CFIUS Mandatory Declarations for TID Businesses: When You Must File and What Happens Next

A foreign-backed buyer and a U.S. target may need to submit a CFIUS declaration or a written notice before completing a transaction. The filing requirement does not follow simply from having foreign capital, holding sensitive data, or working in a regulated industry. The transaction must first meet the applicable jurisdictional and mandatory filing tests, subject to specific exceptions.

This guide explains how buyers and sellers can organize the facts for that analysis. It is part of our CFIUS review guide. CFIUS and cross-border counsel can assess jurisdiction, filings, and related matters alongside the M&A team. The analysis is transaction-specific.

Start with the covered transaction

CFIUS jurisdiction and mandatory filing are separate questions. A transaction may be covered without requiring a filing. Conversely, parties must not assume that a minority investment is outside the rules because the investor lacks a majority of the voting shares. Begin with the purchaser, its ownership chain, the U.S. target, the rights attached to the investment, and what will change at completion.

A covered control transaction concerns a transaction that could result in foreign control of a U.S. business. Control is a fact-specific concept, not just a percentage calculation. Under 31 CFR 800.211, a covered investment can also include a noncontrolling investment by a foreign person other than an excepted investor in an unaffiliated TID U.S. business. The investment must afford the foreign person specified access to material nonpublic technical information, board membership, observer or nomination rights, or involvement beyond voting shares in substantive decisionmaking concerning the specified technology, infrastructure, or personal data. Read the actual governance documents, side letters, and information rights together.

The parties should document the transaction structure at signing and revisit it if ownership, rights, or the target change. An option, conversion, or new board right can affect the assessment. A title in an investment agreement does not settle whether the substance of the arrangement meets a regulatory definition. Counsel should apply 31 CFR 800.213 and the related definitions to the facts.

What makes a business a TID U.S. business?

TID refers to technology, infrastructure, and data. Under 31 CFR 800.248, the definition covers a U.S. business with specified activities involving critical technology, specified functions involving covered investment critical infrastructure, or the maintenance or collection of sensitive personal data of U.S. citizens. Review each potential category rather than treating the company’s industry label as dispositive.

For technology, identify products, software, and technology that the business produces, designs, tests, manufactures, fabricates, or develops. Compare them with the definition of critical technologies and obtain support for applicable export classifications. Not every item on a control list necessarily satisfies the CFIUS definition, and a classification by itself does not determine the filing requirement.

For infrastructure, compare the actual asset and the business’s role with both columns of Appendix A to Part 800. An asset’s relationship to an infrastructure sector does not by itself establish that the business performs a listed function. For example, ask whether the company owns, operates, manufactures, supplies, or services the specified infrastructure in the way the applicable entry describes.

For data, identify the data maintained or collected, the individuals it concerns, the business’s customers and objectives, and the applicable time period. The sensitive personal data definition has specified categories and conditions, a separate genetic test provision, and exclusions. The conditions matter: more than one million records alone may be insufficient, and a business below that number can still qualify.

Foreign-government substantial interest test

One mandatory trigger applies to a covered transaction where a foreign person acquires a substantial interest in a TID U.S. business and the national or subnational governments of a single foreign state, other than an excepted foreign state, have a substantial interest in that foreign person. See 31 CFR 800.401(b). Both sides of that test must be examined, along with applicable exceptions.

Under 31 CFR 800.244, substantial interest generally means at least 25% voting interest in the U.S. business and at least 49% voting interest in the foreign person by the national or subnational governments of a single foreign state. These are different thresholds applied to different entities. The rule addresses direct and indirect interests and includes a special calculation for entities whose activities are primarily directed, controlled, or coordinated by a general partner, managing member, or equivalent.

Collect an ownership chart with voting rights, parent entities, and the identity of government owners. A simple multiplication of economic interests may not reflect the regulation’s parent rule. For a managed entity, examine the interest in its general partner or equivalent rather than assuming that the limited partners’ combined fund interests settle the question. Avoid aggregating governments from different states as though they were one state without an applicable legal basis.

An ownership chart can reveal whether the target and investor thresholds may be met. This is a screening step: jurisdiction, exceptions, the investor structure, and all other transaction facts still matter.

Critical technology and regulatory authorization

The second mandatory trigger concerns specified covered transactions involving a TID U.S. business that produces, designs, tests, manufactures, fabricates, or develops critical technology. The analysis asks whether a U.S. regulatory authorization would be required for an export, reexport, transfer in country, or retransfer of the relevant technology to the specified transaction parties or owners, applying the rule’s assumptions and exceptions.

Treasury revised this test effective October 15, 2020. The current regulation uses an authorization test instead of a simple inquiry into whether the target operates in an enumerated NAICS industry. The Treasury fact sheet explains the revised authorization framework; the regulation controls and includes an applicability provision for particular transactions.

An export specialist should identify each relevant technology and classification, then consider the direct acquirer and relevant persons in the ownership chain under the precise regulatory definitions. The CFIUS test also addresses a specified hypothetical transfer, so examine the rule even if no actual shipment is planned. Some EAR license exceptions are relevant under the express rule, but it is unsafe to assume every available exception removes a mandatory filing.

For deal execution, the seller can assemble the product inventory and classification evidence while the buyer supplies the ownership and nationality information needed for the relevant persons. Both should protect sensitive technical information and document assumptions. If classification or ownership remains unknown, record the uncertainty and resolve it before relying on a no-filing conclusion.

Excepted investors and other exceptions

Exceptions are specific to the trigger and transaction. Section 800.401 contains separate provisions for the foreign-government and critical-technology tests, including defined investment fund circumstances. The critical-technology provision also addresses certain covered control transactions by excepted investors and specified export license exceptions. A fund with a U.S. manager or passive investors must still satisfy the specific conditions for an exception.

Excepted investor status requires the detailed conditions in 31 CFR 800.219, not merely a statement that an investor is from a friendly country. Counsel should examine the current list of excepted foreign states, the investor’s organizational facts, ownership, governance, and other regulatory conditions. Those facts can be more complicated in an investment fund with several layers.

Excepted investor status leaves some transactions within CFIUS jurisdiction and some mandatory filing tests potentially applicable. Where an exception appears relevant, identify the exact subsection, the transaction it covers, and evidence that each condition is satisfied. If a transaction changes, reassess whether the same conclusion holds.

Filing timing and declaration outcomes

For transactions with completion dates after March 14, 2020, the regulation generally requires the mandatory declaration or notice at least 30 days before completion. It contains a provision allowing completion earlier after specified written CFIUS action and additional rules if a filing is rejected or withdrawn. The filing date and the date CFIUS concludes all action are separate milestones.

Parties can elect to submit a written notice instead of a declaration. Under 31 CFR 800.405, the 30-day assessment begins when the Committee receives the accepted declaration from the Staff Chairperson, which may be later than the initial submission. If the thirtieth day is not a business day, the period ends no later than the next business day. Preparation and the possibility of additional proceedings also matter when setting the timetable. Review the conditions to closing, long-stop date, responsibilities for information, and responses to requests rather than assuming the deal can close as soon as a filing is submitted.

Under 31 CFR 800.407, CFIUS may request a written notice, inform the parties it cannot conclude action on the declaration and they may file a notice, initiate a unilateral review, or notify the parties that it has concluded all action. A statement that the Committee cannot conclude action leaves the review outcome distinct from a conclusion of all action. A request for a notice is also different from an invitation to file one.

The parties should agree who prepares the ownership charts and descriptions, who communicates with CFIUS counsel, how follow-up questions will be handled, and how they will decide whether to pursue a notice. A declaration can be rejected in specified circumstances. A commercial closing condition may be more demanding than the minimum filing requirement and should reflect the negotiated risk allocation.

Build the diligence record before signing

Start with a list of the legal entities and owners, including voting rights and government interests. Add the target’s products, export classifications, infrastructure functions, and data inventory. Identify every right the buyer receives, including access to technical information and participation in board or sensitive business decisions. Gather the agreements that grant those rights, not just the term sheet.

Next, separate facts from conclusions. A seller may know the product portfolio while the buyer has better access to its ownership chain. Assign an owner to each open item and set a date for obtaining evidence. If either side cannot support a required fact, mark the filing conclusion as unresolved rather than filling the gap with a general industry assumption.

The purchase agreement can allocate cooperation, regulatory submissions, information access, interim operating restrictions, and consequences if approvals or a particular CFIUS outcome are not obtained. The appropriate allocation depends on the target, transaction structure, and risk the parties have agreed to bear. Independent CFIUS counsel and M&A counsel should coordinate these provisions with the actual filing strategy.

Missed filings and non-notified transactions

Failure to submit a required filing can lead to civil penalties. The applicable maximum and enforcement procedure depend on the current regulations and facts, including the provision violated. The penalties rule should be checked directly rather than relying on an older summary or treating the transaction value as the only possible measure.

CFIUS can also examine a covered transaction that was not filed, including a transaction for which a filing was not mandatory. A transaction without a mandatory filing can still raise national security concerns. Filing, jurisdiction, substantive risk, and the effect of a particular written outcome are distinct issues.

If a potential omission is discovered after signing or closing, preserve the relevant documents and obtain prompt advice from CFIUS counsel. The appropriate next step depends on the transaction and the current enforcement rules. Parties should avoid assuming that a later filing automatically resolves a violation or that a penalty and a substantive national security review are the same proceeding.

Frequently Asked Questions