CFIUS review now reaches minority stakes in tech startups

The record

The Committee on Foreign Investment in the United States, known as CFIUS, reviews transactions by foreign persons for effects on national security under authority the Committee's own site traces to a statute amended repeatedly since 1988. The Foreign Investment Risk Review Modernization Act, FIRRMA, was enacted on 13 August 2018, according to the laws and guidance page, and extended the Committee's jurisdiction beyond transactions giving a foreign person control of a US business to certain non-controlling, or minority, investments in businesses that work with critical technology, critical infrastructure or sensitive personal data, referred to as TID businesses. Implementing regulations at 31 CFR Part 800 became effective 13 February 2020, and a further rule that October added mandatory declaration requirements for some critical-technology transactions.

What the sources establish

The Committee's own FAQ page states that a mandatory declaration is required for covered transactions involving a US business that produces, designs, tests, manufactures, fabricates or develops one or more critical technologies, and that filers must identify each such technology by its Export Control Classification Number. The same page notes CFIUS may request information about governance and other contractual rights an investor holds, which is how a minority stake without majority ownership can still fall within the Committee's jurisdiction: a non-controlling investment can trigger review if it grants the investor access to material nonpublic technical information, board or observer rights, or involvement in substantive decision-making about the TID business.

Scope and revision

Not every foreign check written to a startup is a covered transaction, and not every covered transaction requires a mandatory filing; the mandatory declaration requirement is specifically tied to critical-technology TID businesses, while other covered transactions may be filed voluntarily or reviewed if CFIUS learns of them independently. The distinction between a full notice and a short-form declaration also matters for timeline: a declaration is a narrower filing that can lead the Committee either to clear a deal quickly or to request a full notice. None of the cited pages state a percentage ownership threshold comparable to a bright-line test; the standard is fact-specific to control and access rather than a fixed stake size.

The decision in front of you

A founder taking money from a non-US investor should, as an editorial checklist beyond the cited pages, identify whether the company's technology, data handling or infrastructure role could make it a TID business, whether the specific investor is receiving governance or information rights beyond a passive stake, and whether the technology involved carries an Export Control Classification Number, since any of those facts can turn an ordinary minority round into a filing obligation.

• Does the company's product or data handling put it within the TID business categories the regulations define?
• Does the investor's side letter or board seat grant rights beyond a passive financial stake?
• Has counsel confirmed whether a mandatory declaration, rather than a voluntary notice, applies to this specific technology?

CFIUS jurisdiction over venture rounds turns on facts the term sheet does not always surface on its own, which is why the statute and the implementing rules, not the round's headline size, are the operative texts.