We counted the China subsidiaries. That is not the risk.

Exhibit 21 to a Form 10-K is the least glamorous document a public company files and one of the most useful. It is a flat list: entity name, and the state or country whose law the entity was formed under. Item 601(b)(21) of Regulation S-K is the instruction that produces it, and the instruction is short.

Two things follow from that sentence, and both matter before anyone counts anything. The first is that the column a reader wants is a legal fact, not an operational one. "Hong Kong" in that column means the entity was organized under Hong Kong law. It does not mean a factory, or a payroll, or a single employee. Plenty of entries on these lists are holding companies whose only asset is another company.

The second is that the list has a floor. The same rule permits an omission, and this is the sentence a program office should read twice.

A significant subsidiary under Rule 1-02(w) of Regulation S-X is one that clears an asset, investment or income test measured against the consolidated whole. A registrant with a hundred billion dollar balance sheet can leave a great many entities unnamed and still comply. So a company whose Exhibit 21 shows nothing in China has told you it has no significant China subsidiary. It has not told you it has none.

That limitation runs in one direction only, which is what makes the exhibit worth reading anyway. What IS on the list is on the list because the registrant put it there, signed by an officer, in a document filed under penalty of the securities laws. Every figure below is a count of things registrants affirmatively disclosed.

Before the China number means anything it needs a denominator. Across the 75 readable exhibits, registrants named 4,004 subsidiaries. The jurisdiction column states a readable place for 3,968 of them. Of those, 1,978 are United States entities and 1,990 are incorporated abroad, spread across 145 distinct places.

The shape of that map is the first useful finding. This is an industry incorporated overwhelmingly in the English-speaking world and Western Europe. The United Kingdom alone carries 401 entities, more than four times mainland China. People's Republic of China carries 69, level with France, and only 5 places abroad carry more. Hong Kong carries 33 more.

Add mainland China, Hong Kong and Macau together and the PRC family comes to 102 entities: 69 in mainland china, 33 in hong kong, 0 in macau. We group the three because that is how the covered-country definitions in the DFARS read the place, and we count Taiwan separately and leave it out, because none of the four prohibitions below treats Taiwan as the People's Republic of China. Taiwan accounts for 5 entities across 5 registrants. Folding them in would be the easiest way to inflate the headline, which is why the figure is printed here rather than buried.

25 of the 75 registrants list at least one PRC family entity, which is 33 percent of them. The other 50 list none. The distribution is not even: the top five registrants hold 54 of the 102 entities, 53 percent of the total.

What the entities are matters more than how many there are, and the names on the lists say a great deal. The largest holding by a wide margin belongs to a printed circuit board manufacturer whose mainland entries are operating plants in Guangzhou, Dongguan, Shanghai, Zhongshan and Suzhou. That is manufacturing, and the company says so in its own risk factors.

At the other end of the same list sit entries that are not operations at all. One aerospace prime's single mainland entry is a joint venture that overhauls engines in Shanghai. Another registrant's only PRC entry is a joint venture with a Chinese state offshore engineering company. Several registrants' entries are Hong Kong holding or trading companies whose function is to sit between a parent and an operating business somewhere else entirely.

That range is why the count alone will not answer a supply chain question. The 16 entries of one printed circuit board maker, plants and the Hong Kong companies that hold them, and a single engine overhaul joint venture are both "a China subsidiary" on a spreadsheet. They are not remotely the same fact.

A 10-K carries a second China disclosure, and it is the one most readers actually reach for: Item 1A, the risk factors. If corporate presence and stated risk tracked each other, the two would largely coincide. They do not.

Across the 71 registrants whose Exhibit 21 and Item 1A were both readable, 22 list a PRC family entity and 34 name China, Chinese or the PRC somewhere in their risk factors. Only 12 do both.

The two off-diagonal cells are the interesting ones. 22 registrants name China as a risk while listing no entity incorporated there, and the largest defense contractor in the country is one of them.

That is exposure running the other way. A contractor with no corporate presence in the PRC can still be sanctioned by it, cut off from a mineral it depends on, or caught in a tariff. None of that would appear on a subsidiary list, and a screen built on subsidiary lists would score that company clean.

Going the other way, 10 registrants list a PRC family entity and never mention the country in Item 1A at all. A large shipbuilding and aerospace prime is among them, with 4 Hong Kong entities on its exhibit out of 244 listed, and not one sentence in its risk factors naming China. That silence is a judgment about materiality, not an oversight, and it is a defensible one: business aviation service entities in Hong Kong are not a risk the company owes its shareholders a paragraph about. It is still a reminder that Item 1A answers "what could hurt our stock," never "where are we."

And a registrant can sit in the overlap while its two disclosures describe different things entirely.

One Shanghai maintenance joint venture on the exhibit, and a risk factor about being sanctioned over sales to Taiwan. The presence and the risk are both real and they are not the same story.

Now the part that decides whether any of this matters to a contract. There are five principal China-facing prohibitions in the codified FAR and DFARS that a Department of War contractor lives under, and three more that reach a contract by class deviation before the Code of Federal Regulations carries them. The striking thing when you read them side by side is what none of them says.

Start with the munitions rule. DFARS 225.770 implements a series of National Defense Authorization Act provisions, and its clause, DFARS 252.225-7007, prohibits acquiring United States Munitions List or 600 series items from a Communist Chinese military company. The definition is the whole lesson.

Read the first four words again. Regardless of geographic location. The test is whether an entity is part of the PRC defense industrial base or is owned, controlled by or affiliated with an element of the PRC government or armed forces. A Delaware corporation can be one. A Hong Kong holding company can fail to be one. Where the entity was incorporated is not an input.

The clause also flows down, which is where a subsidiary-list mindset does the most damage. Paragraph (c) requires the contractor to insert the substance of the clause in all subcontracts for covered items, at every tier. The obligation follows the item, not the org chart.

The materials rule works the same way on a different axis. DFARS 252.225-7052 restricts samarium cobalt magnets, tantalum and tungsten from four covered countries.

That prohibition turns on where a material was mined, melted or produced. A contractor with zero foreign subsidiaries can breach it through a third-tier supplier it has never heard of, and a contractor with a dozen Chinese subsidiaries can comply with it perfectly by sourcing elsewhere.

The telecommunications rules are narrower still and name their targets outright. FAR 4.2102 states the government-wide prohibition, FAR 52.204-25 is the clause, and the offeror answers for itself through FAR 52.204-24 and FAR 52.204-26.

Named companies and their affiliates, plus a category the Secretary of Defense may designate. Its defense counterpart, DFARS 252.204-7018, extends the same logic to any entity the Secretary reasonably believes to be owned or controlled by, or otherwise connected to, the government of a covered foreign country. Connection is the test. Not incorporation.

The newest of the five travels furthest of all from geography. FAR 52.240-1, added to the FAR to carry the American Security Drone Act, prohibits delivering or operating an unmanned aircraft system made by a covered foreign entity. It does not describe such an entity at all. It points at a list.

That is the whole definition. The test is neither incorporation nor ownership nor provenance: it is whether the maker appears on a roster the Federal Acquisition Security Council publishes in the System for Award Management. A contractor complies by looking the manufacturer up before it proposes or flies the aircraft, and the clause pushes that obligation into every subcontract, commercial items included. No amount of reading an Exhibit 21 substitutes for the lookup.

The ones the eCFR does not carry

Everything above is codified, which is why this platform can quote it from the seeded Code of Federal Regulations. A Department of War contracting officer also works under class deviations, memoranda from the Department's pricing and contracting policy office that put a clause into a contract before a rulemaking does, or instead of one. The Department keeps a public index of the deviations in effect. When we read it on September 15, 2026, two of them were China-facing prohibitions with no counterpart in the eCFR. A third, the FAR Overhaul deviation for supply chain security, has since folded both into a single DFARS part and added the one prohibition a subsidiary screen would most like to catch. We captured each memorandum once, stored it beside this article with its hash, and read it the way we read the rules.

The first is the Department's own drone rule, older and broader than the FAR clause above. Where FAR 52.240-1 points at a list, the deviation names its covered foreign countries outright and then reaches the aircraft, its flight controller, its radio, its camera, its gimbal, its ground software and the servers its data sits on.

This is the one text in the set that names a place, and it should be said plainly. It reaches a system or a part made in a covered foreign country or by "an entity domiciled in a covered foreign country", and domicile is the nearest any of these rules comes to asking where a company was formed. It is still a test the aircraft and its parts have to pass, applied through whoever made them, rather than a question a registrant's Exhibit 21 could answer: a gimbal from a mainland subsidiary of an American prime is caught exactly as a gimbal from any other mainland maker is.

The second reaches further from geography than anything else here. It does not ask where a chip was made or where its maker sits. It asks whom the maker sells to.

A vendor incorporated in Delaware that knowingly supplies chipmaking equipment to a Huawei affiliate is out. A vendor incorporated in Shanghai that does not is in. The test is a commercial relationship, not a map.

The third is where the ground has moved, and it is the one a subsidiary screen would most like to be. Since September 3, 2026 the Department's contracting officers have applied Revision 3 of the FAR Overhaul deviation for supply chain security, in place of the codified text of FAR part 40 and DFARS part 240. That memorandum is where the prohibition on Chinese military companies now lives at the Department, and it carries the newest one: from June 30, 2026, no award, renewal or extension to an entity on the Secretary's section 1260H list, or to an entity that a listed company controls.

Read the definition once more. A Chinese military company is an entity on a list the Secretary publishes in the Federal Register. Not an entity incorporated in China, not an entity with a Chinese parent, not an entity with a Shanghai address: an entity on the list, and anything a listed company controls. The Department could have written the test the SEC writes. It wrote a roster.

That last row is the point of the ledger. The one document in the set that DOES turn on a place of incorporation is the disclosure, not any of the prohibitions. We looked for place-of-incorporation language in all five codified rules and in the section of each of the three memoranda that states its prohibition, and found it in none of them, against 26 sections elsewhere in the seeded acquisition regulations that use exactly that phrasing. FAR 25.003 is one of them, defining a domestic concern partly by where it is organized. The FAR knows how to write that test. These rules deliberately do not, and the trend across them runs away from geography rather than toward it: ownership and affiliation, then provenance, then named companies, then a list you look up. The one place-based test in the set, domicile in the drone deviation, follows a part rather than a parent.

None of the above says the 102 entities are harmless. A wholly owned plant in Guangzhou is subject to PRC law, PRC labor conditions, PRC export controls and PRC data rules, and the fact that the parent is a defense contractor does not exempt it. A joint venture with a Chinese state enterprise puts a partner with its own government relationship inside the tent. Those are genuine facts that a program office, an investor and a foreign ownership, control or influence reviewer should all want to know.

What the measurement says is narrower and more useful: counting subsidiaries is a poor proxy for the exposure the rules are aimed at, and it is poor in both directions. 10 registrants would score as risky on a subsidiary screen and describe no risk themselves. 22 would score as clean and describe real exposure. The screen and the risk are close to independent.

The reason is structural rather than accidental. A subsidiary list answers a question about ownership at one moment, filed once a year, with a materiality floor under it. The prohibitions ask about the provenance of a part, the identity of a supplier, and a chain of control that can run through entities nobody consolidates. Those are different questions and they live in different documents.