01
Foreign-Investment Risk Assessment
Early diligence on a transaction's CFIUS exposure. We map the target's technology, infrastructure, and data against the regulations so the parties know where they stand before terms are set.
Corporate & Business Law
CFIUS & National Security
Foreign-investment review built into the deal itself: CFIUS analysis, mandatory and voluntary filings, mitigation, and the export-control and sanctions touchpoints that decide if a cross-border transaction can close, and on what terms.
National security review used to be one question at the end of a deal. It is now four regimes on separate clocks. Since January 2025 the Treasury's outbound rule has prohibited, or required notice of, certain US investments in Chinese semiconductors, quantum computing and artificial intelligence. Since April 2025 a Justice Department rule has restricted deals giving a country of concern access to bulk sensitive data on Americans.
The Committee on Foreign Investment in the United States remains the center. It can clear a covered transaction, condition it, or recommend that the President block or unwind it, and a deal it never saw stays open to review. Around it sit the export-control and sanctions rules that decide whether the technology may be shared and whether the investor may participate at all.
We assess exposure before terms are set, decide whether a filing is mandatory or merely wise, prepare it, and negotiate mitigation the business can live under. We advise on and represent clients in matters before CFIUS and the Departments of the Treasury, Justice and Commerce, drawing in registered trade counsel where licensing requires it.
What we do
National security counsel for cross-border investment, from early risk assessment through filing, mitigation, and ongoing compliance.
02
Mandatory & Voluntary Filings
Determining if a filing is required or advisable, then preparing declarations and full notices, with the threshold analysis for critical-technology, critical-infrastructure, and sensitive-data (TID) businesses and government-interest deals.
03
Mitigation Agreements
Negotiating the commitments that resolve a national security concern, such as governance restrictions, security plans, data controls, and monitoring, structured to satisfy the Committee while keeping the business operable.
04
FOCI & Governance Structures
Designing arrangements that address foreign ownership, control, or influence where it intersects with sensitive work: proxy, voting-trust, and board structures, coordinated with outside counsel where required.
05
Export Controls & Sanctions Touchpoints
Mapping how US export controls and sanctions regimes interact with a deal, from the control status of the target's technology to who may invest, and drawing in registered trade counsel for licensing where needed.
06
Deal Structuring & Closing Conditions
Building the national security analysis into the transaction documents, through representations, covenants, CFIUS closing conditions, and risk allocation, so review is managed within the deal rather than around it.
What you should know
The realities that shape a national security review.
01
Only the President blocks
The Committee can clear a deal or negotiate mitigation, but it cannot prohibit one. A block or forced divestiture comes by presidential order, due within 15 days after the investigation ends. Most deals headed that way are withdrawn and abandoned first, so the timetable has to allow for the Committee's signal, not the order.
02
Mandatory means 30 days before
A required filing is due at least 30 days before closing, and the penalty for skipping it rose in December 2024 from $250,000 to the greater of $5 million or the value of the transaction. A signing-to-closing gap shorter than the declaration's 30-day assessment is a defect in the deal, not a scheduling problem.
03
TID has a definition
A TID business produces or develops critical technology, owns or operates critical infrastructure on the list appended to the regulations, or maintains sensitive personal data on more than one million people. Mailing lists do not count; financial, health and geolocation data do, and the one-million test looks back twelve months.
04
Export controls and sanctions are linked
The export-control status of a target's technology can decide if a CFIUS filing is mandatory, and sanctions exposure can shape who may invest. The regimes have to be read together.
05
Restructuring beats mitigation
If the sensitivity sits in one product line or one data set, carving it out before filing, or selling it to a US buyer at closing, often clears a deal mitigation would burden. A mitigation agreement runs for years, with a security officer, third-party audits and a monitoring agency; a carve-out ends at closing.
06
A clearance is a separate problem
If the target holds a facility security clearance, foreign ownership must be reported to the Defense Counterintelligence and Security Agency, and the clearance survives only under a FOCI instrument: a board resolution for small stakes, a security control agreement, or a proxy or voting-trust agreement that removes the foreign owner from classified work entirely.
The arc of a review
How this work runs
How a deal clears the Committee.
- Stage 01
Jurisdictional threshold
Before terms are set, we map the target against the regulations on critical technologies, covered infrastructure, sensitive personal data, and foreign-government interest, and settle the first question: is a filing mandatory, advisable, or unnecessary.
- Stage 02
Declaration or notice
We choose the path, a short-form declaration where the facts support it and a full joint voluntary notice where they do not, and build the submission so the Committee's questions are answered before they are asked.
- Stage 03
Review and questions
Once accepted, the statutory clock runs. Interagency questions arrive on tight response deadlines; where concerns surface, the matter proceeds into investigation and the negotiation begins over what conditions the deal can bear.
- Stage 04
Clearance or mitigation
The matter ends in clearance, in a mitigation agreement covering governance limits, data controls, security plans, or monitoring, or in a restructuring that removes the concern. The terms negotiated here govern the business for years, so we draft them to be operable as well as approvable.
The Committee does not renegotiate your deal. It decides if the deal you negotiated can exist.
45 days
the initial CFIUS review period before a matter proceeds to investigation
Frequently asked
Common questions on CFIUS and national security review.
What is CFIUS, and why does it matter to a deal?
CFIUS is the Committee on Foreign Investment in the United States, an interagency body that reviews certain foreign investments in US businesses for national security risk. It matters because the Committee can impose conditions on a transaction, and in some cases recommend that the President block or unwind it, so its analysis has to be built into deal terms and timing from the start.
When is a CFIUS filing mandatory rather than voluntary?
Most CFIUS reviews are voluntary, but filings are mandatory for certain transactions, for example some involving critical technologies subject to US export controls, or substantial foreign-government interests in TID businesses (critical technology, critical infrastructure, or sensitive personal data). The threshold analysis is fact-specific, and getting it wrong can carry penalties, so we assess each deal against the current regulations before deciding the path.
What is a CFIUS mitigation agreement?
A contract with the US government, signed by the parties as the price of clearance and enforced by a monitoring agency after closing. Common terms include a security officer approved by the agency, limits on who may access specified technology or data, and board carve-outs that keep the foreign owner away from defined decisions. Data may have to stay on US servers, and audits by a third party, paid for by the parties, recur each year. Since December 2024 a breach can be penalized at the greater of $5 million, the transaction value or the value of the breaching party's interest, and the Committee may also unwind the deal. The terms are negotiated during the review, because afterward there is no counterparty to negotiate with.
How do export controls and sanctions interact with a CFIUS review?
They are closely linked. The export-control status of the target's technology is one of the facts that can make a CFIUS filing mandatory, and sanctions exposure can shape who may invest and on what terms. We map the export-control and sanctions touchpoints alongside the CFIUS analysis so the transaction is assessed as a whole, drawing in registered trade counsel where particular admission or licensing is required.
Does the firm represent clients before CFIUS and other agencies?
Yes. We advise on and represent clients in matters before CFIUS and the agencies that intersect with national security review, including the Department of the Treasury, the Department of Justice, and the Department of Commerce. We represent the parties to the transaction and do not speak for the agencies, and we coordinate with outside counsel where a matter calls for it.
How early should national security review enter a cross-border deal?
Before the letter of intent names the investor. A mandatory declaration is due at least 30 days before closing and takes 30 days to assess, so the analysis has to be finished before signing, not started after it. The purchase agreement then needs three things the commercial lawyers will not add on their own: a CFIUS clearance condition, an outside date long enough for a withdrawal and refiling, and a clause allocating who must accept mitigation and how much. A seller will often ask for a reverse termination fee if the buyer walks over a burdensome condition. Those terms are cheap to draft at the start and impossible to add once the Committee has the file.
Specific national security regimes
Where a transaction turns on a specific control regime, we go deeper.
Export Controls & Economic Sanctions
EAR and ITAR classification, OFAC compliance, and licensing, the trade-control analysis that decides if technology can be shared and who may invest.
Explore →Foreign Direct Investment Screening
CFIUS risk analysis, voluntary and mandatory filings, and mitigation, screening inbound investment for national security exposure before terms are set.
Explore →Related
Adjacent corporate and transactional practices.
Mergers & Acquisitions
Buy-side and sell-side M&A, with the structuring, diligence, and negotiation for the transactions where CFIUS and national security review most often arise.
Explore →Public Companies
Counsel for listed and listing companies on disclosure, reporting, and the governance obligations that follow a foreign-investment or control transaction.
Explore →Corporate Governance & Securities
Board structure, fiduciary duty, and securities compliance, the governance framework that mitigation agreements and FOCI structures are built on.
Explore →Reviewed by Jonathan D. Herpy, Sr., Senior Partner · Last updated October 2026 · Educational overview · Not legal advice