Most foreign buyers in China plan around merger control and price. Fewer plan around the one review that can undo the deal after money has changed hands: China's foreign-investment security review. In April 2026 it stopped being theoretical — the regulator ordered a roughly US$2 billion technology acquisition unwound after it had already closed. If a target sits anywhere near a sensitive sector, this review belongs in the term sheet, not the closing checklist.
- It is a real gate, not a formality. China's foreign-investment security review (FISR) can impose conditions, block a deal, or order a completed transaction to be reversed.
- Run by the NDRC and MOFCOM. A joint working mechanism, with its office housed in the National Development and Reform Commission, decides and reviews. Filing is mandatory in advance for covered deals.
- Triggered by sector plus control. Review attaches where a foreign investor takes actual control of assets in defence-related, infrastructure, energy, key-technology, critical IT and similar sensitive areas.
- A closed deal is not safe. The 2026 Manus decision was the first publicly confirmed use of the mechanism to unwind a cross-border AI acquisition — and the regulator looked through an offshore holding structure to the origin of the technology.
- Map it before signing. Security-review exposure changes whether — and how — you do the deal at all.
We set out the four approvals every foreign acquisition has to clear in the four filings behind a China acquisition. This piece goes deep on the one that surprises buyers most, because it is the one that can bite after completion.
1. What the security review is — and who runs it
China's Measures for the Security Review of Foreign Investment were jointly issued by the National Development and Reform Commission (NDRC) and the Ministry of Commerce (MOFCOM) on 19 December 2020 and took effect on 18 January 2021. They created a standing review comparable in function to CFIUS in the United States: a screen on inbound deals that could affect national security.
Administration sits with a working mechanism whose office is housed in the NDRC and jointly led by the NDRC and MOFCOM. The regime is a mandatory declaration system — for a covered transaction, the parties must file before completing, not after. The office then decides, within 15 working days of a complete filing, whether a review is needed; a general review runs about 30 working days, with a further special review where concerns are unresolved.
2. When it applies: sector plus “actual control”
Two things have to line up for the review to attach. First, the sector. The Measures cover investment in the military and defence-adjacent field, and — for other areas — investment in important agricultural products, important energy and resources, important equipment manufacturing, critical infrastructure, important transport services, important cultural products and services, important information-technology and internet products and services, important financial services, key technologies and similar sensitive fields.
Second, control. Outside the military field, the trigger is a foreign investor acquiring actual control of a target in one of those areas. The sectors are described in broad strokes and leave real room for interpretation, which is precisely why a buyer cannot self-clear by assuming its target is “just software” or “not strategic.” And the office can examine a transaction that was not filed — non-filing is not a shield.
3. The Manus decision: a closed deal, unwound
In April 2026 the security-review office ordered the unwinding of a roughly US$2 billion acquisition of Manus, a Chinese-founded developer of AI agents, by a major US technology company. The transaction had already closed. It is, on the public record, the first confirmed use of China's foreign-investment security review to unwind a cross-border AI deal — and the first known block of an acquisition in the AI sector since the Measures took effect.
The lesson for foreign buyers is blunt: clearing the commercial terms and even the merger-control step does not immunise a deal. Where a target touches a sensitive area, the review can bite after signing and after closing, and “we already completed” is not an answer.
4. Why it reached an offshore company: jurisdiction follows origin
What makes the Manus decision instructive is how jurisdiction was found. The target had relocated its corporate home offshore. The regulator looked through the offshore structure and focused on the origin of the technology — where it was developed, where the engineering team built its expertise, and how the intellectual property had been moved out of the original Chinese entity.
The practical takeaway: for a target with Chinese technological roots, redomiciling to Singapore or elsewhere does not, by itself, place the deal outside China's reach. Diligence has to trace the provenance of the core technology and team, not just the current cap table and place of incorporation.
5. Don’t confuse it with the new outbound rules
One clarification, because the timing invites it. This inbound security review is separate from China's 2026 outbound-investment (ODI) framework — the State Council rules that took effect on 1 July 2026 and screen Chinese entities investing abroad (sometimes called a “reverse CFIUS”). For a European or US company acquiring into China, the regime that matters is the inbound FISR described here; the outbound rules govern a different direction of capital and a different filer.
6. What foreign buyers should do before signing
Treat the security review as a gating question at the term-sheet stage, not a closing formality:
- Screen the sector honestly. Ask whether the target touches any listed sensitive field, reading those categories broadly rather than narrowly.
- Test for control. If the structure gives you actual control of a target in a covered area, assume a mandatory filing and build the timeline in.
- Trace technology provenance. Where the target has Chinese roots, map where the core technology and team originated — offshore holding structures do not settle the question.
- Sequence it. A mandatory filing must precede closing; getting the order wrong is what turns a signed deal into a stalled one.
- Price the tail risk. For borderline targets, allocate the risk of a post-closing review in the deal terms rather than discovering it afterwards.
Foreign capital is genuinely returning to China through acquisitions — we covered that shift in foreign capital is returning through a different door. The buyers who close cleanly are the ones who ask, before signing, whether this gate applies to their deal.
Frequently asked questions
Yes. China's foreign-investment security review can impose conditions on, block, or order the unwinding of a transaction that touches a sensitive sector — even after it has completed. In April 2026 the regulator ordered a roughly US$2 billion AI acquisition unwound after closing, the first publicly confirmed case of its kind. Security-review exposure should be assessed before signing.
It is a mandatory national-security screen on inbound foreign investment, created by Measures jointly issued by the NDRC and MOFCOM on 19 December 2020 and effective 18 January 2021. A working mechanism whose office sits in the NDRC receives filings and decides whether a deal touching sensitive sectors may proceed.
Investment in the military and defence-adjacent field, and — where the foreign investor acquires actual control — important agriculture, energy and resources, equipment manufacturing, critical infrastructure, transport, cultural products, information-technology and internet services, financial services, key technologies and similar sensitive areas. The categories are drawn broadly.
For covered transactions the filing is mandatory and must be made before completing the deal. A working mechanism jointly led by the NDRC and MOFCOM, with its office in the NDRC, decides within 15 working days of a complete filing whether a review is needed, followed by a general review of about 30 working days and a special review if concerns remain.
It confirmed that a closed deal can be reversed, and that the regulator will look through an offshore holding structure to the origin of the technology. Redomiciling a China-rooted target abroad does not by itself place an acquisition outside China's reach, so diligence must trace where the core technology and team originated.
Sources
- Morgan Lewis — The Manus Decision: China's first AI security-review block (May 2026): the unwinding order, the offshore look-through, and implications for cross-border AI investment.
- Baker McKenzie — China enacts new foreign-investment security-review Measures: the NDRC/MOFCOM working mechanism, covered sectors and the mandatory-declaration structure (effective 18 January 2021).
- ICLG — Foreign Direct Investment Regimes 2026: China: mandatory filing, the working office under the NDRC, and the 15 / 30 working-day review timeline.
- Internal: The four filings behind a China acquisition; Foreign capital is returning to China through a different door.
This article is general information for foreign companies, not legal advice on any specific matter. Rules and practice change; please take advice on your facts.