The regulatory environment for cross-border M&A has transformed in the last three years in ways that even experienced dealmakers have struggled to absorb. CFIUS has expanded its jurisdiction, increased its staffing, and demonstrated a willingness to block or impose conditions on transactions that would have cleared without comment five years ago. The EU Foreign Subsidies Regulation — which came into full effect in October 2023 — added a new filing obligation for transactions where any party has received substantial government support from a non-EU country. China's national security review regime now touches virtually any transaction involving Chinese assets or a counterparty with Chinese connections. The dealmaker who treats these as separate, sequential concerns is already behind.
The practical consequence is that deal timelines have extended. A transaction that would have closed in 60 days in 2020 now routinely takes 9–12 months when CFIUS review is involved, and CFIUS review is increasingly unavoidable — not because the parties choose it, but because the statute now requires mandatory filing for transactions involving certain technology sectors, critical infrastructure, and sensitive personal data. The 'voluntary' filing that used to be the standard advice is no longer strategically viable in most contexts; the risk of a post-closing CFIUS mitigation order is too high.
The strategic implication for buyers is earlier regulatory counsel engagement. The regulatory risk assessment that used to happen during due diligence now needs to happen before the LOI in most significant cross-border transactions. Deal structure, equity percentage, governance rights, and the identity of the acquiring entity all affect regulatory exposure — and changing them after signing is expensive and sometimes impossible. Sellers need to understand that the regulatory timeline is now a negotiating point in its own right: the buyer who can demonstrate a credible, specific CFIUS mitigation strategy is more valuable than the buyer who offers $20M more with vague assurances about regulatory risk.
Our cross-border M&A team has managed CFIUS processes, EU FSR filings, and multi-jurisdiction merger control in 23 countries. The lesson from that experience is not that cross-border deals are harder — they are — but that the difficulty is manageable when the regulatory strategy is developed at the same time as the business strategy, not after it.