CFIUS Is Looking Beyond the Buyer: What Foreign VC and PE Investors Need To Know

Key Takeaways

• CFIUS is looking beyond the named buyer. Its review may extend to ultimate beneficial owners, limited partners, co-investors, affiliates, portfolio companies and commercial relationships that could create foreign-influence or national security concerns.
• Foreign-adversary connections can create risk even when indirect. Investors should evaluate not only ownership but also governance rights, sources of capital, counterparties, operations, and other ties involving China and other foreign-adversary jurisdictions.
• CFIUS penalty activity is on the rise. Parties that do not obtain a CFIUS safe harbor may remain subject to post-closing review, mitigation requirements, significant penalties and even divestment.
• Early diligence and engagement are critical. Parties should assess the investor network and the U.S. business's sensitive technologies, data, contracts and infrastructure before signing, and build appropriate flexibility into transaction timelines, regulatory covenants and financing arrangements.

While foreign investment in the U.S. remains welcome, the Committee on Foreign Investment in the United States (CFIUS or the Committee), which is the U.S. government interagency committee chaired by the U.S. Department of the Treasury (Treasury) responsible for conducting national security review of foreign investment into U.S. businesses, is increasingly focused on the broader ecosystem surrounding a transaction rather than solely on the identity of the acquirer and its direct parent. For venture capital and private equity investors, that means CFIUS diligence now regularly extends beyond the acquisition vehicle to ultimate beneficial owners, limited partners, co-investors, affiliates, portfolio companies and even commercial relationships that may implicate U.S. national security concerns.

Buyers and targets should evaluate the broader business ecosystem surrounding a transaction, including portfolio companies, vendors, customers and supply chain relationships that may create exposure to foreign-adversary jurisdictions or other national security concerns. Just as important, companies should assess the U.S. business itself through a national security lens. Sensitive personal data, critical technologies, export-controlled products, government contracts, critical infrastructure assets and research activities can all influence CFIUS risk, review timelines and potential mitigation requirements.

Recent enforcement activity, expanded review tools, new CFIUS guidance and evolving filing requirements underscore a simple reality: Understanding the investor network behind a transaction has become as important as understanding the target itself. Investors and U.S. businesses that identify and address those issues early are generally better positioned to manage review timelines, mitigation requirements and transaction execution risk.

Looking Beyond the Named Buyer

CFIUS has long possessed authority to examine ownership structures beyond the immediate purchaser, but recent guidance - including but not limited to Executive Order (EO) 14083, Ensuring Robust Consideration of Evolving National Security Risks by the Committee on Foreign Investment in the United States, of Sept. 15, 2022 - policy developments and enforcement activity make clear that the Committee increasingly focuses on the broader network of relationships surrounding a transaction.

Under current CFIUS filing requirements, parties must disclose information concerning not only the foreign investor but also its parent entities and ultimate beneficial owners.[1] CFIUS has emphasized, including through its organizational chart guidance, that acquisition vehicles, newly formed subsidiaries and other special-purpose entities generally are not viewed as the "actual party in interest" when assessing national security risk.[2] Instead, CFIUS focuses on direct and indirect ownership, beneficial ownership, voting rights, and economic interests throughout the chain of ownership and control.

For investment funds, that inquiry can become particularly expansive. CFIUS guidance indicates that the Committee may seek information regarding foreign investors participating directly or indirectly in a transaction, including limited partners, and their ownership structures, jurisdictions of organization and governance rights.[3] Treasury has also signaled a willingness to request partnership agreements, side letters and related transaction documents notwithstanding contractual provisions intended to preserve investor confidentiality. As a result, a fund's broader investor base may become relevant to the review process even where those investors are removed from day-to-day transaction decision-making.

Thus, the Committee's focus does not end with ownership. As illustrated by EO 14083 and CFIUS's 2024 and 2025 Annual Reports to Congress, CFIUS investigates an investor's ties to third parties; activities that may present national security concerns, including ownership, rights or control with respect to certain manufacturing capabilities, services, critical mineral resources or technologies; and the potential transfer of sensitive technology or information to unauthorized parties as relevant risk considerations. Mitigation measures increasingly address information-sharing protocols, vendor relationships, access restrictions, personnel decisions and future governance rights, reflecting the Committee's broader interest in how influence may be exercised after closing.

Foreign-Adversary Connections Remain a Central Consideration

The February 2025 America First Investment Policy further reinforced the central role that foreign-adversary connections play in U.S. investment-security reviews. The policy directs heightened scrutiny of investments involving foreign adversaries and emphasizes the use of CFIUS and other authorities to address risks arising from investments in sensitive U.S. businesses. The policy defines foreign adversaries to include China, including Hong Kong and Macau, as well as Russia, Cuba, Iran, North Korea and the Maduro regime in Venezuela. It also highlights concerns regarding transaction structures that may obscure foreign-adversary involvement through intermediary entities, third-country investment vehicles, partner companies or investment funds.

Although the policy applies broadly to foreign adversaries, China remains the most prominent focus of current U.S. investment-security initiatives. As a result, investors with direct or indirect China connections, operations, counterparties or sources of capital should carefully assess potential CFIUS implications early in the transaction process.

For sponsors and investors, the practical significance extends beyond the location of the acquiring entity. The policy directs attention to whether investors in sensitive U.S. businesses can demonstrate meaningful independence from foreign-adversary governments and influence. While the policy continues to support genuinely passive investment that does not provide governance, board, voting, managerial or material nonpublic-information rights, investors should expect increased scrutiny of ownership structures, governance arrangements and investor relationships that may create actual or perceived ties to foreign-adversary jurisdictions.

Enforcement Continues To Expand

CFIUS has reported a significant increase in penalty activity in recent years, including enforcement actions involving unauthorized access to sensitive data, failures to comply with mitigation commitments and material inaccuracies in filings. Several recent public resolutions focused not merely on the underlying acquisition itself but also on governance arrangements, compliance controls, information access restrictions, and representations made to CFIUS concerning transaction funding or post-closing operations.

Treasury's November 2024 regulations[4] expanded the Committee's authority to obtain information and issue subpoenas to transaction participants and third parties such as financial institutions, underwriters and service providers. The rules also increased potential monetary penalties for certain violations to as much as $5 million per violation or, in some cases, the value of the transaction.

Recent developments reflected in CFIUS's 2025 Annual Report specifically reinforce this trend. The Committee continued to devote substantial resources to identifying and reviewing non-notified transactions and to monitoring hundreds of mitigation agreements through compliance reviews and site visits. As of year-end 2025, CFIUS was monitoring 234 mitigation agreements and conditions and had conducted 40 site visits during the year to assess compliance with mitigation obligations. The Committee also screened thousands of potential non-notified transactions, investigated 90 matters, opened 62 formal inquiries and requested filings in nine matters.[5] Together, these activities demonstrate a growing focus on understanding not only who owns a business but also who may be positioned to influence it through governance arrangements, financing relationships, commercial ties, or other forms of direct or indirect connectivity.

For example, in January 2026, the president required the divestment of semiconductor-related assets acquired from EMCORE Corp. by HieFo Corp., a California-based photonics company controlled by a Chinese national.[6] The order followed CFIUS's review of the April 2024 acquisition by HieFo Corp. of EMCORE's digital semiconductor and related wafer design, fabrication and processing business. After its investigation, CFIUS concluded there was credible evidence that HieFo Corp. might take action that could threaten to impair U.S. national security. Of note, the presidential order extended beyond the direct purchaser and imposed restrictions on its partners, subsidiaries, affiliates and foreign-person shareholders. It also authorized CFIUS, when reviewing a proposed transferee, to consider direct and indirect contractual, financial, familial, employment, and other close and continuous relationships between the proposed transferee and the original purchaser, its affiliates, or their officers and employees.[7]

Taken together, these developments demonstrate that CFIUS's interest in ownership structures and influence networks does not end when a transaction closes. Further, parties that do not obtain a CFIUS safe harbor remain exposed to post-closing scrutiny, mitigation obligations and potential divestment and enforcement action.

Treasury's New CFIUS Resources Reflect a Continued Focus on Transparency and Early Engagement

As noted earlier, it is important to address CFIUS considerations early in the deal process. In July 2026, Treasury launched a dedicated CFIUS website that consolidates filing guidance, organizational chart requirements, enforcement resources, non-notified transaction materials and other process-related information in a single location. Although the redesign does not alter CFIUS's jurisdiction, filing requirements or substantive national security standards, it provides a clearer road map for how the Committee expects parties to prepare and present transactions for review.

Several of the new resources are particularly relevant to private equity and venture capital investors. Treasury introduced a formal prefiling consultation portal that permits parties to engage with CFIUS before submitting a declaration or notice, as well as expanded filing guidance that distinguishes between information required by the regulations and information that CFIUS frequently requests during the review process. The guidance specifically highlights ownership structures, indirect foreign investors, limited partners, governance arrangements, side letters and other materials that often generate follow-up questions and delay the review process. Prior to using the formal prefiling consultation portal, a party should be aware of the various options and outcomes of this proactive outreach to CFIUS.

The redesigned website also includes illustrative organizational chart examples and a new risk-analysis framework focused on recurring national security considerations such as technology transfer, personal data security, cybersecurity, supply chain resilience and foreign influence. While these tools do not create new legal obligations or predict how CFIUS will view a particular transaction, they provide additional insight into the factors the Committee considers most important during the review process. More broadly, the redesign reflects a continuing emphasis on filing readiness, complete ownership transparency and early identification of potential national security concerns - themes that increasingly shape CFIUS reviews.

The Bottom Line: What Investors and Companies Should Be Doing Now

The message is increasingly clear: CFIUS's analysis is no longer limited to the acquisition vehicle and its immediate parent. The Committee is increasingly focused on the broader ecosystem of owners, investors, affiliates and commercial relationships that may create opportunities for foreign influence over a U.S. business. Thus, fund sponsors should be prepared to identify significant investors, understand governance and information rights, assess whether limited partners, co-investors or affiliates may present CFIUS considerations, and address CFIUS issues early in the transaction process. Early preparation can help parties identify issues before signing, structure transactions appropriately, and build sufficient flexibility into deal timelines, regulatory covenants and financing arrangements to accommodate potential filing, review and mitigation requirements.

[1] See 31 C.F.R. §§ 800.502(c), 800.503.

[2] See Treasury-CFIUS FAQ: https://home.treasury.gov/faq-item/international-affairs/what-steps-can-be-taken-with-respect-to-information-required-by-31-cfr-ss-800502-to-further-facilitate-cfius-review.

[3] See Treasury-CFIUS FAQ: https://home.treasury.gov/cfius-faq-item/international-affairs/does-cfius-require-information-on-all-foreign-persons-such-as-limited-partners-in-an-investment-fund-that-would-hold-an-interest-in-a-us-business-whether-directly-or-indirectly-as-part-of-a-transaction.

[4] See Treasury Nov. 26, 2024, Final Rule: https://www.federalregister.gov/documents/2024/11/26/2024-27310/penalty-provisions-provision-of-information-negotiation-of-mitigation-agreements-and-other.

[5] See Committee on Foreign Investment in the United States, Annual Report to Congress for Calendar Year 2025, available at https://www.cfius.gov.

[6] See Order Regarding the Acquisition of Certain Assets of EMCORE Corporation by HieFo Corporation, 91 Fed. Reg. 867 (Jan. 8, 2026), §§ 2(a), 2(g)(ii).

[7] See Order Regarding the Acquisition of Certain Assets of EMCORE Corporation, 91 Fed. Reg. 867 (Jan. 8, 2026), §§ 2(a), 2(g)(ii).