Section 117 Is Becoming a Data-Governance Problem, Not Just a Reporting Problem

At many institutions, the honest answer depends on which office you ask. That is the problem this article is about.

Section 117 (20 U.S.C. § 1011f) requires institutions that receive federal financial assistance to disclose foreign gifts and contracts worth $250,000 or more from a single foreign source in a calendar year, counted alone or in combination. Reports are filed on January 31 or July 31, and the statute makes all disclosure reports public records.

The statute itself asks for amounts and the country a gift is attributable to, with more detail for restricted or conditional gifts. The Department’s reporting instructions go further and ask institutions for the name and address of each foreign source. According to AAU, the Department assured institutions and donors in writing for years that this identifying information would remain confidential and be used to verify compliance.

That posture changed in 2026. In April, the Department proposed a revised information collection, and higher-education associations objected in June that it would allow donor names to be made public. In July, the Department announced it would publish “the names of all foreign sources from prior reporting cycles.” The date moved several times. On July 15 it published a narrower list of 92 foreign entities that also appear on U.S. government lists, and it later set October 2 for the broader release.

AAU filed suit on October 1 against the Departments of Education and State and their secretaries. The State Department has supported Section 117 administration under an interagency agreement signed in February 2026. AAU argues that the statute does not call for publishing private donors’ personal information, that the Constitution protects donors from compelled public exposure of their charitable associations, and that the reversal came without notice to affected donors and without the rulemaking the law requires. The Department has described publication as consistent with Section 117’s transparency requirements.

In granting the order, the court found AAU likely to succeed on its claim that publishing after six years of written assurances to the contrary was arbitrary and capricious, and found that publication could cause irreparable harm. The practical logic is plain: once a name is published, it cannot be unpublished. That is why the order preserves the status quo while the court considers a preliminary injunction.

Most foreign-source problems start when these five activities are treated as one.

Collection is the moment information enters the institution: a gift agreement in advancement, a wire in finance, a sponsored-research contract, a faculty appointment, a department’s agreement with a foreign university. Collection has its own questions: what was captured, from whom, for what purpose, and who can see it.

Screening checks parties against relevant authoritative sources, such as the OFAC Specially Designated Nationals List or the BIS Entity List, when the relationship calls for it. A screen produces a result, not a conclusion. A potential match is a reason to look closer.

Institutional review is where people with authority decide what a relationship means: whether a counterparty is governmental, whether conditions attach, whether research-security or export-control review is needed, and whether to escalate. It is a human determination, and it should leave a record.

Federal reporting is providing what Section 117 and the Department’s current instructions require, on the statutory schedule. It rests on a specific legal authority, and that authority defines its scope.

Publication is making information public. It is a different act, governed by a different authority, and as of this writing the subject of active litigation. Information reported to the government is not, by that fact alone, information the public receives.

A compliance system has to keep these as separate states of the same record. When a screening hit, a reviewer’s note, a reported field, and a published field collapse into one spreadsheet column, the institution can no longer show what was decided, what was submitted, or what was ever meant to be public.

Section 117 used to look like a finance exercise: total the foreign gifts and contracts twice a year and file. The information now in play is more sensitive and more structured than that:

• Donor identities, including donors who asked the institution for anonymity
• Source classifications: individual, company, university, government entity, state-owned organization, or an intermediary acting for someone else
• Country attribution, which can turn on citizenship, residence, or place of incorporation
• Agreements, payments, and the conditions attached to them
• Access: who inside the institution can see identifying information, and why
• Provenance: where each fact came from, and whether it was later corrected
• Version history: which Department instructions applied when a field was completed
• What was submitted to the Department and, separately, what was made public

None of that is generic cybersecurity. It is record governance. Federal handling of Section 117 has shifted repeatedly in 2026: a new reporting portal in January, a proposed information collection in April, a process for amending historical submissions in June, and a run of announced publication dates from July to October. A reviewer who classified a counterparty in 2023 applied 2023 instructions. If the institution cannot show which rule applied at the time, it will struggle to defend the determination later.

If the answers live in five systems and three inboxes, the institution has a reporting process. It does not yet have a governed record.

Section 117 increasingly sits beside research security in daily practice. In July 2026, the Department published a list of foreign entities from Section 117 data that also appear on U.S. government lists, and the State Department wrote to the governing boards of R1 universities about reported funding from counterparties on cautionary and restricted U.S. government lists. Recent federal foreign-funding investigations have requested records well beyond gift ledgers, including faculty agreements, research collaborations, and participation in foreign talent programs. We walked through one such records request in an earlier analysis.

The same foreign organization may appear in a donation record, a sponsored-research agreement, a faculty affiliation, an export-control review, and a restricted-party screening result. Those records should not live as five unrelated facts.

When they do, the institution answers the same question five times, sometimes in five different ways. Advancement may record a counterparty as a private foundation while research administration treats the same organization as state-affiliated. Neither office is necessarily wrong; each may be applying a different rule for a different purpose. The governance failure is that no one can see both answers side by side, or explain the difference when asked.

Connecting the records does not mean merging the legal questions. They stay distinct:

None of this requires waiting for the court. These ten capabilities hold up under any outcome:

The pattern across all ten is the same: keep the fact, the decision, and the disclosure as separate things, each with an owner and an audit trail.

SecurePoint Education is built on a simple premise: compliance decisions should not disappear into spreadsheets, email threads, and one-time searches.

Its existing workflow foundation is designed around people, organizations, screening evidence, human review, monitoring, and retained records. That is the screening and review layer described above, and for each party screened, it preserves what a reviewer decided, when, and why.

It is not a Section 117 reporting system. Decisions about what is reportable, and what may be disclosed, belong to the institution and its counsel. SecurePoint’s job is to preserve the screening and review evidence those decisions rest on.

The court will decide whether the Department can publish these names, and on what terms. Whatever it decides, the long-term compliance challenge is not simply whether a university can file a report. It is whether the institution can reconstruct the reasoning behind that report months or years later, for a regulator, a court, a board, or a donor who asks what happened to their information.