Powers of the Modern CFIUS

The United States has long prided itself on being open to foreign investment. The Committee on Foreign Investment in the United States — CFIUS — is the dramatic exception: a body with the power to unwind a deal in the name of national security, operating almost entirely out of public view. What can it actually do, and how should a company deciding whether to buy, sell, or invest plan around it?

In this TalksOnLaw interview, Joel Cohen is joined by two people who spent years inside the committee. Aimen Mir chaired CFIUS during nine years at the Treasury Department, helped negotiate the 2018 law that expanded its reach, and now leads Freshfields' CFIUS practice. Colin Costello served as the intelligence community's primary representative to CFIUS from the Office of the Director of National Intelligence and now advises clients at Freshfields as well. The conversation moves between how the committee thinks and what that means for a deal.

What CFIUS Is — and What It Can Actually Do

CFIUS is an interagency committee chaired by Treasury and drawing on Defense, Justice, Homeland Security, Commerce, Energy, State, and others. Its jurisdiction runs to three kinds of transactions: those giving a foreign person control of a U.S. business, non-controlling investments in businesses involving critical technology, sensitive personal data, or critical infrastructure, and even bare real estate near sensitive government facilities.

A common misconception, Costello explains, is that CFIUS blocks deals. It does not; only the president can prohibit a transaction. The committee's real instrument is the negotiated mitigation agreement, backed by the veiled threat of recommending a prohibition. Because CFIUS acts by consensus, a president rarely overrides it — so parties told a prohibition is coming almost always withdraw and quietly abandon the deal. That quiet is by design: the committee works in a classified environment, and Treasury will not even confirm a review exists. Only a presidential prohibition becomes public, which is precisely the incentive to settle or walk away.

FIRRMA, Mandatory Filings, and the End of the Desktop Analysis

The 2018 Foreign Investment Risk Review Modernization Act, which Mir helped shape, pushed the jurisdictional question past deal structure and into a closer look at the assets being acquired — and the implementing regulations leave real ambiguity. Mir is candid that these judgments are now hard for a business to make on its own.

FIRRMA also created mandatory filings, which arise when a target produces critical technologies that would require an export license to share with the investor, or when a foreign-government-backed investor takes a stake in a sensitive business. The penalty for missing one can reach the full value of the transaction, the obligation falls on buyer and seller alike, and there is no statute of limitations. Most filings remain voluntary, and the calculus there is a wager: the risk of a post-closing knock on the door against the safe harbor a clearance provides. The episode walks through the clocks — a 30-day short-form declaration, a 45-day review with an optional 45-day investigation, and the withdraw-and-refile that resets it all.

Negotiating in the Dark

Mitigation can range from a light supply-assurance commitment to a proxy board that renders an investment entirely passive. Parties find the negotiation frustrating, Costello acknowledges, because they cannot see the classified analysis and hold little leverage. Yet the fact that CFIUS is negotiating at all signals it believes the risk can be managed and wants the deal to close. The harder problem is that the committee often cannot say what worries it — Mir describes companies that never knew their commercial product sat inside a government system — leaving counsel to intuit the concern and engineer a path to yes.

An Expanding Definition of National Security

National security is undefined in the statute and keeps widening — from missiles and aircraft to artificial intelligence, robotics, and data, though only sensitive personal data, not data as such. China has drawn the most scrutiny, but Mir stresses that CFIUS is not country-specific and the risk exists regardless of where an investor is from.

What to Know Now

The mechanics Mir and Costello lay out are the mechanics practitioners work with today; what has grown is the committee's reach and its willingness to enforce. A 2022 executive order directs CFIUS to weigh supply-chain resilience, technological leadership, and sensitive-data risks explicitly. Rules finalized in 2024 raised the penalty for misstatements and omissions to $5 million or the transaction value if greater, broadened the committee's subpoena power to parties and third parties, allowed it to set deadlines in mitigation negotiations, and extended its real-estate jurisdiction to some sixty additional military installations. Enforcement has followed: by the committee's own account, it issued more penalties in one recent eighteen-month span than in its prior three decades. For anyone structuring a cross-border deal, the lesson of this conversation has only sharpened: the filing analysis is judgment-heavy, the committee is not country-specific, and the cost of getting it wrong keeps rising.