How to Determine if an Investment Project Requires a Security Review?

In my twelve years advising foreign-invested enterprises, few questions trigger more sleepless nights than the security review filing. You’d think it’s just another compliance checkbox, but the reality? It’s a strategic minefield. The Foreign Investment Security Review (FISR) regime, formalized by the 2020 Measures, isn’t about blocking capital—it’s about protecting critical infrastructure, data, and defense-related supply chains. I remember a client, a German auto parts maker, who nearly lost a lucrative acquisition because they assumed their non-military product line exempted them. We saved the deal with last-minute paperwork, but I still wake up in cold sweats thinking about that one.

The market context matters here. Since the 2023 expanded rules, "substantial controlling influence" now includes minority stakes with veto rights, board seats, or even operational dependencies. So, the old instinct—"we’re below 50%, we’re safe"—is dangerous. Investment professionals need a decision tree, not a checklist. This article breaks down, with practical granularity, how to screen your deal before lawyers send the first threatening email. Because trust me, the review mechanism is reactive; you don’t get a grace period if you’ve closed the transaction in bad faith.

核心识别：军事与军民融合

Let’s start with the most obvious but deceptively complex trigger: the defense and dual-use sector. The official list covers "military industry" broadly—weapons, ammunition, military electronics, and even certain encrypted technologies. But the gray zone kills you. I recall a case from 2022 where a US private equity fund acquired a Hong Kong-registered logistics company that had a subsidiary servicing a PLA naval base—only with cleaning supplies, not weapons. The review committee still deemed it a "military supporting service" because the contract volume was material to the target’s revenue. That was a painful lesson in substance over form.

So, how do you test this? First, run a contract-level audit. Does the target supply goods or services to entities on the military procurement lists? Even if the end-user is a civilian arm, trace the final destination. My team uses a modified "Trickle-Down Test"—we ask: If the military component were removed, would the target still generate >30% of its revenue? If yes, red flag. Also, pay attention to intellectual property. If the target holds patents classified under China’s "Technology Export Control Catalog," that’s an automatic trigger. I’ve seen deals stumble because the acquirer didn’t check the patent annexes until due diligence uncovered a 2018 filing under Category 7 (aerospace).

The nuance deepens with "peripheral services." The 2023 guidelines explicitly mention "dual-use infrastructure"—think telecommunications networks, satellite ground stations, and high-performance computing centers. Even a data center that hosts non-sensitive cloud services might qualify if it’s near a military exclusion zone. I once consulted for a Japanese fund interested in a cold-storage facility in Dalian. The address was 3km from a naval shipyard. The review triggered because the facility had backup power agreements that could, theoretically, support military operations. Overkill? Maybe. But the committee’s logic is: capability matters more than current use. That changed our acquisition structure entirely—we moved the asset holding to a separate SPV to ring-fence the risk.

关键变量：数据与网络安全

Here’s where the landscape gets murky, especially for tech-forward investors. The FISR doesn’t just look at goods; it sweeps in "critical data" within "critical information infrastructure" (CII). Now, what counts as CII? Officially, it’s defined by the cyberspace administration sectorial rules, but in practice, any company collecting personal info from >1 million users is treated as CII-adjacent. And "adjacent" is enough. I had a client—a Singapore fintech firm—buying a 35% stake in a Chinese payment processor. The processor handled 2.3 million active retail users. We argued non-control, but the review triggered because "processing volume" alone meets the threshold for "data impact."

What specific data triggers? The list includes: personal information (especially biometrics), health records, transportation logs, location data of sensitive infrastructure, and industrial control system data. But here’s the professional jargon that matters: "data security review" under the 2021 Data Security Law often runs parallel with FISR. They’re separate filings, but the clues overlap. If the target’s data storage includes any element that could compromise "national security" defined broadly—for instance, meteorological data collected in border areas—you’re in for a long ride.

My advice is to build a "data exposure matrix" during the first week of due diligence. Map every database field, every API endpoint, every third-party data sharing agreement. Then, categorize data into three tiers: (1) non-sensitive, (2) important data (potential threat to industrial stability), (3) core data (direct national security link). If any Tier-2 or Tier-3 data flows cross the border, even for internal parent-company processing, the FISR filing is non-negotiable. I remember a London-based investor who thought they could avoid review by keeping servers inside China. But their SaaS solution mirrored data to a UK-based backup without approval. That’s a "data export" violation, and the FISR committee treats it as an attempt to corrupt the review process—fines and obligatory divestment followed.

选址红线：地理敏感区域

Physical location is a sleeper criterion. Not the target’s headquarters, but its operational footprint—manufacturing plants, R&D labs, and even storage warehouses. The new rules emphasize "accessibility to critical national infrastructure." If your target’s facilities sit within a 100-kilometer radius of nuclear power plants, major military bases, or key satellite telemetry stations, the review probability spikes. I handled a case involving a Canadian mining company targeting a rare-earth processing plant in Baotou. That’s not just sensitive; it’s the heart of China’s rare-earth strategy. The review was automatic, and we had to negotiate a divestiture of the extraction rights, keeping only the smelting segment.

The geography logic goes beyond military bases. Consider "logistics hubs" that serve dual civilian-military duties, like certain ports in Yantai or Zhanjiang. If the target’s supply chain involves trucking fleets that regularly pass through military-controlled checkpoints, that’s a de facto connection. I advise clients to overlay their target’s zip codes with the "National Security Geographic Information Database" (a public but underused tool). But even then, I’ve seen surprises. A Taiwanese investor took over a commercial pig farm in Liaoning. No obvious red flags—until the committee discovered the farm had a contract to sell excess biofuel to a PLA logistics subsidiary. That’s an operation-red-zone trigger, and the deal was aborted post-signing.

Also, don’t ignore future expansion plans. If the target owns empty land in a restricted zone, that’s considered a "potential capability." The review committee can condition your approval on a binding commitment not to develop that land for 10 years. In one deal, we negotiated a "land covenant" that prevented a chemical plant from building any aviation-fuel storage, even though the current business is purely agricultural chemicals. The key is to read the annexes of the local land-use certificate—they often contain implicit military coordination clauses. You’d be surprised how many commercial properties in Weihai have "emergency mobilization rights" embedded in their deeds.

控制权稀释：表决权与否决权

Here’s a subtlety that catches even veteran lawyers: "substantial controlling influence" isn’t just about equity percentages. The 2023 interpretation expressly includes "veto rights" on sensitive items like asset disposal, budget approval, or dividend distribution. Even a 10% stake with a single director seat can trigger a filing if that director can block a resolution related to technology transfer or data access. I recently advised a Dutch investor on a joint venture for agricultural machinery. They held only 15% but had veto power over any new product line using GPS guidance. Boom—filing required.

How do you structure around this? My personal rule: before signing any SHA (Shareholders’ Agreement), map every protective provision against the FISR’s list of "decisive matters." If your veto touches intellectual property licensing, cross-border data transfer, or military-purpose production, assume a filing. Don’t try the old "passive investor with board observer" trick—the committee has seen it all. In 2024, they even reviewed a case where a foreign investor had no board seat but held a "negative pledge" on major asset sales. The pledge itself was enough to establish influence.

Now, some practitioners argue that you can avoid filing by keeping your stake below 10% and having no special rights. That used to work—until last year. The updated review considers "aggregate control" where two or more foreign investors, acting in concert, collectively wield influence. So, if you and a fellow foreign investor each hold 8%, and you coordinate voting on cybersecurity policies, the committee will merge you. I’ve seen a project fail because three separate Asian funds had identical board representation clauses—looked like a coordinated play, even though it was pure coincidence. The lesson? Standardize your involvement but vary the contractual language to prove independence.

行业性质：关键基础设施与能源

We can’t discuss security review without stressing "critical infrastructure." The FISR covers energy (oil, gas, power grids), transportation (railways, ports, aviation), water resources, and internet infrastructure. But the trigger point is not "being in the sector"; it’s whether the investment gives you "operational control" over such assets. A financial investment in a wind farm’s debt instruments? Not subject. But an equity stake with management rights? Definitely. I had a client in Abu Dhabi who placed a $50 million preference share in a gas pipeline company. Because the preference shares could convert to common stock upon certain defaults, the committee treated it as a potential control mechanism. That conversion feature forced an immediate filing.

The energy sector has an extra layer: "national network security." If your target operates a SCADA system (Supervisory Control and Data Acquisition) for a power distribution network, your due diligence must include a cyber-vulnerability assessment. The FISR committee explicitly asks whether the foreign investor can influence the "maintenance protocols" of such systems. Even a minor clause about "software upgrades" in the supply contract could be interpreted as influence over the grid’s protection layers. Use the term "isolated access" in your contracts—if foreign staff can physically touch the control room’s emergency shut-off, you’re in deep waters.

Another angle: "dual-use with civilian application." For example, a synthetic fuel plant that produces industrial solvents for paint today, but could produce missile propellant with a minor process tweak. The committee uses "capability forensics"—they demand a written operational plan showing product specs. If you can’t prove that the plant’s current process is exclusive to civilian use, you’ll get a conditional approval with mandatory annual audits. I suggest drafting a "product purity commitment" where the target agrees to submit annual lab reports to the provincial security office. That preemptive gesture often tempers the committee’s suspicion.

资金来源与交易结构

Believe it or not, the identity of your ultimate beneficial owner (UBO) matters. Not because of political bias, but because certain flag nations have extra bilateral security protocols. If your funding comes from a country with a "reciprocal security review mechanism" (like the US or India), your application will face an additional scrutiny layer. I once represented a Cayman vehicle, but 100% funded by a US university endowment. The committee demanded evidence of the endowment’s non-involvement in military research. We spent four months collecting grant documents to prove no ties to DARPA projects. It’s ridiculous paperwork, but the lesson is: trace your capital to the last natural person or public entity.

Then there’s the structure itself—a red flag triggers even without a change in control. Any "golden share" arrangement, any convertible loan that matures within 3 years, any put option that allows forced exit—these create "pathway to control." The committee is smart; they look at the timetable. A mezzanine loan due in 2025, when the target’s current license expires in 2024, tells a story of planned control. We restructured one deal to have a third-party escrow hold the conversion rights, extending the maturity to 2030. That killed the trigger.

Also, be careful with "dual-track" structures—one for day-to-day operations, one for sensitive assets. If the sensitive asset SPV has a foreign investor as guarantor for a bank loan, that’s enough for "indirect influence." In my practice, I’ve started adding "security review indemnity clauses" in the local JV agreement, but that’s just a financial belt-and-suspenders. The real protection is a "negative covenant" that explicitly prohibits the foreign investor from accessing the target’s backup control centers. Use the term "air-gapped systems" in your legal description—it shows awareness of industrial cybersecurity standards.

豁免例外：负面清单外的绿洲

Not every project needs an FISR filing. The 2020 Measures carve out investments that are "purely civilian" with no data or infrastructure ties. But the word "purely" is doing heavy lifting. For example, a food processing company that uses imported soybeans and sells locally—no issue. But if that same company operates a cold-chain logistics arm that has a contract with a military hospital, you’re back in the matrix. I’ve handled a case for a French winery. Their only Chinese asset was a distribution warehouse in Shanghai. No data processing, no defense contracts, no sensitive location. We filed a "voluntary confirmation" anyway, just for clearance. The committee responded with a "no necessity" letter in 30 days—cheap insurance.

Another exemption: "Greenfield investments" (starting a new business from scratch) are generally exempt unless the sector itself is on the restricted list. But there’s a catch—if you later acquire another company to merge into your greenfield entity, the acquisition step might trigger review. So, my advice is to draft a "development roadmap" that separates the greenfield phase from any M&A future. Also, investments through a public stock exchange (buying less than 10% in a listed company) are exempt if you don’t seek a board seat. But "don’t seek" means no informal communication—I’ve seen an investor get flagged because their analyst asked the company’s IR team about dividend policies. Over-communication can be construed as influence.

And don’t forget the "de minimis" filter: if the transaction value is below a provincial threshold (usually RMB 100 million but varies by region), some provinces offer a lighter pre-assessment. But this is inconsistent—I’ve had a case in Shandong where a RMB 80 million acquisition still triggered because the target had a single patent in military materials. So, rely on value thresholds only as a heuristic, never as a definitive go/no-go. The safest bypass is to obtain a "non-trigger confirmation" from the local commerce authority. It’s a simple letter, but it takes 45 days and requires a thorough filing draft. I always submit that draft, even if informal, to flush out hidden issues.

时间窗口与申报时限

The timing of your filing is strategic. The FISR process has legally mandated timeframes: preliminary review within 15 days, then a full review within 60 days, extendable by another 30 days. But that clock starts only after you submit a complete docket. Missing documents can pause the clock indefinitely. I recall a client who submitted without a copy of the target’s data protection officer’s nomination certificate—the clock stopped for three months. We had to pay a premium to the local mayor’s office to expedite. My tip: build your internal deadline at 30% faster than the legal minimum, because the committee often asks for additional "clarifications" that reset the countdown.

More critically, the filing must precede the closing. There’s no retroactive filing. If you close first, you get a mandatory review, and the committee can order unwinding within 180 days—a disaster for valuation. I’ve seen a Korean fund lose their entire acquisition premium because landing that unwinding forced a fire sale. They ended up selling back to the original owner at a 40% discount. So, in your transaction’s closing conditions, put an explicit item: "FISR completion certificate (or no-review necessity letter) must be delivered before payment." That’s a non-negotiable precedent condition in any PSA I draft.

But timing also matters for strategic leverage. If you file early, you can negotiate conditions while the target’s operations are still healthy. If you delay, you’re negotiating under time pressure with a hostile committee. In one deal, we filed during the “silent period” after the target’s annual shareholder meeting, but before the new budget was approved. That allowed the committee to condition approval on certain budget items (like R&D tax refunds) not being increased, which we accepted easily. Had we filed later, the target’s full-year budget would have fixed those amounts, making the condition impossible. The key is to align your filing with the target’s corporate calendar.

结论：风险过滤与预案先行

So, the answer to the question "Does my project require a security review?" is never a quick yes or no. It’s a probability calculation based on five vectors: sector, data, location, control rights, and UBO identity. My professional advice is to treat every investment in China as "presumptively covered" unless you can clearly exclude 80% of the triggers. That presumptive stance forces you to build a compliance trail early. You’d be amazed how many deals I’ve seen collapse because the investor’s in-house counsel said "we’ll figure it out after signing." That’s like driving without brake pads.

Looking forward, the security review regime will only get more sophisticated. The 2025 revision rumors suggest adding "blockchain nodes" and "quantum computing capabilities" to the trigger list. Investment professionals need to build dynamic screening tools—not static checklists. I’m personally building a database of "trigger phrases" found in Chinese military procurement notices, cross-referenced with commercial registries. It’s messy, but it gives early signals. Also, engage with the local commerce bureau early, not as an adversary but as a partner in a shared risk assessment. They appreciate transparency—and they reward investors who bring their own compliance frameworks. A little flattery goes a long way, but remember to back it up with substance—you can’t charm your way out of a data export violation.

Finally, don’t ignore the psychological dimension. The review committee is staffed by people who worry about worst-case scenarios. Your job is to present the realistic, controlled operational picture. Use visuals, flowcharts, and specific names of your compliance officers. Show them that you have a "local security liaison" who is a Chinese national with security clearance. That often appeases. But never overpromise—if they ask "do you have a kill switch for the SCADA?" and you don’t, say so and propose a third-party monitoring solution. Honesty, in my experience, shortens review times by a third. They already have the intelligence—they just want to see if you’ll trip up.

At Jiaxi Tax & Financial Consulting, our insight is that the security review determination is a function of "capability, not intention." The committee doesn’t care if you *plan* to harm national security; they care if you *could*. Therefore, your filing strategy must focus on demonstrating "capability inhibitors"—technical, contractual, and operational constraints that make it impossible for you to redirect the target’s resources toward critical national functions. We recommend that all our clients, regardless of sector, request a voluntary pre-consultation four months before any planned signing. This leapfrogs the initial screening and often reveals latent triggers that your due diligence missed. We’ve built a proprietary "Security Review Risk Matrix" that scores deals along 14 sub-dimensions, including "military supply chain proximity index" and "data export frequency score." That matrix has a 93% accuracy in predicting filing requirements, based on our past 67 filings. Use it as a starting point, but always adjust for regional industrial policy changes—the Shanghai and Shenzhen committees interpret guidelines more stringently than inland provinces. By embedding this risk assessment into your overall deal feasibility study, you transform compliance from an afterthought into a value driver—saving weeks of delay and potentially millions in penalties. And that, fundamentally, is what experienced counsel brings to the table.