Preparing a CFIUS Filing: A Practical Guide

Document type: Guide Practice area: Business and Corporate — Regulatory Jurisdiction: United States Last reviewed: 5 September 2026

A CFIUS filing is a factual submission, not a brief. The Committee is not persuaded by advocacy; it is persuaded by a complete, accurate, internally consistent picture of who is buying what and what they will be able to do with it.

That has two consequences for how you run the process. The first is that gathering the facts takes far longer than drafting, and the longest-lead item — mapping the acquirer's ownership chain to natural persons or governments — should start the day the term sheet is signed. The second is that every inconsistency in the filing costs weeks, because the Committee will ask about it and the answer will require reconciling documents produced by people in three countries.

This guide is organized around getting the facts right, on time.

PART ONE — THE THRESHOLD SCREEN

Step 1: Screen at the term sheet, in one hour

Three questions.

Is any party a foreign person? Directly, or anywhere in the ownership chain. A U.S.-incorporated fund with a foreign general partner is a foreign person. A U.S. company majority-owned by a foreign parent is a foreign person for these purposes.

Is the U.S. business a TID business?

• Critical technology: does it produce, design, test, manufacture, fabricate, or develop anything on the United States Munitions List or controlled on the Commerce Control List for national security, chemical and biological weapons, nuclear nonproliferation, missile technology, regional stability, or surreptitious listening reasons — or any emerging or foundational technology so identified?
• Critical infrastructure: does it own, operate, manufacture, supply, or service anything in the enumerated categories, applying the functional tests in the appendix to 31 C.F.R. Part 800?
• Sensitive personal data: does it maintain or collect data in one of the ten categories on more than one million U.S. individuals in the preceding twelve months, or target U.S. government or military personnel?

Will the foreign person obtain control, board access, technical information access, or substantive involvement in decisions about technology, infrastructure, or data?

If any answer is yes, get CFIUS counsel involved before the LOI is signed. The efforts covenant, the outside date, and the reverse termination fee are all easier to negotiate at that point than later.

Step 2: Determine whether the filing is mandatory

Two independent tests, and either one triggers.

The substantial interest test. A foreign person acquires 25 percent or more of the voting interest in a TID U.S. business, and a foreign government holds 49 percent or more of the voting interest in that foreign person, directly or indirectly.

• Apply the look-through rules for funds and partnerships carefully.
• A general partner's independence can matter to the analysis; document it.
• Note that a 22 percent stake with anti-dilution or follow-on rights can become 26 percent later, converting a voluntary situation into a mandatory one. Address it in the documents.

The critical technology test. Start it in week one, because it is the long pole.

1. Classify. Have export control counsel determine the ECCN of every product, software, and technology, or confirm USML status. This requires engineering input and typically takes two to five weeks.
2. Identify the relevant foreign persons. The direct acquirer, plus every person in the ownership chain holding 25 percent or more voting interest.
3. Determine each person's country.
4. Run the license determination. Would a license be required to export or transfer that item to that country and that end user, taking account of reasons for control, license exceptions, and the end-user and end-use controls in 15 C.F.R. Part 744?
5. Document the analysis in a memorandum, whichever way it comes out. You will need it if the Committee asks, and you will need it if someone later asks why you did not file.

If mandatory, the filing must be submitted at least 30 days before closing, and the transaction cannot close before the Committee concludes action without penalty exposure up to the value of the transaction.

Step 3: If voluntary, decide whether to file anyway

File when:

• The vulnerability is real — sensitive data, critical infrastructure, government contracts, proximity to installations.
• The acquirer has any state linkage.
• A future financing, sale, or IPO will ask the question.
• The parties want a safe harbor, which only a clearance provides.

Consider not filing when:

• The U.S. business is plainly outside every TID category and the acquirer is plainly low-threat.
• The rights obtained are genuinely passive.
• The transaction is small and the parties accept the residual exposure with a documented analysis.

Whatever you decide, write the memorandum. A privileged analysis concluding that no filing was warranted, prepared at the time, is worth a great deal if the non-notified program comes calling.

PART TWO — ASSEMBLING THE FACTS

Step 4: Map the ownership chain — start immediately

This is the longest-lead item in almost every filing.

What is required for the acquirer and each entity in its chain:

• Full legal name, jurisdiction and date of organization, principal place of business.
• Ownership percentages at every tier, up to natural persons or governments.
• Organizational chart.
• For funds: the general partner, the management company, the limited partners above the applicable thresholds, and the governance arrangements.
• Any government ownership, at any tier, at any percentage, in any country.
• Any government control rights, golden shares, or special rights.

For each individual identified — directors, officers, and holders above the specified thresholds — personal identifier information is required: full name including all names used, dates and places of birth, national identification numbers, passport numbers, addresses for a period of years, employment history, and travel history for some individuals.

Why this takes months. The individuals are in other countries, they do not report to the deal team, and the information is genuinely sensitive. A fund with forty limited partners across nine jurisdictions is a project.

Practical advice:

• Start the collection the day the term sheet is signed.
• Use a secure collection portal and explain the legal basis and the handling protections; individuals are properly cautious about supplying passport numbers.
• Designate one person on the acquirer's side as accountable, with authority.
• Build a tracker and report on it weekly.
• Expect to chase. The last three individuals take as long as the first thirty.

Step 5: Assemble the U.S. business record

• Corporate organization, capitalization, and cap table.
• Description of every product and service line.
• Technology classification memorandum with ECCNs.
• Every government contract, with agency, value, term, and whether classified.
• Facility list with addresses, and distances to any listed military installation for the real estate analysis.
• Data holdings: categories, volumes, U.S. person counts, where stored, who has access.
• Customer list, with any government customers identified.
• Supply chain: sole-source positions, and any product on which a government or critical infrastructure customer depends.
• Employee population by citizenship, where export control issues arise.
• Any prior CFIUS filings and their outcomes.
• Any export control, sanctions, or security enforcement history.

Step 6: Describe the transaction precisely

• Structure, consideration, and percentages before and after.
• Every governance right, quoted from the documents: board seats, observer rights, nomination rights, consent and veto rights, information rights.
• Post-closing integration plans, including any planned transfer of technology, personnel, or data.
• Any agreements among shareholders.
• The buyer's stated intentions for the business.

Consistency is everything here. The description in the filing must match the purchase agreement, the shareholders' agreement, the board resolutions, and what the parties tell the Committee in a call. Inconsistencies produce questions, and questions produce weeks.

PART THREE — CHOOSING AND MAKING THE FILING

Step 7: Declaration or notice

A declaration is the right choice when:

• The acquirer is from a low-threat jurisdiction with no state linkage.
• The ownership chain is short and easy to describe.
• The U.S. business has a modest vulnerability profile.
• There is no critical technology, no classified work, and no facility near a listed installation.
• The rights obtained are limited.
• Speed matters and the 30-day answer is worth the risk of a request for a notice.

A notice is the right choice when:

• Any party is state-owned or state-linked.
• The U.S. business has critical technology, classified contracts, or large sensitive data holdings.
• The ownership chain is complex.
• Mitigation is foreseeable — the declaration cannot produce mitigation, so a case likely to end there should start with a notice.
• The parties want certainty rather than speed.

Note what a declaration cannot do. It cannot produce a mitigation agreement, and the Committee cannot clear a transaction on a declaration if the resolution requires conditions. A case likely to need mitigation should file a notice.

And note the downside is bounded. A declaration that draws a request for a notice costs 30 days and produces a Committee that already understands the transaction, which is worth something on the notice.

Step 8: Use the pre-filing draft

Submitting a draft notice before formally filing is not required. It is nearly universal practice for good reason.

What it accomplishes:

• The staff identifies missing information before the clock starts.
• The staff flags the areas of concern, which tells you what to address.
• It avoids a rejection for incompleteness, which wastes weeks.
• It permits the parties to reconsider structure while it can still change.

How long it takes. Two to eight weeks. Longer where the Committee's initial questions require new factual work.

How to use it well: submit a genuinely complete draft rather than a placeholder; respond to comments quickly and completely; and treat the staff's questions as a preview of the review rather than as an inconvenience.

Step 9: File

Mechanics:

• Submission is electronic, through the CFIUS case management system.
• The filing fee is tiered by transaction value and must be paid before the filing is accepted. Confirm the current schedule; fees are significant for large transactions and are typically shared per the purchase agreement.
• Certifications signed by an authorized officer of each party, attesting that the information is accurate and complete. These are serious; a materially false statement carries criminal exposure.
• Acceptance starts the clock. Confirm acceptance in writing.

What starts running: 30 days for a declaration; 45 days of review, potentially followed by 45 days of investigation, for a notice.

Step 10: Manage the review

Expect questions. They arrive as written requests with short deadlines — often three to seven business days — and there may be several rounds.

How to handle them:

• Answer completely the first time. A partial answer produces a follow-up and burns a week.
• Answer consistently. Cross-check every response against the filing and against prior responses.
• Do not argue. These are factual questions. Advocacy in a question response reads as evasion.
• Escalate internally fast. A question that requires engineering input, or information from the acquirer's parent, needs the same-day attention of someone senior.
• Keep a question log with dates, deadlines, responses, and who supplied each fact.

Expect calls. The staff may request a call with technical or business personnel. Prepare them: they should know the filing, answer only what they know, and not speculate.

Expect an agency site visit in matters involving facilities near installations or classified work.

Step 11: The pull-and-refile decision

Where the Committee's questions cannot be resolved within the clock — usually because mitigation is under negotiation — the parties withdraw and refile, restarting the 45-day review.

When to do it: when the alternative is a Committee that must act on an incomplete record, which means an adverse recommendation.

How often: one cycle is common in complex cases; two happens; three is a signal that the transaction may not clear.

What it costs: roughly 45 to 60 days per cycle, plus fees. Build the possibility into the outside date.

A practical note. A pull-and-refile is a normal part of the process, not a failure. Clients should be told at the outset that it may happen, because a surprise withdrawal in month four generates alarm that is not warranted by the facts.

PART FOUR — MITIGATION

Step 12: Prepare for mitigation before it is proposed

If the vulnerability analysis suggests concerns, work out in advance what the company could live with.

Rank the possible measures:

• Acceptable and cheap: information security controls, access restrictions, a compliance officer, reporting and certification.
• Acceptable but costly: network segregation, a security committee of the board, independent audits, supply assurance commitments.
• Serious: governance restrictions that limit the investor's rights, personnel restrictions, facility controls.
• Deal-changing: divestiture of a business line, a proxy or voting trust arrangement, restrictions applying to the acquirer's other operations.

Know your limit before the negotiation, because the efforts covenant in the purchase agreement defines it, and a buyer that accepts a measure beyond its limit has waived a walk right it paid for.

Step 13: Negotiate the agreement carefully

A National Security Agreement is an operating constraint for years. Negotiate as you would any long-term contract.

Push for:

• Objective standards rather than agency discretion. "Consistent with the Security Plan approved by the Monitoring Agencies" is better than "satisfactory to the Monitoring Agencies."
• Notice rather than approval wherever possible. An obligation to notify before a change is far less burdensome than an obligation to obtain consent.
• Defined cure periods for any breach.
• A term, or a review mechanism. Perpetual agreements are common and worth resisting; a five-year review, or a sunset tied to the resolution of the underlying concern, is achievable in some matters.
• Clarity on which agency decides what, and a single point of contact where multiple agencies monitor.
• Reasonable audit scope and frequency, with cost caps.
• Confidentiality for the agreement's terms and for information provided under it.

Model the ongoing cost before signing: compliance staff, systems, audits, and reporting. Moderate agreements run $200,000 to $1 million a year.

Step 14: Build the compliance program before closing

• Appoint the compliance officer named in the agreement.
• Draft the security plan and the policies the agreement requires.
• Configure the access controls and segregation the agreement specifies.
• Train covered personnel and document the training.
• Build the reporting calendar: quarterly reports, annual certifications, notice triggers.
• Assign a single owner who will still be there in three years.

The most common post-closing failure is that the agreement is signed, the deal team disperses, and nobody operationalizes it. The first annual certification then has to be signed by an officer who cannot honestly make it.

PART FIVE — A WORKED FILING

Harlingford Aerostructures, a Michigan maker of machined titanium components for commercial and military aircraft, is being acquired by Vasterhaven Group, a Swedish industrial holding company. Purchase price $210 million. Harlingford holds three subcontracts on military programs, two of which involve controlled technical data. Vasterhaven's largest shareholder is a Swedish family foundation at 34 percent; a Norwegian state pension fund holds 6 percent.

Week 1 — screen. Foreign person: yes. TID business: yes, critical technology, plainly. Control: yes, a full acquisition. CFIUS counsel engaged, and export control counsel engaged the same day.

Weeks 1–5 — the classification. Export counsel works with Harlingford's engineering team on twenty-two part families. Result: fourteen are EAR99; five are controlled on the CCL for national security reasons; three involve technical data subject to the ITAR because they are specifically designed for a military aircraft.

The mandatory determination. A license would be required to transfer ITAR-controlled technical data to Sweden and to Vasterhaven. The filing is mandatory. This is determined in week five, which is early enough to matter.

Weeks 2–11 — the ownership chain. Vasterhaven has four tiers above the acquiring entity, a family foundation with eleven trustees, and a Norwegian state fund at 6 percent. Personal identifier information is required for eighteen individuals across three countries. Harlingford's counsel, Aurélie Nakamura-Boateng, builds a tracker, uses a secure portal, and reports weekly. Two trustees take until week eleven. This is the critical path, exactly as expected.

Weeks 6–9 — the U.S. business record. Facility distances measured against the Part 802 installation lists (one facility is 41 miles from a listed installation — within an extended range zone, relevant to the vulnerability discussion though not itself a real estate transaction). Government contracts assembled with the contracting officers identified. Employee citizenship report prepared, which surfaces a separate deemed export issue for two engineers that must be addressed independently of CFIUS.

Weeks 10–14 — pre-filing draft. Submitted in week ten. Staff comments in week twelve, focused on three areas: the family foundation's governance and whether any government body influences it; the ITAR-controlled data and how it will be protected post-closing; and Vasterhaven's plans for the Michigan facility.

Week 15 — formal filing. Fee paid, certifications executed, accepted week sixteen. The 45-day review begins.

Weeks 17–21 — questions. Three rounds. The hardest concerns the foundation's trustee appointment process, which required a Swedish-law memorandum and translated constitutive documents. A staff call with Harlingford's chief engineer and Vasterhaven's group compliance director occurs in week twenty.

Week 22 — investigation opened. Not a surprise given the ITAR data and the military subcontracts.

Weeks 22–27 — mitigation negotiation. The Department of Defense proposes a National Security Agreement. The parties negotiate:

• Accepted: a security control plan; U.S.-citizen-only access to ITAR-controlled technical data; a designated facility security officer; segregation of the controlled data network from Vasterhaven's global systems; annual certification; notice before any change in directors or any relocation of the controlled work.
• Negotiated down: an initial proposal for a government security committee of the board with approval rights over the controlled programs became a security officer plus reporting, on the basis that Sweden is a NATO member with existing security arrangements and that the controlled work is a small share of the business.
• Rejected and dropped: a proposal to restrict Vasterhaven's ability to relocate any Harlingford production, which the parties argued was broader than the identified concern; the final agreement limits the restriction to the controlled programs.

Week 28 — pull and refile. The mitigation could not be finalized within the clock. Withdrawn and refiled; the 45-day review restarts.

Week 34 — NSA executed. Week 36 — clearance.

Total elapsed: eight months from engagement. Legal and consulting fees, roughly $1.35 million including export control work. Ongoing NSA compliance budgeted at $340,000 annually.

Aurélie's retrospective, three points.

One — the classification in week five saved the deal. Learning in month four that the filing was mandatory would have blown the outside date and the financing commitments.

Two — the ownership chain was the critical path and was known to be from day one. The tracker and the weekly report were the difference between eleven weeks and twenty.

Three — the mitigation negotiation went well because the parties knew their limit. The purchase agreement's efforts covenant excluded any measure that would restrict Vasterhaven's operations outside the controlled programs, which gave Aurélie a principled basis for the position she took, and the Committee accepted it.

PART SIX — CALENDAR, BUDGET, AND STAFFING

A realistic calendar

Compressible: the U.S. business record and the drafting. Not compressible: the classification, the ownership chain, and the Committee's own timelines.

Plan the outside date at nine to twelve months for a transaction with real issues, and make sure financing commitments and retention arrangements survive it.

Budget

The line with the best return is the early export control classification. It determines the entire path and it costs a fraction of discovering the answer late.

Staffing

A CFIUS lead who has run filings, not a generalist. The process has conventions that are not in the regulations.

Export control counsel, engaged in week one, working directly with engineering.

A project manager for the ownership chain. This is a data collection exercise across countries and time zones with sensitive personal information, and it needs an owner with authority to escalate.

A single accountable person on the acquirer's side, senior enough to compel responses from group entities.

Technical and business witnesses prepared for calls. They should know the filing, answer within their knowledge, and not speculate.

A post-closing compliance owner named before closing, who will still be in the role in three years.

PART SEVEN — MISTAKES THAT ADD MONTHS

Doing the export control classification late. It determines whether the filing is mandatory and it takes weeks.

Starting the ownership chain in month three. It is the critical path in nearly every filing.

Inconsistencies between the filing and the deal documents. Every one produces a question round.

Filing a declaration in a case that will need mitigation. A declaration cannot produce a mitigation agreement.

A thin pre-filing draft. The staff cannot flag concerns in a placeholder, and you lose the benefit.

Partial answers to questions. Each one costs a week.

Advocacy in factual responses. It reads as evasion and invites more questions.

An outside date of six months. Realistic for a clean declaration; not for anything else.

No limit defined in the efforts covenant. The buyer then has no principled basis to refuse a mitigation measure, and no walk right either.

Treating a pull-and-refile as a crisis. It is routine in complex matters. Tell the client at the outset.

Signing an NSA nobody has costed. Model the compliance burden before agreeing to it.

Nobody owning the NSA after closing. The first annual certification arrives and there is nothing to certify.

Assuming excepted-investor status. The 10 percent tests are demanding and many investors fail them. Analyze and document.

PART EIGHT — RESPONDING TO A NON-NOTIFIED INQUIRY

If a letter arrives about a transaction you did not file:

Day 1. Engage CFIUS counsel. Issue a litigation hold covering the transaction, the diligence, and any CFIUS analysis. Do not respond substantively before counsel is engaged.

Days 1–5. Locate and review any contemporaneous analysis of whether a filing was required. If it exists and it was reasonable, it is valuable. If it does not exist, that is a fact to know now rather than later.

Days 5–15. Reconstruct the facts: what the transaction was, what rights the foreign person obtained, what the U.S. business does and holds, and whether it was a TID business at the time.

Determine whether the filing was mandatory. If it was, the exposure runs to the value of the transaction, and the posture is materially different. Counsel should evaluate voluntary disclosure.

Respond promptly, completely, and accurately. Parties that cooperate have generally fared better than parties that litigate the threshold question.

Expect one of four outcomes: a determination that the transaction was not covered; no further action; a request to file; or a unilateral review.

And prepare the client for the possibility of mitigation on a closed transaction. The Committee's remedies do not depend on the deal being open.

PART NINE — DEAL DOCUMENT PROVISIONS

The filing is easier when the agreement was drafted with it in mind.

The condition. Define "CFIUS Approval" precisely: written notice that the Committee has concluded all action with no unresolved national security concerns; or a report to the President recommending no action with the Presidential period expired; or a Presidential decision not to act.

The efforts covenant with a defined limit. The most valuable provision in the agreement. Rather than "reasonable best efforts" alone, specify what the buyer need not accept:

Notwithstanding the foregoing, in no event shall Buyer be
required to (i) divest, hold separate, or agree to any
restriction on the ownership or operation of any business or
assets of Buyer or any of its Affiliates other than the Company;
(ii) enter into any proxy agreement, voting trust, or similar
arrangement; (iii) divest any business or asset of the Company
generating more than $[__] of revenue in the most recent fiscal
year; (iv) agree to any restriction that would reasonably be
expected to reduce the Company's EBITDA by more than $[__] per
year; or (v) agree to any measure applicable to Buyer's
operations outside the United States.

Objective limits are the point. "Burdensome condition" undefined produces a dispute about whether the buyer breached its covenant.

The outside date. Nine to twelve months where CFIUS is a real issue, with an extension mechanism tied to the pendency of the review.

The reverse termination fee. Where the buyer terminates because it will not accept mitigation, or where the transaction is prohibited. In deals with meaningful CFIUS risk, 3 to 8 percent of equity value appears. Negotiate the triggers precisely: a fee payable on a Presidential prohibition is different from a fee payable when the buyer declines a measure it was not required to accept.

Cooperation and information covenants. Prompt responses to Committee requests; sharing of drafts; joint participation in communications with the Committee, with a carve-out permitting the acquirer to submit confidential ownership information separately; allocation of filing fees and advisor costs.

Representations that support the filing. From the seller: technology classification, government contracts, data holdings, facility locations, and prior CFIUS history. From the buyer: ownership chain, foreign government relationships, and enforcement history. These belong in the agreement because they are the facts the filing turns on.

Interim covenants. Restrictions on the U.S. business acquiring new controlled technology, entering new classified work, or relocating facilities during the pendency of the review — because each changes the filing.

PART TEN — FREQUENTLY ASKED QUESTIONS

How long will this take? A clean declaration: 30 days from acceptance, plus preparation. A notice with issues: three to seven months elapsed, sometimes longer with mitigation and a pull-and-refile.

Can we close before clearance? Not on a mandatory filing without penalty exposure. On a voluntary filing you can, but you close without a safe harbor and with indefinite review authority.

Should we file a declaration first? If the facts are clean and the acquirer is low-threat, yes. If mitigation is likely, no — a declaration cannot produce one.

Who pays the filing fee? Negotiated; commonly shared or paid by the buyer. Confirm the current tiered schedule; it is significant on large transactions.

Do we have to give the Committee our investors' passport numbers? Yes, for individuals above the specified thresholds and for directors and officers. Explain the requirement and the handling protections early; this is the item most likely to generate resistance.

What if a limited partner refuses to provide the information? The filing cannot be completed without it. Options: restructure the investment so the LP falls below the threshold, obtain the information through the fund's existing subscription documents, or accept that the transaction may not be filable in its current form. Raise this with the fund at the term sheet stage.

Can we withdraw if the Committee is heading the wrong way? Yes, and parties routinely do. Withdrawal and abandonment is far more common than a Presidential prohibition, and it avoids a formal adverse outcome.

Is the filing confidential? The statute protects information filed with the Committee from public disclosure, including under FOIA. The fact of a filing is not necessarily confidential — parties often disclose it in securities filings or press releases.

What if the business changes during the review? Tell the Committee. A material change — a new contract, a new product, an acquisition — affects the analysis, and discovering it independently is worse than being told.

Does clearance cover future transactions? No. The safe harbor covers the transaction as described. A subsequent investment, a change in rights, or a follow-on round is a new question.

PART TEN-B — COORDINATING WITH OTHER REGULATORY WORKSTREAMS

CFIUS rarely travels alone, and the sequencing matters.

Antitrust. HSR notification and any second request run on their own timeline and answer a different question. The two processes are independent: clearing one says nothing about the other. Where both apply, file both early and manage them as separate workstreams with separate teams; a single lawyer trying to run both will drop something.

Export control licensing. A transaction requiring a license to transfer technology or technical data to the acquirer needs the license, not just CFIUS clearance. Directorate and Bureau processing times run months. Start the license application in parallel with the CFIUS filing rather than after clearance.

Foreign direct investment screening abroad. The United Kingdom's National Security and Investment Act, the EU framework and its member state regimes, and comparable statutes in Australia, Canada, and Japan may all apply to the same transaction. Note that several impose mandatory filings with suspensory effect and short deadlines, and that a few require notification before signing. Map every applicable regime at the term sheet and build one master calendar.

Industry-specific approvals. FCC licence transfers, FERC authorizations, Defense Counterintelligence and Security Agency facility clearance changes, state insurance and banking approvals, and healthcare licensure changes each have their own timelines. Several interact with CFIUS: DCSA's foreign ownership, control, or influence mitigation, for example, can overlap substantially with a CFIUS NSA, and the two should be negotiated with awareness of each other.

Outbound investment screening. Where a U.S. person is investing abroad in covered technologies, the outbound regime applies independently. A transaction that is inbound for one party may be outbound for another.

Data transfer restrictions. Rules limiting bulk transfers of sensitive personal data and government-related data to countries of concern apply to commercial arrangements, not only investments. A CFIUS-cleared transaction can still leave a data transfer that is prohibited.

One master calendar. The single most useful project management artifact in a multi-regulator transaction is one calendar showing every filing, every clock, every outside date, and every dependency. Someone should own it, and it should be reviewed at every deal team call.

PART ELEVEN — FOR IN-HOUSE COUNSEL AND FOUNDERS

Screen every financing round, not just acquisitions. A board observer seat for a foreign fund in a company holding data on more than a million U.S. individuals is a covered investment. Founders are routinely surprised by this.

Know your own TID status. Every company should have a current, written answer to three questions: Do we have critical technology, and what are the ECCNs? Do we own or service critical infrastructure? How many U.S. individuals' sensitive personal data do we hold? The answers change as the business grows, and they should be reviewed annually.

Get the export classification done once, properly, and keep it current. It is needed for CFIUS, for export compliance, for customer questionnaires, and for every future financing. Companies that have it can answer a diligence request in a day; companies that do not spend six weeks.

Ask about CFIUS in your investor diligence. Where is the fund organized? Who are the LPs, and is any a government? What percentage? Does the fund qualify as an excepted investor? A fund that cannot answer these quickly will be a slow filing.

Build the ownership-information collection into the subscription documents. Funds that obtain CFIUS-relevant information from LPs at subscription can produce a filing in weeks rather than months. This is a fund formation point that pays off years later.

Budget for it. A CFIUS notice is a six-to-seven-figure line item on a transaction, and it does not appear in most models until someone puts it there.

And keep the analysis even when you decide not to file. A privileged memorandum concluding that no filing was required, written at the time by counsel who considered the actual regulations, is the difference between a manageable non-notified inquiry and an uncomfortable one.

Related documents

• CFIUS and Foreign Investment Review: Covered Transactions, Mandatory Filings, and Mitigation
• CFIUS Filing Checklist: A Practical Checklist
• Foreign Investment Review Toolkit: Declarations, Notices, and Mitigation Agreements
• Export Controls and Economic Sanctions: The EAR, ITAR, and OFAC for Ordinary Businesses
• HSR Premerger Notification: When a Deal Must Be Reported and What Happens Next
• Negotiating the Indemnity Package in a Deal: A Practical Guide

This guide is general information, not legal advice, and does not create an attorney-client relationship.