CFIUS reviews “certain transactions involving foreign investment into businesses in the United States and certain transactions by foreign persons involving real estate in the United States” to understand the effect of such transactions on the United States’ national security. CFIUS enforces compliance with statutes, regulations, and negotiated agreements, using its ability to impose civil monetary penalties and other remedies.

The proposed rule has three key components. First it expands the subpoena authority to acquire information from “third persons not party to a transaction notified to CFIUS and in connection with assessing national security risk associated with non-notified transactions.” This will allow CFIUS to obtain more information for non-notified transactions, which CFIUS indicated would help it better assess which non-notified transactions require further review. Second, CFIUS would have increased authority to impose harsher penalties on those that provide incomplete or misleading information or otherwise violation CFIUS rules and regulations. The base maximum would be raised from $250,000 to $5,000,000. Lastly, the rule would institute an extendable timeline for parties to respond to risk mitigation proposals to allow CFIUS to conclude reviews or investigations within “the statutory time frame.” Importantly, parties will only have three business days to respond to risk mitigation proposals, which could create time crunches for negotiating with CFIUS.

Other items in the proposed rule include:

• Expanding the scope of information CFIUS can require of transaction parties and other persons on transactions not filed with CFIUS.
• Extending the deadline for submissions for reconsiderations of penalties.

Parties affected by the rule have until May 11th to submit comments to Treasury. Those who frequently engage in the CFIUS review process may wish to submit comments during this time.

Please contact our CFIUS, export controls, and sanctions team if you need assistance navigating these latest developments.

On October 20, the Committee on Foreign Investment in the United States (CFIUS or the Committee) issued a press release laying out new guidance to provide clarity about how the Committee assesses violations of the laws and regulations that govern transaction parties, including potential breaches of CFIUS mitigation agreements.

Penalties are possible for the following behavior:

• Failure to File – After the 2018 and 2019 amendments to the CFIUS rules, certain CFIUS filings are now mandatory, including those where the U.S. target makes or holds information related to making items that are controlled for export. Many companies (especially those that don’t export) are not aware that their products (or existing know-how) are controlled for export. Moreover, the scope of export controls has been expanding, which in turn expands the scope of covered CFIUS transactions.
• Non-Compliance with CFIUS Mitigation – When CFIUS has national security concerns about a transaction that it believes can be mitigated through restrictions on foreign national access to technology and via other limiting steps, it will sometimes agree to allow the transaction to proceed, but only if specific, agreed mitigating steps are are fully followed, often described in national security agreements. The new guidance emphasizes that CFIUS will be watching more carefully for compliance with those agreements and that penalties await companies that do not comply.
• Material Misstatement, Omission, or False Certifications to CFIUS during a Review Process – If a party to a CFIUS review makes material misstatements, omissions, and/or false certifications in their documentation filed with CFIUS, then that party could be seen as inhibiting the Committee’s ability to conduct a comprehensive review, and that risks imposition of a penalty.

We expect to see announcements of penalties going forward.

The new approach implements the requirements of the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA, which amended the prior CFIUS statute) to clarify whether a review will be required of foreign investments by CFIUS for "critical technology businesses." In short, mandatory review requirements now turn on whether an export license would be required to release export controlled “critical technology” (the know-how required to develop, produce and in some cases to use export controlled items) to the foreign investor country/personnel. There are a few wrinkles related to export license exceptions, but those can be evaluated on a case-by-case basis for proposed acquisitions and investments.

This new approach provides more certainty for both U.S. and non-U.S. companies evaluating proposed investments in the U.S. as it relies on a long-established approach to the identification of export controlled know-how. That said, many U.S. companies make products that are subject to export controls and this new approach makes it clearer than ever that more foreign investment in the U.S. will be subject to mandatory CFIUS filings. The ruling also puts some additional pressure on BIS to continue its progress toward identifying emerging and foundational technologies that should be added to existing traditional export control lists, which are primarily based on multilateral agreements, with some important additional unilateral U.S. controls. As part of that effort, Commerce re-started its moribund Emerging Technologies and Research Technical Advisory Committee as one part of its effort to identify new technologies for export control.

The recent expansion by BIS of controls on a series of relatively low level technologies for military end use and end users (and those who provide “support” for those users) in China, Russia and Venezuela is likely to trigger even more mandatory filings, particularly for proposed Chinese investment. The newly expanded scope of controls for military end users includes a broad swath of relatively basic products, including such common items as stainless steel plate, most industrial pumps and a variety of commonly used valves, items that are commonly traded and not typically thought of as sensitive from a national security standpoint. That said, not all of the newly-listed control categories have associated technology export controls. Sorting out what is controlled for export and what is not for a particular proposed investment will be critical to determining CFIUS filing strategy.

Under FIRRMA, CFIUS is authorized to impose filing fees that may not exceed the lesser of one percent of the value of a transaction or $300,000. The proposed rule would authorize CFIUS to collect fees pursuant to a set schedule tied to the value of a notified transaction. Specifically, the filing fees are:

• $750 for transactions between $500,000 and $5 million;
• $7,500 for transactions between $5 million and $50 million;
• $75,000 for transactions between $50 million and $250 million;
• $150,000 for transactions between $250 million and $750 million; and
• $300,000 for transactions over $750 million.

The filing fees would be required for any full joint voluntary notice filed with CFIUS, however, would not apply to short-form declarations filed with CFIUS or to CFIUS-initiated reviews. If after review of a declaration CFIUS determines that a full joint voluntary notice is necessary, the filing fee would be required. The fee would be required prior to the Committee’s acceptance of a joint voluntary notice for review.

CFIUS is accepting comments regarding the proposed rule until April 8, 2020.

Covered real estate transactions

To qualify as a “covered real estate transaction” transaction within Part 802, a transaction must confer certain property rights to covered real estate. Specifically, a transaction is covered only if it allows a foreign person at least three from the following property rights: 1) access the real estate; 2) exclusion of others from the real estate; 3) improve and/or develop the real estate; 4) attach fixed or immovable structures and/or objects to the real estate. Holding these rights concurrently with another party, including a U.S. party, does not remove such a transaction from CFIUS jurisdiction.

Exceptions

• Excepted real estate investors: certain individuals, governments, and entities meeting a series of factors, provided that they are from an “excepted real estate foreign state.” Currently, the excepted real estate foreign states are Australia, Canada, and the UK, though this list has the potential to expand.
• Urbanized areas and urban clusters: real estate transactions that are within urbanized areas or urban clusters, as defined by the U.S. census, are excepted unless they are in close proximity to a military site or within, or functioning as a part of, a covered port.
• Other exceptions are available for certain commercial office space and individual housing units, among other enumerated exceptions.

These final rules become effective February 13, 2020, and will be located at 31 C.F.R. Part 802.

[1] Transactions in real estate that qualify as controlling investments in a U.S. business continue to be subject to CFIUS jurisdiction pursuant to 31 C.F.R. Part 800 under the traditional “control” analysis.

Jurisdiction over non-controlling investments

The draft regulations identify several company types that satisfy the first part of the test. The first type is a business that produces or otherwise deals in certain “critical technologies.” A separate statute[2] authorizes the Department of Commerce to identify these critical technologies. Although the Department of Commerce did identify examples of these technologies in a 2018 rulemaking, that process is not yet complete.

The second type is a business that maintains or otherwise deals in sensitive personal data of U.S. persons. The scope of sensitive personal data is likely to be very broad in practice, but must be able to be used to identify a person by a “personal identifier.” There are limited exceptions that include anonymized data. In practice, financial firms, insurance firms, firms collecting medical information, and firms in industries that collect similar types of personal identifier information, including certain internet and media firms, are very likely to fall within this type of company.

The final type is a business that owns, operates, manufactures, or otherwise performs a function specified in the regulations in critical infrastructure, which includes infrastructure that, if incapacitated, would have a “debilitating impact” on U.S. national security. Examples of such “covered investment critical infrastructure” includes certain internet protocol networks; certain internet exchange points; certain submarine cable systems and facilities; satellite systems that provide services directly to the U.S. Department of Defense or a related component; certain specialty metals and carbon, alloy, and armor steel plates; systems related to the storage of electric energy comprising the bulk-power system; and several others

The draft regulations specify that, to satisfy the second part of this test, the foreign investor must gain access to certain enumerated rights. These enumerated rights include access to material, non-public, technical information, which includes information that provides information regarding critical infrastructure, or provides information regarding critical technology; membership or observer rights on the U.S. company’s board of directors; and any involvement, outside of voting rights provided by shareholding, in substantive decision making processes.

Mandatory filing types

The expanded jurisdiction regarding critical technology was initially rolled out in the Pilot Program prior to these draft regulations, which identified 27 specific technologies subject to the rules. These draft regulations do not alter the Pilot Program, though we do expect that the final version of the regulations will include information about the Pilot Program.

Further, any transaction resulting in a foreign government obtaining a “substantial interest” in a critical technology, critical infrastructure, or personal data company is subject to a mandatory filing. In general, if the foreign government owns at least a 49 percent voting interest in the foreign person acquiring the U.S. business, and the foreign person is acquiring at least 25 percent of the U.S. business, that would qualify as a substantial interest.

Putting the mandatory filing provisions aside, in general, the proposed FIRRMA implementing regulations codify, rather than expand, the current jurisdiction already exercised by CFIUS in practice. The rulemaking is a clear indication, however, that CFIUS intends to continue to review non-U.S. investments in critical infrastructures and technologies. Moreover, other aspects of FIRRMA – including those related to the imposition of penalties – suggest a more proactive CFIUS going forward.

[1] Currently, the proposed regulations are in a notice and comment period, and there are likely to be some changes in the final rules. However, the basic outline of the changes are unlikely to change substantially.

[2] The Export Control Reform Act of 2018, which was also part of the broader National Defense Authorization Act package that included FIRRMA, is this authority.

Expansion and clarification of jurisdiction

FIRRMA both expands CFIUS jurisdiction and codifies certain existing practices. CFIUS reviews certain “covered transactions” to determine whether proposed foreign investments in a U.S. business would impair U.S. national security, and has the authority, along with the president, to block or amend transactions. Under current law, a “covered transaction” requires that a foreign person have effective control over a U.S. business.[2] FIRRMA expands CFIUS jurisdiction to several non-controlling transactions, if the investment involves:

• Critical technologies. This includes items or technology that are subject to export controls under either the International Traffic in Arms Regulations (“ITAR”) or the Export Administration Regulations (“EAR”), as well as certain undefined “emerging and foundational technologies.”[3]
• Critical infrastructure. The Committee will “enumerate specific types and examples” of critical infrastructure, and will presumably include defense and military, energy, telecommunication, and financial infrastructure, among others. However, because the regulations will likely enumerate a non-exhaustive list, the Committee may interpret this term broadly.
• Sensitive personal data of U.S. citizens. This will broadly include consumer data, as well as information regarding financial services, insurance, and health care.

Other expansions of CFIUS jurisdiction include the Committee’s ability to review certain changes in a foreign investor’s existing rights in a U.S. entity, which could allow the Committee to review both the initial investment by a foreign person, as well as any future investment or change to an entity’s governance structure or authorities. Further, CFIUS may review transactions in real estate located near military facilities, ports, or other sensitive national security facilities. These expansions largely formalize our experience with current CFIUS practices. though it may signal the Committee’s intention to assert this jurisdiction more aggressively.

Administrative procedures and appeals

FIRRMA made significant changes to the CFIUS process, including changes regarding expedited reviews for less sensitive transactions, mandatory filings for certain transactions, timing of the review and investigation procedures, and transparency.

• Expedited reviews. CFIUS will permit parties to file a short “declaration,” rather than a full joint voluntary notice, describing less sensitive transactions. CFIUS will then have 30 days to respond to the declaration by either clearing the transaction or demanding a full joint voluntary notice.
• Mandatory filings. Under current law, submitting a transaction to CFIUS for review and investigation is a voluntary process. Although most transactions will remain subject to voluntary filing, CFIUS will require notification of transactions in which the U.S. business involves either critical infrastructure or critical technology, and a foreign government has a substantial interest in the foreign investor. CFIUS will define “substantial interest” in subsequent rulemakings.
• Review and investigation timelines. When considering a transaction, CFIUS currently has a 30-day review period and an additional 45-day investigation period, if necessary. FIRRMA extends both of these timeframes, automatically making the review period 45 days and allowing the Committee to extend the investigation phase to 60 days, if necessary.
• Increased transparency. CFIUS currently provides an annual report to Congress, but focuses almost exclusively on broad, aggregated statistics (such as the nationality of foreign investors and the economic sector of the U.S. business). FIRRMA will require CFIUS to report at least basic details regarding all reviews that include a full notice, which will include the results of the case. CFIUS will also be required to provide statistics on the length of time the CFIUS review process takes. The increased transparency will offer parties significantly more information regarding how CFIUS has handled transactions in the past and may allow the development of some baseline precedents.
• Judicial review. Currently, only very limited substantive due process appeal rights exist in the CFIUS context.[4] FIRRMA will allow appeals of CFIUS determinations to the DC Circuit Court of Appeals, though presidential determinations are not included in the right to judicial review.
• Filing fees. CFIUS will establish by regulation a filing fee for full notices, though the fee may not exceed either $300,000 or one percent of the value of the transaction. These fees will allow CFIUS to increase its staff to handle CFIUS’ notoriously heavy workload.

______________

[1] Although the majority of the statutory provisions will come into force 180 days after FIRRMA’s effective date, some provisions will be in force immediately after the president signs the bill, including the changes to the review and investigation period timeframes and the right to judicial review.

[2] In our experience, any transaction not meeting the regulatory 10 percent foreign ownership threshold has been potentially subject to CFIUS review.

[3] An interagency committee will be established to identify emerging and foundational technologies.

[4] See Ralls Corp. v. CFIUS.