If Both Sides Want the Deal, Why Does It Still Need a Security Review?

Export controls already exist, so why screen investment as well?

Because they guard different doors. Export controls govern who a thing is sold to: every shipment can be stopped before it leaves, and the next one can be judged afresh. Investment screening governs where the money comes from and what it buys. Once a buyer holds a stake in a company, or owns it outright, the company’s technology, data and facilities no longer need to cross a border, because the owner is already inside. An export licence releases one consignment; clearing an investment hands over lasting access, which is hard to take back once the deal has closed.

That is why screening concentrates on a narrow set of sensitive areas. The EU’s 2019 framework regulation on screening foreign direct investment (2019/452) lists what member states may take into account: critical infrastructure, including the land and real estate needed to use it; critical technologies and dual-use items; supplies of critical inputs such as energy and raw materials; access to sensitive information, including personal data; and the freedom and pluralism of the media. The list amounts to a working map of economic security.

Attracting capital and screening it are not at odds. Washington uses Opportunity Zone tax incentives to pull long-term private money into shipyards and submarine capacity, while relying on the Committee on Foreign Investment in the United States (CFIUS) to review foreign investment in American businesses and certain property deals. As our analysis of Opportunity Zones and shipbuilding notes, the tax code only attracts the capital; keeping hostile capital out depends on investment screening and other safeguards. CFIUS is chaired by the Treasury Secretary, and its members include the heads of the Justice, Homeland Security, Commerce, Defense, State and Energy departments.

Can a minority stake trigger a review too?

Yes. What counts is not the size of the stake but the rights that come with it. The Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA) extended CFIUS’s reach beyond deals that could hand a foreign investor control to non-controlling investments in businesses involved with critical technologies, critical infrastructure or the sensitive personal data of American citizens. Such an investment falls within scope if it gives the investor access to material non-public technical information, a board seat or observer rights, or a role in substantive decisions beyond voting its shares.

The second question is who stands behind the buyer. The EU regulation lets member states take into account whether an investor is directly or indirectly controlled by a foreign government, including through its ownership structure or significant funding. Taiwan’s rules on investment from mainland China treat a company registered in a third country as Chinese if mainland investors hold more than 30% of it, directly or indirectly, or are able to control it; such a company cannot use the ordinary foreign-investment rules. Changing the place of incorporation does not change who the buyer is.

So screeners want more than a chart of shareholdings: they ask about beneficial owners, the source of funds and who appoints the directors. Hiding the controlling party behind nominee shareholders or layers of offshore holding companies is likely to be read as evasion, however sound the commercial case. It is the same problem the de-risking explainer describes when the shareholders change but control does not: the paperwork holds, and nothing real has moved.

Why would a defence ministry veto a land purchase?

Because the risk of land lies in its location, and location does not change with the registered use. In Finland, buyers from outside the EU and the European Economic Area need a permit from the Ministry of Defence to buy real estate, as does a company based inside the area in which a single outside party holds at least 10% or equivalent influence. The application must be made no later than two months after the purchase. If it is refused, the buyer has six months to sell, after which the state disposes of the property itself, by expropriation or similar means.

On 4 June 2026 Finland’s defence minister, Antti Häkkänen, refused 14 such applications from citizens of China, Ukraine, Türkiye and India, or companies they own, with plans ranging from business to recreational and residential use. The ministry said the purchases could endanger national security, hinder the organisation of national defence or threaten security of supply; the decisions are not yet final. Häkkänen had said in October 2025: “Real estate is a tool for hybrid influence activities.” As our analysis of Finland’s land refusals points out, a plot registered for tourism, forestry or housing still gives its owner room for observation, access and future control if it sits near a base, a radar station, a port or an energy facility.

The United States works the same way. CFIUS can review the purchase or lease of property near designated military installations by foreign persons. In May 2024 President Joe Biden ordered a company ultimately majority-owned by Chinese nationals to divest land within a mile of F.E. Warren Air Force Base in Wyoming, a strategic missile base that hosts Minuteman III intercontinental ballistic missiles, and to remove its equipment. The land had been bought in June 2022 and fitted out for cryptocurrency mining, and CFIUS took up the case only after a tip from the public. That November the Treasury added nearly 60 more military installations to the list around which such deals can be reviewed.

Is the outcome simply yes or no?

No. The EU framework regulation defines screening as a procedure to assess, investigate, authorise, condition, prohibit or unwind a foreign direct investment, and those six verbs cover the possible endings. Most deals go through: CFIUS received 347 filings in 2025 and cleared about two-thirds of the transactions in the first phase, the 30-day assessment of a short-form declaration or the 45-day review of a full notice.

Where the risk can be managed, CFIUS can reach an agreement with the parties or impose conditions and let the deal proceed. Where it cannot, the case goes to the president, who may suspend or prohibit the transaction. The timetable has statutory limits: 45 days of review for a notice, a further 45 days of investigation if needed, one 15-day extension in extraordinary circumstances, and 15 days for the president to announce a decision. A company planning an acquisition can budget for that time but cannot compress it.

Closing the deal is not always the end of it. In the United States only a transaction that has completed review enjoys a safe harbour; one that was never filed can still be examined after the fact, and CFIUS screens thousands of such deals a year using public tips, referrals from other agencies and open information. The EU’s new screening regulation (2026/1386), adopted in June 2026 and applying from 17 January 2028, requires every member state to run a screening mechanism and lets authorities review, on their own initiative, deals that needed no prior approval for at least 15 months, and up to five years, after completion.

Why are governments now restricting their own investors abroad?

Because the worry is no longer only that foreign money buys something at home, but also that domestic money helps a rival develop sensitive technology. A US executive order of August 2023 observed that American investment often comes with “intangible benefits”: standing and prominence, managerial assistance, investment and talent networks, market access and easier access to further financing. The G7’s economic security statement at Hiroshima the same year said that measures on outbound investment could be an important complement to the two existing tools, targeted controls on exports and on inbound investment.

The Treasury rules that followed took effect on 2 January 2025 and cover semiconductors and microelectronics, quantum information technologies and artificial intelligence in China, including Hong Kong and Macau. Unlike CFIUS, they involve no case-by-case review: investors must work out for themselves whether a deal is prohibited, must be notified to the Treasury, or falls outside the rules. In December 2025 Congress wrote the approach into law through the COINS Act, part of the National Defense Authorization Act for fiscal 2026. The statute adds high-performance computing and supercomputing, as well as hypersonic systems, to the list of sectors, and extends the countries of concern beyond China to Cuba, Iran, North Korea and Russia, among others.

Biotechnology may be next. Our analysis of US biotech policy describes BINSA, a 2026 bill that would bring drug development, biologics manufacturing and clinical research into outbound review. On 22 October 2026 the Treasury published draft rules to implement the COINS Act that would also bar US investment in certain areas of biotechnology, with comments due by 7 December. The draft is not final; until a final rule takes effect, the rules in force since January 2025 continue to apply.

What does this mean for Taiwan?

In Taiwan, screening is the job of the Department of Investment Review at the Ministry of Economic Affairs, which took over from the former Investment Commission when the ministry was reorganised on 26 September 2023. Under the ministry’s organisational rules, the department reviews investment by overseas Chinese and foreigners, investment from mainland China and the introduction of mainland industrial technology, as well as outbound investment and both investment and technical cooperation in mainland China. Money coming in and money going out pass through the same office.

Screening of China runs in both directions. Under the Act Governing Relations between the People of the Taiwan Area and the Mainland Area, first enacted in 1992, investment from China needs a permit, including from third-country companies in which mainland investors hold more than 30%. Taiwanese firms likewise need ministry approval to invest or cooperate on technology in China (below a set amount, a filing suffices), with activities sorted into prohibited and general categories on grounds of national security and industrial development. That requirement on Taiwanese firms has been in force since at least 2002, more than two decades before the American outbound rules took effect in 2025.

For other destinations, the current rule requires prior approval for investments above NT$1.5 billion; in July 2026, for example, the department approved TSMC’s US$20 billion capital injection into its American subsidiary. Amendments to the Statute for Industrial Innovation promulgated in May 2025 would instead decide which deals need prior approval by destination, industry or technology and amount, with fines of up to NT$10 million per instance for firms that invest without approval and fail to put it right. The Executive Yuan has yet to set a date for the new provisions to take effect.

When Taiwanese companies buy land or businesses abroad, they are the ones being screened. Our analysis of Finland’s land refusals advises checking before a purchase whether a site is near military facilities, ports or subsea cables, disclosing beneficial owners and sources of funds, and writing permit conditions and termination clauses into the contract. Our analysis of Pax Silica and technology sovereignty likewise counts investment screening capacity among the things Taiwan’s technology security strategy should include.