Treasury Issues Final Rule Updating CFIUS Regulations

On September 15, 2020, the Office of Investment Security of the U.S. Department of the Treasury (“Treasury”) published a final rule modifying the Committee on Foreign Investment in the United States’ (“CFIUS” or the “Committee”) regulations relating to its mandatory declaration provisions. The most significant amendments pertain to the mandatory filing requirements for certain foreign investments in U.S. businesses that engage in activities relating to critical technologies, a regime referred to previously as the “Pilot Program.” Under prior iterations of the regulations, a mandatory declaration for an investment in a U.S. business engaged in activities concerning critical technologies was only triggered when those activities were related to one of 27 sensitive industries specified by North American Industry Classification System (“NAICS”) code. The final rule abandons the industry-specific inquiry entirely, and instead adopts a new threshold analysis that focuses on the particular export controls that may be applicable to the critical technology utilized by the U.S. business. The rule does not, however, modify the definition of “critical technologies,” which is defined by the Foreign Investment Risk Review Modernization Act of 2018 (“FIRRMA”) and is, in part, subject to a separate ongoing rulemaking process by the Department of Commerce as explained in further detail below. [1]

The final rule becomes effective on October 15, 2020, and will apply to transactions entered into on or after that date. Transaction parties are encouraged to begin discussions concerning any activities of the U.S. business that relate to critical technologies early in the diligence process. Failure to abide by the mandatory declaration requirements can be costly, and can result in civil penalties of up to $250,000 or the value of the transaction, whichever is greater.

Background

CFIUS first enacted the aforementioned Pilot Program in November 2018 to review both control transactions and non-controlling investments by foreign persons (whether or not government owned or controlled) in U.S. businesses involving critical technologies in 27 specified industries identified by NAICS code, including in the semiconductor, nanotechnology and biotechnology sectors. The regulations define “critical technologies” to include those that are controlled by the International Traffic in Arms Regulations (“ITAR”), certain items controlled on the Commerce Control List of the Export Administration Regulations (“EAR”), items subject to nuclear-related controls administered by the Nuclear Regulatory Commission and Department of Energy, certain specified biological agents and toxins and emerging and foundational technologies controlled pursuant to the Export Control Reform Act of 2018 (“ECRA”).

Whereas before CFIUS filings were submitted pursuant to a voluntary regime, transactions falling within the scope of the Pilot Program were required to be notified to the Committee pursuant to a mandatory declaration or formal notice. The Pilot Program remained in effect until February 2020, when final regulations implementing certain provisions of FIRRMA took effect. These final rules largely incorporated the scope of the Pilot Program, though they exempted certain transactions involving excepted investors; entities subject to an agreement to mitigate foreign ownership, control or influence pursuant to the National Industrial Security Program regulations; certain encryption technologies; and certain investment funds from the critical technology mandatory declaration requirement.

Shifted Focus to Export Control Analysis

The final rule published on September 15, 2020 shifts the mandatory declaration requirement from one that is based on NAICS code industry classifications to one that is based on U.S. export control regimes. Following the changes to the rules, a mandatory declaration is triggered for certain investments in a U.S. business that “produces, designs, tests, manufactures, fabricates, or develops one or more critical technologies for which a U.S. regulatory authorization would be required” to transfer that critical technology to the foreign investor or the foreign persons in the investor’s ownership chain. Conversely, if the U.S. business at issue is authorized to export the critical technology to the foreign investor without a license (based on the foreign investor’s principal place of business for entities, and nationality for individuals), then the transaction would not be subject to the mandatory declaration requirement. [2]

The term “U.S. regulatory authorization” means a license or authorization from one of the four main U.S. export control regimes: (i) the ITAR administered by the U.S. Department of State; (ii) the EAR administered by the U.S. Department of Commerce; (iii) regulations governing assistance to foreign atomic energy activities administered by the U.S. Department of Energy; and (iv) regulations governing the export or import of nuclear equipment and material administered by the Nuclear Regulatory Commission. Therefore, the final rule’s focus on export control requirements will often require a technical review of specific products, including an “analysis of the particular item and end user, and the particular foreign country for export, re-export, transfer (in country), or retransfer.” In determining whether a U.S. regulatory authorization would be required, no effect is afforded under the regulations to any license exemptions available under the ITAR or EAR, with the exception of certain mass market encryption software subject to EAR License Exception ENC; License Exception Technology and Software Unrestricted (“TSU”); and certain elements of License Exception Strategic Trade Authorization (“STA”).

Voting Interests for Purposes of Critical Technology Mandatory Declarations

The final regulation also introduces the term “voting interest for purposes of critical technology mandatory declarations” to specify which persons in the foreign acquirer’s ownership chain should be reviewed for export authorization purposes to determine whether the transaction could trigger a mandatory declaration. In the context of an interest in a foreign person, this term is defined as “a voting interest, direct or indirect, of 25 percent or more.” Additionally, for the purposes of determining an indirect interest, “any interest of a parent entity in a subsidiary will be deemed to be a 100 percent interest.” For investment funds, a foreign person will be considered to have a voting interest for purposes of critical technology mandatory declarations in the acquiring entity if the foreign person holds a 25 percent or more interest in the general partner, managing member, or equivalent of that fund. Additionally, foreign persons who are affiliated, have arrangements to act in concert or are controlled by the same foreign state will have their interests aggregated.

Advance Notice of Proposed Rulemaking Regarding the Identification of “Foundational Technologies”

The definition of “critical technologies” is crucial to determining the extent to which an investment target falls within the scope of the mandatory declaration provision, and as noted above, “foundational technologies” form a key category of critical technologies controlled pursuant to ECRA. Although this term has not yet been defined, on August 27, 2020, the Bureau of Industry and Security (“BIS”) of the U.S. Department of Commerce published an Advance Notice of Proposed Rulemaking (“ANPRM”) seeking public guidance related to the (i) identification and definition of foundational technologies; (ii) criteria for determining whether certain export-controlled items are essential to U.S. national security; (iii) the development status of foundational technologies; and (iv) the impact of technology controls on the development of such items, amongst other topics. The ANPRM does not indicate which foundational technologies BIS intends to control but does list technologies with applications for semiconductor manufacturing, underwater systems, surveillance activities and weapons of mass destruction as potential areas of interest. This ANPRM is part of an inter-agency process implementing ECRA, and once completed, will inform the mandatory filing analysis under the CFIUS regulations. The comment period for the ANPRM closes on October 26, 2020.

Key Takeaways

Once the final rule is effective, determining the extent to which an investment target in the United States falls within the scope of the mandatory declaration provision will require a much more detailed and technical analysis of particular items utilized by the U.S. business that could be considered a critical technology. This, coupled with the increasingly complex review of the nature of the investor and the investor’s ownership structure, will often require much more attention during transaction diligence from both buyer and seller, as well as a heightened level of cooperation in coordinating this analysis. U.S. investment fund sponsors, in particular, should consider whether they are managing their funds in a manner consistent with the requirements of FIRRMA’s investment fund exception to the mandatory declaration provisions in order to avoid a lengthy export control analysis with respect to its foreign limited partners involved in a particular transaction.

To read the final regulations, please click here.

Endnotes

1This is an updated version of a Report from Washington originally published on May 21, 2020, that summarized the proposed rule modifying the mandatory declaration provision published on May 15, 2020.(go back)

2Note that a mandatory declaration may nevertheless be triggered if the U.S. business is separately engaged in certain activities relating to critical infrastructure or the collection of sensitive personal data, as described previously in our Report from Washington published on January 16, 2020.(go back)