A Guide to the New Diligence Questions for “Outbound” U.S. Investment

In late October 2024, the U.S. Treasury Department (Treasury) issued its final rules (the Outbound Rules) implementing President Biden’s Executive Order (EO) 14105 on “outbound” U.S. investment. See our prior mailers here and here. The Outbound Rules will take effect on January 2, 2025, and will add a new layer of diligence to most U.S. parties’ investment activities. On their face, the rules are comparatively narrow, restricting U.S. persons from engaging in certain technology investment and other capital-allocating activities when the target entity has ties to the People’s Republic of China (PRC) and operates in certain specific technology areas. However, in practice, the Outbound Rules will create incentives for U.S. investors—and many non-U.S. funds—to engage in diligence and obtain representations from any business that cannot otherwise clearly rule out connections to those technology areas or to the PRC.

Companies and investors should understand when transactions are prohibited, when they require filing a notice, and the nature of the diligence requirements that will likely arise as a result. The bottom line, up front, is that any time a U.S. person, U.S. entity, or foreign investor backed in significant part by U.S. person funding makes an investment in a privately held business going forward, they will likely need to consider the applicability of these new Outbound Rules. In this client advisory, we provide an overview of the Outbound Rules focused on private U.S. investors and the companies in which they invest. We discuss at a high-level which investors, technologies, and investments may be covered, why determining which businesses are PRC-connected will be complex, and the risks and penalties associated with this new regime.

Briefly: What are the new outbound investment regulations?

The Outbound Rules cover certain equity, debt, and other transactions that provide resources to businesses active in the semiconductor/microelectronics, quantum information technology, and artificial intelligence (AI) areas that are connected in specific ways to the PRC (which, for purposes of the new rules, includes Hong Kong and Macau). Some transactions of this kind are prohibited altogether, whereas others are permitted as long as Treasury is notified.

That sounds pretty narrow. Why do you say the Outbound Rules are likely to create new diligence issues for a wide range of U.S. transactions?

The new rules are intended to limit the ability of PRC-connected businesses to use American capital—and in particular, according to Treasury, the “intangible benefits” associated with that capital—to develop technologies that may be critical to geopolitical competition.

However, as discussed in more depth below, the Outbound Rules define the set of target businesses subject to the rules to include not just businesses that are in China or incorporated under Chinese law, but also businesses with less obvious links to China—specifically, those with significant direct or indirect Chinese ownership or businesses with investments in China that are material to their bottom line. As a result, determining whether a U.S. or European privately held company is a PRC-connected business will require that business, e.g., to make inquiries of the funds on its cap table to find out if they are backed by Chinese investors.

Similarly, as again discussed in more depth below, the set of technologies at issue includes not just, e.g., quantum computing—used by relatively few companies today—but also technologies such as AI that are widely developed and deployed. Determining whether a given company uses AI in a manner controlled by the rules will require examination both of the sophistication of the target’s technology and the applications in which it uses that technology.

Are you suggesting that even though the Outbound Rules are aimed at PRC-connected businesses, they will end up impacting U.S. investment anywhere in the world into any company that uses, e.g., AI or semiconductors?

Such transactions will certainly require diligence under the new rules, as some such transactions may require action. For instance, if a San Jose electronic design automation software start-up were to issue convertible notes to a U.S. VC fund, the transaction could trigger a prohibition if its founders (and majority stakeholders) were Chinese graduate students based in the U.S. Even if a Japanese maker of AI shopping assistance software were to take a SAFE from a U.S. investor, a notification could be triggered if the start-up used certain types of AI and turned out to have a significant number of other investment funds on its current cap table backed by PRC money.

As these examples illustrate, transactions all over the world may be covered by the Outbound Rules if the requisite ties to China are present. Notably, U.S. persons are responsible for conducting “a reasonable and diligent inquiry”—which, under the rules, can include both seeking information and gaining contractual assurances—and they can be held liable to the extent they knew or should have known that a transaction would trigger the rules. As a result, U.S. investors engaged in certain types of transactions will have strong incentives to ask a series of new diligence questions in order to develop sufficient information to determine if and how the rules apply.

Since the Outbound Rules are based on a Biden administration EO, can we simply assume this regime will be placed on hold as soon as the new Trump administration enters? Or that it will be retracted once that happens or soon thereafter?

The Biden administration used executive branch national security authorities to issue the rules after more than a year and multiple rounds of public notice and comment. In order to revise and/or “unmake” the rules, the Trump administration would similarly need to engage in a public notice and comment period. Accordingly, even if the Trump administration wishes to consider a revised approach, the rules are likely to remain in effect for at least a few months.

Moreover, the likelier outcome is that the Trump administration will instead choose to keep or even strengthen the order. There is bipartisan demand in Washington for limitations on U.S.-China economic engagement, and a sizeable faction within the Republican congressional caucus has called for a significantly more robust set of rules controlling investment into China. In addition, in the 2021 transition, the incoming Biden administration chose not to cancel several Trump administration executive orders, such as the ICTS cybersecurity executive order, instead choosing both to implement the proposed rules contemplated by the Trump administration and to add further rules.

If the new rules are likely here to stay, what transactions will be implicated?

For the new outbound investment regulations to apply to a given transaction, there are five tests that must be met:

• There must be a U.S. citizen, resident, legal entity, or foreign branch of any legal entity (i.e., a “U.S. person”), or any controlled foreign subsidiary thereof;
• That U.S. person must engage in certain investments or investment-related transactions;
• No special exception to the investing rules must apply;
• The target of the transaction must engage in certain activities with respect to semiconductors, quantum computers, or AI (“covered activity”) or be invested in a company engaged in a covered activity that is sufficiently important to the target’s economic position; and
• The target of the transaction must be a PRC citizen, an entity organized or based in the PRC, an entity acting on behalf of the PRC government or otherwise under its direct or indirect control, any other entity 50 percent or more under the control in various respects of one of the foregoing entities, or any party that derives certain benefits from one of the aforementioned entities (if engaged in “covered activity,” a target person described in this prong is a “covered foreign person”).

Collectively, a transaction that meets these characteristics is known as a “covered transaction.” Some covered transactions are prohibited by law (“prohibited transactions”), while others are allowed but must be followed within 30 days by a notice to Treasury (“notifiable transactions”).

Which specific types of investments or investment-related transactions may potentially be restricted by the Outbound Rules?

Six categories of transactions are covered: 1. Acquiring equity or “contingent equity” (such as convertible notes); 2. making a loan or providing other debt financing that is either convertible or affords the right to be involved in the target's management in certain capacities; 3. converting contingent equity; 4. acquiring, leasing, or developing property or assets in the PRC; 5. forming a joint venture; or 6. obtaining a limited partner or equivalent stake in an investment vehicle known to invest in the Chinese semiconductor/microelectronics, quantum, or AI areas.

You mentioned special exceptions—what types of investment-related activities are excepted?

Exceptions include investments in publicly traded securities, investments in certain derivative securities, buyouts of PRC ownership (unless the company is chartered in or headquartered in China), certain specified transactions involving a U.S. parent company and its controlled foreign entities, commitments made prior to the rule taking effect, some syndicated debt financings, equity-based compensation, and certain transactions involving countries outside the U.S. that have independently taken measures to safeguard the national security concerns related to the outbound investment at issue.

In addition, a U.S. person’s investment in certain funds, when made as an LP, would not be covered by the Outbound Rules if a) the investment is $2 million or less, or b) there is a contractual assurance that the investment will not be used for activities otherwise prohibited by the new rules.

Please explain which parties are “covered foreign persons” engaged in “covered activities” in more detail; that seems like the key test that will allow parties to ensure a transaction is not covered.

As noted above, to be a covered foreign person, the target entity must both be engaged in a covered activity (or invested in a company engaged in a covered activity that is sufficiently important to the target's economic position) and have certain ties to the PRC. With respect to part one, the covered activity requirement, there are extensive and detailed lists of types of activities that parties can undertake within the three technology sectors that are either prohibited or notifiable activities. Those separate lists are discussed in more detail below. With respect to part two, the PRC requirement, that is derived from EO 14105, which contains an Annex listing “countries of concern.” Currently, the PRC is the only country on that list, but the Trump administration could choose to update the list as national security requires (such that the rules currently applicable to the PRC might apply to other countries in the future as well).

There are six types of PRC connections that can make a party into a covered foreign person, a category that includes: 1) Any person who is a PRC citizen or permanent resident and who is not a U.S. citizen or permanent resident; 2) any legal entity that has its principal place of business in the PRC or is headquartered, incorporated, or otherwise organized in the PRC; 3) the PRC government, any agent thereof, or any entity that the government otherwise has the power to direct; 4) any entity in which one or more of the above PRC persons individually or collectively holds a 50 percent or greater voting interest, voting power of the board, or equity interest; 5) any entity in which a PRC-controlled entity directly or indirectly holds a 50 percent or greater voting interest, voting power of the board, or equity interest; or 6) any entity that has specified influence over a PRC person if the PRC-affiliated entity's operations are sufficiently important to the non-PRC entity.

The sixth category covers entities with a more tangential link to the PRC than the preceding five because the sixth category is intended “to capture those entities that, while not directly engaged in a covered activity themselves, are significantly financially connected to entities that are engaged in a covered activity.” For example, if a U.K.-based company were to have a voting interest in a PRC AI company, and if 50 percent of the U.K. company’s operating expenses were attributable to the PRC AI company, then the UK company would be a covered foreign person—i.e., the ties to China would be sufficient such that a U.S. investment in the U.K. company would be deemed an investment in a PRC AI company.

Please explain the differences between the types of covered activities in the AI, quantum computing, and semiconductor sectors that are prohibited and those that merely trigger a notice.

The question of whether a transaction is barred altogether or simply gives rise to a reporting requirement is primarily determined by looking at the type of technology with which target companies (or their investee companies) are involved:

• With respect to semiconductors/microelectronics, a prohibition is triggered by covered transactions related to the development or production of certain electronic design automation software; the development or production of certain fabrication or advanced packaging tools; the design of select high-performance integrated circuits; the fabrication of several kinds of advanced integrated circuits; packaging activities involving advanced packaging techniques for integrated circuits; and the development, installation, sale, or production of certain supercomputers. A notification requirement is triggered by covered transactions related to the design, fabrication, or packaging of other integrated circuits not otherwise covered by the prohibited transaction definition.
• With respect to quantum information technologies, a prohibition is triggered by “covered transactions related to the development of quantum computers or production of any critical components required to produce a quantum computer; the development or production of certain quantum sensing platforms; and the development or production of certain quantum networks or quantum communication systems,” according to Treasury. There are no technologies in this field that give rise to a notification obligation.
• With respect to AI, a prohibition is triggered by transactions related to the development of any AI system designed to be exclusively used for, or intended to be used for, military, government intelligence, or mass-surveillance end uses. In addition, prohibitions are triggered by covered transactions related to the development of any AI system that is trained using a quantity of computing power greater than 10ˆ25 computational operations or trained using primarily biological sequence data and a quantity of computing power greater than 10ˆ24 computational operations. A notification is triggered by covered transactions related to the development of any AI system not otherwise covered by the prohibited transaction definition, where such AI system is designed or intended to be used for certain end uses or applications, including those listed above as well as cybersecurity applications, digital forensics tools; penetration testing tools; or the control of robotic systems. In addition, a notification is required with respect to any covered transaction related to the development of any AI system that is trained using a quantity of computing power greater than 10ˆ23 computational operations.
  • Many of these purpose-based definitions have unclear scope that the Outbound Rules suggest should be read broadly. For example, an AI system may be considered to be “designed to be used” for mass-surveillance if it, e.g., incorporates “features such as mining text, audio, or video; image recognition; location tracking; or surreptitious listening devices.”

In addition, if the covered foreign person in question is on certain U.S. government restricted lists—e.g., the Bureau of Industry and Security’s Entity List or the Department of the Treasury’s list of Specially Designated Nationals and Blocked Persons (SDN List)—then all notifiable transactions with respect to that person become prohibited transactions.

Who is liable, and what are the penalties?

U.S. persons are liable if they engage in prohibited transactions or fail to comply with a notification obligation. U.S. companies are also bound to take steps to prohibit their foreign subsidiaries from engaging in any prohibited or notifiable transactions. Furthermore, when working with a foreign partner or employer, a U.S. person cannot “knowingly direct” a foreign person to engage in a transaction that would be prohibited if it were undertaken by a U.S. person.

Violations of the Outbound Rules can lead to civil and criminal penalties. Civil penalties can be imposed for the greater of i) $250,000 or ii) an amount that is twice the amount of the transaction that is the basis of the violation with respect to which the penalty is imposed. In addition, a person who willfully commits, attempts to commit, conspires to commit, or aids or abets in the commission of a violation will, if convicted, be fined not more than $1,000,000, or if a natural person, be imprisoned for not more than 20 years, or both. Furthermore, in some cases of prohibited transactions, Treasury can work to “nullify, void, or otherwise compel the divestment” of the transaction. The Outbound Rules also provide a voluntary self-disclosure process for those that may have violated the regulations, a disclosure that Treasury will take into take into account when responding to the possible violation.

So, should we cease investing in China—or in AI or semiconductors—altogether?

Treasury has indicated that its intention is to ensure the Outbound Rules are “narrowly scoped to focus on a limited subset of investment activity” in order to “avoid unintended impacts in broader sectors of the U.S. or global economies.” While the Trump administration could still refocus and/or broaden the outbound investment regime established under the Biden EO, the version that will take effect in January is still relatively limited in its impact. For most investors and companies, a small amount of diligence will likely provide comfort that this new outbound investment regime is not implicated. By taking Outbound Rules considerations into account when assessing their investments, those investors can both rule out transactions of concern and establish a record that will reduce liability if target companies have unexpected exposure to covered activities.

For more information, please contact Stephen Heifetz, Josh Gruenspecht, Seth Cowell, Nimit Dhir, Bryan Poellot, Alyza Sebenius, or any member of the firm's national security practice.