CFIUS filing requirements fall into two categories: a mandatory declaration is required for a narrow set of deals involving foreign government interests or export-controlled technology, and every other covered transaction can be filed voluntarily to obtain safe harbor from later review. The Committee on Foreign Investment in the United States processed 209 formal notices and 116 declarations in 2024, blocked two transactions by presidential order, and imposed mitigation on 25 others.1U.S. Department of the Treasury. CFIUS Annual Report to Congress CY 2024 Whether your deal must be filed, should be filed, or can safely close without a filing depends on the buyer, the target, and the technology or data involved.
When a CFIUS Filing Is Mandatory
Two situations require the parties to submit a declaration before closing.
The first is a substantial foreign government interest. If a foreign government other than one from an excepted foreign state holds a substantial interest in the acquiring entity, and the deal would give that entity a substantial interest in a TID U.S. business (one that handles critical technology, covered infrastructure, or sensitive personal data), a declaration must be filed.
The second is critical technology that would need an export license. If the target produces, designs, tests, or develops critical technologies that would require U.S. export authorization to send to the foreign buyer or its controlling parties, a mandatory declaration is required.2eCFR. 31 CFR 800.401 – Mandatory Declarations
Skipping a required filing carries real consequences. Civil penalties can reach the entire value of the transaction.3U.S. Department of the Treasury. CFIUS Enforcement
When Voluntary Filing Makes Sense
Most CFIUS filings are voluntary, and most parties file even when they don’t have to. The reason is safe harbor. Once CFIUS clears a transaction, the committee generally cannot reopen the review or force divestiture later.4U.S. Department of the Treasury. CFIUS Overview Without that clearance, the deal stays exposed to government intervention indefinitely, which lenders, investors, and boards generally will not accept.
Which Deals Are Covered in the First Place
Before either the mandatory or voluntary path applies, the transaction has to be one CFIUS can review. Two categories qualify.
A covered control transaction is any deal that could give a foreign person control over a U.S. business, including mergers, acquisitions, and joint ventures.5eCFR. 31 CFR 800.210 – Covered Control Transaction Control is a broad concept. A majority stake is not required; if the structure lets the foreign party influence key operational decisions, that is enough.
A covered investment is a non-controlling investment in a TID U.S. business that gives the foreign investor access to non-public technical information, a board seat or observer role, or involvement in decisions about critical technology, sensitive personal data, or covered infrastructure.6eCFR. 31 CFR 800.211 – Covered Investment A TID business is one that produces, designs, tests, or develops critical technologies; operates or services covered critical infrastructure; or maintains or collects sensitive personal data of U.S. citizens.7eCFR. 31 CFR 800.248 – TID U.S. Business The sensitive-data category is broader than most people expect. A consumer health app with a large genetic database can qualify.
Critical technologies are defined by reference to export control regimes: the U.S. Munitions List under ITAR, controlled items on the Commerce Control List, nuclear items regulated by the NRC, select biological agents, and emerging or foundational technologies under the Export Control Reform Act of 2018.8eCFR. 31 CFR 801.204 – Critical Technologies
A separate set of regulations (31 C.F.R. Part 802) covers real estate purchases, leases, and concessions near military installations, certain airports, and maritime ports.9U.S. Department of the Treasury. CFIUS Real Estate Instructions Part 802 Those filings run on their own track from corporate acquisitions.
Investors Who Can Skip the Mandatory Filing
Certain buyers get lighter treatment. CFIUS designates Australia, Canada, New Zealand, and the United Kingdom (excluding British Overseas Territories and Crown Dependencies) as excepted foreign states.10U.S. Department of the Treasury. CFIUS Excepted Foreign States
Being from one of those countries doesn’t automatically make you an excepted investor. The entity and every parent must be organized in an excepted foreign state or the United States, have their principal place of business there, keep at least 75 percent of board members and observers as nationals of excepted foreign states or the U.S., and confirm that every foreign person holding 10 percent or more of the voting interest or profit share is a national or government of an excepted foreign state.11eCFR. 31 CFR 800.219 – Excepted Investor Deals involving excepted investors are generally exempt from the mandatory declaration requirement and from the non-controlling investment provisions for TID businesses.
Declaration or Formal Notice
CFIUS filings come in two formats.
A declaration is a short-form filing designed for simpler transactions or as a first-look step to gauge the committee’s concern. It goes through a 30-day assessment. At the end of that period, CFIUS can conclude action, tell the parties it cannot resolve the matter on the declaration alone, or request a full formal notice.4U.S. Department of the Treasury. CFIUS Overview In 2024, the committee concluded action on 91 of 116 assessed declarations, requested a formal notice in 17 cases, and was unable to conclude on 7.1U.S. Department of the Treasury. CFIUS Annual Report to Congress CY 2024
A formal notice is far more detailed and is the standard path for complex deals or transactions likely to draw close review. Parties must supply a summary of the transaction’s purpose and scope, detailed corporate charts up to the ultimate parent, identification of any shareholder holding more than five percent of a public parent, and the names and nationalities of everyone who will control the U.S. business after closing.12eCFR. 31 CFR 800.502 – Contents of Voluntary Notices The notice must describe the target’s products and services, list current and recent government contracts by agency and number, and address any ties to export-controlled technologies under ITAR or the EAR.13U.S. Department of the Treasury. CFIUS Frequently Asked Questions
Every filing goes through the CFIUS Case Management System, a secure Treasury web portal. Since June 2020, all draft notices, formal notices, and declarations must be submitted electronically through this system.14U.S. Department of the Treasury. CFIUS Case Management System Incomplete filings are common and get rejected. Unclear descriptions of business lines, missing ownership details, and improperly formatted exhibits all send the paperwork back and cost weeks.
Filing Fees
Fees apply to formal notices only. Declarations are free. The fee tier is set by transaction value:
- Under $500,000: no fee
- $500,000 to $4,999,999: $750
- $5,000,000 to $49,999,999: $7,500
- $50,000,000 to $249,999,999: $75,000
- $250,000,000 to $749,999,999: $150,000
- $750,000,000 and above: $300,00015U.S. Department of the Treasury. CFIUS Filing Fees
How Long the Review Takes
Once CFIUS accepts a formal notice as complete, the initial review runs 45 calendar days. If the committee needs more time, it opens a 45-day investigation.4U.S. Department of the Treasury. CFIUS Overview Expect follow-up questions during either phase. Slow answers can stall the clock or prompt CFIUS to reject the notice, forcing a refile. Parties can also request withdrawal at any point, subject to committee approval, which may come with conditions such as keeping CFIUS informed about the deal’s status.
What Happens After You File
Most transactions clear. The best outcome is a safe harbor letter confirming the committee has no unresolved national security concerns.
When CFIUS identifies specific risks but believes the deal can proceed with safeguards, it negotiates a mitigation agreement. Common terms include appointing a security officer at the operational level, installing a security director or board observer for governance-level monitoring, requiring an independent third-party auditor or monitor, and in some cases making the foreign investor’s role entirely passive through a proxy holder or voting trustee.16U.S. Department of the Treasury. CFIUS Mitigation These obligations can run for years. Treat them as a long-term compliance commitment.
If risks cannot be resolved through mitigation, CFIUS refers the matter to the President, who has 15 days to suspend or prohibit the transaction. Presidential decisions to block a deal under this authority are not subject to judicial review under the Defense Production Act.17Office of the Law Revision Counsel. 50 USC 4565 – Authority to Review Certain Mergers, Acquisitions, and Takeovers In practice, most deals facing serious opposition are withdrawn before that point. CFIUS approved 49 withdrawals in 2024.1U.S. Department of the Treasury. CFIUS Annual Report to Congress CY 2024
If You Choose Not to File
CFIUS actively monitors non-notified transactions. The committee draws on tips from the public, referrals from other agencies and Congress, media reports, commercial databases, and classified intelligence, and screens thousands of such deals each year.18U.S. Department of the Treasury. CFIUS Non-Notified Transactions
If Treasury identifies a deal that looks like a covered transaction with national security implications, it will contact the parties and may require a filing. The outcomes for a retroactive review are the same as any other: clearance, mitigation, or a recommendation that the President order divestiture. Anyone can report a suspected non-notified covered transaction or a violation of an existing mitigation agreement to CFIUS.tips@treasury.gov. The cost and delay of a voluntary filing at the front end are small next to unwinding a closed deal years later.