Back to Corporate and M&A Law Committee publications

Allan Grauberd
Moses & Singer, New York
AGrauberd@mosessinger.com

Manti Bean
Moses & Singer, New York
MBean@mosessinger.com

 

Established by an Executive Order of President Ford in 1975, the Committee on Foreign Investment in the United States (CFIUS) is the government committee charged with protecting national security by reviewing economic transactions made in the US by foreign entities. CFIUS operates under the auspices of the Department of the Treasury.

CFIUS is empowered to conduct national security reviews of various types of foreign investment including control transactions and non-control investments meeting certain specifications. Historically, until 2018, CFIUS examined only control transactions. While determining what is a control transaction is a question of fact, investments providing the holder less than ten per cent of a company’s voting equity without the power to control significant corporate actions would generally not be deemed a control transaction.

For example, in May 2019, CFIUS determined that the Grindr app posed a national security risk because of feared Chinese government access to the app user’s personal data. This resulted in its Chinese owner being forced to divest itself of its ownership interest.

How does CFIUS get involved?

CFIUS can examine control transactions and non-control investments on its own volition if it determines the potential exists of a national security risk, or as a result of a voluntary or mandatory short-form declaration or long-form notice by the parties to a transaction.  

Until the adoption of the Foreign Investment Risk Review Modernization Act (FIRMMA) in October 2018, there was no concept of a mandatory filing for any acquisition or investment (controlling or non-controlling). FIRMMA established the requirement of a mandatory filing for investments, even non-control investments with certain access rights such as a board observer seat, in 27 specific industries (pilot programme industries) involving so-called ‘critical technologies’.

FIRMMA, as finally adopted in February 2020, also extended CFIUS jurisdiction to non-controlling investments in certain US businesses when the investment is accompanied by certain rights such as a board nomination right, a board observer seat, or other substantive decision making or access rights.

Other regulations adopted since October 2018 call for mandatory filings for certain investments by foreign government-controlled entities making substantial investments in a so-called ‘TID US business’ (explained below). A May 2020 proposed modification of the mandatory filing regime for businesses involved in critical technologies focuses on the need for export licensing to the investor’s country, rather than an industry specific analysis, to determine whether a mandatory filing is to be made. In addition, voluntary filings can be made for any other transaction under CFIUS oversight.

Effective 13 February 2020, the final FIRMMA regulations expand CFIUS’ oversight to include certain real estate transactions and non-controlling, non-passive investments in businesses performing certain activities involving critical technologies, critical infrastructure and sensitive personal data.

What is a TID US business?

TID is an acronym for critical technologies, critical infrastructure and sensitive personal data (defined below). The definition of a TID US business is important for the expanded scope of the CFIUS jurisdiction. To be a TID US business, the business must:

• produce, design, test, manufacture or fabricate one or more critical technologies;

• perform certain function specified in Appendix A of the FIRMMA regulations with respect to ‘critical infrastructure’; or

• maintain or collect, directly or indirectly, certain ‘sensitive personal data’ of US citizens.

Critical technologies

• Defence articles or services set forth in the International Traffic in Arms Regulations (ITAR).

• Certain items included on the Commerce Control List (CCL) set forth in the Export Administration Regulations (EAR);

• Nuclear equipment, parts and components, materials, software, and technology covered by the Code of Federal Regulation (CFR) No 10, part 810 (relating to assistance to foreign atomic energy activities).

• Nuclear facilities, equipment, and material covered by CFR No 10, Part 110 (relating to export and import of nuclear equipment and material).

• Select agents and toxins covered by CFR 7, Part 331, CFR 9, Part 121 or CFR 42, Part 73.

• Emerging and foundational technologies to be controlled pursuant to Section 1,758 of the Export Control Reform Act of 2018 (ECRA).

Emerging and foundational technologies have not been defined by the Treasury Department and remain to be defined by the Commerce Department. There are expectations, based on a November 2018 Notice of Advanced Rulemaking, that this category will include a variety of cutting edge technologies in the categories of artificial intelligence, robotics, block chain, biotechnology, brain-computer interface, quantum information and sensing technology, data analytics, as well as position, navigation and timing technology.

The first such technology, designated in January 2020 by the Department of Commerce’s Bureau of Industry and Security, is software designed to automate the analysis of geospatial imagery and so-called point clouds. Emerging and foundational technologies are likely to be a significant source of reviewed transactions once they are fully defined by the Department of Commerce.

Critical infrastructure

Critical infrastructure consists of the systems and assets, whether physical or virtual, that are specifically identified in an appendix to the final FIRMMA regulations. Such ‘covered investment critical infrastructure’ includes:

• certain IP networks;

• telecoms and information services;

• submarine cable systems and facilities;

• data centres;

• satellite systems;

• facilities that manufacture certain specialty metals, carbon, alloy or armour steel plate;

• electricity, oil, and gas facilities;

• securities exchanges;

• facilities that serve military installations;

• technology service providers;

• airports;

• maritime ports; and

• public water systems.

As a US business must ‘own, operate, manufacture, supply, or service’ critical infrastructure in order for an investment in such a business to be treated as a ‘covered investment’, the appendix to the FIRMMA rules also identifies the specific functions that the US business must perform in order to qualify as a TID US business with respect to the particular covered investment critical infrastructure at issue.

Sensitive personal data

The final regulations define sensitive personal data to include certain ‘identifiable data’, including certain genetic information. This is another area likely to be a prolific source of CFIUS reviewed transactions. Genetic information which constitutes identifiable data (as described below) excludes genetic data typically maintained by the US government and provided to private parties for research.

‘Identifiable data’ refers to data that can be used to distinguish or trace an individual’s identity, including through the use of a personal identifier such as a name, physical address, email address, social security number, phone number, or ‘other information that identifies a specific individual’. The final rule clarifies that aggregated data or anonymised data will be treated as identifiable data ‘if any party to the transaction has, or as a result of the transaction will have, the ability to disaggregate or deanonymise the data, or if the data is otherwise capable of being used to distinguish or trace an individual’s identity’.

Identifiable data does not include encrypted data ‘unless the US business that maintains or collects the encrypted data has the means to de-encrypt the data so as to distinguish or trace an individual’s identity’.

Identifiable data will be treated as sensitive personal data only if it is maintained or collected by a US business that:

• targets or tailors products or services to any US executive branch agency or military department with intelligence, national security or homeland security responsibilities, or to personnel and contractors thereof;

• has maintained or collected such data on more than one million individuals at any point over the preceding 12 months; or

• has a demonstrated business objective to maintain or collect such data on more than one million individuals and such data is an integrated part of the US business’s primary products or services; and

• it falls within any of the following categories:

– data that could be used to analyse or determine an individual’s financial distress or hardship;

– the set of data in a consumer report, unless such data is obtained from a consumer reporting agency for certain identified purposes and such data is not substantially similar to the full contents of a consumer file;

– the set of data in an application for health insurance, long-term care insurance, professional liability insurance, mortgage insurance, or life insurance;

– data relating to the physical, mental, or psychological health condition of an individual;

– non-public electronic communications, including email, messaging or chat communications between or among users of a US business’s products or services if a primary purpose of such product or service is to facilitate third-party user communications;

– geolocation data collected using positioning systems, cell phone towers, or wifi access points such as via a mobile application, vehicle GPS, other onboard mapping tool or wearable electronic device;

– biometric enrollment data, including facial, voice, retina/iris, and palm/fingerprint templates;

– data stored and processed for generating a state or federal government identification card;

– data concerning US government personnel security clearance status; or

– the set of data in an application for a US government personnel security clearance or an application for employment in a position of public trust.

What types of non-controlling investments does CFIUS now have jurisdiction over?

Unlike in the pre-FIRMMA era, CFIUS now has jurisdiction over non-controlling investments in a TID US business in which the investor has:

• access to any material non-public technical information in the possession of a TID US business;

• membership or observer rights on the board of directors or equivalent governing body of the TID US business;

• the right to nominate an individual to a position on the board of directors or equivalent governing body of the TID US business; or

• involvement, other than through voting of shares, in substantive decision making of the TID US business regarding:

– the use, development, acquisition, safekeeping, or release of sensitive personal data (as discussed above) of US citizens maintained or collected by a TID US business;

– the use, development, acquisition or release of critical technologies; or

– the management, operation, manufacture, or supply of critical infrastructure. 

Mandatory filing

A foreign investment in a TID US business involved in critical technologies in the 27 pilot programme industries, coupled with the access, board or board observer rights noted above or specified involvement in substantive decision making, is subject to a mandatory declaration. Failure to file is subject to monetary fines equal to the greater of US$250,000 or the amount of the investment.

Exceptions to the mandatory filing requirement include:

• investments made by excepted investors;

• investments made by an entity subject to a security agreement to offset foreign ownership control or influence and operating under a specified security clearance;

• investments involving the acquisition of certain encryption technology; or

• investments made by an investment fund managed exclusively by and controlled by US nationals or other non-foreign persons, where any foreign persons owning equity do not have certain specified control rights. 

In May 2020, CFIUS proposed new regulations pursuant to which the mandatory filing requirement would instead apply to businesses which are involved in critical technologies, and which would require an export licence if the technology were to be exported to the country of the foreign investor (as if the foreign investor were the end user). However, the proposed regulations permit avoidance of the mandatory filing requirement if the investment is a non-controlling investment and also does not have any of the factors – a board or observer seat, or access to information, for example – that bring a non-control investment under CFIUS jurisdiction. 

The regulations under which an export licence requirement is to be analysed are:

• the International Traffic in Arms Regulations (ITAR);

• the Export Administration Regulations (EAR);

• Department of Energy regulations in connection with foreign atomic energy assistance; and

• Nuclear Regulatory Commission regulations with respect to the export of nuclear material.

With respect to ITAR and EAR, the requirement is to be determined without giving effect to any exemption in those regulations.

Joint ventures can also be under CFIUS jurisdiction if a US business is contributed and a foreign investor has an interest in the joint venture with certain characteristics.

Lending transactions with equity like economic or control features may be under CFIUS jurisdiction. The acquisition by a foreign lender of a US business upon default of a loan may be under CFIUS jurisdiction if the foreign lender will take control of the assets of the US business or acquire an equity interest with similar access characteristics of an equity investment subject to CFIUS jurisdiction. Another exception is where a foreign lender is part of a syndicate of banks where the US banks control the decision of the syndicate.  

Excepted investors

An excepted investor is a national of, or connected to, an excepted foreign state. These are initially limited to Australia, Canada and the United Kingdom. Excepted investors are not under CFIUS jurisdiction with respect to non-controlling investments but remain subject to CFIUS jurisdiction for controlling investments.

Within this exception are:

• the nationals of these excepted foreign states;

• governments of these excepted foreign states; and

• entities which are organised in these excepted foreign states or the US, have their principal place of business in the excepted foreign state or the US, and with respect to which at least 75 per cent of the board and at least 75 per cent of the board observers are US nationals or nationals of the excepted foreign state.

In addition, at least a majority (if a public entity) and 80 per cent (if a private entity) of the equity must be owned by non-foreign persons, nationals of the excepted foreign state, the government of the excepted foreign state, or entities organised under and having their principal place of business in an excepted foreign state. No more than ten per cent of the entity can be owned by foreign persons other than nationals of an excepted foreign state, the government of the excepted foreign state, or entities organised under and having their principal place of business in an excepted foreign state. Additional requirements apply, including that the excepted investor has not engaged in certain defined bad acts relating to the United States.

Investment fund acquisitions

Indirect investments by a foreign person in a TID US business through an investment fund that gives the foreign person membership as a limited partner or equivalent on an advisory board or committee of the fund will not be considered as subject to CFIUS’s expanded jurisdiction for non-control investments if:

• the fund is managed exclusively by a general partner or managing member;

• the foreign person is not the general partner or managing member;

• the advisory board or committee does not have the ability to approve, disapprove or otherwise control investment decisions of the investment fund or decisions made by the general partner or managing member;

• the foreign person does not otherwise have the ability to control the investment fund;

• the foreign person does not have access to material non-public technical information; and

• the investment does not afford the foreign person any of the access, rights, or involvement characterising covered investments (board seat, board observer seat, etc.).

Investments by foreign government-controlled entities

If an entity in which a foreign government (other than an excepted state) indirectly or directly owns 49 per cent or more of the investment, whereby the investment entity owns 25 per cent or greater voting interest in any TID US business, the parties must file a declaration or notice with CFIUS with respect to an investment in that TID US business.

There are a variety of attribution rules here and uncertainty on how to treat multi-class stock structures. An exception exists if the foreign government investor does not control the control person of the investor entity. This is analogous but not identical to the investment fund exception above. Failure to file is subject to monetary fines equal to the greater of US$250,000 or the amount of the investment.

Declarations and notices

Short-form declarations must be responded to by CFIUS within 30 days. Possible outcomes include:

• CFIUS requesting that parties file a long-form notice;

• a notification that CFIUS has concluded review and will take no further action; or

• CFIUS initiates a unilateral review.

A long-form notice has an initial 45-day review period and subsequent proceedings can take six months. The long-form notice is a far more expansive filing than the short-form declaration. Fees apply for any filing based on the size of the transaction. 

Real estate transactions in the US involving foreign persons

CFIUS also has jurisdiction over purchases or leases by a foreign person of certain private or public real estate in the US. Transactions must accord the investor at least three of the following four fundamental property rights:

• to physically access the real estate;

• to exclude others from physically accessing the real estate;

• to improve or develop the real estate; or

• to attach fixed or immovable structures or objects to the real estate. 

CFIUS jurisdiction pertains to property located:

• within, or that will function as part of, a covered port;

• within close proximity (the area that extends outward one mile from the boundary) of a military installation or another facility or property of the US government, with certain exceptions specified in the appendix to the regulations;

• within the extended range (the area that extends 99 miles outward – but a maximum of 12 seaward miles – from the outer boundary) of combat training centres, major range and test facility base activities and certain specified military ranges or joint forces training centres;

• any county or other geographic area identified in connection with any active Air Force ballistic missile fields; or

• any part of a Navy offshore range complex or operating area located within the limits of the territorial sea of the US.

There are exceptions for certain investors. First, there is an exception for foreign persons who are nationals of one or more excepted real estate foreign states (Australia, Canada or the UK) and who are not also nationals of any foreign state that is not an excepted foreign state. Second, there is an exception for foreign governments of excepted real estate foreign states.

Third, there is an exception for  foreign entities that meet all the following criteria:

• the entity is organised under the laws of an excepted foreign state or the US;

• the entity has a principal place of business in the US or in the excepted real estate foreign state;

• seventy-five per cent or more of the members of the board of directors, and 75 per cent or more of the board observers, are US nationals or nationals of one or more excepted real estate foreign states, and not also nationals of a foreign state that is not an excepted real estate foreign state;

• any foreign person that individually, and each foreign person that is part of a group of foreign persons that in the aggregate holds ten per cent or more of the outstanding voting interest of such entity; holds the right to ten per cent or more of the profits of such entity; holds the right in the event of dissolution to ten per cent or more of the assets of such entity; or otherwise could exercise control over such entity, is:

– a foreign national who is a national of one or more excepted real estate foreign states and is not also a national of any foreign state that is not an excepted real estate foreign state;

– a foreign government of an excepted real estate foreign state; or

– a foreign entity that is organised under the laws of an excepted real estate foreign state and has its principal place of business in an excepted real estate foreign state or in the US; and

• the minimum excepted ownership of such entity (majority for publicly held entity and 80 per cent for privately held) is held individually or in the aggregate by one or more persons, each of whom is:

– not a foreign person;

– a foreign national who is a national of one or more excepted real estate foreign states and is not also a national of any foreign state that is not an excepted real estate foreign state;

– a foreign government of an excepted real estate foreign state; or

– a foreign entity that is organised under the laws of an excepted real estate foreign state and has its principal place of business in an excepted real estate foreign state or in the US.

Finally, there are also exceptions for certain real estate transactions, including:

• housing units;

• urbanised areas and urban clusters;

• commercial office space;

• retail, trade, accommodation or food service establishments;

• lands held by Native Americans and some Alaskan natives;

• lending transactions until default: upon default, the characterisation depends on whether lender will cause the real estate to be transferred to persons who would be excepted investors or US nationals;

• contingent equity transactions, depending on timing and likelihood of conversion; and

• multiple tenant units in commercial spaces where the foreign person holds less than ten per cent of the units and less than ten per cent of the square footage.