Investment Screening Risk: How CFIUS and Outbound Rules Work and What They Mean for Companies and Governments

Glass office towers seen from below at dusk — Who may buy into American companies, and where American capital may go. Photo: Envato.

Ownership is now a front in strategic competition. A takeover can transfer technology, data, or a foothold next to a missile field as surely as an export can, so the United States reviews who buys what, and since 2025 it also regulates what Americans may buy abroad. The Committee on Foreign Investment in the United States (CFIUS) can recommend that the President block a deal or order a completed one unwound. For a company, investment screening risk shows up as a deal that dies, a deal that closes with conditions that last for years, or an investor that must sell. It can also be forecast, because screening follows published priorities and leaves a paper trail.

This page explains how CFIUS and the newer outbound investment program work, how they became instruments of geopolitics, what enforcement looks like, and what executives and the officials who advise investors should do about it. It belongs to a series on enforcement risk; sanctions, export controls, foreign agent registration, foreign bribery, forced-labor import bans, and data security have their own pages. This is a general overview of public law and agency records, not legal advice. Anyone facing a specific transaction should talk to CFIUS counsel.

Investment screening at a glance

Legal basis: section 721 of the Defense Production Act of 1950, as amended (50 U.S.C. § 4565), most recently by the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA), Title XVII of Public Law 115-232, which aimed to “strengthen and modernize” the process (Congressional Research Service). The regulations are at 31 C.F.R. parts 800 (businesses) and 802 (real estate).
Who runs it: CFIUS has nine voting members and is chaired by the Secretary of the Treasury; the Secretary of Labor and the Director of National Intelligence sit as nonvoting ex officio members (CRS).
What it covers: transactions that could give a foreign person control of a U.S. business, certain non-controlling investments in “TID U.S. businesses” (those involved with critical technologies, critical infrastructure, or sensitive personal data), and certain purchases or leases of real estate near sensitive government sites.
Voluntary and mandatory filings: most filings are voluntary, but parties must file a short-form declaration at least “Thirty days before the completion date” when a foreign person with substantial foreign-government ownership acquires a substantial interest in a TID U.S. business, or when the U.S. business deals in critical technologies that would need an export authorization to go to the buyer (31 C.F.R. § 800.401).
Timelines: CFIUS must act on a declaration within 30 days; a full notice gets a 45-day review and, if needed, a 45-day investigation that can be extended once by 15 days in extraordinary circumstances (50 U.S.C. § 4565(b)). In 2025, 61 of 207 notices were withdrawn, most to be refiled (White & Case).
Outcomes: clearance, clearance with a mitigation agreement, abandonment, or referral to the President, who may suspend or prohibit a deal on “credible evidence” that the buyer “might take action that threatens to impair the national security” (2020 presidential order).
Civil penalties: a rule effective December 26, 2024, raised the maximum for material misstatements or omissions from $250,000 to $5 million; for a missed mandatory filing to the greater of $5 million or the value of the transaction; and for breaching a mitigation agreement, order, or condition to the greater of $5 million, the value of the transaction, or the value of the violator’s interest in the U.S. business. It also lets CFIUS issue subpoenas where “appropriate” rather than “necessary” (Covington; Davis Polk).
Excepted foreign states: investors from Australia, Canada, and the United Kingdom (since February 13, 2020) and New Zealand (since January 5, 2022) can qualify for exemptions from mandatory filings and from CFIUS’s non-controlling-investment and real estate jurisdiction if they meet strict ownership and conduct tests (CFIUS).
Outbound investment: since January 2, 2025, Treasury’s Outbound Investment Security Program (31 C.F.R. part 850) bars U.S. persons from some investments in Chinese semiconductor, quantum, and artificial intelligence businesses and requires notice of others within 30 days of completion (Treasury; Federal Register). Violations carry IEEPA penalties, the same ceiling that governs sanctions (Treasury fact sheet).

How investment screening became a strategic instrument

How U.S. Investment Screening Grew: timeline chart of key laws, rules, and cases — How U.S. Investment Screening Grew. Chart: Competitive Futures.

CFIUS began as a monitoring committee. Executive Order 11858 of May 7, 1975, created it to watch the effect of foreign investment, which then meant mostly oil-state money (National Archives). The Exon-Florio amendment of 1988 gave the President statutory power to block deals, and the Foreign Investment and National Security Act of 2007 put the committee itself in statute after the controversy over a UAE-based company’s purchase of U.S. port operations (CRS).

The courts drew one boundary. After a 2012 order made Ralls Corporation, owned by two Chinese nationals, divest Oregon wind-farm projects, the D.C. Circuit held in 2014 that it was entitled to the unclassified evidence against it and “an opportunity to rebut that evidence,” though not to classified material (Jones Day).

FIRRMA in 2018 turned CFIUS from a gatekeeper on takeovers into a tool aimed at technology, data, and geography. It reached minority stakes with board seats or technical access, real estate near military sites, and evasive structures, and it introduced mandatory filings. Presidents had prohibited nine transactions by May 2025, most in the preceding decade (CRS). The real estate map keeps growing: a final rule published November 7, 2024, added 59 military installations, bringing the lists to 162 sites with a one-mile band and 65 with a band of up to 99 miles (Gibson Dunn).

Enforcement became visible in 2024. Treasury began publishing its penalties, noting that CFIUS had issued about three times as many in 2023 and 2024 as in its prior history, and said that when parties fail their commitments “there must be consequences” (Treasury). CFIUS also hunts for deals nobody filed: in 2025 it identified “thousands of potential non-notified transactions,” investigated 90, opened 62 formal inquiries, and requested filings in nine (White & Case; Wiley).

The direction of travel became two-way in 2025. A presidential memorandum of February 21, 2025, titled “America First Investment Policy,” directed agencies to “create an expedited ‘fast-track’ process, based on objective standards,” for investment from specified allies and partners; to “restrict PRC-affiliated persons from investing in United States technology, critical infrastructure, healthcare,” and other sectors; to “cease the use of overly bureaucratic, complex, and open-ended ‘mitigation’ agreements”; and to “consider new or expanded restrictions on United States outbound investment in the PRC” (White House). Treasury launched a Known Investor pilot in May 2025, in which selected repeat filers answer a confidential questionnaire before filing; the program “does not change CFIUS’s jurisdiction” (CFIUS).

Outbound screening followed. Executive Order 14105 of August 9, 2023, led to Treasury’s final rule of October 28, 2024, in force January 2, 2025 (Treasury). Congress then codified and widened the program in the Comprehensive Outbound Investment National Security Act of 2025 (COINS Act), enacted December 18, 2025, in the defense authorization act for fiscal 2026. On October 22, 2026, Treasury proposed rules that would extend the program from China to Cuba, Iran, North Korea, Russia, and Venezuela “under the Maduro regime” (which Treasury says “no longer exists”), and add hypersonics, high-performance computing, and biotechnology to semiconductors, quantum, and what the proposal calls “super intelligence” systems. Comments are due December 7, 2026; the current rule stays in force meanwhile (Treasury fact sheet; Simpson Thacher).

What the risk looks like in practice

The matters below run in date order. Presidential orders state findings but rarely the evidence behind them, and CFIUS penalties are administrative actions, not court judgments.

Broadcom and Qualcomm (2018): a deal can be stopped before it is signed

On March 12, 2018, a presidential order prohibited the proposed hostile takeover of Qualcomm by Broadcom, then “a limited company organized under the laws of Singapore,” finding “credible evidence” that the buyer “might take action that threatens to impair the national security,” and barring any substantially equivalent deal (Federal Register). No transaction had closed or even been agreed. Lesson: a buyer from a friendly country is not immune, and a target’s technology leadership can itself be treated as a national security asset.

Beijing Shiji and StayNTouch (2020): the data is the asset

On March 6, 2020, a presidential order required Beijing Shiji Information Technology and its Hong Kong subsidiary to divest StayNTouch, a Delaware company whose hotel management software held guest data, within 120 days, citing “credible evidence” of a threat (Federal Register). The acquisition had already closed. Lesson: a modest software deal becomes a national security matter when the target holds sensitive personal data on Americans.

MineOne (2024): location is the asset

On May 13, 2024, a presidential order made MineOne entities, ultimately majority owned by Chinese nationals, sell a cryptocurrency-mining site in Cheyenne, Wyoming, “within 1 mile of Francis E. Warren Air Force Base,” which hosts Minuteman III missiles. The order cited the location and foreign-sourced equipment that could enable surveillance, and required divestment within 120 days (Federal Register). The parties had bought the land in June 2022 and had not filed; CFIUS “received a tip about the transaction from a member of the public,” according to one law firm’s analysis (Paul Weiss). Lesson: for real estate, the map is the risk assessment; check every site against the installation lists before signing.

T-Mobile (2024): mitigation is a continuing obligation

CFIUS cleared T-Mobile’s 2020 merger with Sprint subject to a national security agreement. In August 2024 it disclosed a $60 million penalty, its largest, finding that from August 2020 to June 2021 the company failed to prevent unauthorized access to certain sensitive data and to report some incidents promptly, and that the violations “resulted in harm to the national security equities of the United States” (CFIUS). T-Mobile said “this was not a data breach, but a technical issue” during post-merger integration (Engadget). Lesson: clearance with conditions is the start of a compliance program, and the reporting duty matters as much as the security duty.

Nippon Steel and U.S. Steel (2025): an allied buyer, a block, and a negotiated reversal

After a split CFIUS recommendation on Japan’s Nippon Steel’s 2023 agreement to buy U.S. Steel, a presidential order of January 3, 2025, prohibited the deal (Federal Register), and the companies challenged the order in court (Hunton). After a new review, an order of June 13, 2025, amended the January order to permit the deal only if the parties signed a national security agreement with Treasury on or before closing (Federal Register). The deal closed June 18, 2025. The agreement commits about $11 billion in new investment by 2028, requires U.S. citizens in key management and a majority of the board, and gives the U.S. government a “golden share” with consent rights over matters such as redomiciling, renaming, and certain plant closures (Hunton). Lesson: outcomes can change with policy, and the price of approval can include governance rights for the state.

Suirui and Jupiter Systems (2025–2026): time is no shield, and orders are enforced in court

On July 8, 2025, a presidential order required Hong Kong-based Suirui International, a subsidiary of China’s Suirui Group, to divest Jupiter Systems, an audiovisual technology maker with critical-infrastructure and military-related customers, more than five years after the deal closed in February 2020 (Debevoise). On February 9, 2026, the Justice Department sued in the U.S. District Court for the District of Columbia to enforce the order, “the first such action ever filed in federal district court,” On May 26, 2026, the court granted a preliminary injunction and appointed a receiver for Jupiter while the case continues (CRS). A January 2, 2026, order likewise required HieFo Corporation to unwind its $2.92 million purchase of Emcore’s digital chips business, which CFIUS’s non-notified team had found (Debevoise). Lesson: an unfiled deal stays open to review indefinitely, and neither age nor size protects it.

Amidi (2026): the outbound program bites

Treasury announced on October 7, 2026, its first civil penalty under the Outbound Investment Security Program: $200,000, imposed in July 2026 on Amidi, LLC, parent of the accelerator Plug and Play Tech Center. Its subsidiary, a Chinese fund, invested about $92,478 on April 19, 2025, in Shanghai Qiongche Intelligent Technology (Noematrix), an AI and robotics developer, and Amidi did not file the required notification. Treasury found the deal through “regular and ongoing compliance and market monitoring efforts” (Treasury; WilmerHale). Lesson: the outbound rules reach a U.S. parent through its foreign-controlled funds, and a five-figure check is enough.

Published penalties remain few. CFIUS’s enforcement page lists nine, from $100,000 to $60 million, most for breaching mitigation agreements; one, of $1.25 million in 2024, punished forged documents in a filing (CFIUS). The 2025 annual report disclosed no new penalties (Wiley). The larger costs are delay, abandoned deals, mitigation, and forced sales.

What it means for companies

Investment screening risk attaches to what a company buys, who buys into it, where its sites are, and, for U.S. investors, where their money goes.

Molten steel pouring in a mill, an industry at the center of a major U.S. investment screening review — The Nippon Steel–U.S. Steel review showed that investment screening can end in a deal with conditions rather than a simple block. Photo: Envato.

Classify the target before the term sheet. Decide early whether the U.S. business is a TID business: does it produce critical technologies controlled for export, run listed critical infrastructure, or hold sensitive personal data on large numbers of Americans? The answer drives whether a declaration is mandatory and whether a minority stake is reviewable.
Map the buyer’s full ownership. Trace government stakes, limited partners, and side letters; foreign-government interests can trigger mandatory filings.
Price the review into the deal. Build timing, a possible refiling, and likely mitigation into the purchase agreement, and allocate the risk explicitly, including reverse break fees and any duty to accept conditions.
Treat mitigation as an operating program. Name an owner for each obligation, fund the security and audit functions, keep independent directors seated, and report incidents on time; the T-Mobile penalty and an $8.5 million penalty for removing independent directors show where agreements break.
Audit your past deals. CFIUS’s non-notified team works backward, as Jupiter and HieFo show. If an earlier investment might have needed a filing, decide with counsel whether to file now.
Screen land and leases against the installation lists. Check proximity bands for every new site, including data centers, energy projects, and warehouses, and watch state laws on foreign land ownership.
For U.S. investors abroad, build outbound diligence. Ask targets about covered technologies, document the answers, track deals by controlled foreign funds, calendar the 30-day notice deadline, and watch the COINS Act rulemaking.

Forecasting screening risk

Screening decisions follow announced priorities, which makes them forecastable. Useful signposts include presidential memoranda naming sectors or countries; Treasury rulemakings; additions to the installation lists; CFIUS annual reports; congressional letters naming specific deals; and allied decisions on similar buyers or technologies. Scenario work helps most with long-lived exposures: an existing investor from a country that falls out of favor, a mitigation agreement whose terms tighten on renewal, or a portfolio company that drifts into a newly covered technology. Competitive intelligence adds the counterparty view: rival bidders, who might lobby against a buyer, and how defense or infrastructure customers will read the deal. The goal is to know before signing which outcomes are plausible and what each would cost.

What it means for governments advising their companies

Investment agencies, trade ministries, and embassy commercial sections now field two questions: will Washington let our company buy this, and may U.S. money still come here?

Row of national flags, representing allied investment screening regimes — Allied investment screening regimes overlap with CFIUS but differ in thresholds, sectors, and timelines. Photo: Envato.

Reach and nexus. CFIUS reviews investments in U.S. businesses and U.S. real estate, so its reach turns on the target, not the buyer’s home. A foreign company’s U.S. subsidiary, U.S. customers, or U.S. sites can bring a global deal into review. The outbound rules reach in the other direction: they bind U.S. persons, including for deals made by foreign entities they control, so a country seeking U.S. venture capital for AI, semiconductor, or quantum start-ups should expect U.S. investors to ask whether the start-up has ties to a country of concern (Treasury).

Excepted status is narrow. Only Australia, Canada, New Zealand, and the United Kingdom are excepted foreign states, and even their investors must meet strict tests before they can skip mandatory filings, and full control transactions remain reviewable (CFIUS). In 2025, investors from Japan filed the most declarations (18), and the most notices came from China (33), Japan (23), the UAE (18), and Canada (15) (Wiley).

Allied regimes converge but differ. The United Kingdom’s National Security and Investment Act 2021 entered into force on January 4, 2022; it requires notice of acquisitions in 17 sensitive sectors, voids unapproved notifiable deals, and allows penalties up to “5% of worldwide turnover or £10 million – whichever is greater” (Mayer Brown). In the year to March 2026 it received 1,324 notifications and issued nine final orders (Clifford Chance). The European Union replaced its 2019 cooperation framework (Regulation (EU) 2019/452) with Regulation (EU) 2026/1386 of June 17, 2026, published June 26, 2026, which requires every member state to run prior-authorization screening across a common minimum set of sensitive sectors, extends screening to investments made through EU subsidiaries of foreign investors, and applies fully from January 17, 2028 (Cuatrecasas; Debevoise). The European Commission also recommended on January 15, 2025, that member states review outbound investments in semiconductors, AI, and quantum technologies (Cleary Gottlieb). Japan’s Diet amended the Foreign Exchange and Foreign Trade Act on May 29, 2026, formalizing interagency review (a “Japanese CFIUS,” in one firm’s phrase) and adding powers to investigate some deals after closing (Orrick). Canada amended the Investment Canada Act in 2024, and its March 5, 2025, guidelines add economic security as a factor (Government of Canada). Australia requires notice of investments in national security businesses and land, can call in others “at any time in the future while under foreign ownership,” and holds a last-resort power to order divestment (Foreign Investment Australia).

How good briefings work. Useful advice to investors is concrete: whether a U.S. target is likely a TID business, whether a filing is mandatory, how long reviews really take, what mitigation is common in the sector, and, for outbound flows, which domestic start-ups U.S. investors will now diligence more closely. That service is useful whatever view a government takes of a given policy.

Frequently asked questions

Does every foreign investment in a U.S. company need CFIUS approval?

No. Most filings are voluntary. A declaration is mandatory only in defined cases, chiefly substantial foreign-government interests in TID U.S. businesses and deals involving export-controlled critical technologies. But CFIUS can review any covered transaction that was not filed, including years after closing.

What is the maximum CFIUS penalty?

Since December 26, 2024, up to $5 million for a material misstatement; the greater of $5 million or the transaction value for a missed mandatory filing; and the greater of $5 million, the transaction value, or the violator’s interest in the U.S. business for breaching a mitigation agreement or order.

Can the United States force a buyer to sell after a deal has closed?

Yes. Presidential orders forced divestment of StayNTouch in 2020, the MineOne site in 2024, Jupiter Systems in 2025, and Emcore’s chips business in 2026. In the Jupiter case, a federal court appointed a receiver in 2026 to enforce the order.

Are investors from allied countries exempt?

Only partly. Qualifying investors from Australia, Canada, New Zealand, and the United Kingdom can be exempt from mandatory filings and some jurisdiction, but control deals stay reviewable. The 2025 fast-track and Known Investor initiatives aim to speed reviews for allies without changing CFIUS’s jurisdiction.

What does the outbound investment rule cover?

Since January 2, 2025, U.S. persons may not make certain investments in Chinese entities working on advanced semiconductors, quantum, or AI, and must notify Treasury of others within 30 days. A COINS Act proposal of October 2026 would add countries and sectors, including hypersonics, high-performance computing, and biotechnology.