Tracing Foreign Ownership in FOCI Risk Assessments

A FOCI (Foreign Ownership, Control, or Influence) assessment is a formal process to determine whether a vendor is owned or controlled by foreign interests that could create national security or data sovereignty risks. The Australian Department of Home Affairs has made these assessments a mandatory part of technology procurement, with official guidance requiring agencies to trace the ultimate beneficial ownership of technology vendors before engaging them.

Corporate ownership structures can span multiple jurisdictions, each with different registry access rules, disclosure thresholds, and language requirements. Nominee directors, intermediate holding companies, and trust structures are commonly used — sometimes deliberately — to create distance between an entity and its ultimate owner. Records in key jurisdictions such as China, Russia, and the Middle East are often held in local languages and accessible only through local registries, placing them beyond the reach of standard English-language research tools.

The registered owner of a company is the entity formally listed as owning shares in a corporate registry — this is often an intermediate holding company, not a natural person or ultimate controlling entity. The ultimate beneficial owner (UBO) is the individual or entity that ultimately owns or controls the company, often through a chain of intermediary entities. FOCI assessments require identifying the UBO, not just the registered owner — which is why single-tier registry searches are insufficient.

Sayari Graph aggregates corporate registry data from 250+ jurisdictions — including foreign-language registries in China, Russia, and the Middle East — and connects it into a unified ownership graph. This allows analysts to trace ownership chains across multiple tiers and jurisdictions in a single workflow, surfacing relationships that are invisible to manual research. Sayari also integrates sanctions lists, enforcement data, and trade records, giving analysts a comprehensive picture of a vendor’s risk profile.

Solvyr is a sovereign Australian cyber security and risk advisory firm specialising in complex beneficial ownership assessments for government and enterprise clients. In this session, Bianca Puglisi from Solvyr shares hands-on experience from FOCI assessments conducted in the Australian context — including the ownership structures most commonly encountered, the points where assessments typically break down, and what a genuinely defensible assessment looks like in practice.

Yes. While the session is anchored in the Australian FOCI context, the underlying challenge — tracing beneficial ownership across complex multi-jurisdictional corporate structures — is universal. The techniques, tools, and failure modes discussed are directly applicable to FOCI assessments in the US, UK, Canada, and Five Eyes partners, as well as to KYC, sanctions compliance, and supply chain due diligence programs globally.

Yes. The full recording is available on-demand at no cost. Watch the replay above to get the complete session — including Bianca’s walk-through of real FOCI assessment patterns and David’s live demonstration of Sayari Graph.