Introduction

The Committee on Foreign Investment in the United States ("CFIUS" or the "Committee"), which is led by the US Department of the Treasury ("Treasury") and composed of US national security and economic agencies, including the Departments of Defense, State, Justice, Commerce, Energy and Homeland Security, conducts national security reviews of FDI into the United States, including some real estate transactions. The Foreign Investment Risk Review Modernization Act of 2018 ("FIRRMA") significantly overhauled the CFIUS process. Regulations fully implementing FIRRMA's reforms took effect in 2020, and the CFIUS landscape has continued to evolve since then.

In late 2024, Treasury engaged in rulemaking intended to sharpen and enhance CFIUS's procedures and enforcement authorities, expanding, for example, CFIUS's ability to impose much larger monetary penalties and subpoena information from third parties in a wider range of circumstances. More recently, in February 2025, President Trump issued the "America First Investment Policy" National Security Policy Memorandum ("NSPM"), which emphasizes the administration's commitment to an open foreign investment environment while also easing restrictions on foreign investments in proportion to the investor's degree of independence from US foreign adversaries, which include the People's Republic of China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia and the former Maduro regime of Venezuela.

The NSPM included directives for expedited review of investments from allied and partner nations, reduced reliance on open-ended mitigation agreements and the utilization of legal tools like CFIUS to restrict foreign adversary-affiliated investments. The NSPM promised an expedited "fast-track" process for investors from US-allied nations meeting certain eligibility requirements and, on February 9, 2026, Treasury published a request for information ("RFI") seeking comments on this proposed fast-track process, designated the Known Investor Program ("KIP"). The NSPM also indicated that the administration would consider implementing further restrictions on US outbound investments in certain strategic sectors. While new rules and other measures are necessary for its implementation, the NSPM is a harbinger of a significant shift in foreign investment review under the Trump administration.

Summary of major changes in 2025

• CFIUS is requiring mitigation in substantially fewer transactions than it has in recent years. In 2024, only 9 percent of covered transaction notices filed were cleared with mitigation, down from 21 percent in 2023 and 23 percent in 2022. This is a notable decrease, particularly because the drop in mitigation occurred before President Trump issued the NSPM, which specifically outlined the administration's intention of ending the use of "overly bureaucratic, complex and open-ended 'mitigation' agreements for United States investments from foreign adversary countries." The 2024 decrease is likely reflective of multiple variables, including a decline in filings involving certain sensitive sectors that are more likely to elicit mitigation requirements from the Committee, e.g., semiconductor manufacturing and scientific research and development services.
• CFIUS has demonstrated an increased willingness to elevate cases for presidential referral. Presidential decisions were issued regarding two transactions reviewed by CFIUS in 2024, both of which were identified through CFIUS's non-notified process. In May 2024, President Biden issued an Executive Order requiring the divestment of a cryptocurrency mining facility located within one mile of a strategic military installation. Since the transaction was never initially submitted to CFIUS, the Committee only became aware of the acquisition following a public tip. This action marks the first presidential divestment order under FIRRMA real estate jurisdiction, affirming that foreign real estate transactions near sensitive military installations can trigger CFIUS intervention. The second instance of presidential referral and ordered divestment centered on a Chinese company's ownership of a US audiovisual technology company, announced by President Trump in July 2025. The underlying transaction subject to the Presidential Order closed in 2020, five years prior to the CFIUS review, highlighting the risk that older transactions that are not voluntarily filed with CFIUS can still be identified by the Committee and result in presidential action.
• CFIUS continues to focus on enforcement. The Committee reported that it assessed four penalties in 2024 for breaches of material provisions in mitigation agreements, meeting 2023's record for enforcement actions. Additionally, the Committee assessed one penalty in 2024 for submission of a notice and supplemental information containing material misstatements.
• Real estate CFIUS filings remain low compared to investment-related filings, but policy preferences signal a likely future focus by the Committee. In 2024, six declarations and three notices were filed under CFIUS's real estate regulations, which is no major change from 2023's three declarations and two notices filed. As noted above, the first presidential divestment order under FIRRMA real estate jurisdiction was issued in 2024 and, while real estate filings remain low, CFIUS continues to expand its real estate authorities, most recently issuing a final rule in December 2024 that added an additional 59 military installations to the real estate appendix and provided broader jurisdiction for eight installations currently listed. More recently, the National Defense Authorization Act for Fiscal Year 2026 ("NDAA FY2026") authorized the Committee to create a broader list of "national security-sensitive sites" that is reviewed and updated regularly. CFIUS real estate filings will likely grow over the coming years as this list is built out by the Committee. As signaled by the NDAA FY2026, the NSPM and the US Department of Agriculture's ("USDA") National Farm Security Plan, there is a real, and likely continuing, effort to expand CFIUS jurisdiction with regard to foreign ownership of real property in the United States. The NDAA FY2026 also included changes to the Outbound Investment Security Program, which is detailed in depth here.

Who files?

CFIUS filings are usually submitted jointly by the parties to the notified transaction, typically the investing entity and the target.

Though the CFIUS regulations mandate filings for certain transactions, CFIUS review remains predominantly a voluntary process, as most transactions subject to CFIUS's jurisdiction do not meet the mandatory filing criteria. Even for transactions under CFIUS's voluntary authorities, CFIUS may request that parties notify a transaction of interest and has the authority to initiate reviews directly.

CFIUS continues to pursue non-notified transactions aggressively, so the risk of CFIUS reaching out on a non-notified transaction has notably increased since FIRRMA was implemented. CFIUS officials have indicated recently that even more resources are being dedicated to its non-notified process. This is reinforced by the additional authorities CFIUS received in the Treasury's 2024 rulemaking, which expands the information CFIUS can request and the parties from which it can request this information during the non-notified process.

Mandatory filing requirements apply only to covered transactions (foreign investments subject to CFIUS jurisdiction) that involve "TID" US businesses, which are involved with critical technologies, critical infrastructure or sensitive personal data.

Specifically, subject to certain exemptions, mandatory filings are required in two circumstances. The first is the acquisition of 25 percent or more of the voting interests in any TID US business by a person in which a single foreign government holds, directly or indirectly, a 49 percent or greater voting interest. All parents in the investor's ownership chain are deemed 100 percent owners, so dilution of ownership interests is not recognized for purposes of this test.

The second circumstance concerns a foreign investment in a TID US business involved with critical technologies, where one or more US regulatory authorizations, such as export licenses, would be required to export, re-export or retransfer any of the US business's critical technologies to the investor or any person holding a 25 percent or greater, direct or indirect, voting interest in the investor. With a few exceptions, mandatory filing is required even where such critical technologies would be eligible for export to the relevant foreign person under a license exception.

If mandatory filing applies, notification by a declaration or notice (each discussed in greater detail below) must be submitted to CFIUS at least 30 days prior to the transaction's completion date.

While FIRRMA introduced the mandatory filing to CFIUS regulations, it also outlined the concept of "excepted investors." Excepted investors are not subject to CFIUS's expanded jurisdiction for certain non-controlling investments or real estate transactions and are exempt from mandatory filing requirements. Excepted investors and their parents must meet relatively strict nationality-related criteria related to "excepted foreign states," currently Australia, Canada, the UK and New Zealand. Excepted investors are not exempt from CFIUS's general jurisdiction, only from CFIUS's expanded authorities under FIRRMA.

Types of deals reviewed

Consistent with its long-standing authorities, CFIUS has jurisdiction to review any transaction that could result in "control" of a US business by a foreign person. Control is defined as the power, direct or indirect, whether exercised or not, to determine, direct or decide important matters affecting an entity. CFIUS interprets control broadly and, notably, control can be present even in minority investments. Similarly, a US business is defined and interpreted broadly by CFIUS.

In addition to its traditional authorities regarding control transactions, under FIRRMA, CFIUS also has expanded jurisdiction to review certain covered investments in TID US businesses. These are businesses that: produce, design, test, manufacture, fabricate or develop one or more critical technologies subject to US export controls; perform certain actions in relation to identified critical infrastructure assets, referred to as "covered investment critical infrastructure"; or maintain or collect sensitive personal data of US citizens.

A "covered investment" is a non-controlling transaction that affords a foreign investor any of the following with respect to a TID US business: (i) access to "material non-public technical information" in its possession; (ii) board membership and observer rights, including nomination rights; or (iii) any involvement, other than through voting of shares, in substantive decision-making regarding critical technologies, critical infrastructure or sensitive personal data of US citizens.

CFIUS also has jurisdiction to review changes in rights that would provide control or, for a TID US business, covered investment rights, as well as transactions designed to evade CFIUS review.

Covered transactions, those subject to CFIUS's jurisdiction, include deals structured as stock or asset purchases, debt-to-equity conversions, foreign-foreign transactions where the target has US assets, private equity investments (in some cases even where the general partner is US-owned) and joint ventures into which a US business is being contributed.

Beyond its traditional investment focus, CFIUS also has jurisdiction to review the purchase or lease by, or a concession to, a foreign person of real estate in the US that is located within, or will function as part of, certain air or maritime ports, or is located in or within certain proximity ranges of identified military installations and areas. The list of such military installations was expanded in 2024. Separately, as discussed above, the NDAA FY 2026 authorized the Committee to identify "national security-sensitive sites" that fall under CFIUS jurisdiction. These sites may include "facilities or properties of the United States Government," including those of the intelligence community and National Laboratories. Real estate transactions under CFIUS's jurisdiction are not subject to mandatory filing requirements.

Scope of the review

CFIUS reviews are focused on national security concerns. In each case, CFIUS conducts a risk-based analysis based on the threat posed by the foreign investor, the vulnerabilities exposed by the target US business and the consequences to US national security of combining that threat and vulnerability. The CFIUS statute and an Executive Order issued by President Joe Biden in 2022 each specify various factors for CFIUS to consider in its reviews.

Based on its risk assessment, CFIUS determines whether the transaction presents any national security concerns. If CFIUS identifies such concerns, it first determines whether other provisions of US law can sufficiently address them. If no other provisions of US law adequately address the concerns, CFIUS next determines whether any mitigation measures could resolve the concerns. If mitigation is warranted, CFIUS will typically negotiate terms with the parties, which will be a prerequisite to CFIUS clearing the transaction.

If CFIUS determines that mitigation cannot adequately resolve its concerns, CFIUS will typically request that the parties abandon their transaction or that the foreign buyer divest its interest in the US business if the review happens following closing.

If the parties will not agree to abandonment or divestment, CFIUS can recommend that the president of the United States block the investment, as only the president has the authority to prohibit a transaction. Although the CFIUS process is confidential, presidential block orders are public.

Review process timeline

There are two options for how parties can notify a transaction to CFIUS: a declaration, which is a short-form filing reviewed on an expedited basis; or a voluntary notice, which is the traditional CFIUS notification mechanism. Both declarations and notices include required information about the investor and its owners, the US business that is the subject of the transaction and the transaction itself, although notices require more information, including personal identifier information for directors and officers of the investor and its parent companies. For both declarations and notices, CFIUS will also typically request additional information through questions and answers during the review.

Following the initial submission, the declaration process typically takes approximately five to eight weeks and the notice process usually takes approximately three to five months. Following its assessment of a declaration, CFIUS may request the parties file a notice, so in those cases the total process for a transaction notified by declaration will take longer. A variety of factors can impact whether to file via a notice or declaration. For example, for more complex transactions, deals expected to be more sensitive from a national security standpoint or in cases where parties want to be assured the certainty of CFIUS clearance, it may be advisable for the parties to start with a notice.

Once accepted by CFIUS, a declaration is assessed in 30 calendar days. At the end of the 30 days, CFIUS may take one of four actions: clear the transaction; inform the parties that CFIUS cannot clear the transaction on the basis of the declaration, but not request a notice (commonly referred to as the "shrug"); request that the parties file a notice for the transaction; or initiate a unilateral review.

Although the shrug outcome does not confer "safe harbor" as a clearance does, after a shrug CFIUS could theoretically request a notice for the transaction in the future, generally transaction parties have treated the shrug outcome as sufficient for closing.

For a notice, the parties initially submit a draft "prefiling," on which CFIUS will provide comments and follow-up questions. After addressing those comments, parties will formally file the notice with CFIUS. CFIUS then has to accept the filing, at which time a 45-calendar-day initial review begins. At the end of the review, CFIUS will either clear the transaction or proceed to a 45-calendar-day investigation. As of the most recent data published by CFIUS, more than half of cases proceed to investigation.

If a transaction is referred to the president, the president has 15 calendar days to decide whether to prohibit the transaction.

In some cases, CFIUS will need additional time to complete its process, such as when negotiating mitigation measures with the parties. An investigation may be extended for one 15-calendar-day period in "extraordinary circumstances," although this happens rarely. More typically, in such circumstances, CFIUS will allow the parties to withdraw and resubmit their filing, which restarts the initial 45-day review period. Most transactions are cleared in one CFIUS cycle.

Filing fees apply to notices submitted to CFIUS, but not to declarations, although they apply for notices submitted following CFIUS's assessment of a declaration. Fees are assessed based on a tiered approach, providing for a proportional cost equal to or less than 0.15 percent of the transaction value. The lowest fee is US$750 for transactions valued between US$500,000 and US$5 million (transactions under US$500,000 are not subject to fees), and the highest-tier fee is US$300,000 for transactions valued at US$750 million or more.

How foreign investors can protect themselves

It is critical for foreign investors to consider CFIUS issues, including assessing jurisdictional matters, whether mandatory CFIUS filing will apply or a voluntary filing is advisable, and potential substantive risks, as early as possible in cross-border transactions involving direct or indirect foreign investment in a US business. Notably, this includes minority and venture capital investments.

Given potentially severe penalties for noncompliance, parties need to know early on whether filing will be required. Where it is not, they may want to include relevant representations in the purchase agreement to provide additional protection.

In cases where filing is mandatory or the parties voluntarily notify CFIUS, allocation of CFIUS mitigation risk will be a key issue. Most transactions are cleared without mitigation, but mitigation has become more frequent in recent years and, when it is required, it can have a substantial impact on transaction goals and present unexpected costs.

The range of mitigation measures that can be imposed by CFIUS is quite broad, based on the risk profile of the deal, and it is important for investors in particular to have as clear an understanding as possible with respect to what mitigation measures would be acceptable to them.

_{White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.}

_{This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.}

_{© 2026 White & Case LLP}