CFIUS Review and Turkish Acquisitions of US Companies 2026: What Buyers Need to Know

The Committee on Foreign Investment in the United States (CFIUS) has become one of the most significant regulatory considerations in cross-border M&A involving US targets. For Turkish buyers of US companies, understanding CFIUS jurisdiction, mandatory filing requirements, and risk mitigation strategies is essential before signing any acquisition agreement.

CFIUS is an interagency committee chaired by the Secretary of the Treasury that reviews foreign investments in US businesses for national security implications. CFIUS has authority to:

• Review and investigate covered transactions
• Negotiate mitigation agreements to address national security concerns
• Recommend that the President block or unwind transactions

The Foreign Investment Risk Review Modernization Act (FIRRMA), enacted in 2018, significantly expanded CFIUS jurisdiction and introduced mandatory filing requirements for certain transactions.

CFIUS reviews "covered transactions," which include:

Any transaction by which a foreign person could acquire control of a US business. "Control" is broadly defined and includes the ability to determine, direct, or decide important matters affecting a business.

Even non-controlling investments in "TID US businesses" (Technology, Infrastructure, and Data) can be subject to CFIUS review if the foreign investor obtains:

• Access to material non-public technical information
• Membership or observer rights on the board of directors
• Involvement in substantive decision-making regarding sensitive matters

TID US businesses include:

• Businesses that produce, design, test, manufacture, or develop critical technologies
• Businesses that own, operate, or supply critical infrastructure
• Businesses that maintain or collect sensitive personal data of US persons

CFIUS has jurisdiction over certain real estate transactions near military installations or other sensitive government facilities.

FIRRMA introduced mandatory CFIUS declarations for certain transactions. Failure to file a mandatory declaration can result in civil penalties up to the value of the transaction.

1. TID US businesses involving critical technologies: Foreign investments in US businesses that produce, design, test, manufacture, fabricate, or develop critical technologies in certain industries
2. Substantial interest by foreign government: Transactions in which a foreign government obtains a substantial interest (25%+) in a TID US business

For transactions not subject to mandatory filing, parties can voluntarily file a notice with CFIUS. Voluntary filing provides a "safe harbor" — once CFIUS clears a transaction, it cannot later reopen the review absent fraud or material misrepresentation.

Target business characteristics:

• Defense contractors or suppliers
• Critical technology companies (semiconductors, AI, quantum computing, biotechnology, advanced manufacturing)
• Critical infrastructure (energy, telecommunications, transportation, financial services)
• Companies with US government contracts or security clearances
• Companies that collect sensitive personal data of US persons

Buyer characteristics:

• Turkish government ownership or control of the buyer
• Turkish military or intelligence connections
• Buyer's connections to countries of concern (China, Russia, Iran, North Korea)
• Buyer's prior CFIUS history

Turkey is a NATO ally and generally not considered a country of concern by CFIUS. However:

• Turkish companies with significant Chinese or Russian ownership or partnerships may face heightened scrutiny
• Turkish government-owned or controlled entities (including sovereign wealth funds and state banks) face additional scrutiny
• Turkish buyers of US defense or critical technology companies will face thorough review regardless of Turkey's NATO status

A declaration is a short-form filing (typically 5 pages) that CFIUS must review within 30 days. CFIUS can:

• Clear the transaction
• Request a full notice
• Initiate a unilateral review

A full notice is a comprehensive filing that CFIUS reviews in a 30-day initial review period, extendable to 45 days for an investigation. CFIUS can:

• Clear the transaction
• Negotiate a mitigation agreement
• Recommend presidential action

• Declaration: 30-day review
• Notice: 30-day review + 45-day investigation + 15-day presidential review = up to 90 days
• Complex transactions can take 6+ months

When CFIUS identifies national security concerns, it may negotiate a mitigation agreement (National Security Agreement or Letter of Assurance) requiring:

• Exclusion of certain business units from the transaction
• Restrictions on foreign personnel access to sensitive information
• Appointment of a security officer
• Periodic compliance reporting
• Government audit rights

Turkish buyers should assess mitigation risk before signing and consider whether proposed mitigations are operationally acceptable.

Turkish buyers should conduct CFIUS risk assessment before signing:

1. Identify whether the target is a TID US business
2. Assess mandatory filing requirements
3. Evaluate national security risk factors
4. Consider transaction structuring to reduce CFIUS risk (e.g., excluding sensitive business units, limiting board rights)
5. Build CFIUS timeline into deal schedule — CFIUS review can add 3–6 months to deal timelines
6. Include CFIUS condition in purchase agreement — make closing conditioned on CFIUS clearance

Our M&A attorneys advise Turkish buyers on CFIUS risk assessment, mandatory filing analysis, voluntary filing strategy, and mitigation agreement negotiation. We help Turkish acquirers navigate CFIUS efficiently while protecting their transaction timelines and deal economics.

This article is for informational purposes only and does not constitute legal advice. CFIUS review is highly fact-specific; please consult qualified M&A counsel before entering into transactions involving US targets.