What is CFIUS?

When a foreign company buys a U.S. business, who decides whether the deal threatens national security, and why do so many of those decisions happen out of public view?

In this TalksOnLaw Brief, Joel Cohen talks with Aimen Mir, a partner at Freshfields who heads its CFIUS practice and previously served as Treasury's deputy assistant secretary for investment security, and Colin Costello, a CFIUS and national security advisor at Freshfields who was formerly the intelligence community's primary representative to CFIUS. They explain what the Committee on Foreign Investment in the United States does, how its power works in practice, and why it is often called a black box.

What CFIUS Reviews

CFIUS is an interagency committee chaired by the Treasury Department, with members including the Departments of Justice, Homeland Security, Commerce, Defense, State, and Energy, the U.S. Trade Representative, and the White House Office of Science and Technology Policy. The guests describe three kinds of covered transactions: deals that give a foreign person control of a U.S. business; non-controlling but non-passive investments in U.S. businesses involved with critical technology, critical infrastructure, or sensitive personal data; and certain real estate transactions near sensitive government facilities. The real estate authority, added by the Foreign Investment Risk Review Modernization Act of 2018, reaches purchases that involve no business at all but could serve as a platform for intelligence collection.

Mitigation and the President's Power

A common misconception, the guests explain, is that CFIUS blocks deals. As a legal matter, only the President can prohibit or suspend a transaction. When CFIUS identifies a risk, its main tool is a negotiated mitigation agreement, and it can also impose mitigation if the parties will not negotiate. If it concludes that a risk cannot be mitigated, it can recommend that the President prohibit the deal. Because CFIUS generally acts by consensus among agencies such as Defense, Justice, and Homeland Security, a President rarely departs from its recommendation. As a result, parties told that a prohibition recommendation is coming usually withdraw their notice and abandon the transaction.

The Black Box

CFIUS's reputation for secrecy, the guests say, is well earned. Much of the information it relies on comes from the intelligence community and is classified, and strict statutory confidentiality rules bar disclosure of information the parties file, including whether a review exists at all. The main exception is a presidential prohibition, which must be issued by order and published. That gives parties a strong incentive to settle or walk away quietly rather than be publicly branded a national security risk.

What to Know Now

The framework the guests describe remains in place, and CFIUS's reach has grown. In 2024, Treasury raised the maximum civil penalty for violations to $5 million and expanded the list of military sites covered by its real estate rules. Presidential involvement has also become more visible. President Biden prohibited Nippon Steel's acquisition of U.S. Steel in January 2025, and in June 2025 President Trump cleared the deal after a new review, subject to a national security agreement that included a “golden share” for the U.S. government. In 2026, Treasury also sought public input on a “Known Investor” fast-track program for repeat investors. Separately, Congress codified and expanded the outbound investment program, which covers certain U.S. investments in sensitive technologies in countries of concern, through the COINS Act in the 2026 National Defense Authorization Act. For deal planners, the guests' core lessons still apply: assess CFIUS risk early, expect mitigation to be the main battleground, and remember that most outcomes never become public.