Export Controls & Compliance-as-Code + Sovereign Tech
CFIUS for Startups: When Foreign Investment Triggers National Security Review
When CFIUS filing is mandatory versus voluntary, the review timeline, risk factors that trigger scrutiny, and what happens if you skip it
Atomic answer
The Committee on Foreign Investment in the United States (CFIUS) reviews certain foreign investments in U.S. businesses for national security risk. Under 31 CFR 800.401, a declaration is mandatory when a foreign-government-backed person acquires a substantial interest in a Technology, Infrastructure, or Data (TID) U.S. business, or when a foreign person acquires control or a covered investment in a business producing critical technology for which a U.S. regulatory authorization would be required to export to that person. A mandatory declaration is due 30 days before closing. A declaration gets a 30-day assessment; a notice gets a 45-day review, a 45-day investigation, then up to 15 days for the presidential decision. Penalties reach $5,000,000 per violation, and $5,000,000 or the value of the transaction for a missed mandatory filing. Only Australia, Canada, New Zealand, and the United Kingdom are excepted states. CFIUS handled 347 filings in 2025. The founder decision: know whether the round is covered, whether the mandatory clock applies, and price the answer before signing.
Who is this for?
This is the capital-side companion to the site's export-controls pillar. The deep-tech export-controls guide maps the product gate: what you build, where it ships, who can see it. This article maps the investor gate: who may invest, on what terms, and on what clock. A round from a sovereign fund or a foreign corporate venture arm can touch both gates, because the same critical-technology classification that requires an export license also makes the company a TID U.S. business.
The reader: the founder raising from a foreign LP, the counsel running diligence, and the investor choosing a filing path. Nothing here is legal advice. The controlling texts are Section 721 of the Defense Production Act of 1950, as amended by the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA), and 31 CFR parts 800 and 802. Engage qualified CFIUS counsel before accepting foreign capital. Source confidence: Primary (statutory and regulatory texts).
What makes a transaction covered?
Three questions decide jurisdiction. Is there a foreign person? Is there a U.S. business? Does the transaction result in foreign control or a covered investment? Control is fact-specific and can arise from contractual rights, not just share count. A covered investment under 31 CFR 800.211 is a non-controlling investment in an unaffiliated TID U.S. business that gives the foreign person access to material nonpublic technical information, a board seat or observer or nomination right, or involvement in substantive decisionmaking about critical technologies, sensitive personal data, or covered critical infrastructure. Source confidence: Primary.
A TID U.S. business produces, designs, tests, manufactures, fabricates, or develops critical technologies; performs listed functions for covered critical infrastructure; or maintains or collects sensitive personal data of U.S. citizens (31 CFR 800.248). Critical technologies at 31 CFR 800.215 include USML defense articles, CCL items controlled for national security and related reasons, certain nuclear items, select agents and toxins, and emerging and foundational technologies controlled under the Export Control Reform Act of 2018. Sensitive personal data at 31 CFR 800.241 generally requires data on more than one million individuals in categories such as health, financial distress, geolocation, biometrics, or non-public communications, with a separate prong for businesses targeting U.S. national security agencies. Source confidence: Primary.
One common founder error is reading the passive-investment rule too broadly. Under 31 CFR 800.302(b) and 800.243, 10 percent or less of voting interest is not a covered control transaction only if held solely for passive investment with none of the 800.211(b) rights. A five percent stake with a board observer seat, or standard information rights, is not passive. Source confidence: Primary.
Mandatory versus voluntary: the two prongs
Most covered transactions may be filed voluntarily; a cleared filing is the only route to certainty. Two categories make a declaration mandatory under 31 CFR 800.401.
The foreign-government prong covers a transaction resulting in the acquisition of a substantial interest in a TID U.S. business by a foreign person in which a single foreign state's national or subnational governments have a substantial interest (800.401(b)). The critical-technology prong covers a TID U.S. business that produces, designs, tests, manufactures, fabricates, or develops critical technologies for which a U.S. regulatory authorization would be required to export to the foreign person, where that person acquires control, acquires a covered investment, has rights that could change toward one, is party to an evasion structure, or holds group voting interest (800.401(c)). The authorization test runs without most license exceptions; 800.401(e)(6) preserves only three EAR exceptions (15 CFR 740.13, 740.17(b), 740.20(c)(1)). Source confidence: Primary.
The deadline is 30 days before completion (800.401(g)(2)); parties may elect a full notice instead (800.401(f)). Carve-outs exist for covered control transactions by excepted investors (800.401(e)(1)) and certain fund structures (800.401(d)(1), (e)(3)). Excepted investors must satisfy 31 CFR 800.219; as of 2026-09-18 the list is Australia, Canada, New Zealand, and the United Kingdom, subject to conditions. Source confidence: Primary; the list is current as of the access date.
A frequent misconception: the carve-out is not limited to non-critical deals. It reaches covered control transactions by a qualifying excepted investor in critical-technology targets, because 800.401(e)(1) sits inside the critical-technology prong. It is not a blanket exemption for allied money. Source confidence: Primary.
The clock, and the 2025 base rates
A declaration is assessed within 30 days (31 CFR 800.405(b)). The Committee can clear it, request a full notice, say it cannot conclude action, initiate a unilateral review, or take no action (800.407). It is faster and fee-free but less certain. Source confidence: Primary.
A notice triggers a 45-day review (800.503(b)). If concerns remain, an investigation must be completed within 45 days (800.508(a)), with one 15-day extension in extraordinary circumstances (800.508(e)). If the Committee sends a report to the President, the decision comes within 15 days (50 U.S.C. 4565(d)(4)(A)). A clean declaration can resolve in about 30 days; a contested deal runs past 90 days before any presidential decision. Source confidence: Primary.
Treasury's Annual Report to Congress for calendar year 2025, released 2026-08-07, counted 347 notices and declarations of covered transactions or covered real estate transactions. CFIUS cleared 67 percent of distinct transactions within the declaration assessment or initial 45-day review. Of 140 declarations, 36 were pushed to a notice and 92 were cleared. Of 207 notices, 114 went to investigation, 25 required mitigation or conditions, and the President prohibited two transactions. Source confidence: Primary (agency report and Treasury release); counts corroborated by named law-firm summaries.
What triggers scrutiny
Risk factors are structural, not size-based. Investor identity comes first: the America First Investment Policy of 2025-02-21 directs CFIUS to restrict PRC-affiliated investment in U.S. technology, critical infrastructure, healthcare, agriculture, energy, and raw materials, and points toward possible rulemaking on greenfield investments and emerging and foundational technologies. The memorandum is policy direction, not a self-executing rule. Source confidence: Primary for the memorandum; Analytical for deal-specific effect.
Technology and data come second: AI and compute, semiconductors, quantum, biotechnology, autonomous systems, and sensitive personal data are the familiar export-controls categories. Governance rights come third, including information rights that look routine in NVCA-style documents. Real estate is fourth: under 31 CFR part 802, certain purchases, leases, and concessions near listed military installations are covered real estate transactions, and the list and definition were expanded by a final rule effective 2024-12-09. A startup leasing near a listed installation can create exposure without a financing event. Source confidence: Primary for the rules; Analytical for the ranking.
The reverse-direction regime matters for U.S. investors. The Outbound Investment Security Program at 31 CFR part 850 took effect 2025-01-02 and requires U.S. persons to notify or avoid certain investments in Chinese, Hong Kong, and Macau entities in semiconductors, quantum information technologies, and AI. It applies to outbound investments by your company or U.S. LPs, not inbound foreign money. The export-controls guide's note that the outbound rule remained a 2025 proposal is out of date; it is final. Source confidence: Primary.
What happens if you skip a filing
CFIUS actively searches for non-notified transactions: in 2025 it investigated 90, opened 62 inquiries, and requested filings in nine, per the annual report. For an unfiled covered transaction, 31 CFR 800.501(d) permits an agency notice up to three years after completion, with a chairperson-level exception. The Committee can impose mitigation, require a retroactive filing, or recommend unwinding; presidential decisions under Section 721 are not subject to judicial review. Source confidence: Primary for rules and statistics; Analytical for the practical warning.
The penalty ceiling is now material. A final rule published 2024-11-26 and effective 2024-12-26 raised the maxima: up to $5,000,000 per violation for material misstatements, omissions, or false certifications, and up to $5,000,000 or the value of the transaction for failure to comply with the mandatory declaration requirements (31 CFR 800.901). Calendar year 2025 was the first full year of the enhanced regime. CFIUS issued two formal noncompliance determinations for missed mandatory filings in 2025 and reported no monetary failure-to-file penalties that year; 2024 included mitigation-breach penalties of $60 million, $18 million, and $8.5 million per a named law-firm summary of Treasury's enforcement page. Source confidence: Primary for rules and 2025 counts; Mixed for the 2024 figures.
Filing fees are public and tiered by transaction value: $0 below $500,000, $750 to $4,999,999, $7,500 to $49,999,999, $75,000 to $249,999,999, $150,000 to $749,999,999, and $300,000 at $750,000,000 and above; declarations carry no fee. Preparation costs vary by counsel and complexity. Explicit hold: legal-fee estimates are withheld pending a verifiable source. Source confidence: Primary for fees.
What would change this view
This view weakens if the mandatory surface narrows: Congress amending Section 721, a court constraining the covered-investment or critical-technology definitions, or rulemaking implementing the America First directives as narrower triggers. It weakens if the excepted-state list grows, or if the Known Investor Program and any allied fast-track turn voluntary filings into predictable short clearances.
It strengthens if enforcement shifts to failure-to-file penalties, or if a non-notified startup transaction is unwound. It strengthens if declaration-to-notice conversion keeps rising, eroding the declaration's value as a fast path. It changes if the outbound regime expands to biotechnology or public securities as the 2025 memorandum contemplates, because the same investors would face gates in both directions.
FAQ
Q: Does a small angel check from a foreign individual trigger CFIUS? A: The dollar amount is not the test. An investment in a TID U.S. business carrying a board observer seat, information rights, or substantive decisionmaking can be a covered investment, and the critical-technology mandatory prong can then apply. An excepted-state individual with no such rights in a non-TID business differs. Source confidence: Primary for rules; Analytical for the example.
Q: Declaration or notice for a startup? A: A declaration is cheaper and faster but can convert into a notice, restarting the clock. A notice takes up to 45 days plus a possible 45-day investigation but produces the cleared safe harbor investors want. With Chinese or Russian touchpoints, a board seat, or ITAR technology, conversion is likely and the notice path is usually more efficient. Source confidence: Primary for mechanics; Analytical for the recommendation.
Q: Does excepted foreign state status exempt UK, Canadian, Australian, or New Zealand investors? A: Not automatically. The investor must qualify as an excepted investor under 31 CFR 800.219, and the 800.401(e)(1) carve-out applies only to covered control transactions. Excepted status does not eliminate jurisdiction. Source confidence: Primary.
Q: Can we close before clearance? A: If a mandatory declaration applies, no: it is due 30 days before completion, and early closing requires written notice that the Committee has concluded action. If the filing is voluntary, parties can close but carry later mitigation or unwinding risk. A cleared notice is the clean safe harbor. Source confidence: Primary.
Q: How much does a CFIUS filing cost? A: The government fee runs from $0 to $300,000 by deal value; declarations carry no fee. Legal and advisory costs are transaction-specific; no range is asserted. Explicit hold pending a verifiable source. Source confidence: Primary for the fee schedule.
Sources
- Section 721, Defense Production Act of 1950, 50 U.S.C. 4565, and FIRRMA, Pub. L. 115-232: govinfo U.S. Code and congress.gov (accessed 2026-09-18). Primary.
- 31 CFR 800.401 (mandatory declarations), 800.405 (30-day assessment), 800.407 (Committee actions): eCFR Subpart D (accessed 2026-09-18). Primary.
- 31 CFR 800.503 (45-day review) and 800.508 (investigation and extension): eCFR Subpart E (accessed 2026-09-18). Primary.
- 31 CFR 800.211, 800.215, 800.241, 800.243, 800.248, and 800.302 (definitions): eCFR Part 800 (accessed 2026-09-18). Primary.
- 31 CFR 800.901 (penalties), as amended by 89 FR 93184 (effective 2024-12-26): eCFR (accessed 2026-09-18). Primary.
- Treasury final rule on penalties, information requests, and mitigation procedures (2024-11-26): treasury.gov PDF (accessed 2026-09-18). Primary.
- 31 CFR part 802 military installation final rule (effective 2024-12-09): Federal Register (accessed 2026-09-18). Primary.
- 31 CFR part 850 Outbound Investment Security Program final rule (effective 2025-01-02): Federal Register and Treasury program page (accessed 2026-09-18). Primary.
- Excepted foreign states: cfius.gov (accessed 2026-09-18). Primary.
- Filing fees: cfius.gov (accessed 2026-09-18). Primary.
- CFIUS Annual Report to Congress for CY 2025 (released 2026-08-07): cfius.gov PDF and Treasury press release (accessed 2026-09-18). Primary.
- America First Investment Policy, NSPM, 2025-02-21: whitehouse.gov and govinfo DCPD-202500292 (accessed 2026-09-18). Primary.
- Law-firm summaries of the CY 2025 annual report and Treasury enforcement disclosures: Simpson Thacher (2026-08-10) and A&O Shearman (2026-08-12) (accessed 2026-09-18). Secondary, named.
- Companion pillar article, complete guide to export controls for deep-tech startups: stackandstate.com (accessed 2026-09-18). Site article.
- Companion visual: cfius-for-startups-foreign-investment.svg (accessed 2026-09-18). Site asset.
- Bottleneck Map pillar: Bottleneck Map (accessed 2026-09-18). Site pillar.
Methodology
This article follows the Bottleneck Map method. The constraint is assigned to Layer 5, Export Controls, because the binding founder risk is the compliance gate that decides which capital a company can accept. Layer 6 (Non-Dilutive Capital) and Layer 9 (Sovereign Capital) are connected: financing is conditioned by filing, and foreign-government-backed capital is the mandatory trigger.
Source-confidence labels follow the editorial standards: Primary for statutes, regulations, agency reports, or named disclosures; Mixed for figures cited through named secondary summaries; Analytical for Stack & State judgment. Regulatory facts were verified on 2026-09-18 against the current eCFR text of 31 CFR part 800, the U.S. Code, cfius.gov, the Federal Register, and Treasury releases. Where no verifiable public source exists, the article states an explicit hold rather than a placeholder: legal-fee ranges are withheld. No number is asserted without a named source.
Research cutoff and access date for all sources: 2026-09-18. Corrections: /connect/.
Stack & State is an editorial and ecosystem-intelligence publication. Nothing here is legal, investment, procurement, or compliance advice. Program details change; verify requirements with primary sources and qualified advisors.