NSF’s Important Notice No. 149 rewrites what a proposal has to certify before it ever reaches a program officer. Published 30 June 2025 and updated through November 2025, the notice folds several CHIPS and Science Act research-security provisions into binding certification requirements, most of them effective 2 December 2025. For sponsored-programs offices, this is less a policy update to read and more a set of new pre-submission gates to build into routing: a training-completion window to track for every senior/key person, an annual attestation to calendar, and an institutional disclosure to keep current before an Authorized Organizational Representative (AOR) can sign the Cover Sheet.
This piece walks through what actually changed, what was already in effect and is now just more formally certified, and a related but legally separate NSF restriction — on drone procurement — that is easy to conflate with Notice 149 but comes from a different notice entirely.
Research-security training: a 12-month certification window
Effective 2 December 2025, each identified senior/key person on an NSF proposal must have completed research-security training within the 12 months prior to submission, and the AOR must certify that completion on the institution’s behalf. NSF ties the requirement to Section 10634 of the CHIPS and Science Act of 2022 (42 U.S.C. § 19234). The notice specifies the training must cover cybersecurity, international collaboration, foreign interference, and the rules governing proper use of funds, disclosure, conflict of commitment, and conflict of interest.
A separate, adjacent certification — Responsible and Ethical Conduct of Research (RECR) — applies to institutions of higher education specifically: the AOR must certify the institution has a plan providing training and oversight in responsible and ethical conduct, including mentor training and research-security threat awareness.
Operationally, this means a training-completion date is now a proposal-blocking data point, not a background HR record. An office that can’t produce, at submission time, a per-person completion date within the trailing 12 months has a proposal it cannot certify.
Malign Foreign Talent Recruitment Program: certification made explicit
The underlying prohibition is not new — participation in a Malign Foreign Talent Recruitment Program (MFTRP) by NSF-funded senior/key personnel has been barred since 20 May 2024, under Section 10632 of the CHIPS and Science Act (42 U.S.C. § 19232). What Notice No. 149 changes is the certification mechanics around it: the AOR must certify pre-award that all senior/key personnel comply, each senior/key person must individually certify non-participation, and — for awards issued on or after 20 May 2024 — PIs and co-PIs on active awards must certify annually via Research.gov to their participation or non-participation. NSF states it intends to extend that annual post-award certification to all senior/key personnel, not just PIs and co-PIs, at a future date, so this is worth tracking as a compliance requirement that will widen rather than staying fixed at its current scope.
Confucius Institute contracts: a funding bar, waivable
Effective 2 December 2025, no NSF funds may be awarded to an institution of higher education that maintains a contract or agreement with a Confucius Institute, under Section 10339A of the CHIPS and Science Act (42 U.S.C. § 19039). The AOR must certify that, absent a Director’s waiver, the institution maintains no such contract.
The prohibition is not absolute: NSF’s Director may grant a waiver where the underlying contract protects academic freedom, bars application of foreign law on campus, gives the institution full managerial authority over the program’s operations, curriculum, research, and personnel, and prohibits co-location with Chinese-government-linked language, history, or cultural programs. Waiver requests go to [email protected]; NSF’s notice points institutions to the National Academies’ published assessments of Confucius Institutes at U.S. institutions as background reading before requesting one. For any institution with a legacy Confucius Institute arrangement, resolving this — terminate, renegotiate to waiver-eligible terms, or request the waiver — is now a precondition for any NSF award, not a reputational or academic-freedom debate happening on a separate track from grants administration.
Foreign Financial Disclosure Reporting: the annual cycle
Foreign Financial Disclosure Reporting (FFDR) — required under Section 10339B of the CHIPS and Science Act (42 U.S.C. § 19040) — obliges institutions to report current financial support of $50,000 or more, received directly or indirectly by the institution, its foundations, or related entities, from a “country of concern.” NSF defines that term as the People’s Republic of China, the Democratic People’s Republic of Korea, the Russian Federation, the Islamic Republic of Iran, or any other country so designated by the Secretary of State. This sits alongside, and is broader than, the individual-level foreign component and current-and-pending-support disclosures researchers already file.
The first reporting cycle covered 1 July 2024 through 30 June 2025, with the portal opening 1 September 2025 and submissions due 31 October 2025; subsequent reporting periods follow the same 1 July–30 June annual window. Institutions with no reportable foreign financial support still have to submit a negative report — there is no “nothing to disclose, so nothing to file” exemption. Supporting records (copies of the underlying contracts or agreements) must be retained until the latest of: four years after the gift or contract, the contract’s termination date, or whatever a state public-records law separately requires. NSF has also stated its intent to make FFDR information public, subject to standard federal confidentiality protections on specific data elements.
Risk assessment and documentation
Also effective 2 December 2025, NSF reserved the right to run risk assessments — using its own analytical tools — of proposals and awards to check for nondisclosure of required information from senior/key personnel. Proposers and recipients must keep supporting documentation (contracts, grants, or other agreements tied to foreign appointments, foreign employment, or foreign talent-program participation) available to NSF on request. This is the enforcement backstop behind the certifications above: the certifications are what gets signed at submission, the risk assessment and document-retention requirement are what NSF can check afterward.
A related but separate action: the drone-procurement restriction
A restriction that frequently gets folded into summaries of Notice No. 149 actually comes from a different NSF notice. Under the American Security Drone Act of 2023 — enacted as Sections 1821–1825 of the FY2024 National Defense Authorization Act (Public Law 118-31), with the funds-use prohibition’s own effective date deferred two years to 22 December 2025 — federal funds cannot be used to procure or operate unmanned aircraft systems (drones) manufactured or assembled by a Federal Acquisition Security Council (FASC)-listed covered foreign entity. NSF implemented this restriction through its PAPPG 24-1, Supplement 1 policy notice, effective 8 December 2025, not through Notice No. 149. The distinction matters for tracking purposes: an office auditing its Notice 149 compliance and an office auditing its equipment-procurement compliance under the Drone Act are working from two different NSF source documents, on two different effective dates, even though both trace back to the same CHIPS-and-Science-Act-era research-security push. Institutions with UAS-dependent NSF-funded research (agricultural sensing, environmental monitoring, remote fieldwork) should confirm their equipment sourcing against the FASC covered-entity list before spending NSF funds on or after 22 December 2025.
What a sponsored-programs office should check before its next NSF submission
- Training-completion tracking. Confirm every senior/key person named on an upcoming proposal has a documented research-security training completion date within the trailing 12 months, and that your Biographical Sketch / Current and Pending Support workflow captures it as a submission gate, not a post-hoc HR check.
- MFTRP certification routing. Confirm both the AOR pre-award certification and the individual senior/key-person certifications are wired into your internal routing form, and calendar the annual Research.gov re-certification for PIs/co-PIs on active awards issued on or after 20 May 2024.
- Confucius Institute status. Document, institution-wide, whether any unit maintains a Confucius Institute contract. If one exists, resolve it (termination, renegotiation to waiver-eligible terms, or a waiver request to NSF) before an AOR certifies the next Cover Sheet.
- FFDR cycle ownership. Assign clear institutional ownership of the annual 1 July–30 June FFDR reporting cycle, including the negative-report obligation and the multi-year record-retention requirement for underlying contracts.
- Document retention. Make sure contracts and agreements tied to any senior/key person’s foreign appointments, foreign employment, or foreign-talent-program history are retrievable on request — NSF’s risk-assessment authority assumes they exist and are accessible.
- UAS procurement, separately. If any active or planned NSF award involves procuring or operating drones, check the equipment against the FASC covered-foreign-entity list ahead of the 22 December 2025 funds-use cutoff — track this against PAPPG 24-1 Supplement 1, not Notice No. 149.
NSF also provided a short transition window: proposals submitted between 2 and 31 December 2025 could still use the prior Biographical Sketch and Current and Pending Support forms. That grace period has closed; the updated forms and certifications above now apply to every NSF proposal.
Related dictionary entries
- Research security policy
- CHIPS and Science Act
- Foreign talent recruitment programme
- NSPM-33
- Foreign component disclosure
- JASON Report on research security
Related reading
- NSPM-33 disclosure: what US researchers must report in 2026
- NSPM-33 implementation: 18 months in
- Export Control (EAR/ITAR) and International Research Collaboration
Primary source: NSF, Important Notice No. 149: Updates to NSF Research Security Policies (published 30 June 2025, updated November 2025); NSF’s implementation FAQ for Notice No. 149; and NSF’s PAPPG 24-1, Supplement 1 policy notice for the drone-procurement restriction.
