National-security review counsel for inbound cross-border capital. We handle CFIUS jurisdiction and risk analysis, voluntary and mandatory filings, and mitigation, and we start before the deal terms harden.
Two tests decide whether a CFIUS filing is a choice or an obligation. Where a foreign government holds 49 percent or more of an investor taking 25 percent or more of a US business in critical technology, critical infrastructure or sensitive personal data, the filing is mandatory and due at least 30 days before closing. Where the target's technology would need an export license to reach the investor, it is mandatory too. Skipping it costs up to $5 million or the transaction's value, whichever is greater.
Beyond those tests the filing is voluntary, which is where the judgment lies. The Committee on Foreign Investment in the United States can examine a transaction it never saw at any time; a cleared filing closes the door. A declaration takes 30 days and no fee. A full notice runs 45 days of review and up to 45 more of investigation, and its fee rises with deal value to $300,000.
We run the covered-transaction analysis before the term sheet hardens, choose between declaration and notice, and negotiate mitigation while the review is open, coordinating outside national-security counsel and local counsel abroad where needed.
The threshold review that decides if a deal is a covered transaction: the target's business, the buyer's ownership and rights, and the critical-technology, infrastructure, and sensitive-data tests on which CFIUS jurisdiction turns.
Early diligence on where the national-security sensitivities sit in a transaction, so the parties understand the likely posture of the Committee before they commit to deal terms and a timeline that assume an easy clearance.
Preparing and filing short-form declarations and full written notices, marshalling the corporate, ownership, and technology facts into a submission the agencies can act on, and managing the dialogue and follow-up questions through the review.
Resolving if a mandatory filing is triggered, as it is for certain critical-technology, infrastructure, sensitive-data, and substantial-foreign-government-interest deals, and advising on the consequences of filing, declining to file, or restructuring to change the result.
Negotiating the conditions CFIUS may require as the price of clearance, among them governance and board restrictions, security plans, access limits, divestitures, and monitoring. We shape them during the review so the operating terms remain workable afterward.
Mapping the foreign-investment regimes a single deal may trigger across several countries, including the UK's National Security and Investment regime, and coordinating the filings so parallel reviews run on one timeline.
A non-controlling stake in a TID business, one in critical technology, critical infrastructure or sensitive personal data, is a covered investment if it brings a board seat or observer, access to material nonpublic technical information, or a say in decisions about those assets. A ten percent stake with technical information rights can be enough.
An investor from one of the four excepted foreign states, Canada and the United Kingdom among them, can qualify as an excepted investor and sit outside the covered-investment rules and the mandatory filings, if its ownership, board and principal place of business pass the tests. One disqualifying holder in the chain forfeits the exception.
CFIUS can review a covered transaction at any time, with no statute of limitations. A deal that skips a filing it should have made remains open to scrutiny long after closing, and to an order to modify or unwind it.
A mitigation agreement names a lead agency to monitor it, often a third-party monitor paid by the parties, and a security officer inside the company. A breach can now cost the greater of $5 million, the transaction value or the value of the breaching party's interest, so the terms are drafted to be operable.
A declaration is assessed in 30 days, a notice in 45 plus 45 of investigation, with 15 more in extraordinary cases. When the Committee is not finished as the clock expires, the parties withdraw and refile and the 45 days begin again. Outside dates should assume at least one refiling.
Under the UK National Security and Investment Act, taking more than 25 percent of a company in a listed sensitive sector must be notified and cleared before completion, or the acquisition is void. The government has 30 working days to clear or call in, and may call in an unnotified deal for five years.
Before the term sheet hardens, we test the deal against the covered-transaction rules: the target's technologies, data, and infrastructure touchpoints, and the investor's ownership chain and governance rights. From that we resolve if a filing is mandatory, advisable, or avoidable by restructuring.
We choose between a declaration and a full notice deliberately, then trace the ownership tree to its ultimate parents, pin down the export-control classification of what the target makes, and marshal the deal documents into a filing the agencies can act on without a second round of questions.
Once the filing is accepted, the matter runs on the Committee's timeline rather than the deal's. We manage the agency dialogue and follow-up requests, and we keep the purchase agreement's conditions, outside date, and any parallel UK NSI or EU filings sequenced to the same close.
If the Committee wants mitigation, we negotiate the conditions during the review itself: board carve-outs, security plans, access controls, monitors. The safe harbor then arrives with operating terms the investor can live under.
CFIUS never forgets a deal it was never shown.
Foreign direct investment screening is the review a government conducts when a non-US person acquires an interest in, or control of, a US business that may bear on national security. In the United States the review is run by the Committee on Foreign Investment in the United States (CFIUS), an interagency committee that can clear a transaction, impose conditions, or recommend that it be blocked or unwound. The screening analysis asks if a deal is covered, if a filing is required or advisable, and what national-security risk the parties will need to address.
In two situations. First, where a foreign government holds a substantial interest in the investor, meaning 49 percent or more of its voting interest, and the investor is acquiring a substantial interest in a TID business, meaning 25 percent or more. Second, where the target produces, designs or tests critical technology that would need a US export license to be transferred to the investor or to anyone holding 25 percent or more of the investor. In either case the declaration or notice is due at least 30 days before closing. Everything else is voluntary, and the analysis of whether to file anyway is the real work.
Two different things, depending on whether the filing was required. If it was mandatory, the penalty for not making it is up to $5 million or the value of the transaction, whichever is greater, and the Committee will still review the deal. If it was voluntary, nothing happens until the Committee's non-notified transactions team finds the deal, which it does through press, databases and tips from other agencies, and then the review runs without the protection of a closing condition and with the asset already paid for. A cleared filing earns a safe harbor that bars reopening unless the filing was materially false or the mitigation is breached.
With three documents before any filing is drafted. The first is the investor's ownership chart traced to its ultimate parents, because the foreign-government and excepted-investor tests are run on that chart, not on the fund name. The second is the export-control classification of what the target makes, because the critical-technology test is an export-license test in disguise. The third is the purchase agreement, where we draft the CFIUS closing condition, the outside date with a refiling cushion, and the clause that says who bears the burden if the Committee demands mitigation. The filing itself follows from those three.
A mitigation agreement is the set of conditions CFIUS may require as the price of clearance. Typical measures include governance and board restrictions, security plans, limits on access to sensitive data or technology, divestiture of certain assets, and ongoing monitoring and reporting. The terms are negotiated, and they have real operational consequences for how the investor and the target run the business afterward, so the time to negotiate them is during the review itself.
Yes. Many jurisdictions now operate their own foreign-investment regimes, among them the United Kingdom's National Security and Investment regime and a growing number of comparable controls across Europe, the Middle East, and Asia. A single cross-border deal can trigger reviews in more than one country at once. Working from Chicago, London, and Dubai with a partner network across roughly 51 jurisdictions, we map the filings a transaction requires and coordinate them so the timelines run together.
Counsel on EAR and ITAR export controls and OFAC sanctions: classification, licensing, screening, and compliance programs for cross-border trade and the technology that travels with a deal.
Explore →Board structure, fiduciary duty, shareholder arrangements, and disclosure, the governance framework a mitigation agreement so often reaches into and reshapes.
Explore →Term sheets, funding rounds, and investment documentation, structured so an inbound foreign investor's rights and the national-security analysis are reconciled in the first draft.
Explore →Reviewed by Jonathan D. Herpy, Sr., Senior Partner · Last updated October 2026 · Educational overview · Not legal advice
One partner is accountable for the whole matter, and you have that partner's direct line. Chicago, London, and Dubai work to the same standard.