The Mechanics of CFIUS: Jurisdiction, Review Process, and National Security Risk Factors

The Committee on Foreign Investment in the United States (CFIUS) is an interagency committee authorized to review certain foreign investments in the United States to determine their effect on national security. If a transaction poses a threat, the committee can impose stringent mitigation measures or recommend that the President block it entirely.[3]

Chaired by the Secretary of the Treasury, the committee includes representatives from the Departments of Defense, State, Justice, Commerce, Energy, and Homeland Security, alongside specialized offices like the US Trade Representative. This composition ensures that economic, diplomatic, and military perspectives are integrated into the review of cross-border capital flows.[3]

Historically, CFIUS operated largely in the shadows, reviewing straightforward acquisitions where a foreign entity sought a controlling stake in a traditional US defense contractor or critical infrastructure asset. The primary test was whether the transaction resulted in foreign "control" over a sensitive American business.[2][3]

The landscape shifted dramatically with the passage of the Foreign Investment Risk Review Modernization Act (FIRRMA). This legislation expanded the committee's jurisdiction beyond traditional control transactions to include minority, non-controlling investments in specific sectors of the economy.[2]

This expanded jurisdiction specifically targets "TID" US businesses—entities that deal in critical Technology, critical Infrastructure, or sensitive personal Data. A foreign investor purchasing even a small equity stake in a TID business can trigger CFIUS jurisdiction if the investment grants them access to material nonpublic technical information or board observer rights.[2][3]

Real estate also falls under this expanded umbrella. CFIUS now holds the authority to review the purchase or lease of real estate by foreign persons if the property is located near sensitive US military installations, ports, or government facilities, regardless of whether a US business is being acquired.[2]

The review mechanism itself is highly structured. It typically begins when transaction parties submit a voluntary notice or a shorter mandatory declaration. While filing is often voluntary, parties are incentivized to file to obtain a "safe harbor" letter, which prevents CFIUS from unwinding the deal in the future.[3]

Mandatory filings are triggered by specific criteria, most notably when a foreign government acquires a "substantial interest" in a TID US business, or when a transaction involves specific critical technologies subject to export controls.[3]

Once a declaration is filed, CFIUS has 30 days to assess the transaction. For a full notice, the committee conducts a 45-day review. During this period, intelligence agencies conduct a National Security Threat Assessment to evaluate the intent and capabilities of the foreign investor.[3]

If national security concerns remain unresolved after the initial review, the process enters a 45-day investigation phase. This phase requires higher-level scrutiny and often involves complex negotiations between the government and the transaction parties.[3][4]

The definition of what constitutes a "national security risk" has also evolved significantly. A 2022 Executive Order formalized new risk factors, directing CFIUS to explicitly consider a transaction's impact on supply chain resilience, particularly in manufacturing capabilities and critical minerals.[1]

The order also mandates scrutiny of transactions that could compromise US technological leadership in emerging fields such as microelectronics, artificial intelligence, biotechnology, and quantum computing.[1]

Furthermore, CFIUS now evaluates aggregate industry investment trends. The committee recognizes that a series of small, seemingly isolated transactions by foreign entities can cumulatively facilitate the transfer of critical technology or grant adversaries a strategic foothold in a vital sector.[1]

When CFIUS identifies a risk, it rarely jumps straight to prohibition. Instead, the committee frequently negotiates National Security Agreements (NSAs) with the transaction parties to mitigate the identified threats.[3][4]

These mitigation measures can be extensive and costly. They may require companies to store sensitive data exclusively on US soil, restrict foreign board members' access to technical information, divest certain product lines, or appoint government-approved security directors.[4]

If mitigation is deemed insufficient or impossible to enforce, CFIUS refers the case to the President. The President possesses the sole statutory authority to suspend or prohibit the transaction, a power that has been utilized with increasing frequency over the past decade.[3]

Recent trends from the 2025 annual report highlight an increasingly rigorous enforcement environment. The data shows a higher rate of withdrawn notices, as parties frequently choose to abandon deals rather than face protracted investigations or insurmountable mitigation requirements.[4]

The committee has also formalized and expanded its penalty guidelines, signaling that violations of existing mitigation agreements will face strict financial consequences. This marks a shift from merely screening new deals to actively policing past approvals.[4]

Ultimately, the mechanics of CFIUS reflect a structural realignment in global economics. The free flow of capital is no longer assumed to be universally beneficial; instead, cross-border investment is now systematically filtered through the lens of national defense and strategic competition.[5]