Client Alert: Recent Changes to the Committee on Foreign Investment in the United States (CFIUS) Regulations

Introduction

New regulations governing the Committee on Foreign Investment in the United States (CFIUS) took effect on February 13, 2020.  These new regulations implement significant changes to the CFIUS review process, including the following: 

1. Non-Controlling Investments.  CFIUS jurisdiction now includes non-controlling investments by foreign parties in “TID U.S. Businesses” (U.S. businesses involved with “critical technologies”, “critical infrastructure” or “sensitive personal data”) if the foreign investor will (a) have access to material nonpublic technical information, (b) have board or board observer rights, or (c) hold rights to participate (other than through the voting of shares) in decision making regarding the use, development, acquisition or release of “critical technology” or “sensitive personal data” of U.S. citizens, or the management or operation of “critical infrastructure” by the U.S. business. 

2. Mandatory Declarations.  CFIUS filings (which have historically been voluntary) are now mandatory for (a) certain investments in U.S. businesses that produce, design, test, manufacture, fabricate or develop one or more “critical technologies” for use in any of the 27 industries identified in the regulations, and (b) certain investments in “TID U.S. Businesses” by investors with substantial foreign government ownership.

3. Excepted Foreign Investors.  Certain foreign investors from Australia, Canada and the United Kingdom may qualify as “excepted investors” under the new regulations.  Non-controlling investments by excepted investors in U.S. businesses will not be subject to the mandatory review process.

4. Greenfield Investments in Real Estate.  CFIUS jurisdiction now includes certain real estate acquisitions, concessions and leases outside of the context of a transaction involving an investment in a U.S. business.  The focus of this new review authority is whether the real estate is within a certain distance of identified U.S. ports, military and government facilities. The distances vary from 1 mile to 99 miles depending on the sensitivity of the location.  

5. Short Form Voluntary Declaration.  Where a mandatory review is not required, transaction parties now have the option to submit shorter form voluntary “declarations” rather than a full CFIUS notices.  This approach may expedite CFIUS review where national security issues are less likely to be of concern as a result of the transaction. 

Background on CFIUS

CFIUS is a U.S. interagency committee with authority to review foreign investments in the U.S. and make recommendations to the President, who has the authority to block or unwind a foreign investment if the transaction could threaten U.S. national security.  Historically, CFIUS review authority has been limited to transactions that could result in control of a U.S. business by a foreign person.  As noted above and discussed below, the new regulations expand CFIUS jurisdiction to include certain non-controlling investments by foreign parties in “TID U.S. Businesses.”

Prior to the implementation of the CFIUS “pilot program” in November 2018 (please see our prior client alert here) CFIUS filings had been purely voluntary.  The parties to a transaction involving the acquisition of a U.S. business by a foreign person could make a filing with CFIUS to foreclose the risk that the President might ultimately block or unwind the transaction based on a determination that the transaction could threaten U.S. national security.  The CFIUS filing requires the disclosure of detailed information about the parties to the acquisition (as well as their ownership and management), the target business, and the transaction to allow the committee to assess any potential national security issues.  Once a notice or declaration is accepted by CFIUS, it triggers a tiered review process which can either result in the clearance of a transaction to proceed, a request for further information, or the initiation of an investigation.  Each of these steps has a prescribed time limit and, at the conclusion of the process, if the transaction cleared, it cannot later be unwound based on national security concerns. 

The voluntary CFIUS notice process still exists under the new regulations; however, certain transactions are now subject to a mandatory declaration requirement (including those previously covered under the “pilot program”).  Additionally, there is now a voluntary declaration option that requires less information and has a shorter proscribed review period than under the traditional CFIUS notice process. 

Changes to CFIUS Regulations  

The new CFIUS regulations include the following changes: 

1. Non-Controlling Investments in TID U.S. Businesses.

Under the new regulations, CFIUS has jurisdiction to review any non-passive foreign investment (regardless of whether it results in control) in a “TID U.S. Business.”  A “TID U.S. Business” is a U.S. business that (a) produces, designs, tests, manufactures, fabricates or develops “critical technology,” (b) operates or performs certain functions with respect to “critical infrastructure,” or (c) collects or maintains “sensitive personal data” of U.S. citizens. 

The term “passive investment” is narrowly interpreted and will not include any transaction where the foreign investor has access to material non-public information, board or observer rights, or rights to participate in substantive decisions related to the target’s “critical technology,” “critical infrastructure” or “sensitive personal data.”    

(A)       Critical Technologies

            “Critical Technologies” include the following:

• Defense articles or defense services included on the United States Munitions List.
• Certain “dual use” items included on the Commerce Control List that are controlled for national security, weapons and nuclear proliferation, missile technology, regional stability or surreptitious listening grounds.
• Nuclear facilities and certain specially designed nuclear equipment, parts and components, materials, software, and technology, equipment, and material.
• Certain agents and toxins.
• Emerging and foundational technologies to be further defined by the Bureau of Industry and Security.

            (B)       Critical Infrastructure

“Critical infrastructure” means systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems or assets would have a debilitating impact on national security.  A non-exhaustive list of critical infrastructure is set forth at Appendix A of the new regulations (and can be accessed here).    

            (C)       Sensitive Personal Data

“Sensitive personal data” means identifiable data (i.e., data that can be used to distinguish or trace an individual’s identity) that is maintained or collected by a U.S. business that (a) targets or tailors products or services to government agencies or military departments (or their employees or contractors) with intelligence or national security responsibilities; (b) has maintained or collected identifiable data within 10 categories described in the regulations on greater than one million individuals over a 12 month period, or (c) has a demonstrated business objective to maintain or collect such data on greater than one million individuals.  The 10 categories of data identified in the regulations are:

• Financial data;
• Consumer report data;
• Data collected in an application for health, long term care, professional liability, mortgage or life insurance;
• Physical, mental or psychological health data;
• Non-public email, message or chat communications between or among users of the business’s products designed to facilitate such communications;
• Certain geolocation data;
• Biometric enrollment data;
• Government identification card data;
• Government security clearance data; and
• Genetic test data.  

“Sensitive personal data” does not include data maintained or collected by a business with respect to its own employees or data that a matter of public record.  

2. Mandatory Declarations.

CFIUS declarations are mandatory for (a) certain investments in U.S. businesses that produce, design, test, manufacture, fabricate or develop one or more “critical technologies” for use in one or more of the 27 industries identified in Appendix B to the regulations (listed here), and (b) certain investments in “TID U.S. Businesses” by investors with substantial foreign government ownership (where a foreign government owns, directly or indirectly, 49% or more of the investor).  Mandatory declarations must be submitted not later than 30 days before the completion date of the transaction.  The parties in a transaction subject to a mandatory declaration may elect to submit a full CFIUS notice instead of the mandatory declaration.  Upon receipt of a mandatory declaration, CFIUS has 30 days to either (a) direct the parties to file a full CFIUS notice, (b) initiate a review of the transaction, or (c) notify the parties that CFIUS has concluded all action with respect to the transaction. 

3. Excepted Foreign Investors.

Investors from Australia, Canada and the United Kingdom may qualify as “excepted investors” under the new regulations.  Non-controlling investments by excepted investors will not be subject to the mandatory declaration process.  Subject to certain exclusions set forth in the regulations, an “excepted investor” means a foreign person who is:

(a)        A foreign national who is a national of Australia, Canada or the United Kingdom and is not also a national of any other country;

(b)        A government of Australia, Canada or the United Kingdom;

(c)        A foreign entity that meets each of the following with respect to itself and each of its parents (if any):

            (i)   Organized under U.S., Australia, Canada or United Kingdom law;

            (ii)   Principal place of business in the U.S., Australia, Canada or the United Kingdom;

            (iii)  75% or more of the members and 75% or more of the observers on the board of directors or other governing body are nationals of the U.S., Australia, Canada or the United Kingdom and not of any other foreign state; and

            (iv)  Any foreign person that individually or as part of a group holds 10% or more of the outstanding voting interests, profits interests or capital interests (or could otherwise exercise control over the entity) is (1) a national of Australia, Canada or the United Kingdom and not of any other foreign state, (2) a government of Australia, Canada or the United Kingdom, or (3) a foreign entity that is organized under the law of Australia, Canada or the United Kingdom and has its principal place of business in the U.S., Australia, Canada or the United Kingdom. 

4. Greenfield Investments in Real Estate.

CFIUS jurisdiction now includes certain real estate acquisitions, concessions and leases outside of the context of a transaction involving an investment in a U.S. business.  The focus of this new review authority is whether the real estate is within a certain distance of identified U.S. airports, maritime ports, military and government facilities, missile fields and offshore ranges (the distances will vary from 1 mile to 99 miles depending on the sensitivity of the location).  The real estate investment rules also employ an “excepted investor” exception for certain investors from Australia, Canada and the United Kingdom.  The filing process for pure real estate transactions is entirely voluntary (there are no mandatory declaration requirements) and the short form declaration is available as well as the traditional CFIUS notice. 

5. Voluntary Declarations

Where a mandatory review is not required, transaction parties now have the option to submit shorter form voluntary “declarations” rather than a full CFIUS notices.  This approach may expedite CFIUS review where national security issues are less likely to be of concern as a result of the transaction.  Upon receipt of a voluntary declaration, CFIUS has 30 days to either (a) direct the parties to file a full CFIUS notice, (b) initiate a review of the transaction, or (c) notify the parties that CFIUS has concluded all action with respect to the transaction.