CFIUS and Investment Screening

The Committee on Foreign Investment in the United States was established by executive order in 1975 and given statutory authority by the Exon-Florio Amendment to the Defense Production Act in 1988. CFIUS reviews foreign acquisitions of U.S. businesses for national security implications, with authority to recommend that the President block or unwind transactions that pose unresolved national security risks.

For most of its history, CFIUS operated as a voluntary review body with jurisdiction limited to transactions in which a foreign person would acquire control of a U.S. business. The committee's reviews were confidential, its deliberations were not subject to judicial review, and its decisions were rarely publicized. The process was designed to be minimally disruptive to foreign investment flows while preserving a backstop against the most serious national security risks.

The limitations of this framework became apparent as Chinese investment in U.S. technology companies accelerated in the 2010s. Minority investments, joint ventures, and real estate acquisitions near sensitive facilities fell outside CFIUS jurisdiction. Chinese investors structured transactions to avoid triggering review — acquiring minority stakes, using U.S.-based intermediaries, or investing through venture capital funds that were not themselves subject to CFIUS oversight.

The Foreign Investment Risk Review Modernization Act, enacted in August 2018, was the most significant reform of the CFIUS framework since Exon-Florio. FIRRMA expanded CFIUS jurisdiction in three principal ways: it extended review authority to non-controlling investments in TID US businesses (critical technology, critical infrastructure, and sensitive personal data companies); it added jurisdiction over certain real estate transactions near military installations and sensitive government facilities; and it established mandatory declarations for specified categories of transactions.

The TID US business provisions, which took effect in February 2020 under implementing regulations, require mandatory declarations for any foreign government-controlled investment in a TID US business, and for any investment that would give a foreign person access to material non-public technical information, board representation, or involvement in substantive decision-making at a TID US business. The mandatory declaration requirement was a significant departure from the prior voluntary framework.

FIRRMA also authorized CFIUS to charge filing fees for covered transactions — a provision intended to fund the committee's expanded workload — and directed Treasury to establish a pilot program for mandatory declarations in critical technology sectors. The pilot program, launched in November 2018, required declarations for foreign investments in 27 industries involving critical technologies, including semiconductors, advanced materials, and aerospace.

CFIUS has ordered or negotiated the divestiture of several Chinese-owned U.S. businesses on national security grounds. The most prominent cases involve companies with access to sensitive personal data or proximity to sensitive government facilities. Beijing Kunlun Tech was required to divest Grindr, the gay dating application, after CFIUS determined that the company's access to sensitive personal information about U.S. government employees and military personnel posed national security risks. Kunlun sold Grindr in 2020.

iCarbonX, a Chinese health data company, was required to divest its stake in PatientsLikeMe, a patient data platform with information on hundreds of thousands of Americans with chronic conditions. Shiji Group, a Chinese hospitality technology company, was required to divest StayNTouch, a hotel property management system used by properties near sensitive government facilities. In each case, CFIUS determined that Chinese ownership of companies with access to sensitive personal data posed risks that could not be adequately mitigated through contractual protections.

The most significant blocked transaction was the proposed acquisition of Lattice Semiconductor by Canyon Bridge Capital Partners, a private equity firm with ties to Chinese state-owned enterprises, in 2017. President Trump blocked the transaction on the recommendation of CFIUS, citing Lattice's role as a supplier of programmable logic chips to the U.S. military and intelligence community. The Lattice case established that CFIUS would scrutinize Chinese acquisitions of semiconductor companies with defense applications regardless of the acquirer's stated intentions.

FIRRMA's real estate provisions extended CFIUS jurisdiction to purchases, leases, and concessions involving real estate in close proximity to military installations, U.S. government facilities, and other sensitive sites. The implementing regulations identify specific airports, maritime ports, and military installations where proximity triggers CFIUS review authority, and establish a general standard for other sensitive government facilities.

The real estate provisions have been applied in several high-profile cases. A Chinese company's purchase of farmland near Grand Forks Air Force Base in North Dakota — a facility that hosts sensitive drone operations and is being developed as a base for next-generation surveillance aircraft — prompted a CFIUS review and congressional scrutiny. The Air Force publicly opposed the transaction, citing concerns about the proximity of Chinese-owned land to sensitive flight operations and the potential for surveillance of base activities.

The Grand Forks case highlighted a gap in CFIUS's real estate jurisdiction: the committee's authority over agricultural land acquisitions is limited, and several states have enacted their own restrictions on foreign ownership of farmland near sensitive facilities. The Biden administration directed CFIUS to review its real estate jurisdiction and consider whether additional regulatory action was warranted, and the committee subsequently expanded the list of military installations subject to proximity-based review.

When CFIUS identifies national security risks in a covered transaction, it has three options: clear the transaction without conditions, negotiate a mitigation agreement that imposes conditions intended to address the identified risks, or recommend that the President block the transaction. Mitigation agreements — also called national security agreements or letters of assurance — are the most common outcome for transactions that raise concerns but are not deemed to pose unresolvable risks.

Mitigation agreements typically impose requirements on the U.S. business regarding data security, personnel security, physical security, and government access. They may require the establishment of a security committee with U.S. citizen members, restrictions on the transfer of sensitive technology or data to the foreign acquirer, requirements to maintain U.S.-based data storage and processing, and audit rights for U.S. government agencies.

The effectiveness of mitigation agreements has been questioned by national security officials and congressional oversight bodies. A 2022 report by the CFIUS annual report noted that the committee had identified compliance issues in a significant percentage of monitored mitigation agreements. Critics argue that mitigation agreements are difficult to enforce, that Chinese companies have sophisticated means of circumventing data security requirements, and that the fundamental risk — Chinese government access to sensitive U.S. technology and data — cannot be adequately addressed through contractual protections.

CFIUS reviews inbound foreign investment in U.S. businesses, but has no jurisdiction over outbound U.S. investment in foreign companies. The absence of an outbound investment screening mechanism has been identified as a significant gap in the national security framework, as U.S. venture capital and private equity investment in Chinese technology companies has provided capital, expertise, and market access that has accelerated the development of Chinese capabilities in semiconductors, artificial intelligence, and quantum computing.

President Biden issued an executive order in August 2023 directing Treasury to establish a notification and prohibition regime for U.S. investment in Chinese companies in three sectors: semiconductors and microelectronics, quantum information technologies, and artificial intelligence. The order directed Treasury to prohibit certain transactions and require notification for others, with implementing regulations to be developed through a rulemaking process.

The outbound investment rules, finalized in October 2024, represent the first systematic U.S. restriction on outbound investment to a specific country based on national security concerns. The rules prohibit U.S. persons from investing in Chinese companies developing advanced semiconductors, quantum computers, and certain AI systems with military applications, and require notification for investments in a broader set of covered technologies. The rules apply to U.S. persons globally, including through foreign subsidiaries and fund investments.