CFIUS Review
CFIUS review refers to the national security assessment conducted by the Committee on Foreign Investment in the United States, a multi-agency federal body that reviews foreign acquisitions of US businesses to identify and mitigate risks to national security.
The Committee on Foreign Investment in the United States (CFIUS) is an interagency body chaired by the Treasury Secretary that evaluates whether foreign acquisitions of US businesses pose risks to national security. It operates under authority delegated by the President and can recommend that the President block or unwind transactions on national security grounds. Its authority was significantly expanded by the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA).
CFIUS jurisdiction is broad and applies to any transaction in which a foreign person acquires control of a US business, as well as — post-FIRRMA — certain non-controlling investments in US businesses that are critical technology companies, critical infrastructure companies, or companies that maintain or collect sensitive personal data of US citizens. FIRRMA also created mandatory filing requirements for certain categories of transactions, particularly in the critical technology and critical infrastructure sectors, eliminating the voluntary nature of filing for those deals.
The CFIUS review process begins with a notice or declaration filed by the parties. A short-form declaration triggers a 30-day review. A full notice triggers a 45-day initial review period, which can be extended by a 45-day investigation period if the committee identifies national security concerns or if the transaction involves certain sensitive sectors (government contractors, critical infrastructure, sensitive personal data, proximity to military installations). In total, the formal review windows can extend to 90 days, though in practice reviews often take longer due to information requests.
CFIUS can clear a transaction unconditionally, clear it with a mitigation agreement (requiring operational changes, restrictions on foreign employee access, or independent monitoring), or recommend that the President prohibit or unwind the deal. Presidential action blocking or unwinding a CFIUS-reviewed transaction is rare but has occurred — most notably in 2018 when President Trump blocked Broadcom's hostile bid for Qualcomm on national security grounds related to 5G technology leadership.
For cross-border M&A, CFIUS risk has become a central deal diligence and structuring consideration. Deals involving technology, defense supply chains, telecommunications, financial data, or healthcare data now routinely require dedicated CFIUS counsel and, in some cases, pre-signing engagement with the committee to assess the likelihood of clearance.