Understanding CFIUS Reviews in Cross-Border Transactions
If you’re selling your business to a foreign buyer, there’s one regulatory hurdle that can quietly shape—or stop—your deal:
CFIUS.
The Committee on Foreign Investment in the United States.
Most founders don’t think about it early.
And that’s the problem.
Because CFIUS isn’t just another regulatory checkbox. It’s a national security review process that can delay, restructure, or outright block a transaction—even after everything else is agreed upon.
And unlike many other aspects of M&A, this isn’t just about business.
It’s about government oversight.
What CFIUS Actually Does
At its core, CFIUS evaluates whether a foreign investment in a U.S. business could pose a national security risk.
That sounds broad—because it is.
CFIUS has jurisdiction over transactions where:
- A foreign entity acquires control (or certain rights) in a U.S. business
- Sensitive technologies, data, or infrastructure are involved
- There is potential access to critical systems or information
This isn’t limited to defense contractors or government suppliers.
It applies far more broadly than most founders realize.
Why CFIUS Matters in M&A
CFIUS has real authority.
It can:
- Approve a transaction
- Require mitigation measures
- Delay closing
- Recommend that the President block the deal
And importantly, CFIUS can review deals after they’ve closed if they were not properly filed.
That creates ongoing risk.
So this isn’t something you “deal with later.”
It needs to be addressed early—often before signing an LOI.
The Expanding Scope of National Security
Historically, national security reviews focused on obvious areas like defense and military technology.
That’s changed.
Today, CFIUS looks at a much broader range of concerns, including:
- Personal data (especially sensitive consumer data)
- Critical technologies (AI, semiconductors, cybersecurity)
- Infrastructure (energy, telecom, transportation)
If your business touches any of these areas—even indirectly—it may fall within CFIUS scope.
This is where founders get caught off guard.
They assume their business isn’t “sensitive.”
CFIUS may see it differently.
Mandatory vs. Voluntary Filings
Not every deal requires a mandatory CFIUS filing—but some do.
There are two general approaches:
- Mandatory filings for certain transactions involving critical technologies or government-related interests
- Voluntary filings where parties choose to seek clearance to reduce risk
Even when filing isn’t required, many buyers and advisors opt to file voluntarily.
Why?
Because once CFIUS clears a transaction, it provides a level of certainty.
Without that clearance, the deal could be reviewed later.
And that uncertainty can be problematic.
The CFIUS Review Process
The process typically unfolds in stages:
Initial Filing
The parties submit a notice or declaration to CFIUS outlining the transaction.
Review Period
CFIUS conducts an initial review, usually within a defined timeframe.
Investigation (if needed)
If concerns arise, a deeper investigation is launched.
Outcome
CFIUS may:
- Approve the deal
- Approve with conditions
- Or escalate concerns
In more serious cases, the transaction may be referred for presidential review.
Timing: A Critical Consideration
CFIUS introduces time into the deal process.
And not just a little.
Depending on complexity, the review process can take:
- Several weeks for straightforward cases
- Several months for more complex transactions
If issues arise, timelines can extend further.
This affects:
- Deal certainty
- Operational planning
- Buyer and seller expectations
Founders who don’t plan for this often find themselves under pressure as timelines stretch.
Common Triggers for CFIUS Scrutiny
Certain factors increase the likelihood of review:
- Foreign buyers from specific jurisdictions
- Access to sensitive personal data
- Involvement in critical technologies
- Government contracts or relationships
- Control over critical infrastructure
It’s not just one factor—it’s the combination.
Even if your business doesn’t seem sensitive on its own, the buyer’s profile can change the equation.
Mitigation Measures: When Deals Aren’t Blocked
Not all concerns lead to rejection.
In many cases, CFIUS approves deals with conditions.
These mitigation measures may include:
- Limiting access to certain data
- Requiring U.S.-based oversight
- Implementing cybersecurity protocols
- Restricting certain operational control
From a founder’s perspective, this can impact:
- Post-close operations
- Integration plans
- Overall deal value
It’s not just about getting approved—it’s about how the business operates afterward.
The Risk of Not Filing
Some founders and buyers choose not to file—especially if the transaction doesn’t clearly require it.
This can be risky.
CFIUS has the authority to review transactions retroactively.
That means:
- The deal could be investigated after closing
- Conditions could be imposed later
- In extreme cases, the transaction could be unwound
This uncertainty is why many deals include voluntary filings even when not required.
Impact on Deal Structure
CFIUS considerations can influence how a deal is structured.
For example:
- Limiting foreign ownership percentages
- Creating governance structures to reduce control
- Carving out sensitive business units
These adjustments can help address regulatory concerns—but they also add complexity.
This is why CFIUS needs to be considered early, not retroactively.
Coordination Across Advisors
CFIUS sits at the intersection of:
- Legal strategy
- Regulatory expertise
- Deal structuring
Your team may include:
- M&A advisors
- Legal counsel
- National security specialists
Alignment across these groups is critical.
At Legacy Advisors (https://legacyadvisors.io/), we work with founders to identify these issues early and coordinate with the appropriate experts—so they don’t become deal-breaking surprises.
A Founder’s Perspective
This is a point I emphasize in The Entrepreneur’s Exit Playbook (https://amzn.to/40ppRpT):
The best exits are proactive.
Not reactive.
CFIUS is a perfect example.
If you’re thinking about cross-border buyers, this isn’t something you discover during diligence.
It’s something you plan for from the beginning.
Learning From Experience
On the Legacy Advisors Podcast (https://legacyadvisors.io/podcast), we’ve discussed how regulatory issues—especially in cross-border deals—can change the trajectory of a transaction quickly.
CFIUS is one of the clearest examples of that.
Deals that look straightforward can become complex overnight once national security considerations enter the picture.
The founders who navigate this well are the ones who:
- Understand the risks early
- Engage the right advisors
- Set realistic expectations
The Bigger Picture: It’s About More Than the Deal
CFIUS isn’t evaluating your business the way a buyer does.
It’s evaluating it through a different lens.
A national security lens.
That means:
- Different priorities
- Different concerns
- Different outcomes
Understanding that perspective is key to navigating the process effectively.
Final Thoughts
Cross-border M&A introduces opportunity.
But it also introduces oversight.
CFIUS is one of the most important—and often overlooked—parts of that equation.
It can:
- Delay deals
- Change deal structure
- Or stop transactions entirely
But with the right preparation, it can be managed.
The key is awareness.
And timing.
If you’re considering a cross-border transaction and want to ensure you’re prepared for regulatory review, visit https://legacyadvisors.io/
And if you’re looking for a practical, founder-focused guide to navigating M&A, The Entrepreneur’s Exit Playbook is a valuable resource: https://amzn.to/40ppRpT
Because in M&A, it’s not just about who you sell to.
It’s about everything that comes with it.
Frequently Asked Questions About Understanding CFIUS Reviews in Cross-Border Transactions
What types of businesses are most likely to trigger a CFIUS review?
CFIUS reviews are most commonly triggered when a U.S. business operates in areas tied to national security—broadly defined.
This includes companies involved in:
- Sensitive personal data (health, financial, geolocation data)
- Critical technologies (AI, cybersecurity, semiconductors)
- Infrastructure (energy, telecom, transportation systems)
- Government contracts or defense-related work
However, the scope has expanded significantly. Even companies that don’t appear “sensitive” at first glance may fall under scrutiny if they collect large amounts of user data or provide services tied to national systems.
It’s not just about your business—it’s also about the buyer. Certain foreign investors, depending on their country of origin or ownership structure, may increase the likelihood of review.
Is a CFIUS filing always required in cross-border deals?
No—but in some cases, it is mandatory.
Certain transactions involving critical technologies or foreign government-linked investors require mandatory filings. Outside of those situations, filings are often voluntary.
That said, many parties choose to file voluntarily even when not required.
Why?
Because it provides certainty.
Without a filing, CFIUS retains the right to review the deal after closing. That creates ongoing risk. By filing and receiving clearance, both buyer and seller eliminate that uncertainty.
In practice, many cross-border deals include a CFIUS analysis early in the process to determine whether filing—mandatory or voluntary—makes sense.
Can CFIUS actually block a deal?
Yes—and while it’s not the most common outcome, it does happen.
CFIUS has the authority to recommend that a transaction be blocked if it poses a national security risk. In some cases, deals are abandoned before reaching that stage because the risks become clear during the review process.
More often, deals are approved with conditions—known as mitigation measures. These may include restrictions on data access, governance requirements, or operational controls.
The key point is that CFIUS is not a formality. It has real influence over whether a deal proceeds and under what terms.
How does a CFIUS review impact deal timelines?
CFIUS can significantly extend the timeline of a transaction.
Even in straightforward cases, the review process can take several weeks. If a more detailed investigation is required, it can extend into months.
This impacts:
- Closing timelines
- Deal certainty
- Operational planning during the interim
In some cases, delays can create pressure on both parties, especially if market conditions change or financing is involved.
That’s why it’s critical to factor CFIUS timing into the deal from the beginning—not treat it as an afterthought.
What should founders do early to prepare for a potential CFIUS review?
Preparation starts with awareness.
If there’s any possibility of a foreign buyer, founders should:
- Evaluate whether their business touches sensitive areas like data, technology, or infrastructure
- Understand who potential buyers are and where they’re based
- Engage advisors with experience in cross-border transactions and regulatory review
From there, it’s about planning:
- Assess whether a filing may be required or advisable
- Build realistic timelines that account for review
- Consider how deal structure might be adjusted if needed
The founders who navigate CFIUS successfully aren’t surprised by it—they anticipate it and plan accordingly.