National Security Review (CFIUS)
What Is a National Security Review?
A National Security Review is a formal regulatory process, primarily conducted by the Committee on Foreign Investment in the United States (CFIUS), to evaluate whether a foreign investment in a domestic business poses a threat to national security.
A National Security Review is the mechanism by which the U.S. government (and increasingly other nations) scrutinizes foreign direct investment (FDI). While the United States generally maintains an "open investment" policy, it reserves the right to block transactions that could harm its national security. The primary body responsible for this review is the Committee on Foreign Investment in the United States (CFIUS). CFIUS is an interagency committee that includes the heads of major departments such as Treasury, Defense, State, Justice, Energy, and Homeland Security. Their mandate is to identify and address any national security risks arising from "covered transactions"—typically mergers, acquisitions, or takeovers by foreign persons. In recent years, the definition of "national security" has expanded beyond traditional defense contractors. Today, a National Security Review might target a Chinese company buying a social media app (data privacy), a European firm acquiring a port terminal (infrastructure), or a Middle Eastern fund investing in an AI startup (critical technology). The goal is to ensure that foreign adversaries do not gain control over assets that are vital to the U.S. economy or defense.
Key Takeaways
- The review is conducted by an interagency committee chaired by the Secretary of the Treasury.
- It can result in the blocking, unwinding, or modification of a transaction (M&A deal).
- The scope was significantly expanded by the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA).
- Reviews cover critical technology, critical infrastructure, and sensitive personal data (TID businesses).
- Mitigation agreements are often used to clear a deal by imposing specific security conditions.
The CFIUS Process: Step-by-Step
The CFIUS review process is rigorous and time-sensitive. It typically follows these stages: 1. Filing: The parties to a transaction submit a notice to CFIUS. This can be a voluntary "Joint Voluntary Notice" or, in certain cases involving critical technology or foreign government ownership, a mandatory "Declaration." 2. Assessment/Review Period (45 Days): CFIUS staff reviews the filing to determine if the transaction is a "covered transaction" and if it presents any national security risks. 3. Investigation Period (45 Days): If risks are identified that cannot be quickly resolved, CFIUS initiates a full investigation. This is common for complex deals involving sensitive sectors. 4. Presidential Decision (15 Days): If CFIUS cannot resolve the national security concerns through mitigation, it may recommend that the President block the deal. The President has the final authority to suspend or prohibit the transaction. Throughout this process, parties often withdraw and re-file their notice to "restart the clock" and give CFIUS more time to complete its review, hoping to avoid a rejection.
Mitigation Agreements
Rather than blocking a deal outright, CFIUS often negotiates a "National Security Agreement" or mitigation agreement. This is a contract between the companies and the U.S. government that imposes specific conditions to alleviate security concerns. Common mitigation measures include: * Governance: Requiring that certain board members be U.S. citizens approved by the government. * Operational Control: restricting the foreign owner's access to sensitive data or technology. * Supply Assurance: Guaranteeing supply of critical products to the U.S. government. * Audits: Subjecting the company to regular third-party compliance audits. If the parties agree to these terms, CFIUS clears the deal. However, violating a mitigation agreement can lead to severe penalties or the forced divestiture of the business later.
Real-World Example: Grindr Divestiture
In 2016, Beijing Kunlun Tech Co., a Chinese gaming company, acquired a majority stake in Grindr, a popular dating app. At the time, they did not file for a CFIUS review. The Concern: Years later, CFIUS identified a national security risk. The concern was not military, but data privacy. Grindr collects sensitive personal information—including location data, messages, and HIV status—on millions of users, potentially including U.S. government and military personnel. CFIUS feared this data could be used for blackmail or intelligence gathering. The Outcome: In 2019, CFIUS ordered Kunlun to sell Grindr. Because the deal had already closed, this was a "forced divestiture." Kunlun eventually sold Grindr to a group of investors ("San Vicente Acquisition") for approximately $608 million in 2020. This case highlighted that CFIUS can reach back into closed deals and that personal data is a critical national security asset.
Important Considerations for Arbitrage Traders
For merger arbitrage traders, the National Security Review is a critical risk factor. When a deal is announced, the stock of the target company usually trades below the offer price (the "spread"). If the deal involves a foreign buyer, the spread often reflects the market's assessment of CFIUS risk. Break Fees: To compensate the target for this risk, foreign buyers often agree to a "reverse termination fee" or "break fee." If CFIUS blocks the deal, the buyer must pay the target a significant sum (often 3-6% of the deal value). Jurisdiction Creep: Under FIRRMA, CFIUS now reviews real estate transactions near sensitive facilities (like ports or military bases). A seemingly harmless real estate deal can be blocked if it falls within the "proximity" rules.
Team Telecom
A related process involves the "Committee for the Assessment of Foreign Participation in the United States Telecommunications Services Sector," informally known as "Team Telecom." When a foreign entity seeks an FCC license (e.g., to operate a subsea cable or a satellite network), the FCC refers the application to Team Telecom (comprising DOJ, DOD, and DHS) for national security review. This process runs parallel to, but is distinct from, CFIUS. It specifically targets the integrity of the U.S. communications grid.
Key Legislation: FIRRMA
The Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA) significantly strengthened CFIUS.
- Expanded Jurisdiction: Added non-controlling investments in critical tech, infrastructure, and data (TID) businesses.
- Real Estate: Added authority to review real estate transactions near sensitive government sites.
- Mandatory Filings: Created a requirement to file declarations for certain state-owned investors.
- Filing Fees: Allowed CFIUS to collect filing fees (up to $300,000) to fund its operations.
FAQs
Historically, filings were voluntary. However, FIRRMA introduced mandatory declarations for certain transactions involving "critical technology" or where a foreign government has a "substantial interest" in the foreign acquirer. Failure to file in these cases can result in penalties up to the value of the transaction.
Technically, CFIUS makes a recommendation to the President. The President acts as the final decision-maker on whether to suspend or prohibit a transaction. In practice, most parties abandon the deal if CFIUS indicates it will recommend a block, so few cases actually reach the President's desk for a formal order.
Yes. Following FIRRMA, CFIUS has specific jurisdiction over the purchase or lease of real estate that is in close proximity (often within 1 mile, sometimes up to 100 miles) to sensitive U.S. government facilities, ports, or airports, even if no business is being acquired.
TID stands for Technology, Infrastructure, and Data. It refers to U.S. businesses that produce "critical technologies," perform functions related to "critical infrastructure," or maintain "sensitive personal data" of U.S. citizens. Investments in TID businesses attract the highest level of CFIUS scrutiny.
If you don't file a voluntary notice, CFIUS retains the power to review the transaction indefinitely—even years after it has closed. If they later find a national security risk, they can order a divestiture (forced sale). This creates a "tail risk" that never goes away until the deal is cleared.
The Bottom Line
A National Security Review is the ultimate veto in the world of cross-border dealmaking. Led by CFIUS, this opaque but powerful process ensures that foreign investment does not compromise U.S. safety. For executives and investors, it represents a major regulatory hurdle that can delay, modify, or kill a transaction. In an era of heightened geopolitical competition, the definition of "national security" continues to expand, making the CFIUS review a central component of due diligence for any global merger or acquisition. Ignoring it can be a costly mistake.
More in Legal & Contracts
At a Glance
Key Takeaways
- The review is conducted by an interagency committee chaired by the Secretary of the Treasury.
- It can result in the blocking, unwinding, or modification of a transaction (M&A deal).
- The scope was significantly expanded by the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA).
- Reviews cover critical technology, critical infrastructure, and sensitive personal data (TID businesses).