By: Margaret M. Cassidy & Andrew Swick
In February 2026, the Department of Justice did something unprecedented in the nearly four decades since Congress created the modern foreign‑investment review system: it went to court to force a foreign company to sell a U.S. business. The target was Suirui International, a Hong Kong–based subsidiary of a Chinese firm that had quietly acquired Jupiter Systems, a California company whose video‑display technology was embedded in U.S. military command centers and critical infrastructure. Suirui never notified the Committee on Foreign Investment in the United States (CFIUS) when it bought Jupiter in 2020, which left the deal permanently vulnerable. Years later, CFIUS initiated its own review, the President ordered divestiture, Suirui refused, and on June 2, a federal court placed Jupiter into receivership as litigation proceeds.
For companies operating in the defense, critical‑infrastructure, or advanced‑technology sectors, the message is direct: CFIUS is no longer a theoretical risk. The government has now demonstrated it will pursue receivership rather than allow a foreign‑linked company to access advanced technology or critical infrastructure through investment, if it is a risk to U.S. national security. Understanding how CFIUS works, and when it reaches transactions, is now a core element of due diligence when considering foreign investment, acquisition by a foreign entity or merging with a foreign entity.
What CFIUS Is
CFIUS is an interagency committee, chaired by the Secretary of the Treasury, that reviews certain foreign investments in the United States to assess national security risk. The Department of Treasury maintains a useful overview of the committee and runs the Case Management System through which filings are submitted.
Other members include the Departments of Justice, Commerce, Defense, State, Homeland Security, and Energy, along with the Office of the U.S. Trade Representative and the Office of Science & Technology Policy. Other agencies along with White House bodies such as the National Security Council may also participate, and the Director of National Intelligence provides a threat assessment for each review.
It is a Security Screen, not a Barrier to Investment
Despite the Jupiter case, CFIUS is not designed to block foreign capital. Its sole mission is to protect national security, and the U.S. government continues to emphasize that foreign investment is welcome. For most transactions, CFIUS is a review to clear, not an obstacle to overcome.
Where the Authority Comes From
Presidential authority to suspend or prohibit foreign investment that threatens national security rests on executive orders, statutes, and regulations dating back to 1975. The cornerstone is Section 721 of the Defense Production Act, implemented through CFIUS regulations. The most consequential update came with the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA), which expanded jurisdiction—especially over certain noncontrolling investments and real-estate transactions, and strengthened enforcement tools. The Jupiter litigation is the first major test of how far those tools reach.
The Type of Deals CFIUS Cares About
Three types of transactions should put foreign investment on the radar of defense contractors:
- Control transactions: Any deal that could give a foreign person control of a U.S. business. “Control” is defined broadly in the regulations and can be triggered even by some minority stakes.
- TID businesses: Investments, including non‑controlling ones, in U.S. businesses involved in critical Technology, critical Infrastructure, or sensitive personal Data of U.S. persons. What matters is access and influence: board rights, observer seats, access to material non‑public technical information, or involvement in substantive decisions. Jupiter is the cautionary example—few would label it a defense company, yet its integration into military and infrastructure systems placed it squarely in TID territory.
- Covered real estate: Transactions involving property in or around certain properties that are important to national security: airports, maritime ports, and military installations.
Disclosing an Investment to CFIUS Can Be Mandatory or Voluntary
Many types of foreign investments require a voluntary filing with CFIUS. But “voluntary” is misleading. As Suirui learned, CFIUS can review and unwind a deal after closing, with no statute of limitations. A foreign company that acquires a U.S. business and never files remains exposed indefinitely. CFIUS review and approval of a transaction is the only way to eliminate that risk.
Filing is mandatory in two situations:
- When the deal involves a TID business with critical technologies controlled under U.S. export rules.
- When a foreign government acquires a “substantial interest” in a TID business.
Limited exemptions exist for certain passive investments and for transactions involving close U.S. allies.
How the Review Works
Parties typically file jointly through Treasury’s online system, choosing one of two paths:
- Declaration: A short‑form filing. CFIUS has 30 days to clear the deal, request full notice, or end review without formal clearance. Ending review without clearance does not provide a safe harbor.
- Notice: A detailed filing. Once accepted as complete, CFIUS has 45 days to review, may open a further 45‑day investigation, and—if needed—has 15 days for presidential review. This is the path if failing to follow that may lead to divestiture orders like the one in Jupiter.
Timing matters. “Day 1” begins only when Treasury accepts the filing as complete. Follow‑up questions or missing information can delay acceptance of the filing, so build buffer into deal timelines. In fact, this back and forth between a business and CFIUS can take weeks or even months before CFIUS is satisfied it has the information it needs.
CFIUS Is Rarely the Only Review
A CFIUS filing does not satisfy other regulatory obligations. Contractors with export controlled (ITAR, EAR) items need to separately notify the Department of Commerce’s Bureau of Industry and Security (“BIS”) regarding EAR items or the Department of States’ Directorate of Defense Trade Controls for ITAR items. Contractors may have requirements to make disclosures in SAM or to their contracting team. Defense contractors holding classified contracts will have to obtain Defense Counterintelligence Security Agency review and approval. CFIUS does not coordinate these reviews. These reviews can take longer than CFIUS. Map all of them early.
Mitigation: The Middle Path
CFIUS often approves deals subject to conditions rather than blocking them outright. Mitigation can limit foreign control or restrict access to critical technology. Treasury’s Office of CFIUS Monitoring and Enforcement oversees compliance, and other agencies may layer on export licenses or additional controls. In Jupiter, CFIUS concluded the risks could not be mitigated short of a full unwind, a reminder that mitigation is available only when conditions can genuinely neutralize the risk.
Confidentiality
CFIUS filings are confidential. The committee will not confirm that a transaction has been submitted, and filings are exempt from FOIA. Only if the parties disclose the filing may CFIUS comment publicly.
The Stakes
The penalties are significant. The President can suspend, prohibit, or unwind a covered transaction. Civil penalties reach $250,000 per violation for material misstatements or omissions. Violating a mitigation agreement can cost $250,000 per violation or the value of the transaction, whichever is greater, and mitigation agreements may include liquidated or actual damages on top of civil penalties.
The Bottom Line
For U.S. businesses and contractors seeking foreign investment, merger with foreign entities or to be acquired by a foreign entity, two realities are now clear. Failing to voluntarily notify CFIUS of a transaction involving sensitive technology is a gamble with no expiration date. And noncompliance with a presidential divestiture order is no longer a viable strategy; the government has shown it will go to court and seek receivership to enforce one.
For businesses that build technology essential to national security, operates critical infrastructure, or holds sensitive data on U.S. citizens, assume CFIUS is relevant to any deal involving a foreign investor; and treat the filing decision as a board‑level question. The companies that fare best are those that map their CFIUS, export‑control, federal government contracting and NISPOM disclosure obligations before signing, not after a court order lands.
