NSF's Restricted-Entity Collaboration Ban Is Coming With the New Grant Rulebook. Audit Your Co-Authors Before You Have to Certify

The most consequential change to NSF research security in years has no rule number, no comment docket and no fixed effective date. It is a Dear Colleague Letter, NSF 26-022, published July 8, 2026 and marked "last updated October 27, 2026." It says NSF "plans to implement a new research security policy prohibiting collaboration on NSF-funded projects with these restricted entities," meaning organizations on a long list of U.S. government restricted-party lists.

The timing is no longer abstract. NSF says it "intends to implement this prohibition in Fiscal Year 2027 along with the effective date of the Draft Guidance on Financial Assistance" (or, for contracts, the effective date of its acquisition policy). FY2027 began October 1. On October 28, NSF sent its revised Guidance on Financial Assistance to OMB, and its earlier materials target issuance in early to mid FY2027, roughly January through April 2027. The collaboration ban is tied to that timeline.

When the ban takes effect, every NSF proposal will require a certification. Institutions that have not mapped their collaborations by then will be certifying without knowing whether the statement is true.

What the Letter Requires

NSF 26-022 contains three requirements:

1. No NSF funds for collaborative research with restricted entities. NSF funds may not support grants, contracts or other assistance for research conducted in collaboration with a listed entity. The bar "extends to the employees of such restricted entities," so working with an individual researcher from a listed institution counts even if no institutional agreement exists.
2. Personal restrictions on senior/key personnel. For the duration of the award, senior/key personnel may not hold an appointment or position with, receive research support from, or collaborate with a restricted entity.
3. Certification at submission. Once the policy takes effect, the authorized organizational representative (AOR) and senior/key personnel "will be required to certify to this effect at the time of proposal submission."

NSF also rejects the approach many universities have used since 2021. The letter states that "research security risk mitigation for NSF-funded projects involving these restricted entities is not sufficient." Technology control plans, data segregation and enhanced disclosure will not make a listed-entity collaboration permissible.

Which Lists Count

Appendix A of the letter lists the source lists. Outside summaries describe them as about a dozen, up from the four NSF has relied on, and closely aligned with the Department of War's research security framework. The lists include:

The Hogan Lovells analysis notes the letter borrows from the DoW Research Security Decision Matrix, which expanded DoW's restricted lists from four to 13. According to reporting citing Science, the combined lists include hundreds of Chinese universities, laboratories and institutes. Not every major Chinese university is on them. Tsinghua University, for example, was not among the covered entities when the letter was published.

These lists change. BIS adds Entity List designations several times a year, and the §1260H list is updated annually. An entity that is clean when you submit can be listed during the award. The letter does not say whether the restriction applies when a collaborator is designated mid-award or how long an institution has to unwind the relationship.

What Is Still Undefined

The biggest problem is a missing definition. The letter refers to "research in collaboration with restricted entities" and "collaborating with these restricted entities on NSF-funded projects" but never defines collaboration. Law firms and research offices have identified questions that must be answered before anyone can confidently sign the certification:

• Co-authorship. Does a joint paper with a researcher at a listed institution, on work partly supported by NSF, count?
• Visiting scholars. Is hosting a student or postdoc whose home institution is listed a collaboration, a position, or neither?
• Data sharing. Does contributing to or drawing from a shared dataset with listed-entity participants count?
• Large consortia. In multi-institution projects, such as physics collaborations or genomics consortia with hundreds of members, is one listed participant enough to taint every NSF-funded member?
• Conferences. Does presenting NSF-funded work at a meeting co-organized by a listed entity count?

The Educationist report says NSF invited comments from the research community before formally incorporating the policy. The DCL page does not list a comment deadline or docket, so send questions to researchsecurity@nsf.gov, the contact the letter gives. The October 27 update to the page does not say what changed. Compare it against your saved July version.

Why the Certification Matters Most

A certification that turns out to be false raises a legal issue, not only a compliance one. Commentators including Hogan Lovells point out that false certifications on federal awards can create False Claims Act exposure, which includes treble damages and whistleblower suits. That risk is greatest when the underlying term is vague: an institution that relies on a narrow reading of "collaboration" is betting that the government, or a relator, will read it the same way.

Because the certification is personal for senior/key personnel, it also falls on individual PIs, not only the sponsored programs office. A faculty member who signs without checking their co-author network, visiting scholars and external appointments is personally exposed.

Where This Fits in the Research Security Trend

The Quincy Institute describes the change in its title: From Disclosure to Prohibition. The period from 2019 to 2022 mostly built disclosure requirements, including FY2019 NDAA §1286, Presidential Proclamation 10043, NSPM-33 in January 2021 and the CHIPS and Science Act's ban on malign foreign talent recruitment programs. Researchers had to report foreign ties, and agencies decided whether the risk was acceptable.

2026 moved from disclosure to prohibition:

• NSF 26-022 bars listed-entity collaborations and rules out mitigation.
• OMB's proposed Uniform Grants Regulation would bar federal funding for collaborations with entities "owned or controlled by" the Chinese government or "affiliated with" its military. Quincy argues this would cover "effectively all leading Chinese research universities." That rule is currently frozen until December 11 by the continuing resolution.
• In August, the Department of War directed 30 U.S. universities to review their collaborations with "foreign entities of concern."
• Rep. John Moolenaar, chair of the House Select Committee on China, called NSF's move "commendable and commonsense" and urged NIH and DOE to adopt similar policies.

The likely result is that NSF's list-based approach becomes the minimum across agencies, and OMB's broader "owned or controlled" test may come later. Institutions should build one screening process that can handle both.

A 60-Day Plan

The GFA could be finalized as early as January. Here is what to do before then.

Research offices

1. Build the screening list. Combine the Appendix A lists into one searchable list and set up automatic refreshes. Most institutions already screen against BIS and OFAC lists for export control. Adding §1260H, §1286, the UFLPA list and the FCC list is incremental work.
2. Screen current NSF awards. Run senior/key personnel's current-and-pending and biosketch disclosures, plus the last three years of co-authors, against the combined list. This tells you how large the problem is before the certification exists.
3. Draft an internal definition of "collaboration." Until NSF defines it, document a reasonable, conservative interpretation, approved by counsel, and apply it consistently. A documented good-faith reading is a much stronger defense than none.
4. Plan the certification workflow. Decide who checks what before the AOR signs, and how PIs will attest. Do not rely on a checkbox in Research.gov as your only control.
5. Ask NSF your questions in writing at researchsecurity@nsf.gov and keep the responses.

PIs

1. Check your network. Review co-authors, visiting scholars, students' home institutions, adjunct or honorary appointments, and any research support from abroad. Check every external affiliation against the lists, not only your Chinese collaborators.
2. Plan new collaborations around the lists. For proposals going in after mid-2027, assume the ban applies. Structure international work so that any listed-entity involvement is funded separately from NSF and kept clearly separate.
3. Consider projects that span the effective date. The letter suggests the ban applies through certification at proposal submission. Continuing awards may face it when new funding increments are issued, consistent with the GFA applying to "new awards or new funding for existing awards." Do not assume an existing award is exempt.
4. Keep records. If you end a collaboration to comply, note the date and your reasons.

The Bottom Line

NSF has given the research community an unusual amount of advance notice: a published list of lists, an implementation window tied to a known rulemaking, and a stated certification requirement. What it has not provided is the definition that determines whether a given co-authorship, dataset or visiting scholar is prohibited. Institutions that use the next two months to map their exposure and document their interpretation will be able to certify accurately when the GFA takes effect. Institutions that wait for NSF to define "collaboration" may find the certification is due before the definition is.

Granted tracks NSF solicitations, policy changes and compliance deadlines. Search NSF funding opportunities or use Granted AI to draft compliant proposal sections.