by Les P. Carnegie, John H. Chory, Benjamin A. Potter, Rachel K. Alpert, and Erica S. Koenig

On February 13, 2020, two Final Rules published by the US Treasury Department implementing changes to the foreign investment review process administered by the Committee on Foreign Investment in the United States (CFIUS) became effective. The Final Rules include provisions pertaining to certain investments in the United States by foreign persons (PDF: 479 KB), as well as provisions pertaining to certain transactions by foreign persons involving real estate in the United States (PDF: 406 KB). This post provides an overview of the areas of the Final Rules that may affect technology companies and their investors.[1]

Transactions Subject to CFIUS Review and Filing Requirements

The Final Rules expand CFIUS’ jurisdiction to reach non-controlling and non-passive investments by foreign investors in US businesses involved in (1) critical Technology, (2) critical Infrastructure, or (3) sensitive personal Data (so-called TID US businesses) in which the foreign investor is afforded certain triggering rights, such as board or observer rights, access to material non-public technical information about the TID US business, or involvement in the substantive decision-making of the TID US business. A few nuances to CFIUS’ jurisdiction over TID US businesses are particularly relevant to technology companies.

Jurisdictional Limitations

The Final Rules clarify that not all US businesses involved with critical technology are TID US businesses. For example, if a US business produces an item using a critical technology component from a third party, and if the role of the US business is limited to merely verifying the fit and form of the third-party-supplied component, the US business is not a TID US business.

The Final Rules also provide much-needed relief to US critical technology businesses that were subject to the CFIUS Pilot Program’s filing requirement solely because they were involved with items subject to certain encryption controls under the Export Administration Regulations (EAR) but eligible to take advantage of License Exception ENC.

Emerging Technologies

The Final Rules continue to include “emerging and foundational technologies” in the definition of “critical technologies.” The technologies that constitute emerging and foundational technologies are being determined through an interagency process, which is anticipated to result in a proposed rule for new Export Control Classification Numbers (ECCNs) on the EAR’s Commerce Control List. Once these emerging and foundational technologies are identified in new ECCNs, they will become part of the CFIUS critical technology landscape.

On November 19, 2018, the US Department of Commerce’s Bureau of Industry and Security (BIS) published an advance notice of proposed rulemaking (PDF: 222 KB), seeking public comment on the criteria for identifying emerging technologies that are essential to US national security. At the time, BIS identified 14 categories of technology under consideration, including artificial intelligence; biotech; robotics; position, navigation, and timing (PNT) technology; microprocessor technology; additive manufacturing; advanced computing technology; hypersonics; and advanced surveillance technologies.

The timing of a new rule identifying emerging technologies and corresponding new ECCNs remains unclear, but its publication will mark another significant development for CFIUS, as well as for US export control.

When a CFIUS Filing Is Required

Foreign investors will be required to file with CFIUS in connection with certain investments involving “critical technology” as well as certain investments in TID US businesses by parties in which a foreign government has a “substantial interest.”

Pilot Program

The CFIUS Pilot Program already requires review by CFIUS of non-passive investments by foreign persons in US businesses that produce, design, test, manufacture, fabricate, or develop one or more “critical technologies” either used in connection with or designed specifically for one or more of 27 specified pilot program industries. This Pilot Program is now incorporated as a permanent part of the final CFIUS regulations, with certain changes (including, among others, the removal of basic encryption items subject to License Exception ENC from consideration as a critical technology).

Foreign Government

With certain exceptions, a CFIUS filing will be required for transactions in which a foreign person acquires a “substantial interest” in a TID US business if a foreign government has a substantial interest in the foreign investor. A foreign government has a substantial interest in the foreign investor if the foreign government has a 49% or greater direct or indirect voting interest in the foreign investor. A foreign investor has a substantial interest in a TID US business if the investment gives the foreign investor a 25% or greater direct or indirect voting interest in the TID US business. Notably, the Final Rules clarify that limited partnership interests held by a foreign government generally do not count toward the substantial interest test.

Penalties

If parties fail to make a mandatory CFIUS filing, CFIUS can assess a civil monetary penalty against the foreign investor, the US business, or both, up US$250,000 or the value of the transaction, whichever is greater.

Format

Like in the Pilot Program, under the Final Rules, parties generally have a choice of filing either a short form declaration or a full notice to CFIUS.

Declarations and full notices each have advantages and disadvantages. A declaration can be prepared more quickly than a full notice, and CFIUS completes its review of a declaration in 30 calendar days as opposed to the two to four months or longer that its review of a full notice takes. However, filing a full notice necessarily leads to a final decision by CFIUS, whereas filing a declaration can lead to an inconclusive result—CFIUS can ask the parties to file a full notice after finishing its 30-day review of a declaration, or can conclude its review of a declaration without clearing the investment, meaning that the parties must file a full CFIUS notice to obtain protection against post-closing review of the transaction.

CFIUS’ Jurisdiction to Review Transactions That Do Not Require a Filing

CFIUS also has jurisdiction to review the following three types of transactions in which a filing is not required:

• Control transactions: CFIUS retains jurisdiction to review any transaction that could result in control of a US business by a foreign person. The final CFIUS regulations define “control” broadly to encompass certain minority investments. Importantly, the Final Rules maintain the carve-out from CFIUS’ jurisdiction for transactions that result in a foreign person holding 10% or less of the outstanding voting interest in a US business “solely for the purpose of passive investment.” A US business is a business that engages in interstate commerce in the United States.
• Certain non-controlling TID US business investments: Now that the Final Rules are effective, CFIUS has jurisdiction to review non-passive investments in a TID US business by a foreign person if the investment affords the foreign person any of the following triggering rights identified in the Final Rules, even if the investment does not give the foreign person control of the US business:
  • Access to material non-public technical information of the US business regarding its critical technology or its covered investment in critical infrastructure
  • Membership or observer rights on, or the right to nominate an individual to a position on, the board of directors or equivalent governing body of the US business
  • Involvement, other than through the voting of shares, in substantive decision-making of the US business regarding the business’ critical technology, the operation or supply of a covered investment in critical infrastructure, or the use of sensitive personal data of US citizens
• Certain real estate investments: Now that the Final Rules are effective, CFIUS has jurisdiction to review transactions involving the purchase or lease by, or concession to, a foreign person of real estate in the United States located within (or functioning as a part of) an airport or maritime port, or in “close proximity to” a US military installation or other facility “sensitive for reasons relating to national security.”

When CFIUS has jurisdiction to review an investment but a CFIUS filing is not required, the parties should consider carefully whether to make a voluntary filing to obtain CFIUS clearance. Absent such a clearance, CFIUS retains the right to force a filing of a transaction after signing or even after closing—with the possibility that CFIUS may impose conditions on the deal (called “mitigation”) or even recommend to the President of the United States that the President block or unwind the transaction. In most cases, once CFIUS clearance has been received for a control transaction, the parties to the transaction benefit from safe harbor from further review. The decision whether to make a voluntary filing with CFIUS depends on a variety factors, including the national-security risks associated with the foreign investor and the US business, the deal timing, and the parties’ tolerance for the possibility of a CFIUS review after signing or closing. Notably, CFIUS is devoting considerably more resources to identifying so-called “non-notified” transactions. It is important to note that there is no time limit for CFIUS to exercise jurisdiction and force a filing. 

Transactions Not Subject to Filing Requirements or CFIUS’ Jurisdiction

While the new regulations significantly expanded the scope of CFIUS, the following types of transactions will not be subject to filing requirements or CFIUS’ jurisdiction.

Transactions Involving Only Non-Foreign Investors

CFIUS does not have jurisdiction to review transactions involving only non-foreign investors unless an investor is ultimately controlled by a foreign person. As in the current CFIUS regulations, and in general terms, an entity qualifies as a foreign person if:

• It is organized under the laws of a country other than the United States.
• Its principal place of business is outside the United States or its equity securities are primarily traded on one or more foreign exchanges—unless the majority of its equity interests are ultimately owned by US nationals.

Transactions Involving Certain Investment Funds

As required under the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA), certain transactions involving investment funds are excluded from the expanded scope of CFIUS’ jurisdiction for non-controlling investments in TID US businesses (but not from the expanded jurisdiction for real estate investments). In addition, filings are not required for qualifying transactions involving investment funds.

Transactions Involving Investors with Close Ties to Australia, Canada, or the United Kingdom

FIRRMA requires CFIUS to exempt investors from some countries from the expanded scope of CFIUS’ jurisdiction for non-controlling investments in TID US businesses and real estate investments. As alluded to in the proposed regulations in September 2019, the Final Rules identify a short list of “excepted” foreign states: Australia, Canada, and the United Kingdom. The Final Rules note that the list could be expanded in the future.

To qualify as an excepted investor, a party must satisfy several requirements establishing close connections to one or more of the excepted foreign states and/or the United States. For example, at least 75% of the foreign investor’s board members and all individuals holding 10% or more of the voting interests in the investor must be from an excepted foreign state or the United States. Even if a foreign investor satisfies these requirements, it will not be eligible for the exception if it has been found to have violated certain US laws, regulations, and orders. For instance, the foreign investor will not be eligible for the exception if it has been notified of a breach of a CFIUS mitigation agreement; if it has received a finding of a US sanctions violation by the Office of Foreign Assets Control; if it has been debarred by the US State Department, or if it has been identified on the Commerce Department’s Entity List or Unverified List.

Transactions Involving Investors Subject to Other Governmental Oversight

Some foreign investment transactions that are already subject to US government oversight do not need to be notified to CFIUS. For instance, for investments involving critical technology, the Final Rules exempt from the CFIUS filing requirement certain investments through an entity that is already subject to a security control agreement, special security agreement, voting trust agreement, or proxy agreement to offset foreign ownership, control, or influence (so-called FOCI) pursuant to the National Industrial Security Program regulations. However, the fact that a transaction involves an entity operating under such an agreement does not exempt it from CFIUS’ jurisdiction or the filing requirement for transactions in which a foreign government has a substantial interest. So a CFIUS filing may still be warranted under certain circumstances.

How the Final Rules Impact Investment Funds

One important implication for investment funds is the new definition of “principal place of business.” The Final Rules define principal place of business, in the case of a fund, as the place “where the fund’s activities and investments are primarily directed, controlled, or coordinated by or on behalf of the general partner, managing member, or equivalent.” This definition clarifies for investment funds whether a transaction is subject to CFIUS’ jurisdiction, and seeks to ensure that a fund’s principal place of business is the same across federal, state, and foreign government filings.

The Final Rules also retain the clarification that excludes from CFIUS’ jurisdiction certain non-controlling indirect investments in TID US businesses through investment funds in which:

• The fund is managed exclusively by a general partner or equivalent that is not a foreign person.
• If there is an advisory board or committee, the foreign person does not have the ability to control the fund’s investment decisions through the advisory board or committee.
• The foreign person does not otherwise have the ability to control the investment fund.
• The foreign person does not have any of the triggering rights discussed above (g., board or observer rights).

Key Takeaways

Now that the Final Rules are effective, technology companies and their potential investors will have to pay close attention as to whether the nature of the company’s business or the role of foreign investors in the proposed transaction (and how any investment fund involved is structured) will trigger CFIUS review and a potential CFIUS filing obligation. While the Final Rules provide relief to certain technology companies in the encryption space or companies that merely integrate third-party critical technology into their products, many technology companies interested in transactions involving foreign investors will not be able to avoid the scope of CFIUS’ jurisdiction.

Footnotes

[1] For a more comprehensive discussion of the final CFIUS regulations, see Latham & Watkins LLP, Client Alert: Final CFIUS Regulations Implementing FIRRMA Take Effect in February 2020: 10 Key Questions Answered (PDF: 128 KB). For an overview of foreign direct investment reviews in the United States and select countries, see Foreign Direct Investment Regimes App, Latham & Watkins LLP, which has been updated to reflect the Final Rules.

Les P. Carnegie, John H. Chory, and Benjamin A. Potter are partners, and Rachel K. Alpert and Erica S. Koenig are counsel, at Latham & Watkins LLP.  

Disclaimer

The views, opinions and positions expressed within all posts are those of the author alone and do not represent those of the Program on Corporate Compliance and Enforcement (PCCE) or of New York University School of Law.  PCCE makes no representations as to the accuracy, completeness and validity of any statements made on this site and will not be liable for any errors, omissions or representations. The copyright of this content belongs to the author and any liability with regards to infringement of intellectual property rights remains with the author.