CFIUS National Security Review
Understanding when foreign investments trigger national security screening
CFIUS Quick Reference
30
Declaration Days
Short-form review
45+45
Notice Days
Full review + investigation
$5M
Max Penalty
Per violation
2018
FIRRMA
Expanded jurisdiction
What Transactions Does CFIUS Cover?
CFIUS has jurisdiction over transactions that could result in foreign control of, or certain non-controlling investments in, US businesses.
Control Transactions
- Mergers and acquisitions
- Stock purchases conferring control
- Asset acquisitions
- Joint ventures
- Long-term leases
Non-Control TID Investments
- Board seats or observer rights
- Access to material non-public info
- Decision-making involvement
- Critical tech access
- Sensitive data access
Who Qualifies as a Foreign Person?
Foreign Persons Include
- Non-US citizens (except LPRs)
- Foreign governments
- Foreign entities
- Entities controlled by foreigners
Not Considered Foreign
- US citizens
- Lawful permanent residents
- US entities without foreign control
- Purely passive investors
What Counts as a US Business?
A US business is any entity engaged in interstate commerce, regardless of ownership nationality.
US Business Includes
- US incorporated companies
- US branches of foreign companies
- US assets with business operations
- Joint ventures in US
- IP held in US
TID US Businesses
- Critical technology producers
- Critical infrastructure operators
- Sensitive personal data holders
Mandatory Declaration Requirements
Failure to file: civil penalty up to $5M per violation
Mandatory Filing Triggers
- TID + foreign govt interest 25%+
- Critical tech requiring authorization
- Substantial interest by certain countries
- Specific designated sectors
Declaration Contents
- Transaction summary
- Party information
- Business description
- National security considerations
- 5 pages maximum
Voluntary Notice Strategy
Voluntary notice provides safe harbor protection
When to File Voluntarily
- Government contractor involvement
- Sensitive industry sector
- Proximity to military sites
- High-risk investor country
- Deal certainty required
Benefits of Filing
- Safe harbor from future review
- Deal certainty for parties
- Reduced risk of forced divestiture
- Clear path forward
Review Timeline
Declaration (30 Days)
- Day 1: Accepted for review
- Day 1-30: Assessment
- Day 30: Response issued
- May request full notice
Full Notice (45+45 Days)
- Day 1-45: Initial review
- Day 45: Clear or investigate
- Day 46-90: Investigation
- Day 90+: Presidential referral (rare)
Mitigation Agreements
CFIUS may condition approval on mitigation measures to address national security concerns.
Common Mitigations
- Proxy boards for sensitive decisions
- US citizen officer requirements
- Technology access restrictions
- Data localization requirements
- Audit and reporting obligations
Compliance Requirements
- Annual compliance reports
- Third-party audits
- Government inspection rights
- Ongoing monitoring
Blocked Transactions
Presidential blocks are rare but final
Block Consequences
- Transaction prohibited
- Divestiture ordered
- No judicial review
- Penalties for non-compliance
Risk Factors for Block
- Adversary country investor
- Critical technology sector
- National security nexus
- No mitigation possible