Kassim Ferris, Miller Nash LLP
The Committee on Foreign Investment in the United States (CFIUS) has expanded its reach and impact over the past few years through jurisdictional expansion, increased penalties, stable funding, and dedicated enforcement and monitoring teams, while weathering staff turnover and growing pains. A more detailed summary of CFIUS’s powers and procedures was previously published in the September 2023 issue of Oregon Business Lawyer. In light of CFIUS’s expanded reach and heightened scrutiny, it is increasingly essential for attorneys who handle M&A, financing, and real estate transactions to know how to spot potential national security risk issues for a proposed transaction and when to call in a CFIUS specialist.
CFIUS is an inter-agency committee led by the U.S. Department of the Treasury and is empowered to investigate national security implications of foreign investments in U.S. businesses and acquisitions of certain U.S. real estate. CFIUS can impose mitigation measures and make recommendations to the President of the United States to prohibit transactions. Presidential action is not reviewable by the courts, and recent administrations have increasingly exercised these powers against perceived threats, especially those involving Chinese investors and buyers. Consequently, many prospective foreign investors in U.S. businesses have become acutely concerned about CFIUS issues. CFIUS diligence and clearance are gating issues in many transactions and require technical expertise and knowledge of complex CFIUS regulations and committee practices.
A filing with CFIUS is mandatory for certain non-passive foreign investments in “TID U.S. Businesses”: those that deal with critical technologies, critical infrastructure, or sensitive personal data. CFIUS has the power to impose penalties of up to the value of the transaction against each party that fails to file when mandatory. For all other transactions, filing with CFIUS is voluntary, but if CFIUS is not formally notified, it retains jurisdiction to investigate foreign investment transactions at any time, including after a transaction has been completed. Foreign buyers who have failed to notify CFIUS have later found themselves forced to divest U.S. operations and real estate when foreign ownership was deemed to present national security issues.
It is a common misconception that CFIUS is only an issue for large transactions. In fact, there is no size or value threshold, and CFIUS has blocked many small transactions and forced the divestiture of several small businesses (such as Emcore and MineOne) to address national security threats or vulnerabilities, including vulnerabilities that may not have been apparent or present at the time of the transaction.
Another pitfall is to assume that a particular buyer or investor is not a foreign person. U.S. domiciled entities that are directly or indirectly controlled by foreign nationals, companies, and/or governmental bodies are considered foreign persons subject to CFIUS scrutiny. And the regulatory definition of control for the purpose of CFIUS jurisdiction is broader than conventional notions of control in the corporate context. When a seller of a TID business is unable to verify the ultimate buyer’s or investor’s ownership or nationality, including for significant minority investors, then care is warranted to mitigate the unresolved risk of violating mandatory CFIUS filing requirements. In many cases this may mean demanding that the buyer or investor either join in making a filing with CFIUS or give fundamental CFIUS representations and warranties and accept strong indemnity obligations with an extended survival period.
In reviewing a transaction, CFIUS assesses evidence of the vulnerabilities of the target U.S. business in terms of susceptibility to impairment of national security, the threat posed by the foreign acquirer or related foreign persons, and the potential consequences to national security that could reasonably result from exploitation of the vulnerabilities by the threat actor. Accordingly, assessing the activities of the U.S. business and identifying the investor/buyer and its direct and indirect owners are important first steps in CFIUS diligence.
Several recent developments and CFIUS actions summarized below illustrate these principles.
Expanded jurisdiction over real estate transactions
In 2018, Congress expanded CFIUS’s jurisdiction to include the acquisition or lease by, or concession to, a foreign person of covered real estate near certain military sites and within significant ports and airports. Since then, CFIUS has continued to extend its reach through regulatory changes. The most recent changes occurred in late 2024, when CFIUS added sixty military sites to the list. The scope of covered real estate now includes 227 military sites, including sixty-four for which real estate within an extended range of one hundred miles is subject to review. Covered real estate also includes offshore training complexes (including the entire coast of Oregon and Washington) and missile fields in Colorado, Montana, Nebraska, North Dakota, and Wyoming. Nearly 30 percent of the American West is now considered covered real estate, as illustrated in the map below.

A CFIUS filing is not mandatory for a real estate transaction not involving a U.S. business. However, in at least one instance, a real estate acquisition provided the only jurisdictional hook for CFIUS action that resulted in a presidential prohibition and forced divestiture:
In May 2024, President Biden issued an order retroactively prohibiting the purchase of real estate near Cheyenne, Wyoming, by MineOne, a cryptocurrency mining company allegedly majority-owned by Chinese nationals with ties to the Chinese Communist Party or state-owned entities. By the time CFIUS was tipped off, MineOne had built a cryptocurrency mining facility on the property. The property was located within one mile of Warren Air Force Base, the home of the strategic command for all U.S. Air Force intercontinental ballistic missiles. It was also located across the street from a Microsoft data center handling some defense work and near a National Science Foundation supercomputing center. The order included a requirement to remove all improvements and equipment from the property. Some observers noted that the cryptocurrency mining equipment, which was made in China, not only raised concerns about surveillance but allegedly included back doors that could allow a threat actor to remotely and suddenly shut down the equipment and destabilize the power grid—potentially affecting critical national defense capabilities. Notably, if this greenfield project had been built in the adjacent vacant lot just one thousand feet further from Warren AFB, then CFIUS might not have had jurisdiction.
Enhanced penalties for noncompliance
Penalties for noncompliance with CFIUS laws and regulations also increased in late 2024. In particular, penalties for material misstatements and omissions in a submission to CFIUS were increased to a maximum of $5 million per occurrence, up from $250,000. CFIUS also established penalties for violations of a mitigation agreement—of up to the greater of $5 million, the transaction value, or the current value of the interest in the U.S. business or real estate.
The tenor of these changes is reflected in CFIUS’s announcement of several significant penalty actions over the past few years, including a $60 million fine against T-Mobile for violation of a national security agreement relating to a proposed merger with Sprint. T-Mobile allegedly failed to prevent access to sensitive data or to promptly report the unauthorized access to CFIUS.
In less egregious cases, and in cases involving first-time offenses or other mitigating factors, instead of pursuing monetary penalties CFIUS may issue a Determination of Noncompliance Transmittal (DON’T) Letter pursuant to a relatively new practice of the committee. While these letters do not result in penalties or enforcement action, CFIUS’s enforcement policy states that a DON’T Letter can be an aggravating factor in future enforcement action.
Increased funding, staffing, and enforcement capabilities
CFIUS’s mission is supported by stabilized funding, including through government appropriations and collection of filing fees of up to $300,000, imposed on a sliding scale based on the size of the transaction. Program budgets increased from $42.2 million in FY 2024 to $45.2 million in FY 2025, with about $21 million expected to come from filing fees annually. CFIUS has seen several changes in leadership and senior staff over the last three years while also growing its bench. According to program budget summaries, CFIUS now has about 110 full-time equivalent (FTE) employees. At the same time, filings have decreased, from a high of 440 filings in FY 2022 to 325 filings in FY 2024 (the last period for which data is available as of the writing of this article). Despite an increase in resources and decrease in filings, the challenges posed by staff turnover and the change in administration in early 2025 have led to delays in processing and occasional inconsistencies in mitigation and enforcement actions.
CFIUS has also sharpened its enforcement capabilities by establishing a dedicated non‑notified team that scrutinizes transactions for which the parties did not notify the committee. CFIUS now has the power to require parties to provide information needed to determine whether a transaction is covered, whether it raises national security concerns, and whether it triggers a mandatory filing requirement. This has enabled CFIUS to proactively identify and investigate more transactions that might otherwise escape review, particularly those involving foreign investors from countries of concern.
A good example of enforcement action by CFIUS on a non-notified transaction is the January 2, 2026, presidential order requiring HieFo Corporation to divest its indium-phosphide wafer fabrication business. Indium-phosphide semiconductors are critical technology that provides high-speed, high-frequency capabilities for applications such as fiber optic communications, 5G/6G transmitters, and satellite communications. HieFo acquired the business in 2024 from its former parent, EMCORE Corporation, for only $2.9 million. In the order, President Trump claimed that HieFo was controlled by a Chinese citizen and that there was credible evidence the acquisition could threaten U.S. national security. A CFIUS press release cited a risk of diversion of the supply of indium-phosphide chips. HieFo’s founders included its CEO, Dr. Genzao Zhang, who received his PhD from the University of Ottawa, Canada in 1991 and had previously worked at EMCORE in Alhambra, California for twenty years, most recently as its vice president of engineering.
The order against HieFo highlights the U.S. government’s suspicion of Chinese owners and its continued suppression of exports to China of advanced semiconductor technology and other sensitive technologies, such as supercomputers, AI chips, 6G technology, and quantum computing technologies. Enforcement actions like this can be expected to continue, resulting in ongoing fragmentation of global supply chains.
America First investment policy directive
On February 21, 2025, President Trump issued a memo regarding his America First Investment Policy. The memo largely reiterated existing policies and practices of CFIUS and other agencies but did focus on framing economic security as national security. Much of the memo is devoted to emphasizing the importance of protecting U.S. technology, businesses, and resources from the People’s Republic of China (PRC) and restricting outbound U.S. investment in Chinese companies involved in sensitive technology sectors or areas implicated by the PRC’s military-civil fusion strategy—topics already addressed by CFIUS and various other regulatory powers. Among other things, the memo included directives to:
- ease restrictions on foreign investors “in proportion to their verifiable distance and independence from the predatory investment and technology-acquisition practices of the PRC and other foreign adversaries . . .,” and
- create a “fast-track” process to facilitate foreign investment in the U.S. from allies, subject to requirements to avoid partnering with foreign adversaries.
In response, CFIUS announced in May 2025 that it is developing a Known Investor Program (KIP) seeking to increase efficiencies by collecting information from eligible foreign investors in advance of a CFIUS filing. Think of it as a sort of TSA PreCheck program for foreign investment. Frequent flyers will still need to walk through the metal detector, but at least they may get through security a bit faster. A pilot of the KIP was slated to run in late 2025 with a small number of selected investors. CFIUS recently solicited input from the public via a Request for Information (RFI) in anticipation of a broader rollout. The RFI suggests the KIP is likely to have strict eligibility criteria and will only be available to foreign investors that have made at least three CFIUS filings within the preceding three years.
New outbound investment security program
One other development tangentially related to CFIUS is the U.S. Treasury Department’s issuance of final rules, effective January 2, 2025, implementing the Outbound Investment Security Program (OISP) pursuant to Executive Order 14105. Under the OISP regulations, U.S. persons are prohibited from engaging in certain investments and joint venture transactions involving persons of “countries of concern” (currently, only China, including Hong Kong and Macau) that operate in certain technology sectors. Targeted sectors currently include semiconductor technologies, microelectronics, quantum information technologies, and artificial intelligence. The regulations include specific technical thresholds for prohibited transactions. For certain other outbound investments in the targeted sectors, a notification is required under the OISP regulations. Unlike the CFIUS regime, the OISP regulations do not require the Treasury Department to review or respond to a mandatory notification. And the Treasury Department has so far declined to provide advisory opinions or guidance on the scope of prohibited transactions, so U.S. persons investing in China and in businesses operated by persons with ties to China would be wise to take a conservative approach when interpreting the scope of the OISP’s prohibitions and notification requirements.
Applicable penalties are established in the OISP regulations pursuant to the International Emergency Economic Powers Act (IEEPA) and include civil penalties of $377,700 or up to twice the amount of the transaction. Willful violations are subject to criminal fines of up to $1 million and up to twenty years in prison upon conviction.
A statutory framework for the OISP was recently included in the National Defense Authorization Act for Fiscal Year 2026 (Pub. L. 199-60 at Sec. 8521). It expands the scope of targeted sectors to include high-performance computing and hypersonic systems, while defining certain limited exceptions to the scope of covered transactions. It also authorizes, but does not require, the Secretary of the Treasury to prohibit U.S. persons from knowingly engaging in covered transactions in prohibited technologies. The Secretary of the Treasury has until March 15, 2027, to issue implementing regulations.
Conclusion
Foreign investments can raise U.S. national security issues deserving of careful attention. Failure to submit a CFIUS filing, when mandatory, can subject all transaction parties to harsh penalties. Regardless of whether a filing is mandatory, when a filing is not made, CFIUS retains the power to force the divestiture of a U.S. business or real estate even after a foreign investment or acquisition has concluded. Assessing the activities of the target business to determine whether it qualifies as a TID U.S. Business, and identifying the investor/buyer and its direct and indirect ownership, are important first steps in evaluating whether a CFIUS filing is mandatory or warranted for a proposed transaction.
Several other countries have CFIUS-like regimes. Also, new outbound investment security regulations prohibit covered investments by U.S. persons in certain sensitive high-tech businesses in the semiconductor, microelectronics, quantum computing, and AI sectors operating in China or controlled by persons with ties to China. Certain other covered outbound investment transactions in these same sectors that are not outright prohibited now require a notification to the U.S. Department of the Treasury.
As the U.S. government continues to sharpen its scrutiny of foreign investments, it is increasingly essential for deal parties and their counsel to begin their diligence on potential national security issues early to avoid big problems and hefty penalties. ♦