Cross-border M&A regulations layer national security screening, antitrust clearance, sanctions and export controls, data privacy rules, anti-corruption exposure, and tax treaty mechanics on top of every deal that crosses a border, and each regime runs on its own timeline with its own penalties for getting it wrong. A single missed filing can delay a signing, unwind a closing, or attach successor liability to the buyer. The gap between signing and closing in international transactions routinely stretches six months or longer as parties work through overlapping government reviews.
What follows is the working map: the regimes that reliably show up, what triggers them, and what the exposure looks like if they get skipped.
National Security Screening
The Committee on Foreign Investment in the United States (CFIUS) reviews transactions that could give a foreign person control of a U.S. business, with particular focus on companies touching sensitive personal data, critical infrastructure, or advanced technology. Parties can submit either a full written notice or a shorter declaration, and filing fees scale with transaction value, from zero for deals under $500,000 up to $300,000 for transactions at or above $750 million.1eCFR. 31 CFR Part 800 – Regulations Pertaining to Certain Investments in the United States by Foreign Persons For certain transactions involving technology, critical infrastructure, or sensitive personal data, a declaration is mandatory rather than optional.
The penalty for skipping a mandatory CFIUS filing is up to $5 million or the value of the entire transaction, whichever is greater.2eCFR. 31 CFR 800.901 – Penalties If the government clears a deal but attaches a mitigation agreement — for instance, requiring a government-approved board member or restricting the foreign parent’s access to certain data — violating that agreement carries penalties of up to $250,000 per violation or the transaction’s value.1eCFR. 31 CFR Part 800 – Regulations Pertaining to Certain Investments in the United States by Foreign Persons CFIUS also retains the authority to force divestiture of a completed acquisition.
Many other countries run parallel national security reviews. Energy, telecommunications, and defense commonly trigger automatic change-of-control reviews by domestic regulators, each on its own schedule and each requiring detailed ownership charts tracing every entity back to its ultimate beneficial owners. Map these filing obligations across every relevant jurisdiction before signing, because discovering a missed requirement afterward is a hard leverage problem to fix.
Antitrust and Merger Control
Large acquisitions in the United States require premerger notification under the Hart-Scott-Rodino (HSR) Act. For 2026, transactions valued above $133.9 million generally require a filing with the Federal Trade Commission and the Department of Justice, regardless of the size of the parties involved.3Federal Register. Revised Jurisdictional Thresholds for Section 7A of the Clayton Act Filing fees for 2026 range from $35,000 for deals under $189.6 million up to $2,460,000 for transactions valued at $5.869 billion or more.4Federal Trade Commission. Filing Fee Information
Once the filing is accepted, a mandatory 30-day waiting period begins (15 days for cash tender offers or bankruptcy transactions). During that window the parties must continue operating as entirely separate businesses. No coordinating on pricing, no sharing competitively sensitive information, no making operating decisions for the target. Premature coordination, known as “gun-jumping,” has drawn civil penalties in the millions. The FTC imposed a $5.6 million penalty in one recent case for unlawful pre-closing coordination between oil producers, the largest gun-jumping fine in U.S. history at the time.5Federal Trade Commission. Premerger Notification and the Merger Review Process
The European Union runs its own merger control regime under Council Regulation (EC) No 139/2004. A deal has “Community dimension” and requires notification to the European Commission before closing if the combined worldwide turnover of all companies involved exceeds €5 billion and at least two of those companies each generate more than €250 million in EU-wide turnover.6European Commission. Merger Procedures Closing without notifying the Commission can draw fines of up to 10% of aggregate turnover.
The EU Foreign Subsidies Regulation
Since mid-2023, the EU Foreign Subsidies Regulation (FSR) has added another mandatory filing layer. An M&A deal requires notification to the European Commission if the target (or at least one merging party) generated more than €500 million in EU turnover in the last financial year and the parties collectively received more than €50 million in third-country financial contributions over the preceding three years.7European Commission. The Foreign Subsidies Regulation in a Nutshell The regulation targets state subsidies from non-EU governments that could distort the single market. For acquirers backed by government financing, sovereign wealth funds, or state-owned enterprises, the FSR adds timeline risk and document production obligations that overlap with traditional merger control.
Sanctions and Export Controls
Trade controls get underestimated in almost every cross-border deal. If the target is registered under the International Traffic in Arms Regulations (ITAR), meaning it manufactures, exports, or brokers defense articles, any change in ownership triggers a mandatory written notification to the Directorate of Defense Trade Controls within five days. When the buyer is a foreign person, the registrant must notify DDTC by registered mail at least 60 days before the intended sale or transfer of ownership.8eCFR. 22 CFR 122.4 – Notification of Changes in Information Furnished by Registrants That 60-day clock runs before closing, not after, and it does not replace the separate requirement to obtain export licenses for any defense articles or technical data involved.
The Office of Foreign Assets Control (OFAC) creates a different risk. Acquiring a company that has done business with sanctioned persons, entities, or countries can saddle the buyer with successor liability for those violations. OFAC expects acquirers to build sanctions screening into pre-deal due diligence, escalate issues to senior management, and resolve problems before closing.9U.S. Department of the Treasury (OFAC). A Framework for OFAC Compliance Commitments Screen the target’s customer lists, vendor relationships, and payment histories against OFAC’s Specially Designated Nationals list early enough that a hit does not surface the week before closing.
Data Privacy and the Data Room
Moving employee records, customer databases, and other personal data from a European target to a U.S. buyer triggers the GDPR’s restrictions on international data transfers. If the buyer participates in the EU-U.S. Data Privacy Framework, personal data can flow without additional safeguards. Otherwise the parties need to put appropriate transfer mechanisms in place, typically Standard Contractual Clauses approved by the European Commission, and conduct a transfer impact assessment documenting the laws in the destination country and any supplementary measures needed to protect the data.10European Data Protection Board. International Data Transfers
The data room itself creates transfer issues that get overlooked. Sharing personal data during due diligence with advisors or potential buyers outside the EEA — employee names, salaries, health records, customer lists — may constitute an international transfer under GDPR Article 46, requiring safeguards before the data room opens. Derogations under Article 49, such as transfers necessary for legal claims, are narrow exceptions meant for specific situations, not ongoing data access across a months-long diligence process.11GDPR. Art 46 GDPR – Transfers Subject to Appropriate Safeguards
On the U.S. side, the California Privacy Rights Act provides a specific carve-out for M&A: transferring personal information as part of a merger, acquisition, or bankruptcy does not count as a “sale” or “sharing” that would trigger consumer opt-out rights, provided the buyer continues to use the data consistently with the promises made at collection. If the buyer later changes how it uses or shares that data in a materially inconsistent way, it must give consumers prior notice and a meaningful opportunity to exercise their privacy choices.
Anti-Corruption and Labor Liabilities Inherited From the Target
The Foreign Corrupt Practices Act requires a careful look at the target’s financial records and its relationships with third-party agents, consultants, and government contacts abroad. Red flags include unusually large consulting fees, payments routed through shell entities, and gifts or hospitality directed at foreign officials.12U.S. Department of Justice. Foreign Corrupt Practices Act Unit Acquirers inherit FCPA exposure. The DOJ has brought enforcement actions against buyers for the target’s pre-acquisition bribery, which makes this one of the few areas where due diligence is genuinely existential.
The UK Bribery Act 2010 creates a corporate offense when a company fails to prevent bribery by its associates. The only defense is proving the company had “adequate procedures” in place to prevent corrupt conduct.13legislation.gov.uk. Bribery Act 2010 – Section 7 Verify that the target has functioning anti-bribery policies, regular training, and audit protocols, not just a compliance manual on a shelf.
Worker protections create some of the largest hidden liabilities in a cross-border deal. In the United Kingdom, the Transfer of Undertakings (Protection of Employment) Regulations, commonly called TUPE, require that employees of the target automatically transfer to the buyer on their existing terms and conditions.14GOV.UK. Business Transfers, Takeovers and TUPE The buyer inherits every existing employment contract, collective bargaining agreement, and pension obligation. Failing to properly inform and consult with affected employees before the transfer can result in compensation awards of up to 13 weeks’ uncapped gross pay per employee, a figure that adds up fast for a large workforce.15Acas. What the Law Says – TUPE: Informing and Consulting Similar automatic-transfer protections exist across the EU, though specifics vary by member state.
Cross-Border Tax Structuring
The financial architecture of an international acquisition revolves around Double Tax Treaties, most of which follow the OECD Model Tax Convention. These treaties prevent the same income from being taxed twice by allocating taxing rights between countries. Without an applicable treaty, a U.S. company acquiring a foreign target could face a default 30% withholding tax on dividends repatriated to the United States. Treaty protections can reduce that rate to 5% or even zero when specific ownership thresholds are met, which puts treaty analysis at the front of any structuring exercise.
Permanent Establishment and CFC Rules
A permanent establishment arises when a company maintains a fixed place of business in a foreign country: an office, a factory, or even a dependent agent who habitually concludes contracts on the company’s behalf. Once that threshold is crossed, the company must file local tax returns and pay tax on profits attributable to that location. Structuring aims to manage this exposure while keeping the corporate hierarchy efficient. Controlled Foreign Corporation rules in the acquirer’s home country also matter, because they can trigger immediate taxation on certain types of passive foreign income regardless of whether that income is actually repatriated.
Holding Structures
Many transactions route the acquisition through a Special Purpose Vehicle in a jurisdiction with an extensive treaty network and favorable capital-repatriation rules. Luxembourg and the Netherlands have historically been popular choices, allowing dividends and interest to flow to the parent with minimal tax leakage. These structures face increasing scrutiny. The SPV must have genuine “substance,” meaning real offices, local employees, and decision-making authority, to be recognized as a valid treaty resident rather than a shell.
When acquisition debt is pushed down to the target, interest payments flowing back to the acquirer may face withholding taxes in the target’s country. Treaty relief is available, but the parties must satisfy Limitation on Benefits clauses that require the entity claiming treaty benefits to meet specific residency and ownership tests. Transfer pricing rules add another layer: intercompany loans and service agreements must be priced at arm’s length, meaning the terms must reflect what unrelated parties would negotiate in a comparable transaction.
Share Purchase Versus Asset Purchase
The choice between buying shares and buying assets often drives the entire deal structure. A share purchase transfers the entity as a whole, preserving existing tax attributes like loss carryforwards but locking the buyer into the target’s existing tax basis in its assets. An asset purchase lets the buyer step up the tax basis of acquired assets, potentially generating higher depreciation deductions going forward, but it often triggers immediate capital gains for the seller and can involve complex VAT filings in jurisdictions that treat asset transfers differently from share transfers.
Managing the Gap Between Signing and Closing
In domestic deals, signing and closing sometimes happen on the same day. In cross-border M&A, the gap between signing the purchase agreement and completing the transaction can stretch for months while regulatory approvals come through. The target’s business might deteriorate. A key customer might leave. A government might shift its regulatory posture.
Material adverse change (MAC) clauses address this risk by giving the buyer the right to walk away before closing if events seriously damage the target. The buyer’s obligation to close is typically conditioned on the seller’s representations remaining true as of the closing date, a “bring-down” condition. If a material adverse change has occurred, the buyer can refuse to close or renegotiate the price. Courts set a high bar for invoking these clauses in practice: a MAC generally must threaten the target’s long-term earnings potential in a durationally significant way, not just reflect a bad quarter.
Cross-border deals complicate this. A MAC clause drafted under U.S. practice may not be read the same way by a court or arbitral panel applying the target’s local law. Most cross-border acquisition agreements are governed by the law of the target company’s jurisdiction, since the deal is often subject to local securities and takeover rules. Clear, jurisdiction-aware MAC language, including explicit exclusions for general economic conditions, industry-wide changes, and effects caused by the deal itself, is where experienced cross-border counsel earns its fee.
Closing Mechanics and Post-Closing Filings
The move from agreement to ownership centers on the Share Purchase Agreement and the fulfillment of all conditions precedent: regulatory approvals, third-party consents, and any required reorganization steps. At closing, the purchase funds are typically held by an escrow agent in a designated account until all conditions are satisfied. In private M&A transactions without representations and warranties insurance, the median escrow amount is roughly 10% of the transaction value, serving as a post-closing indemnity fund. When R&W insurance is in place, that drops to around 0.5% of transaction value because the policy absorbs the indemnity risk.
R&W insurance has become standard in private M&A. The buyer purchases a policy covering losses arising from breaches of the seller’s representations and warranties, which lets the seller walk away with a cleaner exit and gives the buyer a more creditworthy source of recovery than chasing a former owner. Premium rates have been rising, averaging roughly 3% of policy limits as of late 2025, and buyers pay the premium in the vast majority of deals. Retentions have settled at approximately 0.5% of enterprise value for midmarket transactions.
Currency fluctuations between signing and closing can meaningfully change the effective purchase price. Buyers commonly manage this through hedging contracts or by locking in an exchange rate on a specified date. The actual transfer of funds happens over the SWIFT network. The buyer’s bank issues an MT103 message, the standard format for international single-customer credit transfers, and closing is formally declared once the target’s bank confirms receipt.
Immediately after funds transfer, the legal team updates local corporate registries to reflect the new ownership. This involves filing notices of change of control, updating the company’s statutory books with the new board of directors and shareholding structure, and registering the new parent as ultimate beneficial owner with local tax authorities. In the United States, domestic companies are now exempt from beneficial ownership reporting to FinCEN following a 2025 rule change, but foreign-formed entities registered to do business in any U.S. state or tribal jurisdiction must still file beneficial ownership reports under updated deadlines.16Financial Crimes Enforcement Network (FinCEN). FinCEN Removes Beneficial Ownership Reporting Requirements for US Companies and US Persons
The seller’s Disclosure Letter, the document listing all exceptions to the representations and warranties in the SPA, matters most at this stage. If a liability surfaces after closing that the seller knew about but failed to disclose, the buyer can pursue a breach-of-contract claim against the seller, the escrow fund, or the R&W insurance policy, depending on how the deal was structured. Completing every registry filing and confirming that the Disclosure Letter accurately covers every known issue is the final step in officially transferring the business across borders.