1. Jurisdiction and Covered Transactions
CFIUS derives its authority primarily from Section 721 of the Defense Production Act of 1950, as amended by the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA). The implementing regulations are found principally in 31 C.F.R. Part 800, which addresses covered investments in U.S. .usinesses, and Part 802, which addresses certain real estate transactions involving foreign persons. CFIUS reviews transactions where a foreign person acquires control of a United States business, as well as non-controlling investments in sensitive entities.
Under 31 C.F.R. Part 800, CFIUS focuses on TID U.S. .usinesses handling Technology, Infrastructure, or Data:
Critical Technology: Entities developing or testing technology subject to United States export controls.
Critical Infrastructure: Entities operating key physical or cyber infrastructure assets, including maritime ports and power grids.
Sensitive Personal Data: Entities maintaining personal identifying data of United States citizens, such as health or financial records.
Foreign investors must evaluate whether their target entity meets these statutory definitions. SJKP's legal team assesses ownership structures and technology portfolios to determine jurisdictional exposure prior to deal execution. For comprehensive corporate guidance, our firm provides targeted advice through our Corporate Counsel team.
Recent Expansion of Cfius Authority
CFIUS jurisdiction has expanded since FIRRMA to include certain non-controlling investments in TID U.S. .usinesses and certain real estate transactions involving foreign persons. In 2026, the Department of the Treasury is also developing the Known Investor Program, including a pilot and public input process intended to improve procedural efficiency for eligible investors. The program does not currently change CFIUS jurisdiction or replace the statutory review process. Supply chain resilience and data privacy remain central pillars of federal security assessments, with non-allied investors facing heightened scrutiny.
2. The Cfius Review Process: Timeline and Stages
The CFIUS clearance timeline requires careful management to keep commercial transactions on schedule. Parties submit filings to the Department of the Treasury, which coordinates interagency reviews.
| Review Phase | Duration | Primary Objectives & Outcomes |
|---|---|---|
| Pre-Filing Consultations | 1 to 3 Weeks | Draft filings submitted informally to allow federal staff to provide preliminary guidance. |
| Initial Assessment Period | 45 Calendar Days | Interagency panel reviews national security risks and issues clearance or initiates an investigation. |
| Subsequent Investigation | 45 Calendar Days | Conducts in-depth risk analysis, negotiates risk mitigation agreements, or refers to the President. |
| Presidential Decision | 15 Calendar Days | President orders prohibition, transaction unwinding, or grants unconditional clearance. |
Voluntary Notification Vs. Mandatory Filing Requirements
Filing with CFIUS is either mandatory or voluntary depending on target business activities and foreign buyer ownership. Mandatory declarations apply to transactions involving critical technologies or foreign government ownership interests exceeding statutory thresholds. Failing to submit a mandatory declaration can result in severe civil penalties.
Alternatively, voluntary notices allow parties to proactively secure a safe harbor against future divestment orders. Our firm's attorneys analyze transaction terms to establish filing triggers. Clients can review broader regulatory frameworks by exploring our dedicated Foreign Investment Review analysis.
Expedited Vs. in-Depth Review Timelines
Parties can choose between a short-form declaration and a full voluntary notice. A short-form declaration offers a 30-day assessment period, while a full notice initiates the standard 45-day review timeline. When complex risks emerge, the committee extends proceedings into a 45-day investigation phase.
3. Critical Industries and "Control" under Cfius Rules
Federal regulations define control broadly beyond majority voting equity to include the power to determine important operational decisions of a United States business.
Sensitive Sectors and Technology Restrictions
Transactions involving dual-use software, defense systems, semiconductors, and biotechnology receive intense scrutiny. Foreign buyers cannot acquire direct access to proprietary source code or design schematics without regulatory risk.
How Cfius Defines Foreign Investment Control
Control manifests through specific corporate mechanisms:
Board representation or observer rights on corporate governing bodies.
Contractual veto rights regarding capital expenditures or asset sales.
Access to material non-public technical information held by the target firm.
4. Common Deal Structures That Trigger Cfius Scrutiny
Regulatory scrutiny applies across asset purchases, equity acquisitions, and joint business ventures.
M&A Transactions Involving Foreign Acquirers
When a foreign entity acquires controlling equity in a domestic firm, CFIUS verifies whether the acquirer maintains ties to foreign governments.
Joint Ventures and Technology Licensing Agreements
Joint ventures fall under CFIUS jurisdiction if a foreign partner contributes capital for operational control over domestic assets. Technology licensing agreements transferring intellectual property rights also trigger federal oversight. To evaluate international transaction structures, investors can reference our firm's overview on Foreign Investment Law.
5. Cfius Mitigation Strategies and Protective Agreements
When national security concerns arise, CFIUS may condition transaction approval on binding risk mitigation measures negotiated directly with monitoring agencies.
Negotiating Conditions and Behavioral Commitments
Mitigation conditions range from operational restrictions to structural firewalls, including independent board committees, restricted access to client databases, and independent compliance monitors.
National Security Agreements (Nsas) and Compliance
A National Security Agreement is a legally binding contract between transaction parties and the United States government. Violating an NSA leads to substantial monetary fines or compulsory transaction unwinding. SJKP's legal team works with corporate boards to draft workable mitigation protocols that satisfy federal authorities while preserving commercial goals.
6. Red Flags: When to Consult a Cfius Foreign Investment Review Attorney
Early risk identification prevents transaction failures. Foreign acquirers should retain experienced legal counsel before executing definitive acquisition agreements.
Identifying High-Risk Transactions Early
Key red flags include foreign government ownership in the investment chain, target operations near sensitive military facilities, and access to personal identifying information.
Hypothetical Example for Educational Purposes Only
A foreign investment firm planned to acquire a twenty percent equity stake in a New York technology firm that developed satellite tracking software. The agreement granted the foreign investor one board seat and access to technical data.
During pre-filing due diligence, legal counsel identified that the target entity held contracts with defense agencies and advised submitting a joint voluntary notice. By negotiating a targeted National Security Agreement that restricted access to defense data, the parties secured regulatory clearance without disrupting the deal timeline.
Cost of Noncompliance and Unwinding Orders
Operating without required clearance exposes transacting parties to severe legal consequences:
Civil monetary penalties reaching the total value of the underlying transaction.
Presidential unwinding orders requiring complete divestment of acquired assets.
Perpetual legal liability and reputational damage across international capital markets.
06 Aug, 2026
