What CFIUS is
CFIUS draws its authority from Section 721 of the Defense Production Act of 1950, as amended by the Foreign Investment and National Security Act of 2007 and the Foreign Investment Risk Review Modernization Act of 2018, known as FIRRMA. The Treasury Department chairs the committee and leads each case, and members include the Departments of Justice, Homeland Security, Commerce, Defense, State and Energy, plus other offices. For each case, one or more agencies with the relevant expertise act as co-lead.
The committee's question is narrow: does the transaction create a risk to US national security that cannot be resolved with other laws? Competition is not part of it. That is the job of the antitrust agencies under the HSR waiting period, a separate review that runs in parallel.
Which deals it covers
CFIUS has jurisdiction over three broad kinds of transactions:
- Control transactions. Any deal that could give a foreign person control of a US business, whatever the industry.
- Covered investments. Since FIRRMA, certain non-controlling investments in US businesses dealing with critical technologies, critical infrastructure or sensitive personal data, when the investor gains board rights, access to material non-public technical information or a role in key decisions.
- Real estate. Certain purchases or leases of property near sensitive government sites.
Most filings are voluntary. Mandatory declarations apply in two main cases: certain investments in businesses that produce or develop critical technologies, and certain investments by investors in which a foreign government holds a substantial interest.
The process and its timelines
| Stage | Statutory period | What happens |
|---|---|---|
| Pre-filing consultation | No set period | Parties share a draft notice; CFIUS staff ask questions |
| Declaration (short form) | 30-day assessment | CFIUS clears, asks for a full notice, or takes no action |
| Notice: review | 45 days | Agencies assess the threat, the vulnerability and the consequences |
| Notice: investigation | 45 days | Deeper analysis, often negotiation of mitigation |
| Extension | 15 days | Only in extraordinary circumstances |
| Presidential decision | 15 days | The President may prohibit or suspend the deal |
The statutory clock looks tight, but real timelines are often longer. Pre-filing consultation is not counted. And if CFIUS needs more time near the end of an investigation, the parties often withdraw and refile, which restarts the review. A deal can go through more than one such cycle.
A declaration can be quicker and cheaper, but CFIUS may respond by asking for a full notice, which adds a full review on top. Full notices also carry a filing fee that scales with the size of the deal.
Possible outcomes
- Clearance. CFIUS concludes its action with no conditions. This is the most common outcome.
- Clearance with mitigation. The parties sign an agreement, often called a national security agreement, with conditions such as data access limits, government-approved security officers, US citizen directors or the sale of a sensitive unit.
- Abandonment. When CFIUS signals that it cannot clear a deal, the parties often walk away rather than wait for a presidential order.
- Prohibition. The President blocks the deal or orders a completed deal unwound. This is rare, but it has happened.
Why it matters for event-driven investors
For merger arbitrage, CFIUS is one of the regulatory approvals the deal must clear, and it is one of the harder ones to predict, because the process is confidential. The parties rarely disclose more than the filing date and the outcome. Our article on regulatory approvals as catalysts covers how these reviews fit beside antitrust and sector regulators.
The merger agreement tells you how the parties priced the risk. Read three provisions closely, using our guide on how to read a merger agreement:
- The CFIUS condition. Whether clearance is a condition to closing, and what counts as clearance.
- The efforts covenant. What the buyer has agreed to accept in mitigation, for example whether it must agree to divest a business.
- The outside date and the reverse termination fee. How long the parties will wait, and what the buyer pays if the deal fails on regulatory grounds.
Our guide on how to calculate a merger arbitrage spread walks through the full method, including how to treat a termination fee.
Signals to watch during a review
Because the process is confidential, investors read indirect signals:
| Signal | Where it appears | What it can mean |
|---|---|---|
| Notice accepted, review clock starts | Press release or proxy | The formal timeline has begun |
| Withdraw and refile | 8-K or press release | CFIUS needs more time, often over mitigation |
| Outside date extended | 8-K, amended agreement | The parties expect a longer review |
| Mitigation agreed | Closing announcement | Conditions accepted; check whether they affect value |
| Public statements by officials | News reports | Political attention, which can raise the risk |
Track these as dated events on a calendar; our guide on how to track a merger through approval has a template. For how individual deals have played out, see our market coverage.
CFIUS and other national security reviews
CFIUS is not the only review a cross-border deal may face. Companies with defense contracts may need clearance from the Defense Counterintelligence and Security Agency for facility security clearances, and businesses in telecommunications can face review by other agencies. Many other countries run their own foreign investment screening, so a deal between two non-US companies can still need approval in several places.
For a US investor, the practical point is to list every review named in the merger agreement and the proxy, note the expected timing of each, and watch which one is likely to come last. The slowest review sets the closing date, and the spread reflects the risk in all of them together.
Where this goes wrong
- Assuming the statutory timeline. Withdraw-and-refile cycles mean the 90-day figure for a notice is a floor, not an estimate.
- Ignoring politics. CFIUS decisions turn on national security judgments, and attention from officials and Congress can change the risk quickly.
- Missing jurisdiction. A minority investment can still fall under CFIUS if it brings board seats or access to sensitive technology.
- Underestimating mitigation costs. A deal can close with conditions that reduce its value to the buyer, which matters for stock-for-stock deals and for any earnout.
- Treating abandonment as rare. Many deals that would not be cleared never reach a presidential order. They end with a termination announcement, and the target falls toward its standalone value, as described in what happens when a merger fails.
The bottom line
A CFIUS review is the national security check on foreign investment in US businesses, led by Treasury and run on short statutory clocks that often stretch in practice. Most deals are cleared, many with mitigation conditions, and only the President can formally block one. For event-driven investors, the risk sits in the spread, and the merger agreement's condition, efforts covenant, outside date and termination fee show how the parties priced it. Watch for refilings and extensions as the dated signals.