On September 17, 2019, the Committee on Foreign Investment in the United States ("CFIUS" or the "Committee") published proposed rules (the "Proposals").  The Proposals would significantly expand CFIUS' jurisdiction but only slightly enlarge the number of transactions for which a filing is mandatory.  Five key takeaways for investors and companies regarding the Proposals are set forth immediately below; each is followed further below by additional explanation and context.

1. The Proposals (here and here) are not final or binding at this time. The public has 30 days to comment (until October 17, 2019), after which time CFIUS will review those comments and publish final rules early next year.
2. The Proposals would significantly expand CFIUS's jurisdiction.  CFIUS has broad jurisdiction to request or require filings for particular investments (often called "voluntary" filings because discretion about whether to file is left to the transaction parties until such time as a request is made by the Committee).  The Proposals would enable the Committee to review even more of those investments.  Most notably, the Committee's jurisdiction would now reach non-controlling foreign investments, even investments of 1% or less, in certain U.S. technology, infrastructure, and data businesses (referenced in the Proposals as "TID" businesses), as long as the foreign investor obtains certain rights in those TID businesses.  The set of TID businesses is broad, including any business that maintains or collects certain types of "sensitive personal data."  In addition, the Proposals would give CFIUS jurisdiction over a purchase or lease of "covered real estate" by a foreign person.
3. The set of transactions that must file at CFIUS as a matter of law will increase, but potentially only slightly.  The Committee previously issued a "pilot program" rule, effective November 10, 2018, which created filing obligations (so-called "mandatory" filings" because the transaction parties have no discretion about whether to file) for certain categories of foreign investments into U.S. companies involved with "critical technologies."  Our summary of that rule is here, and it remains in effect.  In addition, the Proposals add a second mandatory filing trigger for transactions involving a foreign government "substantial interest."  This new mandatory filing trigger specifies that a foreign investment of 25% or more into a TID business must be filed with CFIUS if a foreign government has a stake of 49% or more in the foreign investor.
4. The Proposals offer an exemption to certain foreign investors, but the exemption may be of little use in practice.  Although the Proposals include a process through which CFIUS can exempt from its jurisdiction certain foreign investments associated with certain countries, such exemptions would not be effective until 2022 at the earliest, and the exemptions are so narrow that their utility may be marginal.
5. Beyond the slice of transactions for which CFIUS filings are mandatory, the Proposals' expansion of the Committee's jurisdiction is of uncertain practical effect.  The risk associated with failure to voluntarily file with CFIUS is in significant part keyed to the degree to which CFIUS elects to pursue foreign investors and compel filings after closing if parties do not file voluntarily.  Accordingly, the impact of the Proposals' expansion of the Committee's jurisdiction will depend on the frequency with which CFIUS's newly established monitoring and enforcement arm conducts reviews of the broad set of transactions that it has the right to reach under its new jurisdiction, but that are not subject to mandatory filings.

The upshot is that, except for small, purely passive foreign investments, there is a reasonable likelihood that after the rules set forth in the Proposals have been finalized, CFIUS will have jurisdiction to review nearly any foreign investment into a U.S. company involved in technology, infrastructure, and data businesses, and a significant number of covered real estate investments.  However, while the Proposals will undeniably expand CFIUS's reach, the impact of that expansion will only be apparent once the rules are finalized and the new enforcement regime is in place.

For more context on the Committee, its new authorities under the Foreign Investment Risk Review Modernization Act ("FIRRMA"), the Proposals, and the five key points above, please read on.  For an opportunity to understand how these rules will be implemented in practice by hearing from and speaking with experts and government decision-makers, readers should consider attending the second annual Emerging Technology Meets National Security conference, hosted by the National Venture Capital Association this November 7, 2019.  Details and registration information can be found here:  https://nvca.org/emerging-technology-meets-national-security/.

The CFIUS Basics

CFIUS is an interagency committee charged with conducting national security reviews of investments in, or acquisitions of, U.S. companies when the investments are made by foreign persons.  The Committee is chaired by the U.S. Department of the Treasury but includes many other cabinet agencies.

Prior to the fall of 2018, filing with CFIUS was voluntary unless the Committee individually requested or compelled the submission of a notice.  In addition, the Committee's jurisdiction was limited to transactions resulting in foreign "control" over a U.S. business.  While the test for control was broad, mere access to information about a company (through, e.g., a board observer) coupled with an investment of less than 10% generally did not create CFIUS jurisdiction.  With respect to controlling investments, though, CFIUS had the authority to review the transaction at any time, pre- or post-closing.  Parties concerned about CFIUS's authority to review their investments and force post-closing conditions or divestment often would make voluntary filings in order to obtain CFIUS clearance.  Such clearance insulates the transaction from post-closing Committee intervention.

In August 2018, Congress enacted FIRRMA to (i) broaden CFIUS's jurisdiction, (ii) create mandatory filing obligations for certain transactions, and (iii) infuse CFIUS with greater resources to expand its operations, including its ability to hunt for transactions of concern to CFIUS that are not filed with CFIUS voluntarily.

Part I: The Proposals – How the Sausage is Getting Made

FIRRMA's provisions, however, are not self-executing.  Rather, they require CFIUS to issue implementing rules.  CFIUS issued its first set of rules last fall, in the form of the pilot program rule mentioned above.  That pilot program is binding but temporary and focused just on some of FIRRMA's provisions, particularly mandatory filings for certain investments in critical technology businesses.  

The new Proposals set forth several hundred pages of proposed rules, including incorporation of the pilot program (which remains in effect) by reference.  FIRRMA requires full implementation early next year, and the Proposals are intended to advance the rulemaking process by soliciting public input and then giving the agencies sufficient time to consider and incorporate that input before the deadline.  Comments on all aspects of the Proposals are due on October 17.  The pilot program already has triggered numerous comments (see, for example, the comments of the National Venture Capital Association, linked here), but additional comments on those specific mandatory filing rules are re-solicited in the Proposals. 

Notably, a few aspects of FIRRMA are not addressed in the Proposals.  The two most salient aspects are so-called "emerging" and "foundational" technologies and the question of CFIUS filing fees.  The designation of emerging and foundational technologies will help scope the set of mandatory filings at CFIUS.  However, to ensure consistency with U.S. export control rules, those rules are being addressed through a parallel rulemaking run by the Department of Commerce.  With respect to filing fees, FIRRMA provides the Committee authority to charge $300,000 or 1% of the transaction value, whichever is less, for CFIUS filings.  CFIUS has not begun charging filing fees and is not required to do so; the Proposals state that consideration of such fees will be the subject of future proposed rules.

Part II: The Expansion of Jurisdiction – The Land Grab

Even prior to FIRRMA, CFIUS's jurisdiction, though limited to "control" investments, was surprisingly broad.  The definition of control is both broad and amorphous, potentially including not only circumstances in which a foreign investor acquires more than a 10% voting stake or a single board seat, but also circumstances in which a foreign investor holds certain veto rights, such as the right to veto dividend distributions.  The Committee also has substantial discretion in interpreting its regulations, and appeal from CFIUS to a court generally is not practical. CFIUS accordingly is judge, jury, and executioner and interprets its authorities aggressively when it is concerned about a transaction.

The new Proposals broaden CFIUS's jurisdiction even further.  As indicated below, the parameters of the Committee's proposed authority, together with virtually unfettered CFIUS interpretive discretion, might make it hard to conclude that any foreign investment into a technology, infrastructure, or data business is clearly outside CFIUS's jurisdiction, unless that investment does not confer any so-called "triggering rights."  Avoiding triggering rights means that any foreign investment:  (i) is non-controlling, (ii) does not provide for a board seat or observer seat or nomination rights, (iii) provides no access to "material non-public technical information," and (iv) does not enable the investor to become involved in substantive decision-making about the business.  The set of TID businesses includes:

• Investments in "Critical Technology" Businesses.  The pilot program implemented last November created mandatory filing obligations for investments in U.S. businesses that are involved with critical technologies and that design or utilize those technologies in specified industries.  The Proposals would allow CFIUS to review an extended set of investments in critical technology businesses regardless of whether the technologies are designed for or utilized in any of the specified industries.  The set of "critical technologies" is defined by reference to several U.S. government lists, some of which remain under development (such as the lists of "emerging" and "foundational" technologies referenced above).

• Investments in "Critical Infrastructure" Businesses.  For purposes of determining a "critical infrastructure" business, the Proposals define critical infrastructure by reference to an eight page appendix that cross-references a litany of other lists, e.g., "Any (a) internet protocol network that has access to every other internet protocol network solely via settlement-free peering; or (b) telecommunications service or information service, each as defined in section 3(a)(2) of the Communications Act of 1934 (47 U.S.C. 153), as amended, or fiber optic cable that directly serves any military installation identified in § 802.229."

• Investments in "Sensitive Personal Data" Businesses.  The Proposals define "sensitive personal data" as data that facilitates identification and that falls into any one of many distinct categories.  Individuals' genetic information qualifies as sensitive at all times.  Several other categories qualify if the underlying business (i) holds or eventually intends to hold data on a million or more individuals or (ii) targets or tailors its products or services for certain government customers.  Personal data that would qualify as sensitive if falling into either of these latter categories, (i) or (ii), include certain electronic communications; data that can be used to analyze an individual's financial distress; geolocation data; and physical, mental, and psychological health data.

Given the potential breadth of the categories above and CFIUS's interpretive discretion, as long as a foreign investor expects to obtain one or more triggering rights, it would be hard to rule out the possibility of CFIUS taking jurisdiction for an investment into almost any technology, infrastructure, or data business.

In addition, under the Proposals, CFIUS also would acquire jurisdiction over foreign acquisitions, leases, and concessions of "covered real estate."

• Concessions, Leases and Acquisitions of "Covered Real Estate."  The Proposals define "covered real estate" as real estate that is (a) physically within, or functionally a part of, an airport or maritime port; or (b) within specified areas indicated on a seven page appendix (e.g., 99 miles from Aberdeen Proving Ground in Aberdeen, MD; 99 miles from Vandenberg Air Force Base in Lompoc, CA; anywhere in Logan County, CO or anywhere in Cascade County, MT).  CFIUS would have jurisdiction over a foreign person acquiring ownership over, leasing, or obtaining a concession over such covered real estate if the ownership, lease, or concession were to give the foreign investor three or more of the following four rights: (i) the right to physically access the real estate; (ii) the right to exclude others; (iii) the right to improve or develop; (iv) the right to attach fixed or immovable structures or objects.

Part III: Mandatory Filings – The Silver Lining

It is worth re-emphasizing, however, that broad CFIUS jurisdiction is not the same as a mandatory CFIUS filing requirement.  The Proposals add only a relatively small category of transactions that would be subject to mandatory filing requirements.  FIRRMA required CFIUS to implement mandatory filings whenever a foreign investor has a "substantial interest" in a U.S. company and a foreign government has a "substantial interest" in the foreign investor.  CFIUS has proposed to implement this requirement in a manner that is narrower than it could have been.

• Mandatory Filings for Foreign Government "Substantial Interest."  The Proposals would require mandatory filings if a foreign person has a 25% or greater interest (direct or indirect) in a U.S. TID business and a foreign government has a 49% or greater interest (direct or indirect) in the foreign investor.  So, for example, a sovereign wealth fund that owns 70% of a foreign investment company would trigger a mandatory filing if the foreign investment company acquires a 30% stake in a U.S. company that is involved with "critical technologies."

There are some ambiguities about these thresholds, particularly when the foreign investor is a limited partnership – e.g., the Proposals state that if the foreign government is a limited partner and holds 49% or more of the "voting interest of the limited partners," then the 49% threshold is satisfied.  It is unclear what voting interest means in this context.

Ambiguities aside, these thresholds may be a relief to many observers when compared to the first, broader set of mandatory filing rules implemented in November through the pilot program (explained here).  Comparatively, the second (and final) FIRRMA mandatory filing trigger – namely for foreign government substantial interests – looks as if it may be implemented in a manner that is narrower than feared.

Both sets of mandatory filing rules are, of course, only in draft form (though the pilot program nevertheless is currently binding).  The final rulemaking still could expand the set of transactions subject to either the critical technology or substantial interest mandatory filing requirements.

Part IV: The Excepted Investor Rules – Cold Comfort

Under FIRRMA, Congress offered the Committee two opportunities to limit the scope of its review to investors of particular concern.  The first such subsection in FIRRMA required the implementation of a process to exempt selected investors from the expansion of CFIUS jurisdiction, while the second suggested a waiver process to limit the applicability of the mandatory filing rules.  Unfortunately, the Proposals implement only the first of these two authorities, and do so in a manner that make it exceedingly difficult for an investor to qualify as exempt.

In order to qualify as an "excepted investor," the investing entity's nation of organization must first be qualified as an "excepted foreign state" – a status that can only be granted by CFIUS after a review process that will begin no sooner than two years after the rules are finalized.  Once the investor's nation of organization is so qualified, that entity must then satisfy several further tests, including guaranteeing that every one of its board members, observers, and 5% or greater shareholders is a U.S. person or from an excepted foreign state.  Even if the entity can satisfy all of the several tests, it can be removed from excepted investor status for violating any of several U.S. laws or regulations.  Moreover, qualifying as an excepted investor only grants an investor a reprieve from CFIUS's extended jurisdiction – such investors remain subject to CFIUS review for traditional "controlling" investments, and are still subject to mandatory filing requirements for such investments.  If implemented as shown in the Proposals, the excepted investor rules likely would have limited impact.

Part V: CFIUS and Enforcement – the Key Unanswered Question

When these new rules are put in place, what will the consequences be?  Most obviously, FIRRMA authorizes CFIUS to impose penalties up to the value of the transaction for failure to make a mandatory filing.  These fines can be imposed on the foreign investor, the U.S. company, or both.  Such penalties may be applicable when a filing is required under the pilot program rule (concerning certain investments in critical technology businesses); in addition, the Proposals would extend that penalty authority to mandatory filings triggered by the presence of a substantial foreign government interest (49% or more) in a foreign investor that has a substantial interest (25% or more) in a U.S. TID business.

As indicated above, however, except for the foreign government substantial interest provisions, the Proposals generally expand CFIUS jurisdiction without creating new mandatory filing obligations.  The proposed CFIUS jurisdiction is very broad.  Taken together, the Committee's jurisdiction over controlling investments, jurisdiction over non-controlling investments in TID businesses, and jurisdiction over foreign acquisitions and leases of certain real estate may give CFIUS jurisdiction over tens of thousands of transactions (or more) per year.  However, absent a legal obligation to make a filing to CFIUS (i.e., the mandatory filing rules referenced above), or some perception of risk from not making a filing, this expanded jurisdiction may be of limited practical import.

The perception of risk from not making a filing in those voluntary filing scenarios will depend in significant part on CFIUS enforcement activity once the new rules are finalized.  In particular, perceptions of risk likely will be shaped by (i) the frequency with which CFIUS uses its broad jurisdiction to request filings of transactions that were not subject to mandatory filing requirements, (ii) the nature of the transactions that give rise to such CFIUS requests (e.g., whether limited to investors from certain countries such as China and Russia), and (iii) the outcomes of such filings (e.g., whether CFIUS decides that the foreign investor must divest).  This enforcement environment, which may not be clear for a long time, can be expected to play a large part in determining the practical implications of CFIUS's expanded jurisdiction – at least as much as the nuances of the final rules.

For more information, please contact Stephen Heifetz, Josh Gruenspecht or any member of the firm's National Security/CFIUS practice.