For years, many corporate compliance professionals saw the Committee on Foreign Investment in the United States (CFIUS) as primarily a concern for mergers-and-acquisitions attorneys. When a foreign investor sought to acquire a U.S. business, the legal team evaluated potential national security concerns, determined whether to file, and navigated the regulatory review process. Once the transaction closed, the matter often moved off the compliance radar. That approach is increasingly difficult to defend.
The recently released 2025 CFIUS Annual Report to Congress shows that foreign investment oversight has evolved into a sophisticated regulatory regime that includes transaction screening, national security investigations, mitigation agreements, ongoing compliance monitoring, and enforcement. In an analysis by Thaddeus McBride and Faith Dibble, CFIUS Annual Report Reveals Enforcement Trends highlights several developments that should command the attention of Chief Compliance Officers (CCOs), General Counsel, and corporate boards.
The key takeaway is that CFIUS compliance must become part of an organization’s broader enterprise risk management and internal controls framework. For compliance professionals, this creates both new responsibilities and opportunities to demonstrate the strategic value of an effective compliance program.
CFIUS Activity Remains High, and Scrutiny Is Intensifying
The numbers tell an important story. During 2025, CFIUS reviewed or assessed 347 covered transactions through written notices and declarations. Overall filing volume increased about 7 percent from 2024, driven primarily by a 21 percent increase in declarations.
Written notices remained relatively stable, declining approximately 1 percent. At first glance, the growing popularity of declarations might suggest that companies are finding more efficient ways to navigate the CFIUS process. However, the underlying statistics tell a more complicated story.
In 2024, approximately 78 percent of declarations resulted in CFIUS concluding action. That figure declined to approximately 66 percent in 2025. Meanwhile, the percentage of declarations resulting in requests for full written notices increased from 15 percent to 26 percent. This is significant. A declaration provides an abbreviated review process, generally involving a 30-day assessment. A full written notice involves an initial 45-day review, potentially followed by an additional 45-day investigation. For companies pursuing cross-border acquisitions, these timelines create substantial transaction uncertainty.
The compliance lesson: CFIUS risk assessment must occur during the earliest stages of transaction planning, not after the parties have negotiated their principal commercial terms.
CCOs should work closely with legal, corporate development, finance, and business leadership to ensure national security considerations are integrated into acquisition due diligence. The objective is not simply to determine whether a filing is required. It is to understand how regulatory risk may affect transaction structure, timing, valuation, and post-acquisition operations.
National Security Risk Extends Beyond Traditional Defense Industries
Another important finding concerns the industries attracting CFIUS attention. In 2025, finance, information, and services accounted for about 49.5 percent of non-real estate notices, while manufacturing accounted for another 39.5 percent. Together, these sectors accounted for nearly 90 percent of notices.
This demonstrates that CFIUS scrutiny extends well beyond traditional defense contractors and aerospace manufacturers. Companies in financial services, technology, telecommunications, data analytics, advanced manufacturing, and other commercial industries may hold assets that raise national security concerns.
Those assets may include sensitive personal information, proprietary technology, critical infrastructure, government contracts, or supply chain capabilities. Consider a foreign investor acquiring a U.S. technology company whose principal business involves collecting and analyzing consumer data.
The transaction may appear commercially straightforward. However, access to sensitive personal information, cybersecurity systems, or technology infrastructure could introduce significant national security considerations.
For CCOs, this means traditional anti-corruption and sanctions diligence is no longer sufficient when evaluating cross-border investments. A comprehensive assessment should examine beneficial ownership, sensitive technology, cybersecurity, data access, export controls, government relationships, and supply chain dependencies.
This is where compliance can provide real business value. By identifying these risks early, compliance professionals can help leadership make informed investment decisions before the organization commits substantial financial and operational resources.
Mitigation Agreements Are Continuing Compliance Obligations
Perhaps the most consequential findings for compliance professionals concern mitigation and enforcement. During 2025, CFIUS imposed mitigation measures and conditions in approximately 12 percent of transactions. At year-end, the committee monitored 234 mitigation agreements and conditions and conducted 40 compliance site visits.
These figures show that CFIUS oversight often continues long after a transaction closes. A mitigation agreement is not simply a legal document negotiated to obtain regulatory approval.
It establishes operational obligations that may require continuing monitoring, reporting, restrictions on access to information or technology, and other safeguards. Failure to implement those obligations effectively can create significant compliance and enforcement exposure.
This should sound familiar to anyone who has followed the Department of Justice’s approach to corporate compliance. Although CFIUS operates under a distinct legal framework, the underlying compliance principles mirror those in the DOJ’s Evaluation of Corporate Compliance Programs.
The compliance lesson: Every CFIUS mitigation agreement should be translated into an operational compliance framework with clearly assigned responsibilities. That framework should include documented procedures, employee training, testing, escalation protocols, and periodic management reporting. Internal audit should evaluate whether the organization is meeting its obligations.
The board or an appropriate board committee should receive meaningful information about significant mitigation requirements and compliance performance. The objective is to show not merely that the company agreed to certain restrictions, but that those restrictions work in practice.
Non-Notified Transactions Are Becoming an Enforcement Priority
During 2025, the committee investigated 90 potential non-notified transactions, opened 62 formal inquiries, and requested filings in nine cases. Two additional transactions were voluntarily submitted before CFIUS issued formal filing requests. These statistics show that CFIUS does not rely exclusively on companies to identify and report potentially covered transactions.
The committee obtains information through government agencies, congressional notifications, media reports, commercial databases, public tips, classified information, and voluntary disclosures. This has profound implications for corporate compliance.
Historically, some organizations may have viewed not filing as the conclusion of their CFIUS analysis. That assumption is increasingly risky. CFIUS can examine completed transactions and require parties to address national security concerns after closing. In certain circumstances, those concerns may result in mitigation obligations or divestiture.
The 2025 report identified seven transactions that parties abandoned after CFIUS could not identify acceptable mitigation or the parties declined proposed mitigation measures. Two matters also resulted in presidential orders prohibiting acquisitions or requiring divestment. For boards and senior executives, the implications are substantial.
The compliance lesson: Organizations should establish a documented process to evaluate CFIUS jurisdiction and filing obligations for relevant acquisitions and investments. Where management determines that a voluntary filing is unnecessary, the decision should be supported by a documented risk assessment. This documentation should explain the transaction’s ownership structure, relevant national security considerations, and rationale for the filing decision. A defensible decision-making process is essential to effective compliance governance.
Voluntary Self-Disclosure Must Be Part of the Compliance Conversation
The annual report also highlights CFIUS’s continued attention to voluntary self-disclosures involving potential mandatory-filing failures and violations of mitigation obligations. Importantly, the report notes that many instances of noncompliance do not result in penalties. This should not be interpreted as regulatory indifference. Rather, it reinforces the importance of identifying potential violations, investigating them promptly, and considering appropriate disclosure and remediation.
For compliance professionals familiar with the DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy, the broader principle is recognizable. Regulators place significant importance on how organizations respond when problems are discovered. However, CFIUS disclosure and enforcement procedures are distinct from DOJ criminal enforcement policies. Companies should not assume that DOJ disclosure incentives automatically apply to CFIUS matters.
The appropriate response starts with a credible internal process to identify and escalate concerns. Employees responsible for implementing mitigation agreements must understand their obligations and know how to report potential violations. Compliance teams should establish procedures to investigate concerns, preserve relevant evidence, determine root causes, and evaluate corrective action. Where a potential violation is identified, legal and compliance leadership should assess whether voluntary disclosure is appropriate under the applicable CFIUS framework.
What CCOs Should Do Now
The 2025 annual report provides a practical roadmap for strengthening foreign investment compliance.
- Incorporate CFIUS considerations into the enterprise risk assessment. Identify business activities, investment structures, and assets that may create national security exposure.
- Integrate CFIUS screening into transaction approval procedures. Require appropriate legal and compliance review before significant cross-border investments advance.
- Strengthen third-party and beneficial ownership diligence. Understanding who ultimately owns or controls an investor can be essential to identifying regulatory concerns.
- Establish ongoing monitoring for mitigation agreements. Assign control owners, set performance expectations, test periodically, and document remediation.
- Develop escalation and investigation procedures for potential violations. Ensure employees understand how to report concerns and management understands when disclosure decisions must be considered.
- Provide the board with meaningful reporting on material CFIUS risks, significant mitigation obligations, and emerging regulatory developments.
Conclusion: CFIUS Compliance Is a Lifecycle Responsibility
The 2025 CFIUS Annual Report reveals an enforcement environment characterized by sustained transaction activity, increased scrutiny of abbreviated filings, continuing mitigation oversight, and growing attention to transactions that were never submitted for review.
The fundamental lesson is straightforward. CFIUS risk begins before a transaction is signed and may continue long after the transaction closes. For CCOs, the challenge is to ensure that foreign investment compliance is integrated into governance, risk management, internal controls, and organizational accountability.
The companies best positioned to manage this environment will be those that identify national security risks early, make informed filing decisions, operationalize mitigation commitments, and continuously evaluate compliance effectiveness. CFIUS should no longer be viewed solely as a transaction approval process.
It is an ongoing compliance obligation that requires the same discipline, oversight, and commitment to continuous improvement expected of any effective corporate compliance program.
