CFIUS, “reverse CFIUS”, ITAR, EAR, and FOCI are acronyms you will encounter in cross-border deals. They govern different product and investment capital flows, in different directions, decided by different agencies. Here is how to tell them apart and how to recognize when one applies to you.
Most business owners meet these rules in similar ways: a term sheet arrives from an overseas investor, a potential foreign customer asks for a quote, or a prime contractor asks whether anyone in the ownership chain is a foreign national. The instinct is to treat these acronyms as one undifferentiated compliance problem that somebody else will handle. Those instincts can cause trouble, because the regimes are different and only some of them forgive late notices.
Fortunately, telling them apart requires answering just one query…
The Organizing Question: What is Flowing, and Which Way?
Each of these regimes can be placed in its appropriate rules set by asking what crosses a border, and which way.
- Money Flowing In. A foreign person (or company) invests in or acquires a U.S. business – that is Committee on Foreign Investment in the U.S. (CFIUS).
- Money Flowing Out. A U.S. person (or company) invests in certain technology companies in foreign countries of concern – that is the outbound investment program, informally referred to as “reverse CFIUS.”
- Products and Know-How Flowing Out. You send – or explain – some critical technical information to a foreign person, anywhere, including inside your own building. That is International Traffic in Arms Regulations (ITAR) or Export Administration Regulations (EAR).
- Classified Access with Foreign Ownership Present. Your company needs a security clearance and a foreign party owns, controls, or influences it. That is Foreign Ownership, Control, or Influence (FOCI).
Hold onto that broad framing while the rest of the discussion fills in the details.
CFIUS: Foreign Money Coming In
CFIUS is an interagency body chaired by the Treasury Department, with Defense, State, Commerce, and Justice at the table. It reviews foreign investment in U.S. businesses for national security risk, and its ultimate authority runs to the president, who can block a deal or order it unwound.
Two doors lead to a CFIUS filing seeking approval. The first is control: any foreign acquisition of majority control of a U.S. business is covered, whatever the business does. The second catches minority investments – but only in a “TID” business, meaning one involved with critical technology, covered critical infrastructure (not all infrastructure), or sensitive personal data, where the foreign investor also gets rights such as a board seat or access to nonpublic technical information.
The most common misunderstanding is that being covered means you must file a CFIUS disclosure. It does not. Filing is mandatory in only two situations:
- Where the U.S. business produces critical technology that would require a U.S. export authorization to release to the foreign investor, or
- Where a foreign government (via the foreign investor) holds a substantial interest in the acquirer.
Otherwise, a CFIUS filing is voluntary. In the voluntary filing case, it is a risk decision for the company, not a compliance obligation.
A voluntary filing provides a safe harbor; not filing leaves the transaction open to review indefinitely. There is no statute of limitations on a non-notified transaction, and the discovery may come at the worst moment – during diligence on your exit or when a buyer’s counsel finds an unfiled foreign acquisition in your history.
Reverse CFIUS: American Money Going Out
The outbound investment security program is the newest of these regimes and the least understood. Administered by Treasury, it restricts U.S. persons from making certain investments into companies in countries of concern – currently China, Hong Kong, and Macau – in three sectors: semiconductors and microelectronics, quantum information technologies, and artificial intelligence.
Unlike CFIUS, there is no committee, no application, and no approval process. Transactions are either prohibited outright or permitted but notifiable to the Treasury after closing. You do not ask permission – you either cannot do the deal (prohibited outright), or you do it and report it. The regime is self-executing, which puts the entire burden of getting the analysis right on the investor before money moves.
Venture and private equity investors are the obvious audience, but fund investments, joint ventures, and greenfield projects can all be caught – and the diligence obligation sits with the U.S. person making the investment.
ITAR and the EAR: Things and Knowledge Going Out
These are the export control regimes; twins rather than alternatives. A defense (ITAR) or dual use (EAR) item falls under one or the other, not both.
ITAR is administered by the State Department’s Directorate of Defense Trade Controls (DDTC) and governs defense articles, their underlying technical data, and defense services, all enumerated on the U.S. Munitions List. If you manufacture or export anything on that list, you must register before doing business, and individual transactions require licenses on top of registration.
The EAR is administered by the Commerce Department’s Bureau of Industry and Security (BIS) and covers dual-use items with both civil and military applications. Items are classified on the Commerce Control List, and whether you need a license depends on four things: what the item is (not all items are controlled), where it is going, who receives it, and what they will do with it.
The single most important thing to learn about export control is that an export does not require a border crossing. Releasing controlled technology to a foreign person – an employee, a contractor, a visiting engineer – is considered an export to that person’s home country even if it happens in a conference room in Ohio. This is the deemed export rule, and it is where otherwise careful companies get caught, for example, a foreign national engineer on the design team, a cloud server abroad, or a supplier video call with screen sharing.
Software and data are fully in scope. “We do not ship hardware” is not an exemption.
FOCI: Foreign Influence over a Cleared Company
Foreign Ownership, Control, or Influence (FOCI) is administered by the Defense Counterintelligence and Security Agency under the National Industrial Security Program, and it runs on a different axis from everything above: it is triggered not by a transaction but by clearance.
If your company holds or needs a facility security clearance and a foreign party seeks to own or control your company, that clearance cannot be maintained unless the foreign influence is mitigated or eliminated. The scope of mitigation efforts are keyed to how much control the foreign party actually has – from a board resolution, through a security control agreement, up to a special security agreement or a voting trust, in which the foreign owner keeps the economics of the transaction but gives up management control.
Two points matter for company owners: FOCI is a continuing condition rather than a one-time approval, monitored as long as you hold the clearance; and it is not limited to equity – foreign debt, revenue dependence, or contractual relationships can create reportable influence.
The Mechanics of these Rules
- Who decides. Treasury chairs CFIUS and runs outbound investment; State runs ITAR; Commerce runs the EAR; DCSA, within the Defense Department, handles FOCI.
- When it happens. CFIUS is reviewed around the transaction. Outbound investment (Reverse CFIUS) is either prohibited, or notified after closing. ITAR or EAR export licenses come before the shipment of controlled items or before the technical conversation. FOCI is continuous.
- What is at stake. CFIUS can block or unwind a deal. Outbound investment and export violations carry substantial civil penalties and, for willful conduct, criminal exposure. FOCI failure costs you the clearance – and with it, the classified work.
- They stack. One transaction can trigger several. A foreign acquisition of a cleared supplier runs CFIUS and FOCI on parallel tracks, and the target’s export classification determines whether the CFIUS filing was mandatory at all.
Trigger Questions for Companies
You do not need to resolve these – only to notice them and contact qualified counsel.
- Is there any foreign investor, lender, board member, or parent (including through a U.S. entity) that a foreign party owns?
- Are we selling, quoting, or demonstrating military or dual use products or services to a potential customer outside the U.S., or to a foreign-owned company here in the U.S.?
- Does anyone on our technical staff – employee or contractor – hold a non-U.S. passport, and have access to our company’s controlled technology?
- Has anyone formally classified our products, software, or technical data for export purposes?
- Do we hold, or does a contract require, a facility security clearance?
- Are we investing in, or forming a joint venture with, a company in China, Hong Kong, or Macau in semiconductors, quantum computing, or AI?
- Is our data hosted, or our code developed, outside the U.S.?
A yes does not mean you have a problem. It means you have a question worth answering deliberately, on your schedule, rather than under deal pressure.
Practical Takeaways
Three habits prevent most of the damage. Seek to classify your products and technology for export purposes before you need the answer – a documented classification determination is cheap when nothing is pending, yet expensive when a deal waits on it. Treat foreign investment as a term-sheet diligence item rather than a closing item, because the analysis can change structure and timing. And remember that these regimes reach small companies with no revenue as readily as large ones; no size threshold exempts a startup.
None of this is a reason to avoid foreign capital or foreign customers – cross-border investment and export sales are how many companies grow. The point is to recognize the moment the questions arise, so the answers are yours to shape rather than someone else’s to impose.
If you are evaluating foreign investment, entering an export market, or facing questions about ownership and facility clearances, our government contracts and national security team can help you assess exposure and build the compliance foundation before it is tested.
This blog was drafted by Ray Jones, a government contracts and M&A attorney in the Spencer Fane Washington, D.C. office. For more information, visit www.spencerfane.com.
Click here to subscribe to Spencer Fane communications to ensure you receive timely updates like this directly in your inbox.
