Two acronyms cause more confusion in cross-border defense investment than almost anything else in this field: CFIUS and FOCI. They sound related, they sometimes apply to the same transaction, and they are run by entirely different parts of the government for entirely different reasons. Conflating them is an easy mistake, and it is one that can leave a company thinking it has cleared a hurdle that it has not.

CFIUS reviews the transaction, once

The Committee on Foreign Investment in the United States is a Treasury-led interagency body that reviews foreign investment into U.S. companies for national security concerns. Its jurisdiction extends to acquisitions of control, and since the Foreign Investment Risk Review Modernization Act, to certain non-controlling investments as well, particularly where they touch sensitive technology, critical infrastructure, or the handling of sensitive personal data.

A CFIUS review is tied to a specific transaction. It happens once, at the point of investment, and it results in clearance, a mitigation agreement, or in some cases a presidential order blocking or unwinding the deal. Once a transaction clears CFIUS, that particular review is finished.

FOCI is ongoing, and it is about the facility clearance, not the deal

Foreign Ownership, Control, or Influence is a different framework entirely, administered under the National Industrial Security Program by the Defense Counterintelligence and Security Agency. FOCI applies when a company holds, or is seeking, a facility security clearance and has foreign ownership, control, or influence present in its structure. Rather than reviewing a single transaction, FOCI mitigation is an ongoing arrangement, whether that is a Special Security Agreement, a Security Control Agreement, a proxy agreement, or a voting trust, that manages the foreign element for as long as the company holds the clearance.

This is a genuinely different question from the one CFIUS asks. CFIUS asks whether a specific investment poses a national security risk. FOCI asks whether an already-structured company can be trusted to hold classified information given who owns or influences it, on a continuing basis.

Where companies get the sequencing wrong

Clearing CFIUS on an acquisition does not remove the need for FOCI mitigation afterward if the acquired company holds or is pursuing a facility clearance. These are two separate agencies, running two separate processes, with two separate sets of instruments. A foreign investor who treats CFIUS clearance as the finish line is often surprised to learn that the FOCI mitigation process, sometimes a longer and more involved undertaking, is only beginning at that point.

The reverse can also be true. A company can be well down the road on structuring a FOCI mitigation agreement and separately need to account for whether the underlying investment itself required, or should have received, CFIUS review. Treating these as one combined approval, rather than two independent ones that can each apply to the same deal, is the single most common planning error we see in cross-border defense transactions.

Frequently asked questions

Does every foreign investment in a defense company trigger CFIUS review?

Not automatically. Certain transactions require mandatory filings, while others are reviewed only if voluntarily submitted or otherwise identified by the committee. Whether a specific transaction requires or warrants a filing depends on its structure and the sectors involved, and that determination should be made with qualified counsel.

If we already have a FOCI mitigation agreement, do we still need to worry about CFIUS on a future investment?

Yes. An existing FOCI mitigation agreement addresses your facility clearance status. It does not substitute for a CFIUS review of a new transaction that independently meets the criteria for one.

Which process typically takes longer?

Timelines vary by case for both. A CFIUS review has statutory timeframes for its review and investigation phases, while a FOCI mitigation arrangement’s timeline depends heavily on the complexity of the ownership structure and the specific instrument required. Neither should be assumed to be quick.

Where Nortrane fits

Nortrane helps foreign investors and newly acquired entities understand how these two processes interact for their specific transaction, so that clearing one is not mistaken for clearing both. Our detailed guide on FOCI mitigation and the SSA, SCA, proxy, and voting trust options covers the ongoing side of this picture in depth. This is general information, not legal advice. For guidance on your specific transaction, reach out to discuss it.