CFIUS Carried Out More Site Visits in FY24, Began Probes From Voluntary Disclosures

The committee said it carried out 79 site visits with parties to a proposed transaction during FY 2024, an increase from the 43 site visits it carried out in FY 2023 (see 2407230017). Those site visits involved “compliance-focused interviews” with senior executives and line-level employees, inspections of records, verification of physical and logical access controls, and more.

Where the committee’s monitoring agencies found “instances of noncompliance,” they considered imposing penalties, CFIUS said, which resulted in four fines for “breaches of material provisions in mitigation agreements.” The committee also penalized one company for submitting a notice and supplemental information with “material misstatements.”

CFIUS also completed two investigations in 2024 involving companies that it suspected of not complying with the committee’s filing requirements and issued one “formal determination of noncompliance.” It also “received and acted on” multiple voluntary disclosures for other possible failures to file a mandatory declaration, CFIUS said, and those investigations remain ongoing.

In total, CFIUS saw a drop in mitigation measures last year compared with 2023. It adopted mitigation measures and conditions for 25 notices in 2024, representing about 12% of the total number of notices filed that year. In 2023, it adopted mitigation measures in 43 instances, representing about 18% of the total number of notices.

CFIUS imposed a range of mitigation measures, including conditions that blocked companies from sharing certain intellectual property and trade secrets; limiting access to sensitive technology, systems and facilities to only “authorized persons”; ensuring that computer networks are “segregated”; restricting the hiring of certain employees; requiring that a company notify the U.S. government before entering into agreements to collaborate with people from certain countries; and more. At the end of 2024, CFIUS said it was monitoring 242 mitigation agreements and conditions.

The committee also said it looked into “thousands” of transactions that weren’t notified to the committee but potentially should have been, including through tips, media reports and voluntary disclosures. It investigated 98 of those deals and formally opened an “inquiry” into 76 of these transactions, an increase from the 60 non-notified inquiries it opened in 2023. CFIUS asked companies to submit a filing in 12 of those cases in 2024, compared with 13 in 2023.

CFIUS also said it continued to hire “additional staff” and evaluated using “new tools and datasets” to help it find more non-notified deals. One non-notified deal last year, which was originally brought to its attention through a public tip, “was ultimately prohibited by a presidential order," the committee said.

The report also shows CFIUS saw an increase in covered transaction declarations, with 116 in 2024 compared with 109 in 2023. But it saw a decrease in the number of notices, with 209 in 2024 compared with 233 in 2023. Of the 233 covered notices the committee received last year, 49 were withdrawn after a CFIUS investigation began.

CFIUS said it took an average of 6.5 business days from the date it received a draft covered notice to the date when it provided written comments on the notice, a decrease from the 7.86 business days it averaged in 2023. The committee took an average of 46.5 days to close a review of a notice -- slightly higher than the 45.8 days it took the year before -- and an average of 87.5 days to close an investigation, a slight increase from the 85.8 days it averaged in 2023.

Investors from Japan accounted for the most declarations in 2023 at 16 total declarations. Investors from Canada, France and the U.K. accounted for the next highest number of declarations, with 11, nine and nine, respectively.

China continued to file the highest number of notices with CFIUS in 2024, accounting for 12% of the total, or 26 notices. Investors from France and Japan were close behind with 23 notices each.

The report also said CFIUS reviewed 150 covered transactions involving U.S. critical technology companies in 2024. Twenty-four of those transactions involved acquirers from Japan, while 20 involved France and 16 involved China. Most involved companies in the “professional, scientific, and technical services sector,” the “computer and electronic product manufacturing” sector and the “fabricated metal product manufacturing” sector.

The report continued to say that foreign governments remain “extremely likely to use a range of collection methods to obtain critical U.S. technologies,” including through cyberattacks from China, Russia, Iran and North Korea. “Countries with closer ties to the United States have also conducted cyber espionage and other forms of intelligence collection to obtain U.S. technology,” CFIUS said. “Federal research institutions, universities, and corporations are regularly targeted by cyber actors seeking proprietary information.”