Are CFIUS Decisions Legally Vulnerable?

The Committee on Foreign Investment in the United States (CFIUS) is among the oldest and most significant tools in the U.S. government’s arsenal to protect its national security interests. CFIUS can compel entities and individuals to take action to mitigate perceived risks to national security, impose conditions on transactions, and refer transactions (even consummated transactions) to the president of the United States for prohibition.

Its legal foundation, however, is largely untested.

Courts have had few occasions to consider challenges to CFIUS’s authority to date, and several significant issues remain untested and various questions remain unanswered: Just how broad is the committee’s jurisdiction? Can CFIUS force the sale of a controversial company—despite years of evolution—because of a years-old transaction? How transparent must the committee be to satisfy due process? Must the government compensate foreign investors when it orders them to divest?

And underlying all these questions is a threshold issue: When and how can foreign investors challenge the committee’s decisions in court?

CFIUS is intended to operate apolitically. Political officials historically have not made public statements prejudging matters under CFIUS review, and transaction parties generally expect that politics will not impact CFIUS’s analysis. Nippon Steel’s planned acquisition of U.S. Steel, however, generated significant negative comments from a sitting president and the presidential candidates from each major political party before, reportedly, CFIUS had completed its analysis of the transaction. Statements by three of the most powerful political leaders in the nation may have impacted CFIUS’s analysis. In response to President Biden’s decision to block the deal, the transaction parties have sued CFIUS and the president.

Although some actions are insulated from judicial review—such as the president’s decision to suspend or prohibit a transaction—several avenues exist to challenge decisions on constitutional and statutory grounds. CFIUS is likely to see its authority tested in the coming years as it asserts its jurisdiction over more types of transactions, pursues more aggressive actions on transaction parties, and imposes significant penalties publicly naming offending parties—actions that shift the calculus on when and how to challenge CFIUS in court.

Background

In response to concerns that OPEC nations were purchasing strategic assets in the United States, President Ford created CFIUS in 1975 pursuant to Section 721 of the Defense Production Act of 1950 (DPA) (codified at 50 U.S.C. § 4565), empowering federal agencies to review transactions involving foreign investments to determine their effect on national security.

CFIUS operates largely in anonymity. CFIUS filings are not publicly reported (unless by the transaction parties); it does not publish its analyses; it does not comment on cases; and it does not disclose when it enters into agreements with transaction parties to mitigate national security risks.

Historically, the only public action or comments related to a CFIUS case would include any potential presidential orders and any associated press releases. So, transaction parties, to keep any CFIUS issues out of the public eye, would often enter into agreements with CFIUS—sometimes to divest assets—to avoid the publicity associated with a presidential decision, which could negatively affect the public’s perception of the parties.

In 2018, Congress empowered CFIUS to analyze an even larger set of foreign investments with the Foreign Investment Risk Review Modernization Act (FIRRMA). FIRRMA created mandatory filing requirements for certain transactions, subjected certain lower-value transactions to CFIUS review, and added provisions focusing on data of U.S. persons, critical technology, and critical infrastructure, among other changes.

CFIUS jurisdiction has long required three things—a foreign person, a transaction, and a U.S. business. Transactions subject to CFIUS jurisdiction, called “covered transactions,” currently include:

1. any merger, acquisition, or takeover that could result in foreign control, which is defined as the power to determine, direct, or decide important matters;
2. the purchase or lease by, or concession of certain real estate;
3. an investment that affords an equity interest in and certain rights, access, or involvement (including a board or board observer seat) in U.S. businesses involved with critical technologies, critical infrastructure, or sensitive personal data (i.e., a “TID U.S. Business”);
4. changes in rights that could result in a covered transaction; and
5. any arrangement designed or intended to evade or circumvent CFIUS jurisdiction.

In recent years, CFIUS has asserted jurisdiction over a wider range of transactions.

When a CFIUS filing is made, the Department of the Treasury analyzes the transaction and determines if it is subject to the committee’s jurisdiction. This is done through an unclassified covered transaction analysis, which is based on the information provided by the parties in their filing. Once finalized by the Treasury Department, the covered transaction analysis is ratified by CFIUS.

In parallel, CFIUS analyzes the transaction for risks to U.S. national security. If the committee determines that a transaction poses national security risks, it can negotiate an agreement with the transaction parties to require them to take or not take certain actions (that is, enter into a mitigation agreement), order the parties to undertake various mitigation measures, or, in the most sensitive cases, recommend that the president prohibit the transaction. Only nine transactions have ever been subject to a presidential prohibition order (including Nippon Steel’s planned acquisition of U.S. Steel most recently and the planned acquisition of property near a U.S. Air Force base in May 2024), but many more parties have abandoned transactions once it became apparent that neither CFIUS nor the president would clear them.

Since the Exon-Florio Amendment in 1988, the text of the DPA has stated that no CFIUS-related “action” or “finding” of the president can be reviewed by a court. How broad and categorical a bar to judicial review this provision is remains unclear and largely untested.

Prior Legal Challenges

The CFIUS regulations and its underlying statute have evolved significantly since the Ford administration, yet legal challenges have been few and far between.

In March 2012, Ralls Corporation, a Delaware company owned by two Chinese nationals (and thus a foreign person under the CFIUS regulations), purchased four companies that held assets for the development of wind farms in north-central Oregon, some of which were near U.S. Navy sites.

Ralls submitted a CFIUS filing after being informed that a CFIUS review was imminent. Following a review and investigation, CFIUS determined that the acquisition threatened U.S. national security. The matter was then referred to President Obama for decision, and he determined that the transaction posed a threat to U.S. national security and issued a presidential order prohibiting the transaction. The presidential order required Ralls to divest the four companies.

Ralls challenged the order in court. Among other claims, Ralls alleged that the order violated the Due Process Clause of the Fifth Amendment—which states that no person shall be “deprived of life, liberty, or property without due process of law”—because neither CFIUS nor the president provided the company with the opportunity to review and rebut the evidence on which they relied.

The U.S. Court of Appeals for the D.C. Circuit (which has exclusive jurisdiction over CFIUS challenges) agreed. The court first determined that the DPA did not categorically preclude all judicial review, finding that “neither the text of the statutory bar nor the legislative history of the statute provides clear and convincing evidence that the Congress intended to preclude judicial review” of constitutional claims. The court noted that the DPA precludes judicial review of only “final ‘actions’ the President takes ‘to suspend or prohibit any covered transaction that threatens to impair the national security of the United States.’” “The text does not, however, refer to the reviewability of a constitutional claim challenging the process preceding such presidential action,” the court determined.

Having found that it had jurisdiction to review Ralls’s challenge, the court then held that the presidential order “deprived Ralls of constitutionally protected property interests without due process of law.” But the court did not require CFIUS to disclose the president’s thinking on sensitive questions related to national security in reviewing a transaction. Instead, it held that CFIUS must provide “access to the unclassified evidence on which the President relied and an opportunity to respond thereto.”

Following this ruling, CFIUS began providing a letter to transaction parties—called a “Ralls Letter” or “Due Process Letter”—prior to acting. Typically, these letters are provided at least a few days in advance of CFIUS action, and they include—with one notable exception described below—the unclassified evidence upon which CFIUS relied in making its determination.

Other than TikTok’s pending challenge initiated in 2020 in response to an order by President Trump, Ralls is the only meaningful litigation related to CFIUS’s jurisdiction and powers.

Unresolved Issues

Given the dearth of prior legal challenges, significant unsettled legal questions have lingered around CFIUS. For example, a legal challenge to CFIUS’s jurisdiction has never been resolved, the level of transparency CFIUS must provide to transaction parties has not been tested since Ralls, and an argument that adverse CFIUS action could be actionable under the Fifth Amendment has never been settled.

Jurisdictional Challenges

The most direct challenge to CFIUS (and any CFIUS-related presidential action) is to its jurisdiction. Generally, CFIUS has jurisdiction to assess, review, investigate, and act against “covered transactions,” a defined term that must include three things—a foreign person, a transaction conveying CFIUS-relevant rights, and a U.S. business.

The CFIUS regulations define a foreign person as “any foreign national, foreign government, or foreign entity and any entity over which control is exercised or exercisable by a foreign national, foreign government, or foreign entity”; a U.S. business as “any entity, irrespective of the nationality of the persons that control it, engaged in interstate commerce in the United States”; and the term “transaction” as (a) a merger, acquisition, or takeover, including the acquisition of an ownership interest in an entity, the acquisition of proxies from holders of a voting interest in an entity, a merger or consolidation, or the formation of a joint venture, (b) an investment, or (c) the conversion of a contingent equity interest. When transactions do not contain the requisite elements, the committee cannot act against them.

When CFIUS seeks to act against a transaction, it must produce a risk-based analysis that includes credible evidence demonstrating the risk and an assessment of the threat, vulnerabilities, and consequences to national security related to the covered transaction. And in turn, the president of the United States can act to suspend or prohibit only a covered transaction. The entire CFIUS legal framework therefore hinges on there being a covered transaction. The risk-based analysis, the presidential order, and any CFIUS action—each need a covered transaction.

But what happens if the transaction parties do not agree with CFIUS’s assessment? Courts have recognized a nonstatutory cause of action to bring ultra vires claims in certain circumstances. For example, the Supreme Court held in 1944 that plaintiffs could challenge whether the secretary of agriculture exceeded his authority under the Agricultural Marketing Agreement Act, even though the act does not contain a provision explicitly allowing such legal challenges. In Dart v. United States, the D.C. Circuit sustained an ultra vires challenge to the secretary of commerce’s authority under the Export Administration Act, despite the statute not containing a cause of action and specifically precluding challenges brought under the Administrative Procedure Act (APA). And as the Ralls court noted, the DPA’s preclusion of judicial review applies only to claims against the president suspending or prohibiting a covered transaction. So, transaction parties may be able to challenge in court whether a CFIUS action prior to presidential involvement in the case exceeds the committee’s statutory power.

As CFIUS becomes increasingly aggressive, transaction parties will likely begin to consider the relative strength of their claims vis-a-vis CFIUS’s jurisdiction.

A related issue arose in unresolved litigation over the Trump administration’s attempt through CFIUS to force ByteDance, a Chinese company, to divest its ownership of TikTok, the short-form video and social networking application. ByteDance did not actually buy an application called TikTok. Rather, in 2017, ByteDance acquired another Chinese company, Musical.ly, which had operations in the United States. ByteDance did not inform CFIUS at the time of the acquisition, allegedly because it saw no American national security risk to one Chinese company (ByteDance) buying another (Musical.ly). But ByteDance reportedly used part of the Musical.ly software to create TikTok.

In 2020, the Trump administration sought to examine the years-old acquisition of Musical.ly as a maneuver to force ByteDance to sell TikTok’s American operations, amid larger concerns that TikTok might harvest user data and spread anti-American content. ByteDance claimed that the CFIUS review and subsequent presidential order regarding the Musical.ly acquisition exceeded CFIUS jurisdiction. Most of TikTok was developed internally, without Musical.ly software, so, ByteDance argued, CFIUS did not have jurisdiction over most of TikTok. The U.S. business that was the subject to CFIUS’s review and President Trump’s executive order is not the same U.S. business ByteDance purchased in 2017. CFIUS and the president’s jurisdiction, they argued, is limited to the U.S. business they acquired—not what was subsequently built.

In the intervening period, the Supreme Court decided Loper Bright Enterprises v. Raimondo, which held that when an agency is construing an ambiguous statutory term, courts will no longer defer to the agency interpretation just because it is reasonable. Instead, courts will use their own judgment to adopt the best reading of the statute. Some of the regulatory terms used by CFIUS to establish jurisdiction, take action, and make recommendations to the president, including “foreign person,” are not defined in the DPA, the statute underpinning CFIUS’s authority.

Courts have yet to rule on ByteDance’s claims, and the Department of Justice has not filed a response, as the case has been held in abeyance since 2021. And, with Congress’s intervention with the Protecting Americans from Foreign Adversary Controlled Applications Act, which the D.C. Circuit upheld recently, ByteDance’s lawsuit against CFIUS may not ultimately shed further light on these jurisdictional questions. But this type of jurisdictional challenge—that the scope of a CFIUS order exceeded the scope of the definition of a “covered transaction,” especially for retroactive orders—could arise again as CFIUS increasingly uses its divestment powers.

Due Process Challenges

Impacted parties can also challenge the CFIUS process itself. This type of challenge may not be outcome changing, but it could provide parties some relief, such as the ability to rebut information or understand more about CFIUS actions.

The Due Process Clause of the Fifth Amendment states that no person shall be “deprived of life, liberty, or property without due process of law.” Whether and to what extent a foreign investor whose investment is conditioned on CFIUS clearance—and who therefore does not yet have a fully vested property interest—has due process rights is not clear. In Ralls, the D.C. Circuit, citing the Supreme Court’s decision in Dames & Moore v. Regan, suggested that parties with conditional property interests may lack due process rights but also noted that Dames & Moore’s holding was limited to the particular facts of that case. However, following Ralls, CFIUS began providing all foreign investors before the committee with additional process, suggesting that CFIUS considers all parties before the committee to have some due process rights. In addition, the Ralls court was clear that foreign investors who have fully acquired U.S. property have due process rights. Therefore, at a minimum, foreign investors subject to a divestment order could challenge it on due process grounds.

The Ralls court said that due process entitled Ralls to, “at the least, ... be informed of the official action, be given access to the unclassified evidence on which the official actor relied and be afforded an opportunity to rebut that evidence.”

CFIUS has since responded by providing an unclassified summary of the national security risks arising from the transaction and the unclassified information on which it relied in making its determination.

But the covered transaction analysis—the unclassified document on which CFIUS relies to act—is not provided. Transaction parties do not know the mechanics of how CFIUS asserted jurisdiction over a transaction and are not in a position to bring challenges—or even respond—to the assessment that underlies CFIUS jurisdiction.

Given the limited nature of the court’s discussion in Ralls, and the lack of other challenges, it is not clear if CFIUS must also provide the covered transaction analysis to transaction parties. Nor, for that matter, is it clear how long transaction parties must be given to respond to information provided by CFIUS. Ralls also predates FIRRMA, a major 2018 amendment to the statute underpinning CFIUS that expanded the committee’s power dramatically.

Ralls also may suggest that CFIUS is wary of further challenges to its authority. After the D.C. Circuit decision, the government chose to settle rather than further pursue a divestment order, perhaps to avoid risking additional limits on CFIUS. Under the settlement, Ralls was allowed to sell the disputed wind farms to a buyer of its choice.

Takings Clause Challenges

The Takings Clause of the Fifth Amendment to the U.S. Constitution provides that “private property [shall not] be taken for public use, without just compensation.” Both real property and personal property can be protected by the Takings Clause. Generally, there are two types of takings: the physical taking of property and destroying or diminishing the economic value of property by regulating the property. Like in the due process context, it is not clear if foreign investors with conditional property interests are afforded protection under the Takings Clause. Dames & Moore, which involved a Takings Clause challenge, suggests not. But the Takings Clause could potentially be used as an avenue to challenge CFIUS action ordering a foreign investor to divest previously acquired property, although several hurdles would need to be overcome.

CFIUS or the president acting on CFIUS’s recommendation, can force foreign persons to divest assets they have acquired in certain circumstances. Foreign owners, however, have a constitutionally cognizable interest in the properties that are subject to CFIUS review. (Ralls found that foreign investors did not “waive[]” their property rights by acquiring a property that is subject to CFIUS review or failing to obtain CFIUS review before completing the transaction.)

The use of eminent domain power on national security grounds almost certainly qualifies as “public use” within the Fifth Amendment. In Kelo v. City of New London, Conn., the Supreme Court interpreted “public use” broadly to include takings serving a range of “public purposes” benefiting the public. And the Supreme Court made clear in Kelo that the government engages in a taking even when it directs the transfer of property from one private party to another if it does so for a “public purpose.”

To date, courts have not addressed what constitutes “just compensation” after a CFIUS-forced divestment. In the TikTok case against CFIUS, ByteDance claimed that “just compensation would not be available,” as no statute provides for the president to compensate investors after a CFIUS-inspired forced sale. ByteDance did not argue, and no court has addressed, what measure of compensation would be required if compensation were available. Courts would need to decide whether any compensation is necessary if a third party pays a fair price for property in a forced sale, as the forced seller would still be compensated in the transaction—though a divestment mandate can drive down the price. The D.C. Circuit in its decision on the TikTok divestment legislation clarified that a per se regulatory taking requires “a complete deprivation of economic value,” which a forced divestiture is not.

Furthermore, the Supreme Court recently declined to clarify whether the Takings Clause is self-executing, thereby providing a right of action under which property owners can sue. At least one lower court within the D.C. Circuit, however, has found that the Takings Clause is self-executing. Complicating things further is the fact that taking claims against federal entities seeking just compensation above $10,000 generally must be brought in the Court of Federal Claims, although the provision of the DPA that gives the D.C. Circuit exclusive jurisdiction over CFIUS challenges may override that. Affected investors may therefore find a more viable cause of action or combine a Fifth Amendment claim with other challenges.

Administrative Procedure Act Challenges

The APA is a federal law that governs the administrative procedures of the federal government. It establishes how federal agencies make rules, settle disputes, and make decisions.

This would seem to open an obvious vehicle to challenge CFIUS, but in the most contentious cases, CFIUS acts by making nonbinding recommendations to the president. An investor likely could not bring an APA challenge to the CFIUS report recommending prohibition because it does not meet finality requirements for APA standing: The report itself does not determine rights or obligations, and no legal consequences flow from it. It is also “well-accepted” that the APA does not provide for judicial review of actions of the president within his own discretion, regardless of the statutory bar on reviewing CFIUS-related final actions by the president.

In addition, a challenge to the committee’s or president’s determination that a transaction poses a national security threat that can be prevented only through a blocking order poses additional justiciability concerns.

But an APA challenge may be viable in the more limited circumstances. When CFIUS uses a final order under its own statutory power or imposes penalties, an APA challenge could be brought as those actions determine rights or obligations of the parties and are final agency actions.

In these rare instances, CFIUS does not block a transaction—that power lies only with the president—but the committee instead might require that a foreign purchaser divest a handful of sensitive assets from its purchase. Those orders would likely be subject to APA standards, and a regulated party could challenge the legal interpretation or could claim that the order should be set aside because it is “arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law.”

Seventh Amendment Challenges

Recent Seventh Amendment jurisprudence could also have profound impacts on CFIUS’s ability to impose penalties. CFIUS has the ability to require parties to enter into agreements to mitigate national security risks it has identified. And as part of this authority, the CFIUS regulations include language permitting CFIUS to impose penalties for breaches of such agreements.

In August 2024, CFIUS announced six previously unknown enforcement actions. Five related to breaches of mitigation agreements and one for material misstatements to CFIUS. The largest enforcement action resulted in a $60 million penalty against T-Mobile US, Inc., which was publicly named in the release, for breaches of a 2018 mitigation agreement.

But in late June 2024, the Supreme Court held in SEC v. Jarkesy that the imposition of penalties through the Securities and Exchange Commission’s internal administrative proceedings violated the Seventh Amendment, which guarantees a jury trial for claims that are “legal in nature.”

In Jarkesy, the Court held that, in determining whether a suit is legal in nature, courts must consider the cause of action and the remedy it provides, with the remedy being “more important” and, in some cases, “all but dispositive.” Under the Court’s analysis, civil penalties designed to punish and deter misconduct, but not to restore the status quo, are “a type of remedy at common law that could only be enforced in courts of law.” And such claims can implicate the Seventh Amendment and entitle a defendant to a jury trial on these claims. Furthermore, the Court explained that the “public rights exception” to Article III jurisdiction does not apply to “traditional legal claims.”

In the case of a mitigation agreement, which is a contract between the transaction parties and the U.S. government, a court could view, in conjunction, the cause of action as analogous to a common-law breach of contract claim, public statements by CFIUS political leadership indicating that enforcement actions will be brought to punish and deter conduct, and the remedy sought by CFIUS, as matters that implicate the Seventh Amendment and should be brought before a jury in a civil action—something CFIUS is not authorized to do. CFIUS would undoubtedly contest each of these elements and try to invoke the public rights exception, but challengers could have a colorable case.

Interestingly, of the seven mitigation agreement enforcement actions, only one—from 2018—appears to have been “imposed.” Instead, CFIUS appears to have “resolved” these enforcement actions pursuant to negotiations with each of the parties and, in doing so, avoided the issue implicated in Jarkesy. But as CFIUS becomes more forceful and aggressive, parties may not be willing to resolve these actions through negotiations, and thus any vulnerabilities in the underpinnings of CFIUS’s penalty authority might be successfully challenged (or curtailed) under recent jurisprudence.

***