Who Is on the Other Side of the Transaction?
For the DOJ Data Security Program, identifying the recipient is not a final administrative check after the data has been classified. It is one of the facts that determines whether the data-access arrangement is covered at all. This chapter focuses on the difference between a country of concern and a covered person, and on the ownership, residence, employment, control, and designation facts that can change the result. The practical goal is a counterparty record that is more reliable than a nationality field or a search of one public list.
A country of concern is not the same thing as a covered person
The regulation names six countries of concern: China, including Hong Kong and Macau, Cuba, Iran, North Korea, Russia, and Venezuela. In the DSP’s structure, a country of concern is a government-level designation. It is one possible source of the risk the program addresses, and a transaction can involve a country of concern directly.
A covered person is a person or entity that falls within one of the regulatory classes or has been designated by the Attorney General. “Person” here includes an individual and an entity. The category is designed to follow relationships of jurisdiction, ownership, residence, employment, and control, not merely the name of a state. A company incorporated in a neutral country can still be a covered person if the ownership facts place it within the rule. An individual’s status can depend on where they primarily reside or whom they work for. A designated person can remain covered wherever they are located.
The distinction matters because the DSP regulates access by either kind of counterparty. Treating the six-country list as the entire screening task creates a false negative: it may miss an intermediary, subsidiary, employee, contractor, or designated person. Treating every national of one of those countries as a covered person creates a false positive: the rule’s examples preserve distinctions based on U.S.-person status, residence, employment, and designation.
The first automatic pathway concerns foreign entities. An entity can be covered because it is organized or chartered under the laws of, headquartered in, or principally based in a country of concern. It can also be covered because it is 50% or more owned, directly or indirectly, individually or in the aggregate, by a country of concern or by persons already within the covered-person framework. The second ownership pathway captures a foreign entity that is 50% or more owned by another covered person, including a person who became covered through one of the other regulatory classes.
The ownership test is therefore not limited to the company that signs the contract. Imagine a foreign vendor with a familiar brand and an office in Europe. If a country of concern or covered person owns at least half of the vendor, directly or through an ownership chain, the vendor’s neutral office does not settle the question. The relevant review must follow the chain far enough to identify the ownership that the regulation treats as significant.
Indirect ownership can also be aggregated across entities. The eCFR gives an example in which one company is owned by a person in China, two subsidiaries each own part of a fourth company, and the subsidiaries’ shares together reach 50% of that fourth company. The fourth company is covered both because the ownership is indirectly attributable through the chain and because the two covered subsidiaries own at least half in the aggregate. This is why a single legal-entity profile or a simple “parent company” field may be inadequate.
The remaining automatic pathways focus on foreign individuals. A foreign individual is a covered person when they are an employee or contractor of a country of concern or of a covered entity. A foreign individual is also a covered person when they are primarily resident in a country of concern. These are not interchangeable tests. The relevant facts may include the person’s actual primary residence, the identity of the employer or contracting entity, and whether that employer is itself covered.
The fifth pathway is designation. The Attorney General may designate a person, wherever located, when the regulatory criteria are met—for example, because the person is or is likely to become owned or controlled by, subject to the jurisdiction or direction of, or acting for or on behalf of a country of concern or covered person, or because the person has knowingly caused or directed a violation. Designation is not the only way to become covered. The first four classes can apply without an individual public designation, which means the absence of a name from a published list is not proof that the counterparty is outside the rule.
Why nationality and public lists are incomplete shortcuts
The regulation’s examples show how status depends on the relationship between person and place. A Chinese or Russian citizen located in the United States is treated as a U.S. person under the rule and is not a covered person unless individually designated. That person remains subject to the same prohibitions and restrictions as other U.S. persons when engaging in covered data transactions with countries of concern or covered persons. The result avoids a simple nationality rule: the person’s status for this analysis is not determined by citizenship alone.
The reverse example is equally important. A citizen of a country of concern who is primarily resident in a third country that is not a country of concern would not be a covered person merely because of citizenship, unless the person is individually designated or is an employee or contractor of a country-of-concern government or covered entity. Residence can therefore matter independently of nationality.
Employment can add another layer. A foreign person who lives outside the United States and works for a company headquartered in China can be covered because the company is a covered entity and the person is its employee. The person need not appear as a separately designated name for the employment relationship to matter. An organization that screens only its contracting company but never asks which foreign personnel will receive access may miss this pathway.
Designation can override location in a different way. A designated covered person retains that status even when located in the United States. This does not mean that every foreign worker who travels to the United States becomes covered. It means that a designation is a distinct legal fact whose effect is not erased simply by moving the person across a border.
These distinctions are not technicalities detached from the data. They change the counterparty element of the coverage test. The same vendor, cloud platform, research arrangement, or employment role can produce different consequences depending on ownership, primary residence, employer, or designation. Conversely, a business should not infer that a person is covered from a broad identity label when the regulation requires more specific facts.
A public Covered Persons List is useful but has a limited function. The Department may publish designated covered persons there, and the Compliance Guide recommends that organizations screen against updates. But the guide also explains that people covered under the first four categories do not require identification or designation by the National Security Division and may not appear on the list. The list can improve compliance; it cannot replace analysis of the regulatory criteria.
That creates a time dimension. A counterparty’s status can change when ownership changes, a subsidiary is acquired, a person moves their primary residence, an employee changes employers, or the Department adds a designation. A screen performed once at onboarding may not remain accurate for a transaction that occurs months or years later. The required frequency of screening should reflect the organization’s risk profile, but the underlying principle is stable: status is a fact tied to a transaction and a point in time.
Consider a company that has used the same overseas vendor for several years. It may know the vendor’s trade name, invoice address, and service description. It may not know that a new parent acquired 51% of the vendor, that the vendor’s administrators changed, or that a relevant individual now works for a covered entity. These facts do not automatically prove that a violation occurred. They do show why the DSP’s risk-based approach calls for current ownership and identity information rather than permanent trust based on historical procurement approval.
The analysis should also distinguish an entity’s own status from the status of people who interact with it. A foreign company that is not a covered person is not transformed into a covered entity merely because one of its employees has a nationality associated with a country of concern. The rule’s examples make the relationship-specific point: an employee’s status can arise from being a foreign employee of a covered entity or from primary residence in a country of concern, while other facts can leave the employee outside the category. The question is who is receiving access and through which legally relevant relationship.
Build a counterparty record that can survive the next question
A risk-based counterparty review should preserve the facts that support its conclusion. For a foreign entity, that generally means recording where it is organized, headquartered, and principally based; its direct and indirect ownership; the identity and status of relevant parents, subsidiaries, and owners; and whether the Department has designated it. For a foreign individual, the relevant record may include citizenship, primary residence, employer or contracting entity, role, and any designation or control relationship that affects the analysis. The regulation requires specific information for restricted-transaction diligence, and the same factual discipline is useful before deciding whether a transaction is covered.
The record should be tied to the proposed access, not treated as a detached vendor profile. If a company will use a cloud service, identify the entity contracting with the U.S. person and the entities or people who can administer, support, or otherwise access the environment. If the arrangement involves employment, identify the person’s actual role and access capability, not only their job title. If it involves investment, review the ownership and control relationships relevant to the investment agreement. If a counterparty uses an intermediary, the intermediary should be analyzed as part of the actual path rather than assumed to insulate the transaction.
A useful review asks at least five questions:
- Is the counterparty itself a country of concern, or is it a foreign person that may meet a covered-person class?
- Where is the entity organized, headquartered, or principally based, and where does it conduct the relevant activity?
- Who owns it directly or indirectly, and do the ownership interests reach the 50% threshold individually or in the aggregate?
- Which individuals will have access, where do they primarily reside, and who employs or contracts with them?
- Has the Attorney General designated any relevant person, and when was the information last checked against current official materials?
The final question should not be reduced to “Was there a list hit?” A negative list result may be useful evidence, but it cannot answer an unlisted ownership or residence question. Nor can a positive list result, by itself, describe the full access path or the applicable transaction category. Counterparty status is one component of the decision, and the record should keep it attached to the specific data and access being considered.
The diagram is not a substitute for a legal conclusion. It shows why the review branches: entities and individuals generate different evidence, and a public-list search is only one possible input. The “not established” outcome does not mean the transaction is safe; it means the counterparty element has not yet been resolved. The company still has to determine what data can be accessed, through what transaction, and whether other facts or authorizations change the result.
This is also why counterparty diligence should be revisited when the business changes. A merger can alter indirect ownership. A new service model can expand access from a small support team to a global administrator group. A new investment can create control or direction. A person’s residence or employment can change. A screening process that records only a name and a date may be unable to explain which facts were actually considered.
The DSP’s covered-person concept is therefore neither a simple country blacklist nor an invitation to speculate from nationality. It is a structured attempt to follow the relationships through which access can reach a country of concern or a covered person. Once the data-side inventory and the counterparty record are placed together, the next question is whether they are connected by one of the qualifying transaction forms—data brokerage, a vendor agreement, an employment agreement, or an investment agreement. That combination is what turns separate facts into a covered data transaction.