Let’s clear up the first bit of alphabet soup: when most people say “Foreign Investment Committee” in the U.S. context, they’re usually talking about CFIUSthe Committee on Foreign Investment in the United States. CFIUS is the interagency group that reviews certain foreign investments for national security risk. It’s not a court. It’s not a regulator with a daily “you must file” rule for every deal. But it can absolutely ruin your week (and sometimes your transaction) if you treat it like a box-checking exercise.

Each year, Treasury publishes a public version of CFIUS’s Annual Report to Congress. The 2024 Annual Report (covering calendar year 2024) is a rare window into a process that’s usually confidential. Think of it like peeking behind the curtainexcept the curtain is made of national security and the bouncer has a subpoena.

Below are the most important takeaways from the 2024 report, translated from government-statistics-ese into plain English, with practical examples, strategy notes, and a few reality checks for deal teams.

1) The headline number: CFIUS reviewed 325 covered transactions in 2024

The report shows 325 total covered transactions reviewed or assessed in 2024. That total includes:

• 209 notices (the “full” filingmore detailed, more time, more commitment), and
• 116 declarations (the shorter filingoften faster, sometimes riskier if it bounces you into a full notice).

Why it matters: this split is the best snapshot of how the market is using the two main pathways. If you’re planning a deal timeline, budgeting legal fees, or deciding whether to voluntarily file, these are the tracks you’re choosing between.

2) Declarations stabilizedand they’re getting “cleared” more often

Declarations are designed to be a lighter-touch submission. In 2024, CFIUS handled 116 declarations. Outcomes mattered as much as the count:

• 91 declarations resulted in CFIUS concluding action (i.e., “cleared” or otherwise finished without needing a full notice).
• 17 declarations resulted in a request to file a notice.
• 7 declarations ended with CFIUS unable to conclude action.

Practical takeaway: declarations can be a strong option for lower-risk dealsespecially when the investor profile is straightforward and the U.S. business doesn’t sit on sensitive data, defense adjacency, or critical technology. But “lower-risk” doesn’t mean “no-risk.” If CFIUS asks for a notice, you’ve traded speed for a second lap of paperwork.

Timeline tip

The report’s timeline metrics underline why teams like declarations: in 2024, the median assessment time was essentially the full assessment window. Translation: don’t plan on a 10-day miracle. Plan for the process you’re actually going to get.

3) Notices still dominate the hard casesand more than half went to investigation

Notices are where the “serious” CFIUS work happens. In 2024, CFIUS accepted 209 notices. Of those, 116 proceeded to the second-stage investigation phaseroughly more than half.

Investigation isn’t automatically a red flag. It often means the agencies want more time to coordinate, pressure-test mitigation, or confirm facts (especially in complex ownership structures or sensitive sectors). Still, if your business team thinks “CFIUS review” is a tidy 30-day speed bump, the investigation rate is your polite reminder that CFIUS does not share your optimism.

Withdrawals are part of the system (and sometimes part of the strategy)

The report notes 49 notices were withdrawn in 2024, and many were refiled. Withdraw-and-refile is often a pressure valve: the parties need time to negotiate mitigation, correct the record, or adjust the transaction to resolve security concerns.

4) Presidential decisions happened twice in 2024 (rare, but not extinct)

The annual report shows two presidential decisions for transactions where CFIUS initiated a review in 2024. That’s unusual historicallyand it’s the clearest possible signal that the “top of the escalation ladder” is still in play.

One practical implication: if you’re in a deal where CFIUS believes risks can’t be mitigated, the endgame isn’t always “we’ll just abandon quietly.” Sometimes the outcome is public, formal, and painfully final.

5) The sector mix: finance/info/services and manufacturing remain the big buckets

For non-real-estate notices (a large slice of the data), the report shows filings concentrated in a few major sectors. In 2024, non-real-estate notices were heavily weighted toward:

• Finance, Information, and Services (over half of those notices), and
• Manufacturing (about a third).

Within those buckets, subsectors that tend to appear include professional/scientific/technical services, certain publishing and telecom-adjacent areas, and manufacturing niches like electronics and machinery. If your deal touches sensitive data, advanced manufacturing, semiconductors, aerospace/defense supply chains, or critical infrastructure, you’re swimming in the deep end of the CFIUS pool.

A concrete example of how this plays out

Imagine a foreign investor buying a U.S. company that provides specialized engineering services to critical infrastructure operators, or a manufacturer whose components end up in defense-adjacent systems. Even if the target looks “commercial,” the downstream customers and technical capabilities can turn the deal into a national security conversation.

6) Investor country patterns: China is prominent, but allies are very active too

The report’s country data often surprises casual readers. Yes, China-linked deals are prominent in the numbers. But several allied or partner countries also appear frequentlybecause they invest heavily in the U.S., full stop.

In 2024, the report lists top notice counts that include China as a leading source by notice volume, with France and Japan also near the top, and other major investor jurisdictions appearing as well. For declarations, the report shows Japan leading in 2024, with Canada also high on the list.

The takeaway isn’t “allies get a free pass.” It’s “country is only one variable.” Ownership complexity, governance rights, access to sensitive data, critical technology, proximity to military facilities, and supply chain importance can matter just as muchor more.

7) Mitigation was usedbut at a relatively modest share of notices

Mitigation is where CFIUS says, “We can live with this, but only if you do these specific things forever (or at least for a very long time).”

In 2024, CFIUS adopted mitigation measures and conditions for 25 notices (about 12% of notices). The report indicates that 16 notices were cleared after entering into mitigation agreements (about 9% of notices).

What mitigation looks like in real life

The report describes a menu of mitigation tools. In plain terms, these commonly include:

• Restricting access to sensitive technology, systems, facilities, or information to authorized persons only.
• Network segregation and tighter data governance (where data sits, who touches it, and how it’s audited).
• Limits on transferring IP, trade secrets, or technical data to certain foreign persons or locations.
• Corporate governance controls (e.g., security committees, board observers, or other mechanisms to limit foreign influence).
• Third-party monitors/auditors, reporting obligations, and “show us your homework” compliance plans.

Strategy note: mitigation is not “a document you sign at closing.” It’s an operating model change. If your integration plan assumes free-flowing global access to systems and people, mitigation can force a redesign.

8) Enforcement is not a slogan anymore: penalties, site visits, and public examples

If you remember only one theme from the 2024 annual report, make it this: CFIUS wants compliance to be boring, continuous, and provable. And if it isn’t, enforcement follows.

The report states that by the end of 2024, CFIUS was monitoring 242 mitigation agreements and conditions. In 2024, monitoring agencies conducted 79 site visitsincluding interviews, record inspections, and verification of access controls.

On penalties, the report describes five assessed penalties in 2024:

• Four penalties for breaches of material provisions in mitigation agreements, and
• One penalty for submitting a notice and supplemental information containing material misstatements.

The $60 million cautionary tale (and why naming names matters)

Separate public announcements around the same period highlight the enforcement direction. In August 2024, Treasury publicized the CFIUS enforcement posture and referenced the largest penalty it had issued, widely reported as a $60 million penalty involving alleged violations of a national security agreement. The point for deal teams: post-closing compliance isn’t optional, and “we had a technical issue” is not a magic spell.

If your company is subject to mitigation, treat it like regulated compliance: training, incident response, documentation, internal audits, and executive attention. The annual report makes clear that CFIUS monitoring agencies are doing the work to verify, not just to request promises.

9) Non-notified deals: CFIUS is looking, even if you don’t file

The non-notified trend is one of the most practical (and anxiety-inducing) parts of the report. CFIUS uses interagency referrals, public tips, media reporting, commercial databases, classified information, and voluntary disclosures to identify transactions that may have been “missed.”

In 2024, the report says CFIUS preliminarily considered thousands of potential non-notified transactions, investigated 98 further to determine whether to open official inquiries, formally opened 76 inquiries, and requested a filing for 12 non-notified transactions. It also notes instances where parties filed after outreach, before a formal request landed.

Practical implication

“We didn’t file, so we’re fine” is no longer a strategyif it ever was. The better approach is early risk triage:

• Is the U.S. business a “TID U.S. business” (technology, infrastructure, or sensitive personal data)?
• Does the investor get governance rights beyond a passive stake?
• Are there critical tech or export-control touchpoints?
• Is real estate involved near sensitive sites?

If those answers lean “yes,” you want to decide on filing proactivelynot by surprise outreach after closing.

10) Real estate is a bigger part of the CFIUS storyespecially near military sites

The annual report includes real estate notices and describes a presidential order in 2024 that prohibited a purchase and required divestment of certain real estate. That is a flashing neon sign for anyone thinking land deals are “outside CFIUS.”

Add in Treasury’s rulemaking activity around expanding real estate jurisdiction and updating the list of covered sites, and the direction is clear: proximity matters, and the government is updating the map.

Example: when “it’s just land” isn’t just land

A transaction involving foreign ownership of property near a sensitive installation can raise surveillance, signals intelligence, or operational-security concerns, even if the buyer’s stated purpose is commercial or agricultural. In practice, that means diligence must include location-based screening and understanding the covered real estate rulesnot just the corporate structure.

11) Timelines: the report’s numbers should shape your deal calendar

The report provides useful timing metrics, including averages and medians for completing reviews, investigations, and declaration assessments. The broad lesson: build a realistic calendar and assume complexity can push you into longer phases.

A practical planning approach looks like this:

• Declaration path: faster on paper, but still requires full internal coordination and can lead to a notice request.
• Notice path: heavier lift, but often the more predictable route for higher-risk transactions because you’re committing to the full process up front.
• Mitigation path: can reshape closing conditions, integration, IT architecture, governance, and hiring plans.

12) A deal-team playbook: how to use these takeaways immediately

Start with a CFIUS risk snapshot (before signing, not after)

• Map foreign ownership and control (including minority rights, board seats, observer rights, vetoes, and access to technical information).
• Classify the U.S. business: critical tech, critical infrastructure, sensitive data, government contracts, defense proximity, and supply chain relevance.
• Screen for real estate proximity issues when facilities, land, or ports are part of the deal.

Choose the filing route strategically

• Use declarations when the risk profile is genuinely lower and the investor story is clean.
• Prefer notices when you anticipate questions about technology, data, supply chain, or governance rightsor when a mandatory filing may apply.
• Don’t treat “we hope they’ll clear it quickly” as a strategy. Hope is not a filing basis.

Budget for compliance like it’s part of the purchase price

• If mitigation is possible, plan for training, audits, access controls, and ongoing reporting.
• Assume there may be monitoring, including site visits, and make “audit-ready” an operating principle.
• Prepare for incident reporting and internal escalation so you’re not improvising during a breach.

Remember the non-notified reality

• If you skip filing on a transaction with obvious risk factors, you may still end up interacting with CFIUSjust later, with fewer options.
• Document your decision-making process. If you didn’t file, you should be able to explain why you believed it wasn’t required or advisable.

What these trends suggest going forward

The 2024 annual report reads like an agency that is professionalizing and scaling: more targeted non-notified detection, more hands-on monitoring (including site visits), and a willingness to make enforcement public. Combined with rule updates and transparency initiatives, the direction is toward a system that expects sophisticated parties to act like sophisticated partiesmeaning: do the diligence, tell the truth, and comply after closing.

If you’re a dealmaker, the lesson is simple (and annoying in the way true things often are): treat CFIUS as a core workstream, not a closing footnote. If you’re a corporate leader, the lesson is even simpler: if you sign mitigation, your operations team just got a permanent new roommate.

Field Notes: of Real-World “CFIUS Experience” (Without the War Stories That Break Confidentiality)

Anyone who has been through a serious CFIUS process will tell you there are two parallel timelines: the official one, and the one happening inside your deal team’s group chat. Officially, the calendar is reviews, investigations, and assessments. Unofficially, the calendar is “the day we realized our org chart doesn’t match reality,” “the week we learned what a data map actually is,” and “the moment IT said, ‘Sure, we can segregate networks,’ and everyone else said, ‘You can do WHAT by WHEN?’”

A common experience starts early: someone asks, “Do we have to file with CFIUS?” and the room divides into optimists (“Probably not”), pragmatists (“Let’s assess it”), and the one person who has read the rules (“Please stop saying ‘probably’”). The assessment phase often feels like forensic accounting meets corporate genealogy. You’re tracing beneficial ownership, governance rights, board influence, and side agreements that were “totally standard” until CFIUS asks about them.

If you file a declaration, the experience is frequently a lesson in disciplined storytelling. Declarations reward clarity: who the investor is, what rights they get, what the U.S. business does, and why the deal doesn’t create national security risk. The best declaration packages read like they were written by someone who respects the reader’s timebecause they were. The worst read like someone tried to hide the ball, which is a great way to earn a notice request.

A notice filing, by contrast, is a project management event. It’s not just legal drafting; it’s coordination across finance, security, HR, IT, engineering, and sometimes government contracting teams. One of the most common “CFIUS experiences” is discovering that the target’s most sensitive assets aren’t the ones highlighted in the pitch deck. The sensitive assets are the unglamorous parts: a customer list tied to critical infrastructure, a dataset with regulated personal identifiers, a niche component used in defense supply chains, or a facility sitting uncomfortably close to a sensitive site.

If mitigation enters the picture, the experience shifts from “can we close?” to “how will we operate?” Teams often learn that mitigation is an operating model, not a promise. You may need a corporate security committee, new access controls, limitations on foreign national access, independent audits, and incident reporting procedures that actually work. The companies that succeed tend to treat mitigation like compliance in a regulated industry: they assign owners, build training, test controls, document exceptions, and keep leadership involved. The companies that struggle tend to treat mitigation like paperworkuntil a site visit or a compliance question arrives and the paperwork doesn’t match reality.

The most valuable “experience-based” lesson is psychological: CFIUS is not impressed by confidence; it is impressed by controls. You don’t win by saying “trust us.” You win by showing that you’ve mapped the risk, built guardrails, and can prove those guardrails workon ordinary Tuesdays, not just on the day your lawyers are watching.