Grace Hochstatter (White & Case, Law Clerk, Washington, DC) contributed to the development of this publication

The Committee on Foreign Investment in the US (CFIUS), which is led by the US Department of the Treasury and composed of US national security and economic agencies—including Defense, State, Justice, Commerce, Energy and Homeland Security—conducts national security reviews of FDI into the US as well as some real estate transactions. The Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA) significantly overhauled the CFIUS process. Regulations fully implementing FIRRMA's reforms took effect in 2020, and the CFIUS landscape has continued to evolve since then.

In late 2024, the Treasury engaged in additional rulemaking intended to sharpen and enhance CFIUS's procedures and enforcement authorities. More recently in February 2025, President Donald Trump issued an "America First Investment Policy" National Security Policy Memorandum (NSPM) that emphasizes an open foreign investment environment while imposing restrictions on foreign investments in proportion to their degree of independence from US foreign adversaries, which include the People's Republic of China (PRC) (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia and Venezuela.

The NSPM includes directives for expedited review of investments from allied and partner nations, reduced reliance on open-ended mitigation agreements, and the utilization of legal tools like CFIUS to restrict foreign adversary-affiliated investments. The NSPM also notes the administration is considering implementing further restrictions on US outbound investments in certain strategic sectors. While new rules and other measures are necessary for implementation, the NSPM is a harbinger of a significant shift in foreign investment review under the Trump administration.

Summary of major changes in 2024

• As part of the Treasury's rulemaking, CFIUS monetary penalties increased dramatically. The explicit monetary cap for civil penalties relating to material statements or omissions increased from US$250,000 to US$5 million per violation—a 25-fold increase. Maximum penalties for failing to submit a mandatory filing also increased from US$250,000 to US$5 million or the value of the transaction, whichever is greater.  As mitigation measures are implemented over time, the penalties for violations of mitigation requirements similarly increased the maximum dollar value to US$5 million, but the new rule also introduces additional ways for CFIUS to calculate the "value of the transaction" concept for penalty purposes to give CFIUS more flexibility.
• CFIUS can now seek more information related to non-notified transactions, including from non-transaction parties. The previous CFIUS regulations authorized CFIUS to require parties to a non-notified transaction to provide information necessary to determine whether the transaction was subject to CFIUS's jurisdiction. CFIUS can now request information related to whether the transaction will raise national security considerations and whether the transaction meets the criteria for a mandatory filing. These changes are notable for their potentially expansive coverage. Non-notified inquiries are likely to broaden in scope under this update and may include more pointed requests.
• The new expanded authorities permit CFIUS broader authority to subpoena information from third parties in a wider range of circumstances. Historically, CFIUS has not typically needed to use its subpoena powers to obtain information, but the regulatory update gives CFIUS sharper tools should it need information from third parties that is not being provided voluntarily.
• The Treasury expanded CFIUS real estate jurisdiction to nearly 60 additional sensitive US Government locations across 30 states.
• CFIUS is requiring mitigation measures at much higher levels than it has historically, but this trend is worth monitoring during the Trump administration.
• In 2023, 21 percent of notices for distinct transactions were cleared with mitigation, down slightly from 23 percent in 2022 (this was 18 percent of total notices, including withdrawals and refilings, in both years). This is notable, however, because 2022 saw the rate of mitigation being required nearly doubling from historical trends, and the 2023 data indicates that this higher frequency of mitigation is holding. This is not surprising since as CFIUS has bolstered its monitoring and enforcement resources, it has more ability to mitigate perceived risks.
• It will be important to monitor this trend in 2025 as the NSPM committed to end the use of "overly bureaucratic, complex and open-ended "mitigation" agreements for US investments from foreign adversary countries." According to the NSPM, mitigation agreements should generally be time-limited and consist of concrete actions to be completed.
• In 2023 and 2024, CFIUS announced eight civil monetary penalties, triple the total number of penalties in CFIUS's history. Most penalties were for violations of mitigation agreements, with the highest reaching US$60 million.

Who files?

CFIUS filings are usually submitted jointly by the parties to the notified transaction—typically the investing entity and the target.

Though the CFIUS regulations mandate filings for certain transactions, CFIUS review remains predominantly a voluntary process, as most transactions subject to CFIUS's jurisdiction do not meet the mandatory filing criteria. Even for transactions under CFIUS's voluntary authorities, CFIUS may request parties notify a transaction of interest and has the authority to initiate reviews directly.

CFIUS is pursuing non-notified transactions more aggressively, so the risk of CFIUS reaching out on a non-notified transaction has notably increased since FIRRMA was implemented. CFIUS officials have indicated recently that even more resources are being dedicated to its non-notified process. This is reinforced by the additional authorities CFIUS received in the Treasury's 2024 rulemaking, which expands the information CFIUS can request and the parties it can request this information from during the non-notified process.

Mandatory filing requirements apply only to covered transactions (foreign investments subject to CFIUS jurisdiction) that involve "TID" US businesses, which are involved with critical technologies, critical infrastructure or sensitive personal data.

Specifically, subject to certain exemptions, mandatory filings are required in two circumstances. The first is the acquisition of 25 percent or more of the voting interests in any TID US business by a person in which a single foreign government holds, directly or indirectly, a 49 percent or greater voting interest. All parents in the investor's ownership chain are deemed 100 percent owners, so dilution of ownership interests is not recognized for purposes of this test.

The second circumstance concerns a foreign investment in a TID US business involved with critical technologies, where one or more US regulatory authorizations, such as export licenses, would be required to export, re-export or retransfer any of the US business's critical technologies to the investor or any person holding a 25 percent or greater, direct or indirect, voting interest in the investor. With a few exceptions, mandatory filing is required even where such critical technologies would be eligible for export to the relevant foreign person under a license exception.

If mandatory filing applies, notification by a declaration or notice must be submitted to CFIUS at least 30 days prior to the transaction's completion date.

While FIRRMA introduced the mandatory filing to CFIUS regulations, it also outlined the concept of "excepted investors." Excepted investors are not subject to CFIUS's expanded jurisdiction for certain non-controlling investments or real estate transactions, and are exempt from mandatory filing requirements. Excepted investors and their parents must meet relatively strict nationality-related criteria related to "excepted foreign states" —currently Australia, Canada, the UK and New Zealand. Excepted investors are not exempt from CFIUS's general jurisdiction, only from CFIUS's expanded authorities under FIRRMA.

Types of deals reviewed

Consistent with its long-standing authorities, CFIUS has jurisdiction to review any transaction that could result in "control" of a US business by a foreign person. Control is defined as the power, direct or indirect, whether exercised or not, to determine, direct or decide important matters affecting an entity. CFIUS interprets control broadly and, notably, control can be present even in minority investments. A US business is similarly defined and interpreted broadly by CFIUS.

In addition to its traditional authorities regarding control transactions, under FIRRMA, CFIUS also has expanded jurisdiction to review certain covered investments in TID US businesses. These are businesses that: produce, design, test, manufacture, fabricate or develop one or more critical technologies subject to US export controls; perform certain actions in relation to identified critical infrastructure assets, referred to as "covered investment critical infrastructure"; or maintain or collect sensitive personal data of US citizens.

A covered investment is a non-controlling transaction that affords the foreign investor any of the following with respect to a TID US business: access to any "material non-public technical information" in its possession; board membership or observer rights (including nomination rights); or any involvement, other than through voting of shares, in substantive decision-making regarding sensitive personal data of US citizens, critical technologies or covered investment-critical infrastructure.

CFIUS also has jurisdiction to review changes in rights that would provide control or, for a TID US business, covered investment rights, as well as transactions designed to evade CFIUS review.

Covered transactions—those subject to CFIUS's jurisdiction—include deals structured as stock or asset purchases, debt-to-equity conversions, foreign-foreign transactions where the target has US assets, private equity investments (in some cases even where the general partner is US-owned) and joint ventures into which a US business is being contributed.

Beyond its traditional investment focus, CFIUS also has jurisdiction to review the purchase or lease by, or a concession to, a foreign person or real estate in the US that is located within, or will function as part of, certain air or maritime ports, or is located in or within certain proximity ranges of identified military installations and areas. The list of such military installations was expanded in 2024. Real estate transactions under CFIUS's jurisdiction are not subject to mandatory filing requirements.

Scope of the review

CFIUS reviews are focused on national security concerns. In each case, CFIUS conducts a risk-based analysis based on the threat posed by the foreign investor, the vulnerabilities exposed by the target US business, and the consequences to US national security of combining that threat and vulnerability. The CFIUS statute and a CFIUS executive order issued by President Joe Biden in 2022 each specify various factors for CFIUS to consider in its reviews.

Based on its risk assessment, CFIUS determines whether the transaction presents any national security concerns. If CFIUS identifies such concerns, it first determines whether other provisions of US law can sufficiently address them. If no other provisions of US law adequately address the concerns, CFIUS next determines whether any mitigation measures could resolve the concerns. If mitigation is warranted, CFIUS will typically negotiate terms with the parties, which will be a prerequisite to CFIUS clearing the transaction.

If CFIUS determines that mitigation cannot adequately resolve its concerns, CFIUS will typically request that the parties abandon their transaction, or that the foreign buyer divest its interest in the US business if the review happens following closing.

If the parties will not agree to abandonment or divestment, CFIUS can recommend that the president of the US block the investment, as only the president has the authority to prohibit a transaction. Presidential blocks are relatively rare, with only seven having occurred in history. It is more typical for parties to agree to terms for abandonment or divestment directly with CFIUS. Although the CFIUS process is confidential, presidential block orders are public.

Review process timeline

There are two options for how parties can notify a transaction to CFIUS: a declaration, which is a short-form filing reviewed on an expedited basis; or a voluntary notice, which is the traditional CFIUS notification mechanism. Both declarations and notices include required information about the investor and its owners, the US business that is the subject of the transaction and the transaction itself, although notices require more information, including personal identifier information for directors and officers of the investor and its parent companies. For both declarations and notices, CFIUS will also typically request additional information through questions and answers during the review.

Following the initial submission, the declaration process typically takes approximately five to eight weeks, and the notice process usually takes approximately three to five months. Following its assessment of a declaration, CFIUS may request the parties file a notice, so in those cases the total process for a transaction notified by declaration will take longer. A variety of factors can impact whether to file via a notice or declaration. For example, for more complex transactions, deals expected to be more sensitive from a national security standpoint or in cases where parties want to be assured the certainty of CFIUS clearance, it may be advisable for the parties to start with a notice.

Once accepted by CFIUS, a declaration is assessed in 30 calendar days. At the end of the 30 days, CFIUS may take one of four actions: clear the transaction; inform the parties that CFIUS cannot clear the transaction on the basis of the declaration, but not request a notice (commonly referred to as the "shrug"); request that the parties file a notice for the transaction; or initiate a unilateral review.

Although the shrug outcome does not confer "safe harbor" as a clearance does—after a shrug, CFIUS could theoretically request a notice for the transaction in the future—generally transaction parties have treated the shrug outcome as sufficient for closing.

For a notice, the parties initially submit a draft "prefiling," on which CFIUS will provide comments and follow-up questions. After addressing those comments, parties will formally file the notice with CFIUS. CFIUS then has to accept the filing, at which time a 45-calendar-day initial review begins. At the end of the review, CFIUS will either clear the transaction or proceed to a 45-calendar-day investigation. As of the most recent data published by CFIUS, more than half of cases proceed to investigation.

If a transaction is referred to the president, the president has 15 calendar days to decide whether to prohibit the transaction.

In some cases, CFIUS will need additional time to complete its process, such as when negotiating mitigation measures with the parties. An investigation may be extended for one 15-calendar-day period in "extraordinary circumstances," although this happens rarely. More typically, in such circumstances, CFIUS will allow the parties to withdraw and resubmit their filing, which restarts the initial 45-day review period. Most transactions are cleared in one CFIUS cycle.

Filing fees apply to notices submitted to CFIUS, but not to declarations—although they apply for notices submitted following CFIUS's assessment of a declaration. Fees are assessed based on a tiered approach, providing for a proportional cost equal to or less than 0.15 percent of the transaction value. The lowest fee is US$750 for transactions valued between US$500,000 and US$5 million (transactions under US$500,000 are not subject to fees), and the highest-tier fee is US$300,000 for transactions valued at US$750 million or more.

How foreign investors can protect themselves

It is critical for foreign investors to consider CFIUS issues—including assessing jurisdictional matters, whether mandatory CFIUS filing will apply or a voluntary filing is advisable, and potential substantive risks—as early as possible in cross-border transactions involving direct or indirect foreign investment in a US business. Notably, this includes minority and venture capital investments.

Given potentially severe penalties for noncompliance, parties need to know early on whether filing will be required. Where it is not, they may want to include relevant representations in the purchase agreement to provide additional protection.

In cases where filing is mandatory or the parties voluntarily notify CFIUS, allocation of CFIUS mitigation risk will be a key issue. Most transactions are cleared without mitigation, but mitigation has become more frequent in recent years and, when it is required, it can have a substantial impact on transaction goals and present unexpected costs.

The range of mitigation measures that can be imposed by CFIUS is quite broad, based on the risk profile of the deal, and it is important for investors in particular to have as clear an understanding as possible with respect to what mitigation measures would be acceptable to them. Between additional CFIUS resources enabling CFIUS to address concerns in a broader range of transactions and more focused review of certain national security considerations under both FIRRMA and the 2022 CFIUS executive order, mitigation may continue to increase in frequency.

_{White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.}

_{This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.}

_{© 2025 White & Case LLP}