CFIUS Review: When Foreign Money in a US Startup Triggers Scrutiny

Foreign investors are an important source of capital for US startups. But in certain sectors, foreign investment can trigger review by the Committee on Foreign Investment in the United States (CFIUS), an interagency committee that examines transactions for national security risks.

For founders, CFIUS can affect who can invest, what rights they receive and how long a deal takes. For foreign investors, it can determine whether a deal is possible at all. This guide explains when CFIUS applies, what triggers a filing and how founders and investors can plan around it.

1. What CFIUS Does

CFIUS reviews certain foreign investments in US businesses to identify national security risks. It can clear deals, impose conditions known as mitigation measures, or recommend that the President block or unwind transactions. Its powers expanded significantly with the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA), whose main regulations took effect in 2020.

2. Which Startups Are Most Affected

CFIUS pays particular attention to "TID" US businesses, those involved in:

• Critical technologies, including many items subject to export controls, such as certain semiconductors, AI, quantum, aerospace, defence and biotechnology.
• Critical infrastructure, such as energy, telecommunications and certain data systems.
• Sensitive personal data of US citizens, such as health, financial, genetic or location data, above certain thresholds.

Many deep-tech, defence, AI, health and fintech startups can fall into one or more of these categories. See our guides to semiconductor startups and quantum computing.

3. What Triggers CFIUS Jurisdiction

• Control transactions, where a foreign person gains control of a US business.
• Certain non-controlling investments in TID businesses, where the foreign investor receives any of the following:
  • access to material non-public technical information;
  • a board seat or board observer rights;
  • involvement in substantive decisions about critical technologies, infrastructure or sensitive data.

A purely passive investment, without these rights, often falls outside CFIUS jurisdiction for non-controlling deals.

4. Mandatory Filings

Some transactions require a mandatory filing before closing, including certain investments in businesses dealing with export-controlled critical technologies, and certain investments where a foreign government has a substantial interest in the investor. Failing to make a mandatory filing can result in significant civil penalties.

Other transactions may be filed voluntarily to gain certainty, since CFIUS can review non-notified deals later.

5. The Process

• Declarations: a shorter filing with a 30-day assessment period.
• Notices: a full filing with a 45-day review, potentially followed by a 45-day investigation.
• Outcomes: clearance, mitigation agreements, or in rare cases prohibition.

6. Excepted Investors

Investors from certain "excepted foreign states", currently Australia, Canada, New Zealand and the United Kingdom, can qualify for exceptions from some requirements if they meet detailed criteria.

7. How Founders Can Plan

1. Assess early whether your business involves critical technologies, infrastructure or sensitive data.
2. Know your investors, including who ultimately owns or controls them.
3. Limit rights where needed. Offering foreign investors purely passive positions, without board seats, observer rights or technical information, can keep deals outside CFIUS jurisdiction. Side letters are often used for this. See side letters.
4. Build in time if a filing is needed.
5. Consider future exits, since foreign acquirers may face CFIUS review.
6. Take specialist legal advice.

8. Outbound Investment Rules

Separately, US Treasury rules effective from 2025 restrict or require notification of certain investments by US persons in Chinese companies involved in semiconductors, quantum and some AI technologies. These affect US investors investing abroad rather than foreign investment into the US.

For more on cross-border investing, see investing in US startups as a non-US investor.

Frequently Asked Questions

Does every foreign investment in a US startup need CFIUS approval?

No. Many foreign investments are outside CFIUS jurisdiction, especially passive, non-controlling investments in businesses that are not TID businesses.

Can a foreign investor sit on our board?

Yes, but board or observer rights in a TID business can bring the investment within CFIUS jurisdiction and may require a filing.

How long does CFIUS review take?

Declarations have a 30-day assessment period; notices have a 45-day review that can be followed by a 45-day investigation.

What happens if we ignore a mandatory filing?

Significant civil penalties can apply, and CFIUS can review the transaction after closing.

The Bottom Line

CFIUS matters most for startups in critical technologies, infrastructure or sensitive data. Founders who assess their exposure early, structure foreign investment carefully and take specialist advice can continue to raise global capital without unexpected delays or penalties.

Global Capital Network connects founders with investors worldwide through our events and investor network. Get in touch to learn more.

This article is general information, not legal advice. CFIUS rules are complex and change; consult specialist counsel.