- China’s foreign investment security review is a mandatory, two-stage regime administered by MOFCOM and NDRC under the 2020 Measures (Order No. 37), in force since 18 January 2021.
中国外商投资安全审查是由商务部与国家发展改革委依据2020年《外商投资安全审查办法》（第37号令，自2021年1月18日起施行）实施的强制性两段式审查制度。- Acquiring “control” of a Chinese entity in defined key sectors—defence, technology, energy, transport, and data-intensive industries—triggers review even where merger-control thresholds are not met.
在国防、科技、能源、交通及数据密集型等规定关键领域内取得中国实体”控制权”的交易，即便未达经营者集中申报标准亦触发审查。- The general review runs 30 working days; a triggered special national security review lasts at least 60 working days and is extendable, materially affecting deal timelines.
一般性审查时限为30个工作日；一旦启动特别审查，至少持续60个工作日且可延长，对交易时间表影响显著。- Deals closed without clearance can be unwound, restructured, or subjected to divestment and penalties, so pre-closing analysis is essential for inbound investors.
未经审查即完成的交易可能被责令恢复原状、变更或转让，并面临处罚，因此外资方在交割前开展分析至关重要。- As of 2026, scrutiny has intensified around critical and emerging technologies, semiconductors, and data-rich targets, reflecting a broader whole-of-government national security posture.
截至2026年，对关键及新兴技术、半导体以及数据富集型标的的审查明显趋严，反映出更广泛的整体政府国家安全立场。- Foreign investors should map the key-sector catalogue, consider minority or non-control structures, and engage qualified PRC counsel early to avoid irreversible remediation.
外资方应梳理关键领域目录，考虑少数股权或非控制型交易结构，并尽早聘请合格中国法律顾问，以避免不可逆的补救措施。
Foreign Investment Security Review in China: A 2026 Market-Entry Guide | 中国外商投资安全审查：2026年市场准入指南
The Regulatory Anchor: Order No. 37
The foreign investment national security review of the People’s Republic of China is governed by the 《外商投资安全审查办法》 (Measures for the Security Review of Foreign Investment), jointly promulgated by the National Development and Reform Commission (NDRC) and the Ministry of Commerce (MOFCOM) as Order No. 37 on 19 December 2020. The Measures entered into force on 18 January 2021 and remain the operative rulebook for 2026. They sit alongside—but are legally distinct from—the Negative List for market access and the SAMR-led antimonopoly merger-control system. A transaction can be perfectly lawful under the Negative List yet still be unwound for failing security review, a point that surprises many first-time entrants.
When Does a Review Trigger?
The Measures cast a wide net. Two principal scenarios require mandatory review:
- Military and adjacent zones. Any foreign investment in enterprises engaged in military-industrial production or in scientific research and design units serving national defence, and any foreign investment within the prescribed perimeter around military facilities and military-use ports, airports, and border crossings.
- Control of key-sector enterprises. Where a foreign investor acquires “control” (控制权) of a domestic enterprise whose business falls within the key areas enumerated in the Measures’ annex. These cover national defence and the military; agriculture, energy and mineral resources; infrastructure, transport, and utilities; and critical and emerging technologies.
“Control” is defined functionally—holding 50% or more of voting rights, or otherwise being able to exert a decisive influence over the target’s resolutions, board, or operations. Importantly, the review can bite even where the deal is too small to meet SAMR’s merger-notification thresholds, making it a trap for unwary minority-led acquisitions structured as control.
The Two-Stage Adjudicative Process
The system is deliberately sequential:
| Stage | What happens | Statutory timeframe |
|---|---|---|
| General review (一般性审查) | The inter-ministerial office screens the filing | 30 working days |
| Special review (特别审查) | Escalated to a national security assessment | At least 60 working days, extendable |
If the general review finds no national security concern, the transaction clears. If concerns arise, it escalates to the special review, which may impose conditions, prohibit the deal, or—retrospectively—order restructuring or divestment. Parties may also file voluntarily where uncertain, buying certainty at the cost of timetable.
Interaction with the Negative List and Other Regimes
Security review operates in parallel with the foreign investment Negative List. The 2024 edition of the 《外商投资准入特别管理措施（负面清单）》 issued by NDRC and MOFCOM continues to restrict or prohibit foreign investment in a catalogue of sectors; a transaction permitted by the Negative List is not exempt from security review. The same deal can concurrently require SAMR merger clearance, a CAC data-security assessment, and MOFCOM/NDRC security review. Sequencing these workstreams deliberately is now standard deal hygiene for China inbound M&A.
The 2026 Enforcement Posture
Although Order No. 37 dates from 2020, its application has sharpened. Entering 2026, reviewing authorities have visibly prioritised:
- Critical and emerging technologies, especially semiconductors, advanced computing, and dual-use items;
- Data-rich targets, where control would concentrate sensitive personal or important data in foreign hands;
- Infrastructure and utilities with geopolitical sensitivity.
This intensification tracks the broader national-security framing of the 2021 《数据安全法》 (Data Security Law) and the 2022 revised 《反垄断法》 (Anti-Monopoly Law), and the steady refinement of the foreign investment Negative List’s restricted catalogues. Inbound investors should assume that any deal touching these sectors will receive heightened scrutiny and should budget for the full special-review clock.
Practical Steps for Market Entrants
- Map the target against the key-sector annex before signing. A control transaction in a listed area is presumptively reviewable.
- Model alternative structures. Minority stakes, golden-share arrangements held by domestic partners, or contractual (rather than equity) control may avoid a “control” finding—each carries its own legal nuance and must be assessed on the facts.
- File early and voluntarily when in doubt. The 30-working-day general clock starts on acceptance; waiting until signing can compress the deal timeline dangerously.
- Build remediation into the SPA. Include conditions precedent, long-stop dates, and reverse termination fees calibrated to a possible special review.
- Coordinate with merger-control and cybersecurity reviews so that one clearance does not silently prejudice another.
Consequences of Getting It Wrong
Transactions completed without required clearance are vulnerable: the reviewing authority may order the foreign investor to dispose of the interest, transfer assets, change the structure, or restore the original state, and may impose penalties. Because unwinding a closed deal is costly and often practically impossible, the commercial risk is borne almost entirely by the buyer. For this reason, security-review analysis is now a standard workstream in any China inbound transaction involving sensitive sectors.
How This Compares Globally
The Chinese regime is frequently compared with the U.S. CFIUS process. Both are ex ante, national-security-oriented, and capable of blocking or conditioning foreign acquisitions. China’s system is distinctive in its explicit sector catalogue, its codified two-stage timeline, and its tight coupling with the Negative List and the data-security regime. Investors familiar with CFIUS will recognise the logic but should not assume the timelines or sector scope translate directly.
中国外商投资安全审查：2026年市场准入指南
制度基石：第37号令
中国的外商投资国家安全审查由《外商投资安全审查办法》规范。该办法由国家发展改革委与商务部于2020年12月19日联合发布（第37号令），自2021年1月18日起施行，并仍是2026年适用的规则基础。它与市场准入负面清单以及国家市场监管总局主导的经营者集中反垄断审查在法律上相互独立。实践中，一项交易即便完全符合负面清单规定，仍可能因未通过安全审查而被否决或撤销，这一点常令初次进入中国市场的投资者感到意外。
哪些交易触发审查？
《办法》的适用范围相当广泛，主要存在两类强制审查情形：
- 军工及邻近区域。 外国投资者对军工生产企业和军工科研设计单位，以及对军工设施、军用港口、机场、边境口岸周边划定区域内的投资。
- 关键领域企业控制权。 外国投资者取得境内企业”控制权”（控制权），且该企业经营业务落入《办法》附件所列关键领域，包括国防军工、农业、能源与矿产资源、基础设施、交通运输，以及关键和新兴技术。
“控制权”采功能化定义——持有50%以上表决权，或能够对被审查企业决议、董事会或经营施加决定性影响。值得注意的是，即便交易规模过小而未达市场监管总局的经营者集中申报标准，仍可能触发安全审查，这对以控制为目的、却采用少数股权安排的收购构成潜在陷阱。
两段式审查程序
该制度在程序设计上呈顺序递进：
| 阶段 | 审查内容 | 法定时限 |
|---|---|---|
| 一般性审查 | 联席会议办公室对申报进行筛查 | 30个工作日 |
| 特别审查 | 启动国家安全评估 | 至少60个工作日，可延长 |
若一般性审查未发现国家安全风险，交易即获通过。若存在风险，则进入特别审查，审查机关可附加条件、禁止交易，或在事后责令变更或剥离。当事人亦可在不确定时主动申报，以时间换取确定性。
与负面清单及其他制度的衔接
安全审查与外商投资负面清单并行。国家发展改革委、商务部发布的《外商投资准入特别管理措施（负面清单）》2024年版继续在目录中对部分领域采取限制或禁止。符合负面清单的交易并不豁免安全审查。同一项交易可能同时需要市场监管总局的经营者集中审批、网信办的数据安全评估，以及发改委/商务部的安全审查。审慎地统筹这些工作流，已成为中国 inbound 并购的标准操作。
2026年执法态势
尽管第37号令颁布于2020年，但其适用在近年明显趋严。进入2026年，审查机关明显优先关注以下领域：
- 关键和新兴技术，特别是半导体、先进计算与两用物项；
- 数据富集型标的，控制此类标的将使敏感个人信息或重要数据集中于外资之手；
- 具有地缘政治敏感性的基础设施与公用事业。
这一趋严态势与2021年《数据安全法》及2022年修订《反垄断法》所确立的广义国家安全框架一脉相承，也与外商投资负面清单受限目录的持续完善相呼应。外资方应预判：任何涉及上述领域的交易都将受到更高强度审查，并应为完整的特别审查时限预留预算。
市场准入实务步骤
- 签约前对照关键领域附件梳理标的。 在列明领域内取得控制权的交易，原则上具有可审查性。
- 设计替代交易结构。 少数股权、由境内合作方持有的”金股”安排，或合同控制（而非股权控制）可能避免构成”控制权”认定——但每种安排均有其法律细微差别，须依事实评估。
- 存疑时尽早主动申报。 30个工作日的一般性审查时限自受理起算；等到签约后再申报会严重压缩交易时间表。
- 在股权转让协议中嵌入补救机制。 设置先决条件、最晚截止日，以及针对可能出现的特别审查的反向终止费。
- 统筹经营者集中与网络安全审查，避免一项审批在无意中损及另一项。
违规后果
未经审查即完成的交易面临风险：审查机关可责令外国投资者转让股权、转移资产、变更结构或恢复原状，并可能处以处罚。由于已交割交易的撤销成本高昂且往往在实操中难以实现，商业风险几乎完全由买方承担。正因如此，安全审查分析已成为任何涉及敏感领域的中国 inbound 交易的标准工作流。
国际比较
中国的审查制度常被与美国 CFIUS 程序比较。二者均属事前、以国家安全为导向、并可禁止或附加条件于外资收购。中国的制度特点在于其明确的行业目录、成文的二段式时限，以及与负面清单及数据安全制度紧密耦合。熟悉 CFIUS 的投资者可识别其逻辑，但不应想当然地认为时限或行业范围可直接对应。
Sources
- 国家发展和改革委员会、商务部 (NDRC & MOFCOM) — 《外商投资安全审查办法》（2020年12月19日第37号令，2021年1月18日施行）
- 国家发展和改革委员会、商务部 (NDRC & MOFCOM) — 《外商投资准入特别管理措施（负面清单）》（2024年版）
- 商务部 (MOFCOM) — 外商投资安全审查申报工作指引及相关实施口径
- 国务院 (State Council) — 《国家安全战略》框架下外商投资国家安全审查相关部署