NIH MFTRP Certification: The Leniency Period Ends This Month. Here's What Every PI Needs in Their Next RPPR

The most consequential NIH compliance change of 2026 is one most principal investigators have not finished reading. On January 25, 2026, NIH began requiring every senior or key person on every Research Performance Progress Report — the RPPR that all multi-year NIH awards must submit annually — to provide a personal certification that they are not participating in a Malign Foreign Talent Recruitment Program. NIH issued the requirement with a four-month leniency window, allowing PIs and co-investigators to file a hand-signed certification statement in section G.1 of the RPPR while the SciENcv platform was being upgraded to handle the new Common Forms for Biographical Sketch and Current and Pending (Other) Support.

That leniency window closes this month.

After May 2026, the workaround that most research offices have been quietly relying on — the typed certification statement, the scanned PDF, the hand-signed letter pasted into G.1 — will no longer be accepted. From that point forward, every senior or key person on every NIH RPPR will need a SciENcv-generated Common Form that clears all validation warnings, including the MFTRP certification embedded inside it. RPPRs that include a key-person record without a clean SciENcv document will not be acceptable, and the progress report will not progress. For PIs whose Type 5 non-competing renewal hinges on a clean RPPR — which is most of them — the consequences are immediate.

What the Policy Actually Requires

The MFTRP certification requirement is grounded in NOT-OD-26-018, NIH's January 2026 implementation notice for the new federal-wide Common Forms. The certification language is fixed: "I [name] certify that, at the time of submission, I am not a party to a malign foreign talent recruitment program." That sentence must appear in the senior or key person's SciENcv-generated Current and Pending (Other) Support document, embedded as part of the structured certification block. The sentence is not optional, and the structured block is not editable. SciENcv either confirms that the user has affirmed it or it does not.

The MFTRP definition itself comes from the CHIPS and Science Act of 2022 and the implementing guidance from the National Science and Technology Council. The prohibited programs are those operated, sponsored, or substantially funded by a foreign country of concern — currently China, Russia, Iran, and North Korea — that require participation in activities including unauthorized transfer of intellectual property, recruitment under terms that conflict with U.S. federal funding, undisclosed compensation arrangements, or duplication of taxpayer-funded research at a foreign institution. The full list of disqualifying program features runs to roughly two pages. SciENcv asks the user to self-certify against that definition; the platform itself does not detect or screen for participation.

The structural shift PIs need to internalize is that NIH has moved from institution-level disclosure to person-level certification. Before NOT-OD-26-018, the institution affirmed that its grant filings were complete; the responsibility for ensuring no MFTRP participation flowed through the institution's research-security office. After the May 2026 leniency expiration, every individual on every key-personnel list signs a personal attestation, separately, on every RPPR. The institution still bears compliance liability — and now, every named scientist does too.

The SciENcv Gating Mechanism

The leniency window's importance is not legal. It is technical. NIH's SciENcv platform — operated through the National Library of Medicine — had to be reengineered between October 2025 and May 2026 to handle the federal-wide Common Forms, which replaced agency-specific Biographical Sketch and Current and Pending Support templates with versions shared across NIH, NSF, the Department of Energy, the Department of Defense, and other federal research funders. The MFTRP certification block is one part of that reengineering. The platform's validation rules, which check that every required field has been completed and every certification block has been affirmed, are the gate.

After May 2026, NIH will reject RPPRs in which any senior or key person's record contains an unresolved validation warning. The most common warning, in the first four months of the new system, has been incomplete affirmation of the MFTRP certification block. Validators flag the absence of an affirmed certification, and the RPPR cannot be submitted until the record clears.

The implementation timeline matters because the validation rules — and the warning categories that trigger them — have been changing month over month as NIH refines the platform. A SciENcv document generated in February 2026 may not clear validation in May 2026, even if the underlying scientist has not changed roles or institutions. Research offices are recommending that every named senior or key person regenerate their SciENcv document within four weeks of any RPPR submission, not rely on documents created earlier.

What Goes Wrong in Practice

Three failure modes have emerged across the first four months that PIs should plan around explicitly.

The most common is the lapsed co-investigator. A senior collaborator named on an R01 in 2022 may not have logged into SciENcv since. Their old Biographical Sketch is in the system, but the new Common Form is not. They are reachable, but their institutional ORCID linkage is stale or their eRA Commons profile no longer matches their NIH-recognized affiliation. Getting their MFTRP certification into the RPPR before the May expiration of the leniency period requires reaching them in time, walking them through SciENcv re-credentialing, and verifying that the resulting document validates cleanly. For PIs with five or more senior or key persons spread across institutions, this is a multi-week project.

The second is the foreign-affiliated postdoc or junior faculty member who is fully compliant but uncertain about the MFTRP language. Several of the prohibited program characteristics involve unclear application to standard academic collaborations — visiting-scholar arrangements, sabbatical-year hosting, modestly funded research-exchange programs that are not state-sponsored but exist in countries of concern. SciENcv asks the individual to self-certify against the definition; many individuals reach the certification block and freeze, uncertain whether a 2019 visiting position triggers the prohibition. Most research offices are advising those individuals to consult institutional research-security or counsel before affirming, and the consultation takes time.

The third is the senior PI who has not yet personally interacted with SciENcv. Department chairs, center directors, and other senior figures often have administrative staff who manage their grant materials. The new system requires the individual scientist's own credentials and personal affirmation. Some senior figures are encountering SciENcv for the first time in 2026 and are encountering the personal-certification block as a procedural surprise.

The Strategic Implication for PIs

The operational guidance from research offices is consistent. First, audit every NIH award with an RPPR due in the next ninety days and identify every senior or key person on each. Second, contact each of those individuals now — before the leniency period expires — and verify that their SciENcv document is current and validates cleanly. Third, build a calendar habit: re-verify SciENcv currency at the four-week mark before any RPPR, type 5 renewal, or Just-In-Time submission, not the four-day mark.

For multi-institutional projects, the calendar habit is non-optional. A clean RPPR depends on every named individual at every institution producing a clean SciENcv document. There is no graceful failure mode if one of them does not.

The broader policy direction is consistent with where federal research security has been heading since the CHIPS Act passed. NIH's MFTRP certification is the most operationally consequential implementation of person-level research-security certification to date, but it is not the last. NSF, DOE, and DOD are each implementing parallel Common-Form-based certifications on similar timelines, and the same SciENcv document carries those certifications too. Research integrity offices that build their workflows around the NIH May 2026 deadline will be substantially prepared for the NSF and DOE equivalents that follow.

For the technical and policy context behind the broader research-security regime, see Granted's coverage of the NIH AI grant policy and the federal research environment in 2026. The MFTRP certification is one of several disclosure regimes that have moved, in the last twelve months, from the institutional plane to the personal plane. The pattern is clear and the trend is durable: federal research integrity in 2026 is something every scientist signs, not just every grants office.

The Practical Calendar

If your lab has an NIH RPPR due between June 2026 and September 2026, the work to do now is straightforward and not optional. Pull the current key-personnel roster for every award. Email every named individual at least four weeks before the RPPR is due, including a one-paragraph explanation of the SciENcv MFTRP certification and a direct link to the platform. Ask them to regenerate and validate their Common Form, and to forward the validated PDF to the grants administrator. Track returns the way you would track a multi-PI subcontract executed under deadline.

The leniency period is ending because the platform now works. After it ends, the platform — not the institution — is the gatekeeper. Treat it accordingly.