CFIUS Final Rule Broadens Information Demands and Hikes Penalties

Treasury's final rule, effective December 26, 2024, materially expands CFIUS's enforcement toolkit and the financial downside for foreign-investment deal teams. The committee can now issue information requests not only to transaction parties but also to unrelated third parties such as banks, underwriters, and service providers, and can do so even for non-notified transactions, closing a long-standing gap that let non-disclosing deals escape early scrutiny. CFIUS may also impose a minimum three-business-day deadline for parties to respond to mitigation proposals, with limited extensions, compressing the negotiation window during which national-security risk is resolved. Although the alert does not enumerate the new penalty caps in the excerpt provided, it characterizes the increases as significant and signals a clear intent to deter noncompliance with mandatory filings, mitigation agreements, and disclosure obligations. Sophisticated M&A, private-equity, and cross-border finance counsel should brief clients on tightening diligence around TID-target identification, pre-filing risk mapping, and counsel involvement for any deal touching critical-technology, critical-infrastructure, or sensitive-data U.S. businesses. Watch for Treasury's separate penalty-schedule publication and for early enforcement actions testing the third-party information-request authority.