The Foreign Investment Risk Review Modernization Act, or FIRRMA, is the 2018 statute that expanded the federal government’s power to screen foreign investment in U.S. companies for national security risks. Before FIRRMA, the Committee on Foreign Investment in the United States (CFIUS) mostly looked at deals where a foreign buyer took outright control of an American business. FIRRMA reached further, pulling in certain minority investments in sensitive companies, purchases and leases of real estate near military and transportation sites, and modern concerns like data and emerging technology. It also created the first situations in which a CFIUS filing is legally required rather than voluntary.
What FIRRMA Brought Under CFIUS Review
FIRRMA gives CFIUS jurisdiction over three broad categories of transactions.
The first is the traditional control transaction, where a foreign person acquires enough ownership or influence to direct the important decisions of a U.S. business. This category predates FIRRMA but continues under it.
The second, and the biggest change FIRRMA made, is non-controlling investments in what the regulations call “TID U.S. businesses.” TID stands for critical technology, critical infrastructure, and sensitive personal data of U.S. citizens. 1U.S. Department of the Treasury. Fact Sheet: Final CFIUS Regulations Implementing FIRRMA
The third is covered real estate: the purchase, lease, or concession of property in or near specific military installations, maritime ports, and airports listed in the regulations. 2U.S. Department of the Treasury. CFIUS Real Estate Instructions (Part 802)
TID Businesses and Covered Investments
A U.S. business qualifies as a TID business if it produces, designs, tests, manufactures, or develops critical technologies; performs specified functions tied to covered critical infrastructure; or maintains or collects sensitive personal data of U.S. citizens. 3eCFR. 31 CFR 800.248 – TID U.S. Business “Critical technologies” covers defense articles on the United States Munitions List, items on the Commerce Control List controlled for national security or nonproliferation reasons, and emerging or foundational technologies controlled under the Export Control Reform Act of 2018. 1U.S. Department of the Treasury. Fact Sheet: Final CFIUS Regulations Implementing FIRRMA
Not every minority stake in a TID business triggers CFIUS jurisdiction. A non-controlling investment becomes a covered investment only if it gives the foreign investor at least one of three things: access to material nonpublic technical information held by the business; a board seat, observer rights, or the right to nominate a director; or involvement beyond ordinary shareholder voting in substantive decisions about the company’s use of sensitive data, critical technologies, or critical infrastructure. 4U.S. Department of the Treasury. Fact Sheet: Proposed CFIUS Regulations to Implement FIRRMA A purely passive investment with no special rights or access generally falls outside CFIUS review.
Real Estate Near Sensitive Sites
Covered real estate rules apply to properties in or near the military installations, airports, and maritime ports identified in the regulations. 5eCFR. Appendix A to Part 802 – List of Military Installations and Other U.S. Government Sites Several exemptions narrow the reach. Real estate in Census Bureau–designated urbanized areas and urban clusters is generally excluded unless it sits in close proximity to sensitive facilities. Single-family housing units (including fixtures and adjacent land incidental to residential use), retail space leased in airports and ports, and certain commercial space in multi-unit buildings are also excluded. 6U.S. Department of the Treasury. CFIUS Frequently Asked Questions
The Excepted Investor Carve-Out
FIRRMA created a narrow exemption for investors from close security allies. An “excepted investor” is not subject to CFIUS jurisdiction over non-controlling TID investments or to the mandatory filing requirements. The excepted foreign states are Australia, Canada, New Zealand, and the United Kingdom, not including British Overseas Territories or Crown Dependencies. 7U.S. Department of the Treasury. CFIUS Excepted Foreign States
Qualifying takes more than a passport. An entity must be organized under the laws of an excepted foreign state or the United States, keep its principal place of business in one of those jurisdictions, have at least 75 percent of its board composed of U.S. or excepted-state nationals, and ensure that any foreign person holding 10 percent or more of the entity’s voting interest is itself a national or government of an excepted foreign state. 8eCFR. 31 CFR 800.219 – Excepted Investor Miss one condition and the exemption is gone. The carve-out does not apply to covered control transactions, which remain reviewable regardless of the investor’s home state.
Voluntary Filings and the Two Mandatory Triggers
Most CFIUS filings remain voluntary. FIRRMA created two situations where a filing is legally required.
The first is the “substantial interest” test. A mandatory declaration is triggered when a foreign person acquires a 25 percent or greater voting interest in a TID U.S. business, and a foreign government holds a 49 percent or greater voting interest in that foreign person. 9eCFR. 31 CFR 800.244 – Substantial Interest For entities structured with a general partner or managing member, the government’s stake is measured at the general partner level.
The second applies to transactions involving critical technologies where the foreign investor would need a U.S. regulatory authorization, such as an export license, to receive the technology. These mandatory filings are tied to specific industry codes under the North American Industry Classification System (NAICS).
Parties subject to a mandatory filing requirement must submit a declaration at least 30 days before the expected closing date. Missing a required filing can produce civil penalties up to the value of the transaction itself.
CFIUS charges a filing fee only for formal written notices, not for short-form declarations. The fee is tiered by transaction value and runs from zero for deals under $500,000 up to $300,000 for transactions valued at $750 million or more. 10eCFR. 31 CFR 800.1101 – Filing Fees
How a FIRRMA Review Runs
Once CFIUS accepts a filing as complete, the review clock starts. Short-form declarations go through a 30-day assessment period. At the end of that period, the Committee can clear the transaction, ask the parties to file a full written notice, or tell the parties it cannot complete action based on the declaration alone. 11U.S. Department of the Treasury. CFIUS Overview
A formal written notice gets a 45-day initial review. If unresolved national security concerns remain, the Committee opens a second-stage investigation of up to 45 more days. 12Office of the Law Revision Counsel. 50 USC 4565 – Authority to Review Certain Mergers, Acquisitions, and Takeovers In extraordinary circumstances, the Chairperson may grant a single 15-day extension of the investigation on written request from the head of a lead agency. The regulations define extraordinary circumstances narrowly, limited to force majeure events or situations where the extension is necessary to protect national security. 13eCFR. 31 CFR 800.508 – Completion or Termination of Investigation
How Reviews End
Every CFIUS review ends in one of a few ways.
When the Committee completes action without unresolvable security concerns, the parties receive a safe harbor letter. That protects the deal from being reopened later except in limited situations, such as material misstatements or omissions in the filing. 11U.S. Department of the Treasury. CFIUS Overview Safe harbor is a major reason parties file even when not required to.
When the Committee identifies specific risks that can be managed without blocking the deal, it negotiates a mitigation agreement. Terms can limit access to facilities, require a government-approved security officer, or restrict the foreign investor’s access to particular data. Treasury’s Monitoring and Enforcement team tracks compliance through party reports and, in complex cases, independent auditors and monitors. 14U.S. Department of the Treasury. CFIUS Mitigation
When no mitigation can resolve the threat, the Committee may refer the transaction to the President. Under section 721 of the Defense Production Act, the President can suspend or prohibit any covered transaction that threatens to impair national security, and can direct the Attorney General to seek divestiture of a completed acquisition in federal court. 12Office of the Law Revision Counsel. 50 USC 4565 – Authority to Review Certain Mergers, Acquisitions, and Takeovers Presidential orders under section 721 are not subject to judicial review. 15U.S. Department of the Treasury. CFIUS Laws and Guidance
Outright blocks are rare. The more common outcome when CFIUS cannot find acceptable mitigation is that the parties withdraw and abandon the transaction rather than wait for a formal order.
Enforcement and Non-Notified Deals
Because most CFIUS filings are voluntary, there is no statute of limitations sheltering parties who skip the process. Where no notice was filed and no safe harbor was granted, the Committee can initiate a review on its own at any time. Treasury contacts the parties to request information and determine whether the deal falls within CFIUS jurisdiction. 16U.S. Department of the Treasury. CFIUS Non-Notified Transactions
The Committee identifies non-notified transactions through intelligence from across the federal government, publicly available information, tips submitted through the CFIUS tips line, and information from third-party service providers such as auditors and monitors working on other cases. When needed, the Committee can compel information production through subpoena authority under the Defense Production Act. 17U.S. Department of the Treasury. CFIUS Enforcement and Penalty Guidelines For deals where a mandatory filing was required but never made, penalties can reach the full value of the transaction.
How Active FIRRMA Reviews Are
The 2024 CFIUS Annual Report gives a sense of scale. CFIUS assessed 116 short-form declarations and reviewed 209 formal written notices in that year. The Committee entered mitigation agreements on 16 transactions, imposed conditions on six additional withdrawals, and approved the withdrawal of 49 notices, of which 42 were re-filed and four were abandoned after CFIUS indicated it could not identify workable mitigation. Two presidential orders blocked transactions, one arising from a formal notice and one from a non-notified transaction CFIUS identified through a public tip. 18U.S. Department of the Treasury. CFIUS Annual Report to Congress – CY 2024
The pattern behind those numbers is worth keeping in mind. Most deals reviewed under FIRRMA are cleared. But the process is slow and the documentation demands are heavy, so parties planning a cross-border transaction touching a TID business or covered real estate should build CFIUS time and cost into the deal plan well before signing.