In 2024, the Biden Administration substantially expanded executive branch power to monitor foreign investment into and out of the United States. First, the administration continued efforts to aggressively police compliance with rules established by the Committee on Foreign Investment in the United States (CFIUS or the Committee). Second, the administration created a new regime regulating certain American investments in Chinese quantum, microelectronic, and artificial intelligence companies. The Trump Administration is unlikely to roll back any of these developments. Indeed, it is more likely that the new Trump team will build on Biden’s efforts to aggressively evaluate inbound and outbound investment, particularly with regard to China.

I. CFIUS

There was a time not too long ago when CFIUS was a voluntary regime that primarily impacted the defense, telecom, and aerospace sectors. But those days are gone. Today, the CFIUS regime has the potential to impact any foreign person’s acquisition of or investment in a US business involved in a wide range of technologies and economic sectors. CFIUS is keenly interested in nearly all advanced technology sectors, and the Committee made clear in 2024 that it would become far more aggressive about policing compliance with CFIUS mandatory filing requirements and mitigation agreement obligations. The incoming Trump Administration is unlikely to change course in any material way because support for aggressive CFIUS enforcement is one of the few bipartisan commitments in Washington.

What does all this mean for parties pursuing cross-border M&A in 2025? CFIUS should be factored into deal strategy discussions earlier, and parties should be prepared for more post-deal scrutiny for transactions that are not submitted to the Committee.

A. Background

CFIUS has broad authority to review foreign person acquisitions of US businesses. Although CFIUS was historically a voluntary process, with parties opting for a CFIUS review when they desired safe harbor from post-close scrutiny, in 2018 the Committee created a mandatory filing regime to supplement the voluntary filing regime.

Voluntary Filing Regime: CFIUS has the power to review two types of investments pursuant to a voluntary submission to CFIUS. First, CFIUS can review any “covered control transaction” to determine the effect of the transaction on the national security of the United States. A covered control transaction is any merger, acquisition, or investment that “could result” in a foreign person exercising “control” of a US business, which is a person or entity “engaged in interstate commerce in the United States.”¹ CFIUS rules carve out a limited safe harbor from the definition of “control” for passive investments. Under the passive investment safe harbor provision, “[a] transaction that results in a foreign person holding ten percent or less of the outstanding voting interest in a US business [is not a covered transaction] … but only if the transaction is solely for the purpose of passive investment.”²

Second, CFIUS can review any “covered investment,” which is any direct or indirect investment by a foreign person in a technology, infrastructure, or data (TID) US business that does not result in control of the US business but affords the foreign person with access to (i) material nonpublic technical information, personal data, or critical infrastructure information, (ii) membership or observer rights on the board of the US business, or (iii) any other involvement in the operation of the US business (other than voting shares).³

A TID US business is any US business that satisfies one of three criteria:

1. Critical Technology – Produces, designs, tests, manufactures, fabricates, or develops one or more critical technologies;
2. Critical Infrastructure – Performs specified types of work in relation to a list of covered critical infrastructure; or
3. Sensitive Personal Data – Maintains or collects, directly or indirectly, sensitive personal data of US citizens (other than data associated with its employees).⁴

The “covered investment” category is not applicable to Excepted Investors (currently defined as certain investors from Canada, the United Kingdom, Australia, and New Zealand).⁵

Mandatory Filing Regime: Transaction parties must formally notify CFIUS before closing two types of transactions. (Failure to notify a deal covered by these rules can result in a fine of up to the value of the transaction.) First, a mandatory notification to CFIUS may be required for certain types of foreign investments into US businesses that produce, design, test, manufacture, fabricate, or develop critical technology (i.e., that export controlled technology, such as technology subject to the International Traffic in Arms Regulations (ITAR)), if an export license would be required to send the technology to the country of the investor at issue.⁶

Second, parties must notify CFIUS of any covered investment or covered control transaction that results in a foreign government having a “substantial interest” in a TID US business. A substantial interest occurs when a foreign person obtains a 25% or greater voting interest, directly or indirectly, in a US business if a foreign government, in turn, has a 49% or greater voting interest in the foreign person.⁷

B. Changing CFIUS Risk Calculus

The existence of the mandatory regime has made CFIUS filing decisions more consequential than in the past because failure to make a mandatory CFIUS filing can result in substantial penalties. CFIUS announced new regulations in 2024 that created more structure around enforcement activities. In particular, the new rules:

• Expand the ability of CFIUS to seek information from third parties about transactions of interest;
• Expand CFIUS subpoena power;
• Provide CFIUS with more authority to levy civil penalties in response to material misstatements to the Committee; and
• Substantially increase the maximum penalty that may be imposed by CFIUS for violations of CFIUS regulations.⁸

These new rules signal that CFIUS plans to operate more like an enforcement agency than in the past, will expand efforts to police compliance with mandatory filing rules, and will generally be more aggressive in looking for transactions to review. Although it is very likely that the new Trump Administration will continue to use CFIUS authority to focus particular attention on Chinese investment in the United States, expanded CFIUS authority will also be used to more aggressively evaluate M&A from all parts of the globe.

II. “Reverse CFIUS”

On October 28, 2024, the Biden Administration released its new outbound investment or “reverse CFIUS” final rule to restrict US investment in certain Chinese businesses.⁹ This new outbound investment regime, which became effective on January 2, 2025, impacts all US persons involved in investing in Chinese businesses that develop artificial intelligence (AI), semiconductors and microelectronics, and quantum computing technology. Although this regime is relatively tailored to the noted sectors, the new Trump Administration could expand or contract the rule relatively easily.

Broadly speaking, this outbound investment review regime is intended to deter investment in Chinese technologies and products that are perceived as constituting a national security threat to the United States. Pursuant to the new rules, US investment in (i) Chinese companies engaged in quantum computing, (ii) Chinese companies developing AI systems with certain military or mass-surveillance end uses, and (iii) Chinese companies trained using certain computing thresholds and certain semiconductor activities may be prohibited. Other investments in Chinese AI and semiconductor businesses are permissible but subject to a mandatory Treasury Department notification requirement within 30 days of the investment’s closing.

In light of this new regime, US persons and entities pursuing investment in Chinese technology companies must put significant due diligence processes in place to ensure compliance with the new rules. There is no safe harbor under the rule, which means companies and individuals that knew or should have known they made a covered investment will be subject to potential prohibitions and notification requirements. The Treasury Department has stated that its evaluation of the sufficiency of an investor’s due diligence “will be made based on a consideration of the totality of relevant facts and circumstances.”¹⁰

III. Conclusion

The regulatory environment for cross-border investment and M&A was complicated in 2024, and it will remain complicated in 2025. The best path for navigating potential regulatory obstacles to intended deal activity is to account for regulatory hurdles in advance, analyze CFIUS and “reverse CFIUS” risks as early as possible, and develop a plan to mitigate any potential risks.