CFIUS review: when Washington has a say in your US investment

Expand from Europe into the USA and sooner or later you will hear an acronym that sounds like an intelligence agency: CFIUS. It stands for the Committee on Foreign Investment in the United States, a committee of several federal agencies chaired by the Treasury Department. It may review foreign investments in US businesses and certain real estate transactions for their national security implications. In the worst case, the President can block a deal or order it unwound.

For the vast majority of entrepreneurs, though, CFIUS never comes into play. If you set up your own US company, rent an office and serve customers, you are not buying an existing US business. It is a different matter if you take over an American company, invest in a tech startup or buy land near a military base. This guide shows where the line is drawn, when a filing is mandatory, which deadlines and fees apply and what role your origin plays. Everything is drawn from the regulations at 31 CFR Parts 800 to 802 and from the US Treasury Department's website. For an overview of every building block of your market entry, see the guide Expanding successfully into the USA.

1What CFIUS reviews, and on what legal basis

The legal basis is Section 721 of the Defense Production Act. The current implementing regulations have applied since February 13, 2020; they implement the Foreign Investment Risk Review Modernization Act of 2018, FIRRMA for short. The Treasury Department points to three sets of rules. Part 800 covers investments in US businesses. Part 802 covers real estate transactions. Part 801 was a pilot program for critical technologies whose core has been folded into Part 800, including the mandatory filing for certain technology deals.

CFIUS reviews so-called covered transactions. Under 31 CFR 800,213 there are four: a transaction through which a foreign person could gain control of a US business; a non-controlling investment in certain sensitive US businesses; a later change in rights that leads to either of these; and any structure designed to evade review. A foreign person here includes your company back home, and equally a US company that you control.

The key concept is control, and 31 CFR 800,208 defines it broadly. Control is the power to determine important matters of a business, whether through a majority, a strong minority, board seats, special rights or contracts. The regulation lists such matters: selling major assets, restructuring, closing or relocating facilities, major investments, the budget, new lines of business, significant contracts, the handling of confidential information and the appointment of management. So a stake of less than 50 percent can amount to control if it comes with the right set of rights.

2Why most market entries never touch CFIUS

The good news sits in the examples to the regulation itself. In 31 CFR 800,301 the Treasury Department describes a new venture, a greenfield investment in American terms: a foreign company forms a new subsidiary, finances and builds a plant, buys materials, hires staff and acquires the technology it needs. The regulation's verdict: it has not acquired a US business, and the greenfield investment is not a covered acquisition of control. That is exactly the typical route a European company takes into the US market.

Pure exporting is not a CFIUS matter either. Under the examples in 31 CFR 800,252, a foreign company with no branch, no subsidiary and no fixed place of business in the USA is not a US business, even if it ships goods to the USA, licenses technology or serves customers remotely. Only the branch or subsidiary in the USA is a US business within the meaning of the regulation. How to choose between the two is covered in the guide Branch or subsidiary.

The greenfield example adds one caveat itself: the deal may fall under the real estate rules in Part 802. If you buy or take a long-term lease on land for your new plant, check where it is located. The sixth section of this guide covers this. And as soon as you stop building from scratch and instead buy an existing startup that already has staff, a website and offices, the same section treats it as an acquisition.

3When an acquisition or stake is covered

If you buy all or a majority of a US business, that is as a rule an acquisition of control and therefore a covered transaction, regardless of industry or size. But covered does not automatically mean you must file. For most acquisitions of control, filing is voluntary. It only becomes mandatory in the cases set out in the next section.

Non-controlling stakes are trickier. Under 31 CFR 800,211 they only fall under CFIUS when two things come together. First, the target must be a so-called TID U.S. business, meaning a business with critical technology, critical infrastructure or sensitive data. Second, the stake must give you at least one of three rights: access to material non-public technical information, a board seat or observer status or the right to nominate someone for one, or involvement in substantive decisions about the sensitive data, critical technologies or infrastructure.

3.1The three groups of sensitive businesses

What counts as a TID U.S. business is defined in 31 CFR 800,248. The first group produces, designs, tests or develops critical technologies. Under 31 CFR 800,215 these include defense articles on the US Munitions List, many items on the Commerce Control List under export control law, certain nuclear technology and emerging key technologies. The second group operates certain critical infrastructure listed in Appendix A to Part 800. The third group collects or stores sensitive personal data of US citizens. Under 31 CFR 800,241 this covers, for example, financial, health and location data, once the business has held it on more than one million people in the past twelve months or has this as a business objective. For investors in e-commerce and software, this third group is the biggest surprise.

4Mandatory or voluntary filing

The filing requirement is set out in 31 CFR 800,401 and covers two cases. In the first, a foreign person in which a foreign government holds a substantial interest acquires a substantial interest in a TID U.S. business. Under 31 CFR 800,244, substantial means a voting interest of 25 percent or more in the target on the investor's side, and an interest of 49 percent or more in the investor on the government's side. The second case concerns US businesses with critical technologies whose export to the investor would require a US export license. What matters is the investor's principal place of business, or for individuals their nationality. Whether a given item would need a license depends on the target's export classification, so this question belongs early in any review.

In both cases, under 31 CFR 800,401(g), the filing must be submitted no later than 30 days before closing. Instead of the short declaration, the parties may also file a full notice straight away. Miss a mandatory filing and, under 31 CFR 800,901, you risk a civil penalty of up to $5 million or up to the value of the transaction, whichever is greater. For false or incomplete information in a filing, the same regulation provides for up to $5 million per violation.

Outside these two cases, filing is voluntary. The parties can submit a short declaration under 31 CFR 800,402 or a full notice under 31 CFR 800,501. Voluntary does not mean without consequences. Under 31 CFR 800,501(b), the committee can also pick up transactions nobody filed and ask the parties to file, even after closing. If you file voluntarily on a sensitive deal and get clearance, you are buying legal certainty. Whether a deal should be filed is a question for the transaction attorneys on both sides, before the purchase agreement is signed.

5Continental Europe: no exception

The regulations recognize so-called excepted foreign states. Investors from these states may, under strict conditions, qualify as excepted investors and be exempt from the rules on non-controlling investments and from certain filing requirements. The Treasury Department keeps the list on its CFIUS page. It names Australia, Canada, New Zealand and the United Kingdom, and nobody else. No EU country is on it, nor are Norway or Switzerland. For investors from those countries the rules apply in full, with no relief.

The committee's annual report to Congress shows this happens in practice. In 2025, acquirers from Germany filed twelve declarations and fourteen notices, from Switzerland one declaration and three notices, and from Austria no declarations and one notice. The table below shows the figures from 2023 to 2025. In 2025, the committee counted 140 declarations, 51 of them mandatory filings according to the parties, and 207 notices, of which 114 went on to investigation.

For European companies, three situations typically fall within scope. The first is buying an American supplier that makes export-controlled goods, for example for aerospace, defense, semiconductors or measurement technology; here a filing may be mandatory. The second is a fund or a corporate group taking a stake in a US start-up with a board seat or access to technical data, where the start-up develops critical technology or holds large volumes of sensitive data. The third is buying or leasing land near a military installation. Whether a specific deal is covered can only be assessed case by case.

6Process, deadlines and fees

The declaration is a short-form filing, according to the Treasury generally no longer than five pages, submitted through the electronic Case Management System. Once it is accepted, a 30-day assessment period runs under 31 CFR 800,405. At the end, 31 CFR 800,407 allows four possible responses: the committee clears the transaction, it states that it cannot conclude action on the basis of the declaration, it requests a full notice, or it initiates a review on its own. There is no fee for a declaration. According to the annual report, assessments in 2025 took 30.1 days on average, excluding days of a government shutdown.

The notice is the full filing. Once it is accepted, a 45-day review runs under 31 CFR 800,503. If the committee still has concerns afterwards, 31 CFR 800,508 provides for an investigation of a further 45 days, which in extraordinary cases can be extended once by 15 days. The committee then concludes, often after agreeing on mitigation conditions, or refers the deal to the President for a decision. A notice carries a fee under 31 CFR 800.1101 based on the transaction value; the table shows the tiers.

Good planning means being honest about timing. According to the annual report, in 2025 the committee closed about two thirds of all cases within the first deadline, meaning within the 30 days for declarations or the first 45 days for notices, again excluding shutdown days. One third went on to the next round. Anyone negotiating a purchase agreement therefore makes CFIUS clearance a condition of closing and plans the date with a buffer. No one can promise in advance how the committee will decide.

7Real estate: military bases, ports and airports

Part 802 covers real estate transactions whether or not a business is being acquired. Under 31 CFR 802,212 it covers a purchase, lease or concession that gives you at least three of four property rights: to physically access the land, to exclude others from it, to improve or develop it, and to affix structures to it. For a plant site, all four usually apply.

Which properties are affected is set out in 31 CFR 802,211. They include land in or near covered ports and airports, land in close proximity to the military installations listed in Appendix A, which under 31 CFR 802,203 means within one mile of the installation's boundary, and for certain installations an extended range of a further 99 miles under 31 CFR 802,217. For some installations, entire counties are listed. The Treasury provides a mapping tool you can use to check an address against the list.

Exceptions under 31 CFR 802,216 include land in urbanized areas and urban clusters as defined by the Census Bureau (except within the one-mile zone and in ports), a single housing unit with its associated land, retail space in ports and airports, and small commercial space in multi-unit buildings. According to the Treasury, there is no mandatory filing for real estate transactions; the parties decide for themselves whether to file. Separately from CFIUS, any foreign person who acquires an interest in agricultural land must report it to the Department of Agriculture within 90 days under 7 U.S.C. 3501. If you are planning a plant in a rural area, the guide on site selection and incentive programs has more.

8Industry rules outside CFIUS

CFIUS is not the only barrier to foreign capital. Some federal statutes limit foreign ownership in certain industries directly, with no review process at all. Two examples show the pattern. Under 47 U.S.C. 310(b), the Federal Communications Commission may not grant broadcast, common carrier or certain aeronautical radio licenses to companies more than one fifth of whose capital is foreign-owned; for indirect ownership through a parent company, the threshold is one quarter, if the agency finds that refusal serves the public interest.

Airlines must qualify as a citizen of the United States under 49 U.S.C. 40102(a)(15). Among other things, this requires the president and at least two thirds of the board and managing officers to be US citizens, and at least 75 percent of the voting interest to be held by US citizens. Mid-sized European companies rarely operate in industries like these. If you invest in a regulated industry, check the industry rules in addition to CFIUS, not instead of it.

9What to clarify before you buy

For a new company, one question is usually enough: is the property in one of the Part 802 zones? For an acquisition or an investment, the list is longer. Settle these points before you sign:

• Is the target a US business within the meaning of 31 CFR 800,252, that is, active in the United States?
• Will you gain control within the meaning of 31 CFR 800,208, including through special rights or board seats?
• Is the target a TID U.S. business: critical technology, critical infrastructure or sensitive data on more than one million people?
• How are the target's products classified under export control rules, and would exporting them to you require a license?
• Does a foreign government hold 49 percent or more in you or in a co-investor?
• Does the deal include property near military installations, ports or airports?
• Does your timeline allow 30 days' lead time for a mandatory filing and a possible review of 45 plus 45 days?

If several answers are yes, you need transaction attorneys with CFIUS experience before the purchase agreement is final. The Treasury also offers to discuss a deal with committee staff before a formal filing. For the structure afterwards (entity type, taxes and the link to the parent company), see the guides on the tax aspects of US expansion and on foreign direct investment in the USA.

In short

• CFIUS reviews acquisitions of and investments in existing US businesses as well as certain real estate transactions; setting up your own new subsidiary is not a covered control transaction under 31 CFR 800,301.
• A filing is mandatory for certain deals involving critical technologies and where foreign governments hold a substantial interest, no later than 30 days before closing.
• Apart from the United Kingdom, no European country is an excepted foreign state; the only excepted states are Australia, Canada, New Zealand and the United Kingdom.
• The short-form filing (declaration) is free and assessed within 30 days; the full filing (notice) costs up to $300,000 depending on value and runs up to 45 plus 45 days.
• Property near certain military installations, ports and airports is subject to separate rules in 31 CFR Part 802.

How we help you

• US market entrySubsidiary, staff, taxes: your start in the US market.
• Form a CorporationThe US corporation (Inc) for growth, investors and your visa.
• Tax structureA clean structure between parent company and US subsidiary, or between you and your US company, coordinated with your accountant.
• Company formation consultationEntity type, state and tax consequences, before you commit.
• US Company FormationLLC, Inc or LP in Delaware, Florida, California, New York, Texas or Wyoming.