A CFIUS review is the U.S. government's check on whether a foreign investment in an American company raises national security concerns. Some transactions must be filed with the Committee on Foreign Investment in the United States before closing. Most are voluntary, but skipping a filing leaves a completed deal open to review after the fact.
The committee sits inside the Treasury Department and draws its members from across the national security and economic agencies. According to CFIUS's official overview, the Secretary of the Treasury chairs the committee, and the members include the heads of the Departments of Justice, Homeland Security, Commerce, Defense, State and Energy, along with the U.S. Trade Representative and the Office of Science and Technology Policy. The Director of National Intelligence and the Secretary of Labor participate as non-voting, ex officio members. The Secretary of Agriculture joins case by case when a deal involves agricultural land or the agriculture industry.
For buyers and sellers, the practical questions are the same: does this deal require a filing, what does the process cost in time, and what can the government do to the transaction at the end of it? This explainer walks through each in turn.
When is a CFIUS filing mandatory?
Most CFIUS filings are voluntary. Parties file because they want certainty, not because the law forces them to. But two categories carry a mandatory filing obligation.
The committee's own materials describe the first: under 31 C.F.R. § 800.401, a declaration is mandatory where a foreign government is acquiring a substantial interest in certain U.S. businesses, and for certain covered transactions involving critical technologies. A substantial interest means a foreign government holds meaningful rights in the U.S. business, directly or indirectly, even if it is not buying control.
Parties who fail to make a mandatory filing face civil penalties. Even where filing is optional, closing without one has consequences: the committee can open a review of a completed transaction at any time, and a deal that closed years ago is not safely out of reach.
What are declarations and notices?
CFIUS accepts two kinds of filings, and they differ in depth and in what they buy the parties.
A declaration is the short form. The committee's overview describes it as an abbreviated process that can lead to a shorter timeline, such as a 30-day assessment period. The reward for filing is a potential safe harbor letter, which limits the committee from later reopening the transaction except in limited circumstances. A declaration works best for deals where the national security profile is plainly light.
A notice is the full filing. It is detailed, it takes longer, and it is the route for transactions with real national security questions. Parties may withdraw a notice or declaration at any time during review, in writing and subject to committee approval, which may come with conditions such as a requirement to re-file later. The committee can also reject a voluntary filing that is incomplete, that the parties failed to support with follow-up answers, or where material information contradicts what the parties provided.
How does the review process unfold?
The notice process runs on a fixed timetable, and each stage has a deadline set by statute and regulation.
- Review, 45 days. Once the committee accepts a complete notice, the next business day starts the review clock. The review period ends no later than the 45th calendar day after it begins, or the next business day if the 45th day is not a business day.
- Investigation, 45 days. If unresolved questions remain, the committee opens an investigation, which must be completed within 45 days. In extraordinary circumstances, the Treasury Secretary or Deputy Secretary may extend it by one 15-day period on a written request from a lead agency.
- Presidential decision, 15 days. In certain circumstances the committee refers a transaction to the President. The statute requires the President to announce a decision within 15 days of the investigation's completion.
During review or investigation, the parties must answer follow-up information requests within three business days, or within a longer window if the Staff Chairperson grants one in writing. The clock is unforgiving, and incomplete answers can cost a deal its timeline.
At the end, the committee either advises the parties in writing that all action has concluded, because no unresolved national security risks remain, or it takes one of the paths below.
What happens when CFIUS finds a risk?
Not every flagged transaction gets blocked. The committee has a middle option, and it is the one most deals with genuine concerns end up taking.
Where the committee identifies national security risks it cannot otherwise resolve, it can negotiate a mitigation agreement with the parties. Mitigation imposes conditions designed to protect the security interest while letting the deal close. Common conditions include governance changes at the U.S. business, restrictions on access to certain technology or customer data, and ongoing compliance reporting to the committee. Mitigation is a contract with the government, and breaching it carries consequences.
The last resort is referral to the President, who may suspend or prohibit the transaction. Presidential blocking is rare, but the possibility shapes bargaining throughout the process. Parties who see a referral coming often restructure the deal, narrow the foreign investor's rights, or withdraw and abandon the transaction rather than reach the President's desk.
What this means for buyers and sellers
Our analysis of the process points to three practical takeaways for anyone structuring a cross-border deal.
First, screen early. Whether a transaction is covered, and whether a mandatory declaration applies, depends on the nature of the U.S. business, the foreign investor's ownership structure and any foreign government involvement. These are questions about deal structure, and they are far easier to answer before signing than after.
Second, treat the filing decision as a risk allocation question in the purchase agreement. Who bears the cost if the committee demands mitigation, and who may walk away if the President blocks the deal? Buyers and sellers negotiate these conditions expressly, and the answers change the price.
Third, remember that CFIUS is one of several merger reviews a cross-border deal may face. Antitrust review under the HSR Act runs on its own timetable and its own agency, as our HSR merger review explainer covers; national security review does not substitute for it, and a clearance from one says nothing about the other. Readers tracking the broader trade and investment policy picture can find related coverage in our trade section. Readers following this should also see HSR Merger Review Explained: Waiting Periods, Second Requests and Gun-Jumping.
The trade-off parties accept in exchange for a safe harbor letter is disclosure. A filing hands the government a full picture of the investor and the target, including information a party might prefer not to share. For most deals that is a fair price for certainty. For a few, the calculus runs the other way, and the deal is structured to fall outside the committee's jurisdiction entirely. This connects to our earlier piece, Related-Party Transactions: Item 404 Disclosure and the Audit Committee's Gatekeeping Role.
What should parties do after a transaction closes?
Closing is not the end of exposure. The committee can review a completed covered transaction at any time, and a voluntary filing that was never made offers no protection. Parties who closed without filing sometimes file a voluntary notice after the fact to seek the same safe harbor they could have obtained before closing.
The safer path, and the one most experienced deal counsel recommend, is to document the analysis of whether a transaction is covered before signing. If the deal is not covered, the file explains why. If it is, the filing goes in on time. Either way, the record exists, and the party can answer the committee's questions if they ever come.
