The Three Categories of Covered Transactions: How CFIUS Reviews Foreign Investment in U.S. Technology, Infrastructure, and Data

The Committee on Foreign Investment in the United States (CFIUS) reviews non-controlling foreign investments in domestic businesses by classifying them into three distinct jurisdictional categories: critical technology, critical infrastructure, and sensitive personal data. Together, these form the "TID" framework, a statutory mechanism that dictates whether a foreign entity can acquire equity, board seats, or information rights in a U.S. company without triggering federal intervention. The architecture of this review process determines how capital flows into the American defense industrial base and the broader technology sector.[1][7][8]

Prior to the passage of the Foreign Investment Risk Review Modernization Act (FIRRMA) in 2018, the committee primarily concerned itself with transactions that granted a foreign person outright "control" over a U.S. business. The modern regulatory framework abandons that threshold for TID businesses, asserting jurisdiction over minority investments if they afford the investor access to material nonpublic technical information, board observer rights, or involvement in substantive decision-making regarding the company's core assets.[6][7]

The first pillar of the TID framework covers critical technologies. This category is tethered directly to existing U.S. export control regimes, capturing businesses that produce, design, test, or manufacture items restricted under the International Traffic in Arms Regulations (ITAR) or the Export Administration Regulations (EAR). If a U.S. startup develops a dual-use algorithm or a specialized semiconductor requiring a license for export to the investor's home country, any equity investment granting the investor access to that technology falls under mandatory CFIUS review.[1][3]

This technology threshold has fundamentally altered the venture capital stack. Defense tech companies must now treat their investor strategy as a national security issue, because accepting capital from a foreign limited partner can freeze a startup out of Department of Defense procurement pipelines. A mandatory declaration must be filed at least 30 days before the transaction closes, shifting the regulatory burden to the earliest stages of capital formation and forcing founders to audit their capitalization tables before signing term sheets.[2][3]

The second category encompasses critical infrastructure. Rather than relying on a broad conceptual definition, the Treasury Department regulations provide a specific appendix listing 28 distinct types of infrastructure and their associated functions. This statutory list includes entities that own, operate, manufacture, or service physical and virtual assets ranging from interstate oil pipelines and high-capacity telecommunications networks to specialized financial market utilities and bulk-power systems.[1][6]

For an investment to trigger the infrastructure provision, the U.S. business must perform a specified function—such as operating a water treatment facility or manufacturing components for the electrical grid—and the foreign investor must acquire rights that could enable the sabotage or disruption of that system. The regulatory logic treats the financial transaction as a vector for physical or operational access, allowing the committee to block investments that could compromise domestic resilience during a geopolitical crisis.[1][8]

The third and most expansive category is sensitive personal data. CFIUS asserts jurisdiction over investments in U.S. businesses that maintain or collect identifiable data on more than one million individuals, or that target data on specific populations like military personnel or federal employees. This provision was engineered specifically to prevent foreign intelligence services from acquiring bulk datasets through commercial acquisitions, bypassing traditional espionage methods.[5][8]

Sensitive data under this framework includes genetic information, biometric identifiers, financial distress metrics, and precise geolocation data. Consequently, a health-tech startup with no defense contracts and no critical infrastructure assets can still trigger a mandatory CFIUS review if it processes the biometric data of U.S. citizens and accepts funding from a foreign-backed private equity firm. The data pillar effectively expands national security jurisdiction into the consumer technology sector.[1][5]

To mitigate the friction on allied capital, the framework includes an "excepted investor" carve-out. Investors from specific allied nations—currently limited to a narrow list including the United Kingdom, Australia, Canada, and New Zealand—can bypass certain non-controlling transaction reviews if they meet stringent criteria regarding their ownership structure, board composition, and history of compliance with U.S. law.[4][6]

However, this exception is fragile and highly conditional. An excepted investor can lose its status if it violates U.S. sanctions, export controls, or previous CFIUS mitigation agreements. Furthermore, the exception only applies to non-controlling investments; if an allied investor acquires outright control of a TID U.S. business, the transaction remains subject to the committee's full jurisdictional authority, regardless of the investor's country of origin.[4][6]

When a covered transaction presents a national security risk, CFIUS rarely blocks it outright. Instead, the committee typically imposes mitigation agreements—legally binding contracts that restrict the foreign investor's access to the U.S. business's facilities, networks, or data. These agreements can require the U.S. company to establish a security committee composed exclusively of U.S. citizens, to host its data on domestic servers, or to sever specific foreign supply chain dependencies.[2][3]

The ultimate enforcement mechanism for the TID framework is the committee's power to unwind closed transactions. If parties fail to file a mandatory declaration for a covered investment in a technology, infrastructure, or data business, CFIUS retains the statutory authority to investigate the deal indefinitely. Should the committee find an unresolved national security risk, it can compel the foreign investor to divest its equity stake entirely, regardless of how much time has passed since the capital changed hands.[1][7]