Foreign Investment 2020 (Part 5): Final CFIUS Rules Announced

The U.S. Department of the Treasury (Treasury) has released final regulations to implement the Foreign Investment Risk Review Modernization Act (FIRRMA), expanding the jurisdiction of the Committee on Foreign Investment in the United States (CFIUS). As we discussed in previous alerts in this series, the regulations provide long-awaited answers to questions about how Treasury and the other CFIUS member agencies will conduct national security reviews of foreign investment under the “modernized” FIRRMA construct.

Like the proposed rules released in September 2019, Treasury issued the final regulations in two parts, one pertaining to CFIUS’s general jurisdiction to review investments by foreign persons in U.S. businesses (Part 800), and another regarding CFIUS’s jurisdiction to review transactions not covered by Part 800 involving (or in close proximity to) certain U.S. real estate (Part 802). The critical technologies pilot program (Part 801) is disestablished, but its requirements are largely continued in Part 800.

In line with the changes called for in FIRRMA, the proposed regulations released last fall:

1. Significantly expanded CFIUS’s jurisdiction to review certain non-controlling foreign investments in U.S. businesses that involve critical technologies, critical infrastructure, and sensitive personal data (TID U.S. businesses), which was previewed in the critical technologies pilot program announced in October 2018 shortly after FIRRMA’s enactment;

2. Introduced a new CFIUS review regime for real estate transactions previously excluded from CFIUS’s jurisdiction, with rules based on the property’s geographic proximity to airports or maritime ports, or sensitive U.S. military and other government sites; and

3. Included different requirements for different types of foreign investors, including mandatory filing requirements for foreign government transactions, and the concept of “excepted foreign states” from which certain investors would be exempted from CFIUS’s expanded jurisdiction over TID U.S. businesses.

The final rules, which will become effective on February 13, 2020, are largely unchanged from the proposed rules, but include some important updates and clarifications regarding how CFIUS will conduct reviews with respect to these three key areas. Building on our previous alerts in this series, below we highlight several key takeaways from the final CFIUS regulations.

TID U.S. Businesses

• The Critical Technologies Pilot Program Is Ending, But Most of the Mandatory Filing Requirements Will Remain. The final rules disestablish the critical technologies pilot program introduced in October 2018, but move the key aspects of the program to Part 800. Specifically, as with the pilot program, mandatory CFIUS filings will be required for investments in a TID U.S. business involving critical technologies that afford a foreign investor “control” of the U.S. business (as defined in Part 800), board membership or observer rights, access to material nonpublic technical information (MNTI), or substantive decisionmaking rights with respect to critical technologies. The Part 800 rules, however, include some key exemptions to these mandatory filing requirements. These exemptions must be carefully analyzed before parties rely on them, but may apply in circumstances where:
  
  • The investment is by an “excepted investor” (discussed below);
  • The foreign investor is already subject to mitigation for foreign ownership, control, and influence (FOCI) in connection with the operation of a business with a valid facility security clearance;
  • The investment vehicle is a fund managed exclusively by, and ultimately controlled by, U.S. nationals; and
  • The U.S. business is a TID U.S. business solely because of certain non-sensitive encryption technology.

Treasury also noted that it plans to issue separate rules amending the criteria for U.S. businesses subject to the mandatory filing requirement so that they are based on export control licensing requirements rather than North American Industry Classification System (NAICS) codes. This change should simplify the classification of such businesses, given that the export control licensing requirements tend to be more precise and less subjective than NAICS codes.

• Clarification of Rules Relating to Sensitive Personal Data. The final rules provide clarifications and examples for U.S. businesses involving sensitive personal data, which may also qualify as TID U.S. businesses. They include an additional example of a case where an entity has a “demonstrated business objective” to maintain or collect identifiable data for greater than one million individuals, which is one of the ways a U.S. business can be covered by CFIUS’s expanded jurisdiction. Regarding genetic data—a category of data captured in the “sensitive personal data” definition—the final rules provide clarity in two ways. First, they focus the definition on “genetic tests” as that term is defined in the Genetic Information Non-Discrimination Act of 2008. Second, the coverage of the rules is limited to identifiable data. The rules also carve out genetic testing data derived from databases maintained by the U.S. government and routinely provided to private parties for the purposes of research.
• Board Membership or Observer Rights in a Parent Entity Is Imputed to Subsidiaries. The final rules include an example clarifying the application of CFIUS’s expanded jurisdiction over non-controlling “covered investments” in a parent entity that operates a TID U.S. business through a wholly owned subsidiary. Specifically, the example states that if the investment affords a foreign person membership or observer rights on the board of directors or equivalent governing body of the parent entity, the transaction is a covered investment subject to CFIUS review.

Treatment of Different Foreign Investors

• Initial List of Excepted Foreign States Announced. As discussed in our previous alert, “excepted investors” with sufficient ties to “excepted foreign states” are excluded from CFIUS’s expanded jurisdiction over non-controlling investments in the TID U.S. businesses. Treasury has initially selected Australia, Canada, and the United Kingdom as excepted foreign states due to their robust intelligence sharing and defense industrial base integration mechanisms with the United States. CFIUS may expand the list of excepted foreign states in the future, particularly following the two-year process specified in the final rules for determining whether additional foreign states have sufficient national security based investment review processes and bilateral cooperation with the United States to merit such an exception (and whether the existing excepted foreign states should maintain their excepted status).
  
  • The final rules also reduce the “minimum excepted ownership” percentage applicable to entities whose equity securities are not publicly traded on an exchange in the United States or an excepted foreign state from 90% to 80%, which will make it easier for certain foreign investors to qualify as excepted investors.
  • For excepted investors, the final rules loosen the requirement that each member of the investor’s board of directors must be a U.S. national or a national of an excepted foreign state (and not also a national of a non-excepted foreign state). Instead, only 75% or more of the board members, and 75% or more of the observers, must meet these criteria. The final rules also only require the holders of 10% or more of the outstanding voting interest in an excepted investor to be from the United States or an excepted foreign state, rather than the 5% voting interest threshold in the proposed rules.
• Interim Rule Changing the Definition of “Principal Place of Business,” and Opportunity to Comment. The CFIUS regulations rely in numerous instances on an entity’s “principal place of business.” That term, for example, can be relevant to determine important threshold matters like whether the investor is a “foreign entity.” The new rules define a party’s “principal place of business” as its “nerve center,” which is the primary location where an entity’s management directs, controls, or coordinates the entity’s activities (or, in the case of an investment fund, where the fund’s activities and investments are primarily directed, controlled, or coordinated).
  
  • However, if the entity believes its “nerve center” is the United States, but it represented in its most recent submission to the U.S. government or a foreign government entity that its principal place of business (or equivalent) is outside the United States, the prior representation will prevail for CFIUS purposes unless the entity can demonstrate that its nerve center subsequently changed. In other words, it is important for an entity to be consistent in identifying its principal place of business (or equivalent) in government filings.
  • Because this new definition was not included in the proposed rules, Treasury is publishing it on an interim basis and has invited public comments through February 13, 2020, in particular with respect to whether the new definition adequately addresses concerns seeking greater clarity concerning investment funds managed and controlled by U.S. persons.

Real Estate Regulations

• New Web-Based Tool Expected to Help Determine Close Proximity. Treasury anticipates that it will make available a web-based tool to help the public understand the geographic coverage of the new real estate rules in Part 802, which relate to properties within “close proximity” to sensitive U.S. military and other government sites. Until the new tool launches, Treasury has directed interested parties to other resources currently available online. For example, the Census Bureau within the Department of Commerce maintains a web-based system, TIGERweb, which allows users to select features (e.g., military installations, urbanized areas, and urban clusters) and view such attributes on a map. The National Oceanic and Atmospheric Administration and the Bureau of Ocean Energy Management also maintain web-based maps delineating U.S. maritime boundaries, including the territorial sea and other attributes.
• Scope of “Covered Real Estate Transaction” Clarified. Treasury clarified that a transaction that could result in control of a U.S. business by a foreign person is subject to Part 800, and is not a “covered real estate transaction” under Part 802. In other words, CFIUS’s additional jurisdiction under Part 802 only applies to transactions that would not otherwise be covered under Part 800, and there is no need for transaction parties to submit separate CFIUS filings under each set of regulations.

Other Important Clarifications and Examples

• Timing Rule for Contingent Equity Interest. In response to comments received on the proposed regulations, Treasury clarified that the acquisition of a contingent equity interest, without the acquisition of control or the access, rights, or involvement specified in Part 800 is not a covered transaction. In other words, CFIUS’s jurisdiction under Part 800, including any mandatory filing requirements that may apply, is not triggered until the foreign investors converts a contingent equity interest into actual control or the access, rights, or involvement specified in Part 800.
• Clarification of CFIUS Jurisdiction Over Incremental Acquisitions. The proposed regulations included a key assurance to parties that if CFIUS has previously cleared a covered transaction on the basis of a notice submitted to CFIUS, incremental acquisitions of additional interests or rights by the same foreign investor in the same U.S. business are not considered new covered transactions subject to CFIUS review. The final rules clarify that this incremental acquisition “safe harbor” also applies to transactions for which CFIUS has concluded all action on the basis of a declaration submitted to CFIUS, rather than a full written notice. On the other hand, if a foreign investor previously made a non-covered investment in a TID U.S. business, and later obtains new board rights, access to MNTI, or substantive decisionmaking rights with respect to critical technologies, this subsequent transaction would be a covered transaction subject to CFIUS jurisdiction.
• CFIUS Filing Fees to Be Determined in Later Rulemaking. As we previously reported, FIRRMA permits CFIUS to assess and collect filing fees not to exceed the lesser of 1% of the transaction value or $300,000. In a brief comment to the final regulations, Treasury acknowledged this authority, but stated that it would publish a separate proposed rule implementing the filing fee process at a later date.

The issuance of the final rules represents another important milestone in the implementation of Congress’s mandates in FIRRMA. Important milestones remain, including the Department of Commerce’s much anticipated rulemaking effort to define emerging and foundational technologies through changes to the Commerce Control List. This will have a major impact on CFIUS’s jurisdiction over investments in TID U.S. businesses, as well as the rules’ effect on the U.S. export control regime more broadly.