The CFIUS Review Process: What Foreign Investors Must Know

Foreign investors entering the U.S. market face a regulatory landscape that has grown significantly more complex since the passage of the Foreign Investment Risk Review Modernization Act (FIRRMA) in 2018. At the center of that landscape is the Committee on Foreign Investment in the United States — CFIUS — a powerful interagency body with the authority to block, unwind, or impose conditions on transactions that threaten national security.

Understanding how CFIUS actually works is not optional for cross-border dealmakers. It is essential.

What Is CFIUS and Why Does It Matter?

CFIUS is an interagency committee chaired by the Secretary of the Treasury. Its members include the Departments of Defense, State, Homeland Security, Justice, Commerce, Energy, and the Office of the U.S. Trade Representative, among others. The committee reviews "covered transactions" — broadly, any foreign acquisition of, or investment in, a U.S. business that could affect national security.

The committee's authority is sweeping. It can recommend that the President block a transaction outright, require divestiture of a completed deal, or negotiate a mitigation agreement that allows a transaction to proceed under conditions. Since FIRRMA, its jurisdiction has expanded to include certain real estate transactions near sensitive government facilities and minority investments in TID U.S. businesses — those in critical technology, critical infrastructure, or sensitive personal data.

For MENA-based investors and companies with ties to foreign governments, CFIUS scrutiny is not a remote possibility. It is a near-certainty for any transaction touching sensitive sectors.

Phase One: The Initial 30-Day Review

Once a voluntary notice or mandatory declaration is filed, CFIUS enters its initial review phase. The committee has 30 days to complete this phase and determine whether to clear the transaction, open a formal investigation, or — in rare cases — refer the matter directly to the President.

During this phase, CFIUS analysts from each member agency examine the transaction for national security implications. They assess the nature of the U.S. business, the identity and ownership structure of the foreign acquirer, and whether the transaction raises concerns related to:

• Access to critical technologies or intellectual property
• Control over critical infrastructure
• Access to sensitive personal data of U.S. citizens
• Proximity to sensitive U.S. government facilities
• The acquirer's ties to foreign governments or military entities

Parties should expect information requests during this phase. Responses must be accurate, complete, and timely. Incomplete or evasive responses can extend the review and signal bad faith to the committee.

Phase Two: The 45-Day Investigation

If CFIUS cannot clear a transaction during the initial review, it opens a formal investigation. This phase lasts up to 45 days and involves deeper scrutiny of the transaction and the parties involved.

During a Phase Two investigation, CFIUS may:

• Issue additional requests for information (RFIs) to the parties
• Conduct classified briefings with intelligence community input
• Engage directly with the U.S. business being acquired
• Begin negotiating mitigation measures with the parties

Mitigation agreements — sometimes called national security agreements or NSAs — are the committee's primary tool for allowing transactions to proceed while managing identified risks. Common mitigation measures include:

• Restrictions on foreign personnel accessing sensitive facilities or data
• Requirements to maintain U.S.-citizen boards or security officers
• Obligations to notify CFIUS of material changes to the business
• Firewalls between the U.S. business and its foreign parent

Negotiating effective mitigation requires experienced counsel. Agreements that are too broad can impair the commercial value of the acquisition. Agreements that are too narrow may not satisfy the committee — or may be reopened later.

The Presidential Referral: A Rare but Consequential Step

If CFIUS cannot resolve its national security concerns through mitigation, it may refer the transaction to the President. The President then has 15 days to act — either blocking the transaction, requiring divestiture, or taking no action.

Presidential referrals are uncommon but have increased in frequency for transactions involving acquirers from countries of concern, particularly China. High-profile cases — including the blocked acquisition of Lattice Semiconductor and the forced divestiture of Grindr — illustrate that presidential action is a real risk for transactions that reach this stage.

For parties from MENA jurisdictions, the risk of presidential referral depends heavily on the specific country, the acquirer's ownership structure, and the nature of the U.S. business. State-owned enterprises and sovereign wealth funds face heightened scrutiny regardless of the transaction's apparent commercial rationale.

Mandatory vs. Voluntary Filings: Knowing When You Must File

One of the most consequential decisions in any cross-border transaction is whether to file with CFIUS — and whether filing is mandatory or voluntary.

FIRRMA created a mandatory declaration requirement for two categories of transactions:

1. TID U.S. businesses with foreign government investment. If a foreign government will hold a "substantial interest" in a U.S. business that deals in critical technology, critical infrastructure, or sensitive personal data, a mandatory declaration must be filed.

2. Critical technology transactions. Certain investments in U.S. businesses that produce, design, test, manufacture, or develop critical technologies require a mandatory declaration regardless of foreign government involvement.

Failure to file a mandatory declaration can result in civil penalties of up to the value of the transaction. The committee has demonstrated a willingness to impose these penalties, and enforcement has increased since FIRRMA.

For transactions that do not trigger mandatory filing, voluntary notice remains the prudent course in most cases. A voluntary filing provides a safe harbor — once CFIUS clears a transaction, it cannot reopen the review absent fraud or material misrepresentation. Without a filing, CFIUS retains jurisdiction indefinitely, including after closing.

Practical Guidance for Cross-Border Dealmakers

Navigating CFIUS successfully requires early planning, not reactive compliance. Parties should engage CFIUS counsel at the term sheet stage — before signing — to assess jurisdiction, identify potential concerns, and develop a filing strategy.

Key considerations include:

Assess jurisdiction early. Not every foreign investment triggers CFIUS jurisdiction. A careful analysis of the U.S. business's activities, the nature of the investment, and the acquirer's ownership structure can determine whether a filing is required, advisable, or unnecessary.

Structure the transaction with CFIUS in mind. Deal structure can affect CFIUS risk. Minority investments that do not convey control or board rights may fall outside mandatory filing requirements. Carve-outs of sensitive business units can reduce the transaction's national security footprint.

Prepare for information requests. CFIUS will want detailed information about the acquirer's ownership structure, including any foreign government ownership at any level. Parties should be prepared to provide organizational charts, shareholder agreements, and information about the acquirer's business activities in other countries.

Engage proactively with the committee. Pre-filing meetings with CFIUS staff — available to parties before a formal notice is filed — can surface concerns early and allow parties to address them before the clock starts running.

The Cost of Getting It Wrong

The consequences of CFIUS missteps are severe. Transactions blocked by the President cannot proceed. Completed transactions can be unwound — sometimes years after closing. Civil penalties for failure to file mandatory declarations can equal the full value of the transaction. And reputational damage in the U.S. market can be lasting.

For investors from MENA jurisdictions, the stakes are particularly high. The geopolitical environment has made CFIUS more attentive to transactions involving the region, and the committee's analytical framework increasingly incorporates intelligence community assessments of foreign government influence and intent.

The CFIUS process is manageable — but only with experienced counsel who understands both the regulatory framework and the geopolitical context in which it operates.

---

Wassim Joseph Law, PLLC advises foreign investors, U.S. businesses, and multinational enterprises on CFIUS filings, national security reviews, and cross-border transactions involving the USA and MENA region. Contact us to discuss your transaction.