CFIUS Mandatory Filing: When You Have No Choice But to File

Most sophisticated dealmakers know that CFIUS exists. Fewer understand that for certain transactions, filing with the committee is not a strategic choice — it is a legal obligation. Missing a mandatory filing deadline does not simply delay a deal. It can expose the parties to civil penalties equal to the full value of the transaction and invite the kind of regulatory scrutiny that no cross-border investor wants.

Since the Foreign Investment Risk Review Modernization Act (FIRRMA) took effect in 2020, the mandatory filing regime has become one of the most consequential — and most frequently misunderstood — aspects of U.S. foreign investment law.

The Two Pillars of Mandatory Filing

FIRRMA established two distinct categories of transactions that require a mandatory declaration to CFIUS. Understanding which category applies — and whether your transaction falls within it — is the first task for any cross-border dealmaker.

Pillar One: Foreign Government Investment in TID U.S. Businesses

The first mandatory filing category applies when a foreign government will hold a "substantial interest" in a U.S. business that qualifies as a TID U.S. business — one that deals in critical technology, critical infrastructure, or sensitive personal data of U.S. citizens.

"Substantial interest" is defined as a voting interest of 25% or more held directly or indirectly by a foreign government. This threshold applies at the level of the foreign acquirer — meaning that if a foreign government holds 25% or more of the entity making the investment, the mandatory filing requirement is triggered regardless of the size of the stake being acquired in the U.S. business.

This pillar captures a wide range of MENA-based investors. Sovereign wealth funds, state-owned enterprises, and government-linked investment vehicles from the Gulf region frequently hold or are held by foreign governments at levels that trigger this requirement. The analysis is not always straightforward — ownership structures involving multiple layers of holding companies, nominee arrangements, or co-investment vehicles require careful tracing to determine whether the 25% threshold is met.

Pillar Two: Critical Technology Transactions

The second mandatory filing category applies to investments in U.S. businesses that produce, design, test, manufacture, fabricate, or develop "critical technologies" — regardless of whether a foreign government is involved.

Critical technologies under FIRRMA include:

• Items controlled under the Export Administration Regulations (EAR) for national security, missile technology, nuclear nonproliferation, or chemical and biological weapons reasons
• Items controlled under the International Traffic in Arms Regulations (ITAR)
• Nuclear materials and facilities subject to Nuclear Regulatory Commission licensing
• Select agents and toxins regulated by the CDC and USDA
• Emerging and foundational technologies controlled under the EAR

The critical technology pillar is particularly significant for investors in U.S. defense contractors, aerospace companies, semiconductor manufacturers, biotechnology firms, and advanced manufacturing businesses. The list of controlled technologies has expanded substantially in recent years as the Commerce Department has moved to control emerging technologies in areas such as artificial intelligence, quantum computing, and advanced materials.

What Counts as a "Covered Investment" Under the Mandatory Rules?

Not every investment in a TID U.S. business triggers mandatory filing. The transaction must constitute a "covered investment" — defined as a foreign investment that affords the investor:

• Access to material nonpublic technical information in the possession of the U.S. business
• Membership or observer rights on the board of directors or equivalent governing body
• Any involvement, other than through voting of shares, in substantive decision-making regarding the use, development, acquisition, or release of critical technology, critical infrastructure, or sensitive personal data

This definition is broader than it may appear. A minority investment that does not convey formal control can still trigger mandatory filing if it comes with board observer rights, information rights to sensitive technical data, or contractual rights to participate in key business decisions.

Deal lawyers who focus on the absence of majority control — without examining these ancillary rights — can miss mandatory filing obligations that are hiding in plain sight in the transaction documents.

The Declaration vs. Full Notice: Choosing Your Filing Vehicle

When a mandatory filing is required, parties have a choice between two filing vehicles: a short-form declaration or a full voluntary notice.

The short-form declaration is a streamlined submission of approximately 5 pages. CFIUS has 30 days to respond to a declaration. The committee can clear the transaction, request a full notice, initiate a unilateral review, or take no action. A declaration that results in "no action" does not provide the same safe harbor as a cleared full notice — CFIUS retains jurisdiction to reopen the review.

The full voluntary notice is a comprehensive submission that can run 50 pages or more. It triggers the full 30-day initial review period, with the possibility of a 45-day investigation. A transaction cleared through a full notice receives a complete safe harbor — CFIUS cannot reopen the review absent fraud or material misrepresentation.

For transactions with significant national security sensitivities, the full notice is almost always the better choice, even when a declaration would technically satisfy the mandatory filing requirement. The safe harbor provided by a cleared full notice is a valuable asset in any transaction — particularly for investors who plan to make additional U.S. acquisitions in the future.

Penalties for Non-Compliance: The Stakes Are Real

CFIUS has the authority to impose civil penalties of up to the value of the transaction for failure to file a mandatory declaration. The committee has made clear that it will use this authority.

In recent years, CFIUS has imposed penalties on parties who failed to file mandatory declarations, including in cases where the parties claimed they were unaware of the requirement. Ignorance of the mandatory filing rules is not a defense. The committee's enforcement posture has hardened as CFIUS has grown more assertive in policing the boundaries of its jurisdiction.

Beyond civil penalties, failure to file can result in:

• A CFIUS-initiated unilateral review of the transaction, potentially after closing
• Forced divestiture of the acquired U.S. business
• Reputational damage that affects future U.S. market access
• Referral to the Department of Justice for criminal investigation in cases involving willful non-compliance

For MENA-based investors, the reputational consequences of a CFIUS enforcement action can be particularly severe. The committee's findings are not always made public, but enforcement actions have a way of becoming known in the investment community — and they can complicate future transactions for years.

Common Misconceptions That Lead to Non-Filing

Several persistent misconceptions lead sophisticated parties to incorrectly conclude that no mandatory filing is required.

"We're only taking a minority stake." Minority investments can trigger mandatory filing if they involve a TID U.S. business and convey board rights, information rights, or decision-making involvement. The size of the stake is not the determining factor.

"The U.S. business doesn't have government contracts." Government contracts are relevant to CFIUS analysis, but they are not the threshold for mandatory filing. A U.S. business can trigger mandatory filing based on its technology, infrastructure, or data activities without having a single government contract.

"Our sovereign wealth fund is commercially operated." CFIUS does not distinguish between commercially operated and government-directed sovereign wealth funds for purposes of the mandatory filing threshold. If a foreign government holds 25% or more of the fund, the threshold is met.

"We already got export control clearance." Export control compliance and CFIUS compliance are separate legal regimes. Obtaining an export license or commodity classification does not satisfy CFIUS filing requirements.

"The deal closed two years ago." CFIUS jurisdiction does not expire after closing for transactions that were not filed. The committee can initiate a unilateral review of a completed transaction at any time — and has done so for transactions that closed years earlier.

Practical Steps for Assessing Your Mandatory Filing Exposure

For any cross-border transaction involving a U.S. business, the mandatory filing analysis should begin at the term sheet stage. Key questions include:

Does the U.S. business qualify as a TID U.S. business? This requires a careful review of the business's activities, technologies, infrastructure assets, and data practices. Many businesses that do not think of themselves as "sensitive" qualify as TID U.S. businesses based on their data practices alone.

Does the acquirer have foreign government ownership at or above 25%? This requires tracing the acquirer's ownership structure through all layers to identify any foreign government interest. Sovereign wealth funds, state pension funds, and government-linked investment vehicles require particular attention.

Does the transaction convey rights that trigger the covered investment definition? This requires reviewing the transaction documents — not just the share purchase agreement, but also any ancillary agreements, side letters, information rights agreements, and governance documents.

Is the U.S. business involved in critical technologies? This requires a review of the business's export control classifications, ITAR registrations, and technology development activities.

The Value of Early Counsel

The mandatory filing analysis is not a checkbox exercise. It requires legal judgment, factual investigation, and an understanding of how CFIUS applies its rules in practice — which is not always how the rules read on paper.

Engaging experienced CFIUS counsel before signing gives parties the time to conduct a thorough analysis, structure the transaction to manage CFIUS risk, and prepare a filing that presents the transaction in its best light. Waiting until after signing — or after closing — forecloses options and increases risk.

For investors from MENA jurisdictions, early engagement is especially important. The geopolitical context in which CFIUS operates has made the committee more attentive to transactions involving the region, and the mandatory filing rules are applied with that context in mind.

---

Wassim Joseph Law, PLLC advises foreign investors and U.S. businesses on CFIUS mandatory filings, voluntary notices, and national security compliance for cross-border transactions. Contact us to assess your filing obligations before you sign.