Foreign Investment Law: Cfius, National Security Review, and Filing Rules

CFIUS reviews transactions that could give a foreign person control of, or certain rights in, a domestic business or sensitive real estate, to assess national security risk. Its jurisdiction covers acquisitions that result in foreign control, and, since FIRRMA, certain non-controlling "covered investments" in what the rules call TID U.S. .usinesses, those involved in critical technologies, critical infrastructure, or sensitive personal data. It also reaches certain real estate transactions, particularly property near sensitive government or military sites.

What draws scrutiny is not the investment itself but the access or influence it confers, such as board seats, governance rights, or access to sensitive technology or data. A foreign investment in a company handling export-controlled technology or large volumes of personal data is far more likely to attract review than a passive stake in an ordinary business, which is why mapping the target's activities against the TID categories is an early step in any CFIUS compliance analysis.

FIRRMA, enacted in 2018, was the most significant modernization of CFIUS in decades. Before FIRRMA, CFIUS jurisdiction focused on transactions that could result in foreign control of a business, and all filings were voluntary. FIRRMA expanded that reach to certain non-controlling investments in TID businesses and to a defined set of real estate transactions, and, for the first time, created mandatory filing requirements for certain higher-risk deals. It also introduced a streamlined short-form "declaration" alongside the traditional long-form notice.

These changes substantially widened the range of deals that can fall within review, especially in technology, infrastructure, and data. Understanding the FIRRMA framework, including the TID concept and the mandatory-filing triggers, is now central to assessing any inbound investment, and is the focus of dedicated FIRRMA compliance work.

Mandatory filings are generally required for certain higher-risk transactions, particularly where a foreign government holds a substantial interest in a deal involving a TID U.S. .usiness, or where the transaction involves critical technologies subject to U.S. .xport controls. In those situations, the parties must notify CFIUS, and failing to do so can carry steep civil penalties. Reporting indicates penalties were increased to more than $5 million per violation for failures to file, material misstatements, or breaches of mitigation, and can reach up to the full value of the transaction for a violation. The specific triggers are defined by regulation and turn on detailed thresholds.

Determining whether a deal falls into a mandatory category requires analyzing the target's technologies and data, the investor's identity and government links, and the rights being acquired. Treat the mandatory-filing analysis as a gating item before closing, since the penalties for missing a required filing are among the most serious in this area, a concern shared across foreign investment compliance generally.

Many transactions are not subject to a mandatory filing, yet parties still choose to file voluntarily to obtain legal certainty. The reason is CFIUS's "evergreen" authority: if a covered transaction is not reviewed and cleared, CFIUS can review it even after closing and, in principle, require divestment or other remedies. A voluntary filing that results in clearance generally provides a safe harbor against later second-guessing of that transaction.

For that reason, voluntary filing is often the only route to true deal certainty for a covered transaction, even when no filing is strictly required. Weigh the cost and timing of a filing against the risk of an unreviewed deal being unwound later, a judgment that sits at the heart of foreign investment review.

A CFIUS review proceeds through defined stages:

• Filing: parties submit a short-form declaration or a long-form notice
• Review: CFIUS conducts an initial assessment of the national security risk
• Investigation: if needed, a deeper review follows
• Outcome: CFIUS clears the deal, clears it subject to mitigation conditions, or, in serious cases, recommends that the President suspend or prohibit it

Mitigation may involve measures that limit foreign access or influence to address identified risks. The process is fact-intensive and can affect deal timing significantly, so building CFIUS into the transaction calendar matters. Where risks are identified, negotiating workable mitigation rather than facing a block is often the goal, an exercise related to broader FOCI mitigation practice under national security rules.

Foreign investment policy increasingly distinguishes between investors from trusted allies and those linked to identified adversaries. Investors from certain partner countries, designated as "excepted" foreign states under the regulations, can benefit from reduced filing requirements and a more predictable process. Recent policy has emphasized facilitating and fast-tracking investment from allies and partners while directing heightened scrutiny, and potential new restrictions, toward investors connected to designated adversary states, especially in sensitive technologies.

This risk-tiered approach means an investor's nationality and ownership structure can significantly affect how a deal is treated. Identifying where an investor falls in this framework early helps predict the level of scrutiny and structure the transaction accordingly, a consideration that runs through foreign direct investment planning.

Outbound investment screening is a newer dimension of foreign investment policy that regulates certain investments by U.S. .ersons into sensitive technologies abroad, rather than foreign money coming in. The rules now in force restrict or require notification of specified outbound investments in identified countries of concern in areas such as semiconductors and microelectronics, quantum information technologies, and artificial intelligence. This represents a significant expansion, since the government now scrutinizes capital flowing out as well as in.

For companies and investors with international portfolios, this means due diligence now extends to where their own capital goes, not just to inbound deals. Tracking these obligations is increasingly part of cross-border investment planning, and is the focus of dedicated outbound investment screening analysis.

CFIUS is the Committee on Foreign Investment in the United States, an interagency committee chaired by the Treasury Department that reviews certain foreign investments for national security risk. It operates under Section 721 of the Defense Production Act, as expanded by FIRRMA in 2018. CFIUS can clear a transaction, clear it with mitigation conditions, or recommend that the President block or unwind it. Its focus is the national security implications of a foreign person gaining control of, or certain access to, a business or sensitive real estate, not the commercial merits of the deal.

No. Most foreign investment is welcome and never reviewed. Review applies to transactions within CFIUS jurisdiction, broadly, deals that could give a foreign person control of, or specified access to, a business involved in critical technology, infrastructure, or sensitive data, or that involve certain real estate. Some of these require a mandatory filing, while many others are voluntary. Passive, non-controlling investments with no governance rights or sensitive access generally fall outside the most scrutinized categories, though the specifics depend on the facts.

Failing to make a mandatory filing can carry serious consequences. Reporting indicates civil penalties were raised to more than $5 million per violation, and can reach up to the full value of the transaction, and the deal remains exposed to CFIUS's authority to review it even after closing, potentially leading to forced divestment or other remedies. There is no safe harbor for an unfiled covered transaction. This is why the mandatory-versus-voluntary analysis should be done before closing, and why parties often file voluntarily even when not strictly required, to secure certainty.

A TID U.S. .usiness is one involved in Technology, Infrastructure, or Data in ways the CFIUS regulations define, and it is a central trigger for expanded review. The categories cover critical technologies, often those subject to U.S. .xport controls, such as advanced computing, microelectronics, or biotechnology; critical infrastructure like energy, communications, or financial systems; and businesses that maintain sensitive personal data of U.S. .ndividuals. If a target is a TID business, a foreign investment is much more likely to fall within CFIUS jurisdiction and, in some cases, to require a mandatory filing.

Recent policy has moved in two directions at once: easing the path for investors from trusted allies while intensifying scrutiny of those linked to identified adversaries, especially in sensitive technologies. A 2025 executive policy directive set this approach and directed agencies to implement it, so specific rules have continued to develop since. The government has also begun screening certain outbound investments by U.S. .ersons into sensitive technologies abroad. Because these programs are still evolving, the current state of any particular rule should be confirmed rather than assumed.

Yes, in defined circumstances. FIRRMA expanded CFIUS jurisdiction to reach certain real estate transactions by foreign persons, particularly the purchase or lease of property near sensitive government or military facilities, even where no operating business is involved. The concern is the access or proximity such property could provide. Not all real estate is covered, the rules turn on location and use, but foreign buyers of property near sensitive sites should assess whether their transaction falls within CFIUS's real estate jurisdiction before proceeding.