Country Risk Disclosure in the 10-K: 2026 Practitioner Walkthrough

There is no Item called "Country Risk" in Form 10-K. That is precisely the problem. The obligation is real, the SEC is actively enforcing it through comment letters, and the 2026 filing season has raised the stakes considerably with tariff escalation, China regulatory pressure, and Middle East conflict exposure all landing simultaneously. This guide maps exactly where country risk must appear across your 10-K, translates SEC comment letter patterns into drafting guidance, and gives you a checklist to run before you file.

Key takeaway: Country risk disclosure is not a single checkbox. It spans Item 101 (business description), Item 105 (risk factors), Item 303 (MD&A), and at least three financial statement standards. Miss any layer and you are exposed to a comment letter, and potentially to securities litigation.

Where Does Country Risk Disclosure Actually Live in the 10-K?

Country risk must appear in four distinct sections of the 10-K, each with a different regulatory hook. Most compliance teams focus only on risk factors. That is not enough.

The SEC's Form 10-K General Instructions also carry a catch-all in Rule 12b-20: "there shall be added such further material information, if any, as may be necessary to make the required statements, in the light of the circumstances under which they are made, not misleading." That is the hook the SEC uses when it thinks you have disclosed enough to be technically compliant but not enough to be accurate.

Item 101: The Business Description Layer

Item 101 requires disclosure of the material effects that compliance with government regulations may have on capital expenditures, earnings, and competitive position. For a company with significant operations in China, Vietnam, or any jurisdiction with a divergent regulatory regime, this creates a country-specific obligation in the business section, not just in risk factors. The 2020 Reg S-K amendments made this explicit.

Note also Form 10-K General Instruction E: information about foreign subsidiaries may be omitted only "to the extent that the required disclosure would be detrimental to the registrant." That is a narrow, documented exception, not a general license to omit country-specific information about foreign operations on grounds of competitive sensitivity.

Item 105: The Risk Factor Layer

The 2020 Reg S-K amendments require risk factors to be specific to the particular company or offering. Generic risks that "could apply to any registrant" must be moved to the end of the risk factor section under a "General Risk Factors" caption. A risk factor that says "we operate internationally and face geopolitical risks including political instability, currency fluctuation, and regulatory changes" without naming specific countries or quantifying exposure is exactly what the SEC will challenge.

The SEC has said it directly in comment letters, as documented by Deloitte's SEC Comment Letter Roadmap: "The risk factors that you present appear to apply to nearly any issuer in any industry. Please significantly revise the risk factors to ensure that they are tailored to the [company's] business."

Item 303: The MD&A Layer

Item 303, as updated in 2021, requires discussion of known trends, demands, commitments, events, or uncertainties reasonably likely to have a material effect on financial condition or results. Country-specific risks that have already manifested must be discussed in MD&A with quantification where practicable. If tariffs have already increased your cost of goods sold by a measurable amount, or if a currency devaluation in a key market has already reduced reported revenue, that goes in MD&A with numbers, not just in risk factors as a hypothetical.

This is the most common drafting mistake: companies disclose the risk in Item 105 but fail to carry the actual financial impact through to Item 303.

Financial Statement Footnotes: Three Standards You Cannot Ignore

Three FASB standards create parallel country risk disclosure obligations in the financial statements:

• ASC 280 (Segment Reporting): Requires disclosure of revenues attributed to the entity's country of domicile and to all foreign countries in total, plus individual country disclosure if material. FASB ASU 2023-07, effective for fiscal years beginning after December 15, 2023, significantly expanded segment disclosure requirements, including significant segment expenses. For multinationals, this will surface country-specific cost concentrations that must now be disclosed.
• ASC 275 (Risks and Uncertainties): Requires disclosure of geographic concentrations of operations, customers, or suppliers if those concentrations make the entity vulnerable to a near-term severe impact. A manufacturer with 80% of production in a single country has a financial statement footnote obligation under ASC 275, independent of what it says in risk factors.
• ASC 830 (Foreign Currency): Governs foreign currency translation and requires disclosure of translation adjustments and the effects of exchange rate changes. For companies with operations in countries with currency controls or devaluation risk (Argentina, Turkey, Nigeria), ASC 830 disclosures must reflect the actual mechanics of how those currencies are translated and what the financial statement impact has been.

What the SEC Actually Flags in Comment Letters

The SEC's primary enforcement mechanism for country risk is the comment letter, not a specific rule violation. The Division of Corporation Finance reviews 10-Ks and issues comments when disclosure appears generic, inconsistent with public statements, or fails to address material geographic concentrations. Companies that receive a comment letter must respond within 10 business days and may need to amend their filing.

Here are the specific comment patterns the SEC has used, drawn from Deloitte's SEC Comment Letter Roadmap:

Geographic concentration: "We note the reference to disruption or deterioration in the economic conditions or real estate markets in [Geographic Area A] and [Geographic Area B]. Given large geographic concentrations of your loans in these areas, please revise future filings to further clarify and provide additional disclosure on the risks inherent to your operations in these areas."

China CAC oversight: "In light of recent events indicating greater oversight by the Cyberspace Administration of China (CAC) over data security, please revise your disclosure to explain if and how this oversight impacts your business and to what extent you believe that you are compliant with the regulations or policies that have been issued by the CAC to date, if applicable."

VIE structures: "Please include a risk factor discussing the risks associated with winding up the VIE structure."

Russia-Ukraine cyber risk: "Please revise your risk factor to disclose if you have experienced any cyberattacks, explain how cyberattacks could impact your business, and discuss any actions you have taken to mitigate the potential risks [in the context of the Russia-Ukraine conflict]."

The 'actual experience' principle: The SEC has required companies to update risk factors to "reflect significant changes to the risks" when actual events have occurred. If a country-specific risk has already materialized, the risk factor must say so, not just describe it as hypothetical. This is also a securities litigation exposure: courts have increasingly scrutinized risk factors that describe as hypothetical a risk that has already occurred.

The 2026-Specific Country Risks the SEC Is Watching

Tariffs and Trade Policy

The April 2026 "Liberation Day" tariff escalation and subsequent partial rollbacks have created an acute disclosure challenge. Companies with supply chains concentrated in China, Vietnam, or Mexico must now disclose not just the risk of tariffs but the actual financial impact, their mitigation strategies, and the uncertainty around ongoing trade negotiations. White and Case's 2026 annual report guidance identifies economic uncertainty and trade policy as a top priority, noting that risk factors must address "the specific sources of economic uncertainty most likely to impact the company."

For tariff disclosure specifically, the challenge is calibrating specificity without overpromising. If you have quantified the tariff impact in an earnings call, your 10-K must be consistent with that number. Inconsistency between the 10-K and public management statements is an independent SEC comment trigger. For detailed guidance on tariff-specific drafting, see our tariff disclosure best practices walkthrough.

China: VIE, CAC, HFCAA, and Export Controls

China-related disclosure has four distinct mandatory layers, and they are not interchangeable:

1. VIE structure risk: If you use a variable interest entity structure, you need a specific risk factor on the risks of winding up that structure. This is not optional; the SEC has issued this comment directly.
2. CAC oversight: If the Cyberspace Administration of China has oversight over your data operations, you must explain how that oversight impacts your business and your compliance status.
3. HFCAA disclosures: The Holding Foreign Companies Accountable Act requires specific disclosures about government ownership, CCP membership of executives, and whether VIE contracts are enforceable, for companies with auditors in jurisdictions where the PCAOB cannot inspect. This is a statutory requirement, not a judgment call.
4. Export controls: U.S. BIS restrictions on semiconductor and advanced technology exports to China have created material revenue risk for technology companies. The October 2022 and October 2023 chip export rules require specific disclosure of financial impact and compliance costs for affected companies.

State-Sponsored Cyber Threats: The Underappreciated Intersection

The SEC's 2023 cybersecurity disclosure rules, effective for annual reports filed after December 15, 2023, require annual disclosure of cybersecurity risk management, strategy, and governance. This creates a country risk disclosure vector that most compliance teams have not connected: state-sponsored cyber threats are inherently country-specific. If your cybersecurity risk management program identifies threats attributed to China, Russia, North Korea, or Iran, that attribution is country risk disclosure, and it must be consistent with your Item 105 risk factors. For the full cybersecurity disclosure framework, see our Item 1.05 Form 8-K cybersecurity walkthrough.

Russia, Middle East, and Sanctions Exposure

For companies with operations in or near conflict zones, the SEC expects disclosure that reflects actual experience, not just hypothetical risk. If you have taken sanctions-related losses, exited a market, or written down assets in a conflict-affected jurisdiction, that belongs in MD&A with quantification. For the sanctions-specific disclosure framework, see our sanctions risk factor disclosure walkthrough.

The Litigation Defense Dimension

Country risk disclosure is not just a compliance exercise. As White and Case notes, "well-drafted risk factors play a crucial role in defending public companies against allegations of fraud under the U.S. federal securities laws." Inadequate country risk disclosure that is later contradicted by actual losses can form the basis of a securities fraud claim. The Supreme Court's 2024 decision not to resolve the Facebook v. Amalgamated Bank question leaves companies with heightened uncertainty about how courts will treat risk factors that describe as hypothetical a risk that has already materialized.

Gibson Dunn's 2026 10-K guidance recommends updating the introductory paragraph to the Risk Factors section to clarify that risk factor disclosures reflect management's beliefs and opinions about potential future risks, not factual assertions about past events. That framing, grounded in Omnicare, is worth considering for your 2026 filing.

Country Risk Audit Checklist: Run This Before You File

Use this checklist against your current draft 10-K. Each item maps to a specific regulatory hook.

Item 101 (Business Description)

• Does the business description name the specific countries where you have material operations, manufacturing, or revenue?
• Does it address the material effects of country-specific regulatory regimes (China data laws, EU AI Act, India data localization, etc.) on capital expenditures, earnings, or competitive position?
• If you have omitted information about a foreign subsidiary under General Instruction E, have you documented that the omission is justified and identified the subsidiary by name?

Item 105 (Risk Factors)

• Are country risk factors tailored to your specific facts, naming specific countries and quantifying exposure where possible?
• Have you removed or moved to a "General Risk Factors" caption any risk language that could apply to any registrant?
• If a country-specific risk has already materialized (tariff cost increases, CAC regulatory action, sanctions losses), does the risk factor describe the actual experience, not just the hypothetical?
• If you have a VIE structure, is there a specific risk factor on the risks of winding it up?
• If you have China operations subject to CAC oversight, does the risk factor explain how that oversight impacts your business and your compliance status?
• If you are subject to HFCAA, have you included the required disclosures on government ownership, CCP affiliation, and VIE enforceability?
• Does your cybersecurity risk factor identify state-sponsored threats by country where your program does so internally?

Item 303 (MD&A)

• Are country-specific risks that have already affected financial results discussed in MD&A with quantification?
• Is the tariff impact on cost of goods sold or margins quantified, consistent with what management has said on earnings calls?
• Are currency effects by country discussed, with reference to ASC 830 translation mechanics for high-risk currencies?
• Is revenue concentration by country disclosed where material?

Financial Statement Footnotes

• Does the ASC 280 segment footnote disclose revenues by country of domicile and by individual foreign country where material?
• Following ASU 2023-07 (effective for fiscal years beginning after December 15, 2023), are significant segment expenses disclosed in a way that surfaces country-level cost concentrations?
• Does the ASC 275 footnote address geographic concentrations of operations, customers, or suppliers that create vulnerability to near-term severe impact?
• Does the ASC 830 footnote adequately address translation adjustments and the financial statement impact of currency controls or devaluation in high-risk markets?

Consistency Check

• Is country risk language in the 10-K consistent with what management has said on earnings calls, in press releases, and in investor presentations?
• If conditions in a specific country have changed materially since the prior annual filing, have you updated the disclosure rather than rolling forward prior-year language?
• Have you considered whether mid-year country risk developments require disclosure in a 10-Q before the next annual filing?

FAQ

Does the SEC have a specific rule requiring country risk disclosure? No standalone rule exists. The obligation arises from Item 105 (risk factors), Item 101 (business description), Item 303 (MD&A), and financial statement standards ASC 280, ASC 275, and ASC 830, plus the catch-all in SEC Rule 12b-20. The SEC enforces through comment letters, not specific rule citations.

How specific does country risk disclosure need to be? Specific enough that it could not apply to any other company. Name the countries, quantify the exposure where practicable, and describe the actual regulatory or geopolitical mechanism creating the risk. Generic language about "geopolitical uncertainty" will draw a comment letter.

What does 'material' mean for country risk? The standard is whether a reasonable investor would consider the information important in making an investment decision. For country risk, materiality is typically triggered by revenue concentration, asset concentration, or operational dependence on a specific country. See our SEC materiality standard guide for the full two-step analysis.

Do we need to update country risk disclosure in 10-Qs if conditions change mid-year? Yes. Item 303 requires discussion of known trends and uncertainties that are reasonably likely to have a material effect. If a new tariff regime, sanctions designation, or regulatory action in a key country occurs between annual filings, the next 10-Q must address it. Do not wait for the annual 10-K.

How do we handle the tariff environment when policy is changing weekly? Disclose the impact of tariffs that have already taken effect with actual numbers. For ongoing uncertainty, describe the range of scenarios and your mitigation strategies without making forward-looking commitments you cannot support. Consistency with earnings call language is non-negotiable. For detailed tariff drafting guidance, see our 10-Q tariff disclosure requirements walkthrough.

Can we omit information about a foreign subsidiary if it would be competitively sensitive? Only under the narrow exception in Form 10-K General Instruction E, which requires a documented determination that disclosure would be detrimental to the registrant. Financial statements cannot be omitted under this exception. The bar is high and the exception is rarely invoked successfully.