CFIUS Covered Transactions: Types, Filings, and Penalties

CFIUS covered transactions fall into three buckets: acquisitions that hand a foreign person control of a U.S. business, non-controlling investments in U.S. businesses tied to critical technology, critical infrastructure, or sensitive personal data, and certain foreign purchases or leases of real estate near military and government sites.¹ Whether your deal falls into one of these three categories is the threshold question. It decides whether CFIUS can review the transaction at all, whether you must file, and whether failing to file exposes you to penalties.

Control Transactions

The broadest category reaches any merger, acquisition, or takeover that could give a foreign person control over a U.S. business. Joint ventures qualify too, when a foreign person contributes assets alongside a U.S. company and ends up with the power to direct important decisions.² The definition reaches back to any deal proposed or pending after August 23, 1988, so a transaction can qualify even if it was proposed decades ago and never completed.

“Control” is a functional concept, not a fixed ownership percentage. A foreign person has control when they can determine, direct, or decide important matters affecting the business, whether that power flows from majority ownership, a dominant minority stake, board representation, contract, or an informal agreement to act together. The regulation lists ten categories of important matters that signal control, including the power to sell principal assets, close or relocate production facilities, approve the operating budget, select new business lines, appoint or dismiss officers, and set policies on handling non-public technical information.³

This is where deal structuring gets tricky. A foreign investor holding 15 percent of the voting shares can still be treated as having control if the deal gives them veto rights over asset sales, the power to appoint the CEO, or authority over sensitive technology policies. The regulations look past the cap table to the practical power the foreign person walks away with.

The Passive Investment Carve-Out

Not every equity purchase triggers jurisdiction. A transaction is not a covered control transaction if the foreign person acquires 10 percent or less of the U.S. business’s outstanding voting interest and the investment is solely for passive purposes.⁴ A foreign sovereign wealth fund buying a small equity stake in a public company purely for financial return, with no intention of influencing management, is the classic example.

The carve-out disappears once the investor negotiates contractual rights that grant influence over important business decisions or secures the right to appoint a board member.⁴ A small stake bundled with governance rights is no longer passive, whatever its size. And even a genuinely passive stake in a TID business may still be a covered investment under the separate non-controlling rules described next.

Non-Controlling Investments in TID Businesses

The Foreign Investment Risk Review Modernization Act of 2018 extended CFIUS jurisdiction beyond control deals to reach non-controlling investments in businesses involved with critical technology, critical infrastructure, or sensitive personal data. These are known as TID businesses. A covered investment is a direct or indirect investment by a foreign person (other than an excepted investor) in an unaffiliated TID U.S. business that is not a control transaction but still gives the investor one of three specific footholds.⁵

The three triggers are access to material non-public technical information held by the business, board or observer rights (including the right to nominate someone to the board), or any involvement beyond simply voting shares in substantive decisions about sensitive personal data, critical technologies, or critical infrastructure operations.⁵ Any one of them is enough. No board seat is needed if the investor gets access to proprietary technical data.

What Makes a Business a TID Business

Under the technology prong, a U.S. business qualifies if it produces, designs, tests, manufactures, or develops “critical technologies.” That term covers items on the U.S. Munitions List, the Commerce Control List, items controlled under nuclear and select-agent regulations, and emerging and foundational technologies controlled under the Export Control Reform Act of 2018.⁶

The infrastructure prong reaches businesses performing specified functions related to systems so vital that their incapacity would have a debilitating impact on national security. The regulations identify the sectors and functions in an appendix, covering segments of energy, telecommunications, water, and financial services.⁷

The data prong catches businesses that maintain or collect sensitive personal data on U.S. citizens. The threshold gets the most attention: if the business has held identifiable data on more than one million people in a sensitive category over the preceding twelve months, it qualifies. A business also qualifies, regardless of dataset size, if it targets products or services to U.S. intelligence, national security, or homeland security agencies. Sensitive data categories include financial distress indicators, health information, geolocation data, biometric templates, non-public electronic communications, and data tied to government security clearances.⁸

When a Foreign Government Is Behind the Buyer

The stakes rise when a foreign government sits behind the acquiring entity. A foreign government holds a “substantial interest” in a foreign person if national or subnational governments of a single foreign state have a voting interest, direct or indirect, of 49 percent or more.⁹ When that government-backed entity acquires a substantial interest in a TID business, the transaction moves from voluntary review territory into a mandatory filing.

Real Estate Transactions Near Sensitive Sites

Part 802 of the CFIUS regulations governs foreign purchases, leases, and concessions of property located near military installations, certain airports, and maritime ports. Unlike the Part 800 business rules, these rules don’t require an active U.S. business on the property. An empty warehouse near a military base counts.¹⁰

Two geographic zones set the reach. “Close proximity” means within one mile of the boundary of a military installation or sensitive government facility. “Extended range” covers 99 miles outward from that close-proximity boundary around certain installations, effectively reaching up to 100 miles from the installation itself. A November 2024 final rule added 59 installations to the list and expanded jurisdiction around eight others, so the geographic footprint keeps growing.¹ The question is whether the foreign person will gain the practical ability to physically access the property, improve it, attach fixtures, or exclude others from it. Check the designated lists of installations, airports, and ports published in the appendices to Part 802 before finalizing any land deal.

Several types of real estate transactions are carved out. Property inside Census-designated urbanized areas or urban clusters is generally excepted unless it sits in close proximity to certain military installations or covered ports. Buying, leasing, or holding a concession to a single housing unit, including fixtures and incidentally used adjacent land, is excepted. So is leasing commercial space in a multi-unit building where the foreign person and its affiliates hold no more than 10 percent of the building’s total commercial square footage and represent no more than 10 percent of its commercial tenants. Leases or concessions limited solely to retail sale of consumer goods or services to the public are excepted, as are leases by foreign air carriers with accepted TSA security programs. Transactions by excepted real estate investors and transactions involving land owned by Alaska Native entities or held in trust for American Indians and Indian tribes are also carved out.¹¹

Excepted Investors From Allied Countries

CFIUS exempts a narrow set of “excepted investors” from the non-controlling investment and real estate rules, though not from covered control transactions. The status is currently limited to persons tied to Australia, Canada, New Zealand, and the United Kingdom.¹² For the UK, the designation does not extend to British Overseas Territories or Crown Dependencies.

Qualifying takes more than a passport. An entity investor and each of its parent companies must be organized under the laws of an excepted state or the U.S., maintain a principal place of business in an excepted state or the U.S., and have at least 75 percent of its board members and observers who are U.S. nationals or nationals of excepted states. Any person holding 10 percent or more of the entity’s voting interest, profits, or assets must also be tied to an excepted state or the U.S.¹³

The status is fragile. A foreign person loses it if, within the five years before the transaction, they or any parent or subsidiary received a CFIUS violation notice, was subject to OFAC penalties or settlement, was debarred by the State Department’s defense trade controls division, or was convicted of any U.S. felony, among other disqualifying events. If the investor stops meeting the organizational criteria at any point during the three years after closing, the exception is retroactively stripped.¹⁴

When You Must File and When It’s Your Choice

The CFIUS process is mostly voluntary. Parties can file a notice or declaration to get the deal reviewed and, if it clears, earn a safe harbor letter. Two situations require filing, and skipping the filing exposes the parties to civil penalties.

The first is when a covered transaction would give a foreign government-backed entity (one where a single foreign state holds a 49-percent-or-greater voting interest) a substantial interest in a TID U.S. business. The second is certain covered transactions involving critical technologies where a U.S. regulatory authorization, such as an export license, would be required to transfer the technology to the foreign acquirer or its controlling entities.¹⁵

When a filing is mandatory, the declaration is due at least 30 days before the transaction’s “completion date,” which is the earliest date any ownership interest is conveyed or transferred.¹⁶ The clock runs from the equity change, not from when the foreign person starts exercising control. That catches parties who try to defer governance rights to a later date and treat the deferral as buying time.

Declarations, Notices, and What They Cost

Two filing tracks are available. A short-form declaration triggers a 30-day assessment period. At the end of it, the committee can clear the transaction, request a full notice, or inform the parties that it cannot conclude action on the declaration alone.¹⁷ Declarations are the default for mandatory filings and a common voluntary starting point when the parties think risk is limited.

A formal written notice is the fuller filing. It opens a 45-day review. If the committee finds potential concerns, it may open a 45-day investigation to explore them and negotiate mitigation. If the investigation does not resolve the issue, the matter goes to the President, who has 15 days to decide whether to block or unwind the deal. Presidential intervention is rare but represents the ultimate enforcement power. During either track, the committee can reject a filing it considers incomplete, or where the parties fail to answer follow-up information requests within three business days, or where a material change in the transaction or contradictory information surfaces.¹⁷

Both declarations and notices are submitted through the CFIUS Case Management System. Formal notices, not declarations, carry a filing fee scaled to the transaction’s value:

Under $500,000: no fee
$500,000 to under $5 million: $750
$5 million to under $50 million: $7,500
$50 million to under $250 million: $75,000
$250 million to under $750 million: $150,000
$750 million or more: $300,000¹⁸

The “value of the transaction” includes all consideration provided by or on behalf of the foreign person: cash, assets, shares, debt forgiveness, and services or in-kind contributions. The committee will not accept a notice until the fee is received.¹⁸

Why Parties File Voluntarily: Safe Harbor

The main reason to voluntarily file is to earn a safe harbor letter. When CFIUS concludes its review and clears a transaction, the safe harbor prevents the committee from reopening review of that same transaction except in limited circumstances.¹⁷ Without that letter, a closed deal remains indefinitely open to a retroactive CFIUS review. For deals that don’t require a mandatory filing, the safe harbor is the primary reason to go through the process at all.

Mitigation Agreements

When CFIUS finds risks that can be addressed short of blocking the deal, it negotiates a mitigation agreement with the parties. Common measures include requiring the foreign investor to take a fully passive role in governance, sometimes through a proxy holder or voting trustee, and requiring a security officer with appropriate technical credentials to oversee operational compliance or a security director or board observer to monitor governance.¹⁹

Breaking a mitigation agreement is expensive. Under a final rule effective December 26, 2024, a person who violates a material provision may face a civil penalty per violation of up to the greatest of $5,000,000, the value of the person’s interest in the U.S. business at the time of the transaction, the value of that interest at the time of the violation, or the value of the transaction filed with the committee.²⁰ Agreements may also include liquidated damages provisions reflecting a reasonable estimate of the national security harm a breach could cause.

Penalties and the Non-Notified Program

Failing to file a mandatory declaration, or violating other CFIUS requirements, can bring a civil penalty of up to $5,000,000 or the value of the transaction, whichever is greater. These are separate from mitigation-violation penalties. If a party is out of compliance, the committee or its lead agency may negotiate a remediation plan, require the party to submit declarations for any future covered transactions over the next five years, or seek injunctive relief in federal court. Unpaid penalties become a debt to the U.S. government, collectible by Treasury or through a civil action by the Department of Justice.²⁰

Closing without filing does not put a deal beyond CFIUS’s reach. The committee actively monitors for non-notified transactions using tips from the public, referrals from executive branch agencies and Congress, media reports, commercial databases, and classified reporting. If it flags a transaction, Treasury contacts the parties to request additional information. The committee can initiate a review at any time, and without a safe harbor letter, the parties have no protection against a retroactive order to unwind the deal. Tips and voluntary self-disclosures go to CFIUS.tips@treasury.gov.²¹

A Boundary: Outbound Investment Is a Different Program

CFIUS governs inbound investment into U.S. businesses. A separate outbound investment security program, effective January 2, 2025, restricts U.S. persons from making certain investments into entities in countries of concern that work in semiconductors and microelectronics, quantum information technologies, and artificial intelligence.²² That program runs under its own regulatory framework, not the CFIUS rules discussed here. A single cross-border technology deal can implicate both, so if U.S. capital is flowing outward as part of the same structure, evaluate the outbound rules separately.

1
U.S. Department of the Treasury. The Committee on Foreign Investment in the United States (CFIUS)
2
eCFR. 31 CFR 800.210 – Covered Control Transaction
3
eCFR. 31 CFR 800.208 – Control
4
eCFR. 31 CFR 800.302 – Transactions That Are Not Covered Control Transactions
5
eCFR. 31 CFR 800.211 – Covered Investment
6
eCFR. 31 CFR Part 800 – Section 800.215, Critical Technologies
7
eCFR. 31 CFR Part 800 – Section 800.214, Critical Infrastructure
8
eCFR. 31 CFR 800.241 – Sensitive Personal Data
9
eCFR. 31 CFR 800.244 – Substantial Interest
10
eCFR. 31 CFR Part 802
11
eCFR. 31 CFR Part 802 – Section 802.216, Excepted Real Estate Transactions
12
U.S. Department of the Treasury. CFIUS Excepted Foreign States
13
eCFR. 31 CFR 800.219 – Excepted Investor
14
eCFR. 31 CFR 800.219 – Excepted Investor
15
eCFR. 31 CFR 800.401 – Mandatory Declarations
16
U.S. Department of the Treasury. How Does CFIUS Determine the Completion Date
17
U.S. Department of the Treasury. CFIUS Overview
18
eCFR. 31 CFR Part 800 Subpart K – Filing Fees
19
U.S. Department of the Treasury. CFIUS Mitigation
20
eCFR. 31 CFR Part 800 Subpart I – Penalties and Damages
21
U.S. Department of the Treasury. CFIUS Non-Notified Transactions
22
U.S. Department of the Treasury. Outbound Investment Security Program