On Jan. 17, 2020, the Committee on Foreign Investment in the United States (CFIUS) published its final rule expanding its jurisdiction following on the heels of its proposed regulations released several months ago pursuant to the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA). 

The regulations, effective Feb. 13, 2020, greatly expand CFIUS’ jurisdiction to review and approve certain U.S. investments by foreign persons and entities. The agency released separate final rules on covered real estate transactions.

Due to the new FIRRMA framework, parties involved directly or indirectly in foreign investments in the U.S. should be prepared to conduct CFIUS-related diligence in the early stages of a transaction. If a transaction is determined to be within CFIUS’ purview, parties should determine whether the transaction is subject to mandatory filing requirements or, if not, whether the filing of a voluntary notice would be prudent. Parties should plan for such transactional diligence by taking into account the timing of various stages of CFIUS review, as well as considering whether to file a shorter declaration instead of a full notice. 

Below are highlights of the new regulations:

Non-Controlling Investments in ‘TID U.S. Businesses’ 

Before FIRRMA, the definition of a CFIUS “covered transaction” was limited to transactions resulting in foreign control of a U.S. business. Although the control standard still applies under FIRRMA, a covered transaction now also includes non-controlling investments in certain critical technologies, critical infrastructure and sensitive personal data (collectively, referred to as TID U.S. businesses).  
Further definitions are outlined in the final regulations: 

• Critical technologies are defined as including certain items subject to export controls and other existing regulatory schemes, e.g., the International Traffic in Arms Regulation (ITAR) and the Export Administration Regulations (EAR); certain nuclear facilities, equipment and materials; and “emerging” and “foundational” technologies, two terms that have yet to be defined by the Department of Commerce’s Bureau of Industry and Security (BIS).

• Critical infrastructure involves businesses that perform specified functions –owning, operating, manufacturing, supplying or servicing certain critical infrastructure, across subsectors, such as telecommunications, utilities, energy and transportation.  

• Sensitive personal data is defined to include 10 categories of data maintained or collected by U.S. businesses that meet specific criteria, e.g., targeting U.S. military members or collecting or maintaining data on at least 1 million individuals. The categories of data include financial, geolocation and health data, among others. The final regulations slightly modify the proposed regulation’s definition of genetic data and also carve out data derived from databases maintained by the U.S. government that are routinely provided to private parties for the purposes of research.  

Mandatory vs. Voluntary Filings

While the majority of CFIUS filings will still be voluntary, the new regulations impose mandatory filing requirements on two types of covered transactions involving U.S. TID businesses that are generally related to either:

• Substantial interests acquired by a foreign government. It is anticipated that this will affect U.S. investments by foreign government sovereign wealth funds and foreign state owned-enterprises; or 

• Critical technologies utilized in connection with specific industries identified by 27 North American Industry Classification System (NAICS) codes. CFIUS anticipates issuing an advanced notice of proposed rulemaking that will replace the analysis currently based on NAICS code to one based on export control licensing requirements.

These final regulations on mandatory filings replace the pilot program that has been in place since November 2018. Although the final version and pilot program are mostly the same, there are two key differences. 

• Exempting from mandatory filings certain “excepted investors” (discussed further below); entities subject to certain foreign ownership, control or influence mitigation (FOCI); certain encryption technology; and investment funds managed exclusively by, and ultimately controlled by, U.S. nationals

• Shortening from 45 to 30 the number of days that a declaration must be filed with CFIUS prior to the date of closing

Any parties to a transaction that fail to comply with the new mandatory filing requirements may be liable for a civil monetary penalty in an amount up to the value of the transaction.

Shorter 30-Day Declaration vs. Full Notice

Parties to a covered transaction, whether subject to a mandatory or voluntary filing, can choose to file a shorter declaration that requires a response from CFIUS within 30 days. CFIUS can respond to a declaration either by concluding and approving the transaction, recommending or requesting that the parties submit a full notice for review, or initiating a unilateral full review. There are many factors to consider in choosing whether to file a shorter declaration or full notice (which takes several months longer, on average, than a declaration), especially given the uncertainty and lack of substantial precedent of CFIUS clearing declarations within that period of time. As such, parties may choose to file a full notice in lieu of filing the shorter declaration.

‘Excepted Investors’ From the U.K., Australia or Canada Exempt From CFIUS’ Expanded Jurisdiction

The United Kingdom, Australia and Canada have been designated by CFIUS as initial members of the newly defined term “excepted foreign states.” Investors that meet certain nationality requirements related to the excepted foreign states will be recognized as “excepted investors” and will be exempt from CFIUS’ expanded jurisdiction, including mandatory filing requirements under FIRRMA. CFIUS will consider adding other countries to the list of excepted foreign states at a later date.

One important note of caution – investors from excepted foreign states are not exempt from CFIUS’ jurisdiction where there is a traditional covered transaction, i.e., a transaction resulting in foreign control over a U.S. business.

Real Estate Transactions Within CFIUS’ Expanded Jurisdiction

CFIUS has issued separate final regulations governing its expanded jurisdiction into “covered real estate transactions,” including the purchase or lease by, or a concession to, a foreign person of certain real estate in the United States. The covered real estate focuses on transactions in the proximity of specific airports, maritime ports and military installations. The relevant airports and maritime ports are provided by the Department of Transportation and identified in the regulations, and the relevant military installations are listed by name and location in an updated final appendix to the finalized regulations. In the future, CFIUS plans to develop an online tool to help the public identify the geographic coverage of the new real estate rules.