The Pentagon’s 1260H List Is Now a Contract Ban. Is It in Your Screening Stack?

If a DoD solicitation asked you this summer to represent that you are not a “Chinese military company,” or a prime sent you a flowdown that uses the phrase, the source is Section 805 of the FY2024 National Defense Authorization Act. It took effect on June 30, 2026.

The list behind it is not a sanctions list. The Department of Defense compiles it under section 1260H of the FY2021 NDAA, and since September 2025 the department has also used the name Department of War, so expect both names on the same paperwork. A 1260H listing does not, by itself, block anyone’s property or create an export license requirement. What it does now is shut companies out of Defense contracts: the listed company, any company it controls, and, through the contract clause, the subcontracts beneath a prime.

What took effect on June 30

Section 805(a)(1)(A) bars the Secretary of Defense from entering into, renewing or extending a contract for goods, services or technology with two kinds of entity: a company on the annual 1260H list, and “any entity subject to the control of” one. Congress wrote the June 30, 2026 start date into the statute itself.

DoD carried the ban into solicitations and contracts through Class Deviation 2026-O0025, the instrument that rewrote DFARS Part 240 under the FAR overhaul. Its current text is Revision 3, dated September 3, 2026, which also moved the CMMC pause into the contract file (we covered that part in The Pause Is Now in the Contract File). There is no final DFARS rule. The deviation stays in effect until it is rescinded or folded into the regulations. Three pieces of its text are what a supplier will see:

The clause also carries an older rule that matters to ITAR shops: no items on the U.S. Munitions List may be acquired, at any subcontract tier, from a listed company or from several other categories of Chinese entity, including companies on Treasury’s NS-CMIC list and Chinese companies on the Entity List.

Four things sit outside the June 30 ban. Contracts awarded before June 30, 2026 are exempt, “including when such contracts are modified, extended, or renewed.” Components are excluded. Services that connect to a third party’s facilities, such as backhaul, roaming and interconnection, are excluded. So are authorized intelligence activities. Beyond those, relief takes a waiver, which the Secretary can grant to a company that shows a compelling need for more time and a plan to phase the listed company out.

What changes on June 30, 2027

Section 805(a)(1)(B) extends the ban to contracts for goods or services that “include goods or services produced or developed by” a listed company or one it controls. The FY2026 NDAA added a third prohibition on the same date in section 845: no DoD grants, loans or loan guarantees to those companies.

This is the phase people call the Tier 2 and Tier 3 problem, and the label is only half right, because the component exclusion applies here too. 41 U.S.C. 105 defines a component as “an item supplied to the Federal Government as part of an end item or of another component.” On a plain reading, a part inside the item you deliver is a component. A listed company’s drone resold as the end item is not, and neither is a service that runs on a listed company’s cloud. DoD has not issued DFARS text for this phase, so the exact line is still open.

Two things are already settled. The clause reaches commercial products and services, and the FY2026 NDAA wrote that into the commercial-item statute at 10 U.S.C. 3452. And other rules still reach parts: section 889 of the FY2019 NDAA, for one, bars covered telecommunications equipment from Huawei, ZTE, Hytera, Hikvision and Dahua when it is a substantial or essential component of a system.

The June 2026 list, sorted by what a shop buys

DoD released the update on June 8 and published it in the Federal Register on June 10, 2026 (91 FR 35189). Counting each named subsidiary separately, it names 188 entities. It also removed 10, among them CNOOC China Limited and COSCO SHIPPING Finance. Removals matter as much as additions: a stale copy misses the new names and keeps flagging the old ones (more on that in When Sanctions Lists Shrink).

Much of the list is state-owned defense, aerospace, shipbuilding and telecom groups that a small supplier never buys from directly. These are the names that turn up in ordinary purchasing:

Alibaba, Baidu, BYD, Unitree, and the solar makers Trina Solar and JA Solar were among the June additions. Read the legal names, not just the brands: Unitree is listed as Hangzhou Yushu Technology, and Innolight as Zhongji Innolight. A distributor’s invoice may show neither, which is why matching on short names, former names and subsidiaries matters.

“Control” is not a percentage

Section 805 does not stop at the names on the list. It reaches any entity “subject to the control of” a listed company, and it borrows its definition of control from the CFIUS regulations at 31 CFR 800.208. That test is about power: “the power, direct or indirect, whether or not exercised,” to determine, direct or decide important matters affecting an entity. Majority ownership is one route to it. So are a dominant minority stake, board representation, proxy voting, a special share, contractual arrangements, and formal or informal arrangements to act in concert.

The regulation names the decisions that count, among them selling principal assets, mergers, closing or moving facilities, budgets and major investments, significant contracts, and hiring or firing senior managers. It also lists minority-shareholder protections that do not create control on their own, such as the power to block a sale of substantially all of the company’s assets. A 20 percent shareholder with two board seats and a veto over the annual budget can have control under this test. A name match cannot tell you that. It takes ownership and governance facts, and in a close case, counsel.

That makes four different ways a company can be covered without being named, and they do not line up:

The NS-CMIC list is part of the Consolidated Screening List. The 1260H list is not, and the two overlap only in part, so a clean NS-CMIC result tells you nothing about Section 805.

Is the 1260H list in your screening?

The official list is the Federal Register notice: 91 FR 35189, FR Doc. 2026-11571. DoD also posts it with its publications, and the Chinese-language version is in docket DOD-2026-OS-1288 on regulations.gov.

It is not on the Consolidated Screening List. The CSL that the International Trade Administration publishes combines restricted-party lists from the Departments of Commerce, State and the Treasury, and no Defense list is among them. A screening tool that runs only on the CSL cannot return a 1260H match. We made the broader case in The Consolidated Screening List Is No Longer Enough. Three questions for whoever runs your screening:

• Do you load the 1260H list itself, and from which Federal Register notice?
• Did the June 2026 update land, including the 10 removals?
• Do you match legal names, short names, former names and named subsidiaries? Most entries carry a short name, and several carry a former one.

A 10-step checklist for suppliers

What to keep in the file

When a contracting officer, a prime’s compliance team or an auditor asks how you know a supplier is not covered, the answer has to be a record you can hand over. For each supplier, keep:

Where SecurePoint fits: its screening includes the Section 1260H list, loaded from the June 2026 notice, alongside OFAC, BIS and other government lists. A 1260H match holds the screening for a person to review and never blocks on its own. Screenings are recorded with their date and result, and reviewer decisions with who decided and when. The audit log is append-only and hash-chained, so application users cannot edit or delete it, and evidence packs are built from those records. SecurePoint does not decide control under 31 CFR 800.208, and it cannot make a representation true. Those calls stay with your team and your counsel.

Frequently asked questions