CFIUS Review for US Listings: National Security-Related Transactions for Foreign Issuers

The Biden administration’s August 2023 Executive Order on “Addressing United States Investments in Certain National Security Technologies and Products in Countries of Concern” (the “Outbound Investment Order”) has fundamentally altered the calculus for any non-US issuer contemplating a listing on the NYSE or NASDAQ. While the order directly targets outbound investment, its indirect effect—combined with an increasingly aggressive Committee on Foreign Investment in the United States (CFIUS)—has created a de facto pre-clearance regime for any foreign issuer with even tangential ties to China, Russia, or other designated countries. For Hong Kong-based sponsors and their clients, the practical consequence is clear: a US listing now requires a CFIUS strategy as a core workstream, not an afterthought, with the review timeline adding 6 to 12 months to the typical 18-month IPO process. The 2024 National Defense Authorization Act (NDAA) further expanded CFIUS’s mandate to include real estate transactions near sensitive military installations, but the core risk for issuers remains the agency’s ability to impose mitigation agreements—or block a transaction outright—under Section 721 of the Defense Production Act of 1950, as amended by the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA). This article dissects the mechanics of CFIUS review as it applies to US listings, the specific triggers for mandatory and voluntary filings, and the structural workarounds available to foreign issuers.

The CFIUS Jurisdictional Hook for US Listings

CFIUS’s jurisdiction over a US listing is not automatic; it hinges on whether the transaction results in a “foreign person” acquiring “control” of a US business, or whether it involves a “covered transaction” as defined under 31 C.F.R. Part 800. For an IPO, the critical distinction is between a primary offering of new shares and a secondary sale by existing shareholders. A primary offering by a foreign issuer on a US exchange does not, by itself, trigger CFIUS jurisdiction because the issuer is already foreign-controlled, and no change of control occurs. However, the moment a foreign issuer acquires a US target—or has a US subsidiary that holds sensitive data, operates critical infrastructure, or is involved in the defense industrial base—the listing becomes a vehicle for that US business to be sold to a foreign-controlled entity, which is squarely within CFIUS’s remit.

The “US Business” Determination

CFIUS defines a “US business” broadly under 31 C.F.R. § 800.252 as any entity engaged in interstate commerce in the United States. For a Cayman-incorporated holding company with a PRC operating subsidiary and a US-based R&D center, the US subsidiary is a “US business.” If the listing involves the issuance of shares that will be held by the public, including foreign investors, CFIUS may view the transaction as a transfer of control over that US business to a foreign person. The 2023 CFIUS Annual Report to Congress noted that the agency reviewed 286 notices in fiscal year 2022, of which 21% involved transactions from China alone, the highest of any single country. The report further indicated that 15% of all covered transactions involved the “critical technologies” sector, a category that includes semiconductor design, artificial intelligence, and quantum computing—areas where many US-listed Chinese issuers operate.

Mandatory Filing Triggers for Certain Sectors

Under FIRRMA, a mandatory filing is required for transactions where a foreign person acquires a “substantial interest” in a US business that (a) produces, designs, tests, or manufactures “critical technologies,” (b) owns or operates “critical infrastructure,” or (c) maintains or collects “sensitive personal data” of US citizens. The “substantial interest” threshold is defined as a direct or indirect voting interest of 25% or more, held by a foreign person that itself has a 49% or greater interest held by a foreign government. For a PRC state-owned enterprise (SOE) listing on NASDAQ, this triggers a mandatory filing if the SOE’s US subsidiary falls into any of the three categories. The penalty for failing to file is severe: under 31 C.F.R. § 800.901, the maximum civil penalty is USD 250,000 per violation, or the value of the transaction, whichever is greater, and the transaction can be unwound at any time.

The CFIUS Review Process: Timeline and Mechanics

The review process is bifurcated into a 45-day initial review period and, if necessary, a 45-day investigation period, for a total of 90 calendar days. For transactions deemed “covered” and requiring mitigation, the process can extend to 120 days or more. The clock starts when CFIUS accepts a formal notice, which is preceded by a mandatory or voluntary filing. In practice, the lead time for preparing a notice—including assembling the required documentation on corporate structure, ownership, and the US business’s activities—is 4 to 8 weeks.

The Voluntary Filing Path

For issuers not subject to a mandatory filing, a voluntary notice is strongly recommended when the transaction involves a “foreign person” from a country of concern, or when the US business operates in a sector where CFIUS has historically shown interest. The 2023 CFIUS Annual Report listed “information technology, services, and software” as the most common industry for covered transactions, accounting for 22% of all filings. A voluntary filing provides a “safe harbor” from future divestment or mitigation orders, provided the issuer makes full and accurate disclosure. Without a filing, CFIUS can initiate a review unilaterally at any time, including years after the IPO closes, under its “unilateral review” authority in 31 C.F.R. § 800.501.

Mitigation Agreements as a Condition of Clearance

If CFIUS identifies national security risks, it will negotiate a mitigation agreement with the issuer. Common terms include (a) the appointment of a US citizen as a security officer with veto power over certain board decisions, (b) restrictions on the transfer of intellectual property to foreign affiliates, (c) the establishment of a “sensitive data” firewall within the US subsidiary, and (d) periodic compliance audits by an independent third party. The 2023 CFIUS Annual Report disclosed that the agency imposed mitigation agreements in 21% of the transactions it reviewed, with the most common mitigation being “corporate governance measures” (54% of mitigated cases). For a Hong Kong-based issuer, the cost of compliance with a mitigation agreement can run to USD 500,000 to USD 2 million annually, including legal fees, audit costs, and IT infrastructure changes.

Structural Workarounds for Foreign Issuers

Given the complexity and cost of a full CFIUS review, several structural alternatives have emerged for issuers seeking to list in the US while minimizing CFIUS exposure. These are not loopholes—CFIUS has demonstrated its willingness to pierce corporate structures—but they can reduce the likelihood of a mandatory filing or a prolonged investigation.

The “US Business Lite” Structure

The most straightforward approach is to ensure that the listing entity does not own or control any US business that falls within CFIUS’s jurisdiction. This means carving out any US-based R&D operations, sales offices, or data centers into a separate, wholly-owned subsidiary that is not consolidated into the listing entity. The PRC issuer would then list only the non-US holding company, with the US subsidiary remaining under a different ownership structure. This approach requires careful legal separation: the US subsidiary must have independent management, separate financial records, and no cross-guarantees or shared IP licenses with the listed entity. The 2023 CFIUS Annual Report noted that 12% of reviewed transactions involved “ownership or control of a US business by a foreign person,” and in many of those cases, the issuer’s US operations were de minimis. A clean carve-out can reduce the probability of a CFIUS challenge significantly, though it does not eliminate the risk entirely.

The SPAC Route with a CFIUS Pre-Clearance Condition

For issuers pursuing a SPAC merger, the transaction structure is inherently more complex because the SPAC is a US-domiciled entity. Under FIRRMA, a SPAC merger with a foreign target is a “covered transaction” if the foreign target has a US business. However, the SPAC structure allows for a CFIUS pre-clearance condition to be built into the merger agreement. The SPAC sponsor can agree to terminate the merger if CFIUS clearance is not obtained within a specified period, typically 120 days. This is now standard practice for SPACs targeting Chinese companies: the 2023 merger of Digital World Acquisition Corp. (DWAC) with Trump Media & Technology Group was a domestic transaction, but the precedent for CFIUS conditions was set in the 2021-2022 wave of Chinese SPAC mergers, including the failed merger of Social Capital Hedosophia Holdings Corp. V with a Chinese EV maker. The key advantage of the SPAC route is that the CFIUS review is conducted pre-merger, not post-IPO, which avoids the risk of a post-listing divestment order.

The “Dual-Class” and “Golden Share” Mitigation

For issuers that cannot avoid CFIUS jurisdiction, a dual-class share structure with a government-designated “golden share” can be offered as a mitigation measure. Under this structure, the PRC government (or a designee) holds a special class of shares with veto power over board decisions related to national security, while the public holds ordinary shares with no such rights. This structure was used by several Chinese state-owned enterprises listed on the Hong Kong Stock Exchange (HKEX) in the 2010s, but its application to US listings is limited because CFIUS typically requires the golden share to be held by a US person, not a foreign government. The alternative is to appoint a US-based independent director with veto power over security-related matters, which is the most common mitigation measure imposed by CFIUS. The 2023 CFIUS Annual Report indicated that “corporate governance measures” were the most frequently imposed mitigation, appearing in 54% of mitigated cases, and these measures often include the appointment of a US security officer.

The Intersection with the Outbound Investment Order

The August 2023 Outbound Investment Order adds a parallel layer of scrutiny for US persons investing in Chinese companies, but its indirect effect on issuers is significant. The order requires US persons to notify the Treasury Department of investments in Chinese companies involved in semiconductors, AI, and quantum computing. For a Chinese issuer in these sectors, the presence of US venture capital or private equity investors in its cap table can trigger a notification requirement, which in turn alerts CFIUS to the transaction. The order does not require CFIUS clearance, but it creates a de facto information-sharing pipeline between the Treasury Department and CFIUS. The 2023 CFIUS Annual Report noted that the agency coordinated with the Treasury Department on 14% of its reviews, and this number is expected to increase as the Outbound Investment Order is implemented.

Practical Implications for Hong Kong Sponsors

For Hong Kong-based sponsors advising Chinese issuers on US listings, the key takeaway is that CFIUS review is no longer a niche concern limited to defense contractors. The 2023 CFIUS Annual Report identified “critical technologies” as the second most common sector for covered transactions, representing 15% of all filings, and “information technology, services, and software” as the most common at 22%. Any Chinese issuer with a US subsidiary, a US customer base, or US-based R&D should assume a voluntary filing is necessary. The cost of non-compliance—a potential unwinding of the IPO years after closing—far exceeds the upfront legal cost of a CFIUS notice, which typically ranges from USD 200,000 to USD 500,000 for a straightforward filing.

Actionable Takeaways

1. Conduct a CFIUS jurisdictional assessment at the start of the IPO planning process, not during the SEC review, to determine whether a mandatory or voluntary filing is required under 31 C.F.R. Part 800, and allocate a minimum of 6 months for the review.
2. For issuers in the “critical technologies” or “sensitive personal data” sectors, assume a mandatory filing is required if the issuer has a US subsidiary, and prepare the notice documentation concurrently with the F-1 registration statement.
3. If a mitigation agreement is likely, negotiate the terms—particularly the appointment of a US security officer and the scope of data firewalls—during the CFIUS review, not after clearance is granted, to avoid last-minute concessions.
4. For SPAC mergers, include a CFIUS pre-clearance condition in the business combination agreement, with a termination right if clearance is not obtained within 120 days, to protect the target from a post-merger divestment order.
5. Monitor the implementation of the August 2023 Outbound Investment Order, as it will create additional disclosure obligations for US investors in Chinese issuers, which may trigger CFIUS reviews indirectly through Treasury-CFIUS information sharing.