Review by the Committee on Foreign Investment in the United States (CFIUS) is one of the most important regulatory issues in cross-border acquisitions. Foreign investment remains an important source of capital for U.S. businesses, but these transactions can raise regulatory issues that domestic deals do not.
CFIUS is an interagency committee chaired by the U.S. Department of the Treasury that reviews certain foreign investments for potential national security risks. Its jurisdiction is broader than traditional acquisitions of defense contractors. CFIUS can review mergers, acquisitions, and takeovers that could result in foreign control of a U.S. business, certain non-controlling investments involving critical technologies, critical infrastructure, or sensitive personal data, as well as certain real estate transactions.
For foreign buyers, private equity sponsors, and U.S. companies seeking international capital, that means CFIUS should be considered early in the transaction. A CFIUS issue identified after signing can affect the closing timeline, negotiating leverage, financing commitments, and, in some cases, whether the transaction can proceed in its original form.
Which Cross-Border Transactions Can Trigger CFIUS Review?
A common misconception is that CFIUS applies only when a foreign buyer acquires a large U.S. company or takes complete ownership of one.
The actual jurisdictional analysis is more nuanced. CFIUS has authority over transactions that could result in foreign control of a U.S. business. Under the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA), that authority also extends to certain non-controlling foreign investments involving U.S. businesses connected to critical technologies, critical infrastructure, or sensitive personal data, commonly referred to as TID U.S. businesses.
That distinction matters for minority investments. A transaction does not necessarily fall outside CFIUS scrutiny simply because a foreign investor acquires less than a controlling equity stake. The rights accompanying the investment, the nature of the U.S. business, the sensitivity of its technology or data, and the investor's relationship to the company can all affect the analysis.
Deal teams should therefore treat CFIUS jurisdiction as a substantive diligence question rather than relying primarily on transaction size or ownership percentage.
When Is a CFIUS Filing Mandatory?
Many CFIUS filings are voluntary, but not all of them.
Treasury regulations require declarations for certain covered transactions involving specified U.S. businesses where a foreign government acquires a substantial interest. Mandatory filing requirements can also apply to certain covered transactions involving U.S. businesses that produce, design, test, manufacture, fabricate, or develop critical technologies. Parties may submit a full notice instead of a declaration in those circumstances.
Determining whether a mandatory filing applies requires a transaction-specific analysis. Counsel may need to examine the target's technology, export-control classifications, ownership structure, the foreign investor's ownership chain, governance rights, and the nature of the target's operations.
A finding that no mandatory filing is required does not end the analysis. CFIUS can identify and review transactions within its jurisdiction that the parties have not filed, including after closing. Parties should therefore separately assess whether a voluntary filing is warranted, taking into account potential national security concerns and the risk of having to address those concerns after the investment has been completed.
The practical point is straightforward: the CFIUS analysis should begin during diligence and transaction structuring, not shortly before an anticipated closing.
CFIUS Due Diligence Should Address More Than Ownership
Good CFIUS diligence starts with the target, but it does not end there.
For a U.S. target, the buyer and its counsel should understand whether the company works with critical technologies or critical infrastructure, handles sensitive personal data, performs government or defense-related work, or owns relevant real estate. CFIUS jurisdiction includes certain real estate transactions in addition to investments in U.S. businesses.
The foreign investor also needs to be examined. Its ownership chain, government relationships, investment structure, and proposed governance or information rights may become relevant to the CFIUS assessment.
For technology acquisitions, these issues frequently overlap with broader M&A diligence. As discussed in our article on AI Due Diligence in M&A: Evaluating IP Ownership, Data Privacy, and Licensing, buyers already need to understand what data a target possesses, what technology it owns or licenses, and what regulatory obligations follow those assets. In a transaction involving foreign investment, those findings may also be relevant to the CFIUS analysis.
CFIUS Risk Should Be Reflected in the Deal Documents
Identifying a potential CFIUS issue is only the first step. The more difficult question is often how the parties allocate that risk in the purchase agreement.
The answer depends on the transaction. Sophisticated parties should consider how the CFIUS process affects closing conditions and outside dates, what covenants and allocation of responsibility for regulatory filings are needed during review, and how representations and termination rights allocate regulatory risk.
A seller may want strong commitments requiring the buyer to pursue clearance and accept reasonable mitigation measures. A buyer, particularly one investing through a complex international ownership structure, may resist an open-ended obligation to accept restrictions that materially change the economics or governance of the deal.
Those competing interests should be negotiated explicitly.
Filing format matters to the timetable. A short-form declaration has a 30-day assessment period, but CFIUS may request a full notice or report that it is unable to conclude action on the declaration. A full notice has a 45-day review period, potentially followed by a 45-day investigation. These periods do not capture the entire transaction timetable: preparation, acceptance of a complete filing, and other process delays also need to be considered when negotiating the outside date.
If CFIUS review could materially extend the regulatory timetable, the outside date should account for that possibility. The agreement should also address who controls communications with CFIUS, how information requests will be handled, what level of cooperation each side must provide, and what happens if clearance is conditioned on mitigation.
Depending on the level of risk and bargaining leverage, parties may also consider whether regulatory uncertainty should affect escrow arrangements, purchase-price protection, or other risk-allocation mechanisms
Mitigation Can Change the Economics of the Transaction
CFIUS review does not always end with an unconditional clearance or a blocked transaction.
When CFIUS identifies a national security risk within its jurisdiction, it has authority to negotiate mitigation agreements or impose conditions designed to address that risk.
For dealmakers, mitigation should not be treated as an abstract regulatory possibility. Depending on the transaction, restrictions imposed to address national security concerns may affect information access, governance, operations, or other aspects of the investment.
That can alter what the buyer is actually purchasing.
Restrictions on expected governance rights or access to information can change the value of an investment. A financial sponsor acquiring a technology company, for example, should understand before signing whether potential restrictions could interfere with the rights or information access contemplated by its investment model. For a minority investment, regulatory limitations on rights expected by the investor can similarly change its value.
The purchase agreement should account for that possibility and establish how much mitigation the buyer is required to accept before it can walk away.
Sensitive Personal Data Can Create CFIUS Exposure
Data has become especially important in cross-border investment reviews.
CFIUS jurisdiction extends to certain non-controlling investments in TID U.S. businesses, including businesses that maintain or collect sensitive personal data of U.S. citizens. That can make CFIUS relevant to transactions involving businesses that do not fit the traditional image of a national security target.
Healthcare provides a useful example. As we discussed in Double Exposure: Navigating CFIUS and HIPAA Compliance in an Era of Foreign Investment in Health Data, healthcare M&A can require deal teams to evaluate national security regulation alongside established privacy and data-protection requirements.
This is one reason CFIUS diligence should not be confined to the regulatory section of a diligence request list. Data privacy, cybersecurity, intellectual property, export controls, government contracts, and corporate governance can all provide information relevant to the analysis.
CFIUS Process Developments and Deal Planning in 2026
Recent Treasury activity reinforces the importance of building CFIUS analysis into the transaction process.
Treasury's CFIUS regulations provide mechanisms for information requests, mitigation, and penalties associated with violations of statutory or regulatory obligations and mitigation agreements. In 2026, Treasury also sought public input on ways to streamline the foreign investment review process, including development of the Known Investor Program.
In July 2026, Treasury launched a redesigned CFIUS website that includes a pre-filing consultation portal, a national-security risk matrix, examples of mitigation measures, and additional process guidance. Treasury described the initiative as a way to support earlier engagement and more efficient review while continuing national-security scrutiny of foreign investment.
For transaction parties, earlier regulatory planning can make an important difference. The closer the parties get to signing or closing before identifying a material CFIUS issue, the fewer practical options they may have for changing structure, negotiating risk allocation, or accommodating the regulatory timetable.
Protecting Foreign Direct Investment Without Losing the Deal
CFIUS review does not mean that foreign investment in a U.S. business is inherently problematic. U.S. policy has long supported an open investment environment, while CFIUS focuses on the national security risks presented by certain transactions.
For middle-market buyers, private equity sponsors, and corporate deal teams, the better approach is to identify CFIUS exposure early and work it into the commercial structure of the deal.
That means determining whether the target and transaction fall within CFIUS jurisdiction, identifying whether a filing may be mandatory, understanding the investor's ownership and governance structure, assessing potential mitigation, and allocating regulatory risk in the transaction documents.
In cross-border M&A, CFIUS should not be a closing checklist item. It should be part of the deal strategy from the beginning.
