated counterparty in the market stays designated.

None of those is decided by anything a royalty buyer does, and three of the four operate on the payor or the counterparty rather than on the transaction. The fourth operates on the origination funnel with a five to ten year lag, which means the cohort of streams it prevents will be missing from portfolios assembled in the early 2030s by people who never saw the rule that caused it.

Transactions being underwritten now on ten-year tails will spend most of their lives under rules that have not been written.

The practical response is to keep the structures plain, resolve the recharacterisation trade-off deliberately, decide now whether the China book is a purchase book or a financing book, and move the diligence effort from the buyer's own jurisdictional position to the payor's manufacturing base.

Reflects publicly available information as of 22 August 2026, derived from the Code of Federal Regulations, UK primary legislation, company filings and disclosures, press releases, regulatory documents and financial news reporting. Statements about the application of CFIUS jurisdiction to royalty structures are inferences from regulatory text and worked examples; no published decision addresses the acquisition of a pharmaceutical royalty by a foreign person, and structures identified as untested are marked as such. Deal-value series are drawn from commercial trackers using differing deal-scope methodologies and are not directly comparable; upfront-to-headline ratios are calculated from disclosed per-deal terms. Pending legislation is identified as pending. For informational purposes only; not investment, legal, or financial advice. The author is not a lawyer or financial adviser.