United States: CFIUS Publishes Final Rules Implementing FIRRMA: What Changed And What It Means For Industry

On February 13, 2020, the final rules implementing changes to the Committee on Foreign Investment in the United States’ (CFIUS) jurisdiction and review process, as required under the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA), take effect. 

CFIUS, the inter-agency body responsible for reviewing foreign investment into the United States for national security risks, has traditionally been limited to reviewing transactions in which a foreign person acquires "control" of a US business. FIRRMA was enacted on August 13, 2018 to address widely perceived gaps and shortcomings in CFIUS’s authority to review foreign investments and other transactions that do not result in foreign control of a US business. (For additional background on FIRRMA please see our previous International Law Advisory). 

CFIUS published proposed rules in September of last year, which we summarized in an International Law Advisory at the time. The final rules track fairly closely with the proposed rules, although CFIUS made a number of changes in response to comments from industry. This advisory summarizes the final regulations in their entirety and also highlights where the final regulations differ from the proposed rules. 

Separate CFIUS regulations address foreign investments in US businesses (31 CFR Part 800) and certain real estate transactions not otherwise covered by Part 800 (31 CFR Part 802). 

Foreign Investments in US Businesses

CFIUS's regulations at Part 800 now cover both "controlling" and certain "non-controlling" investments in US businesses. 

The final rules extend CFIUS's jurisdiction to review non-controlling investments, referred to as "covered investments," in US businesses engaged in specified activities involving critical technology, critical infrastructure, or sensitive personal data. Such businesses are referred to in Part 800 as "TID" (technology, infrastructure, and data) US businesses. 

The term "covered investment," defined at Part 800.211, remains largely unchanged from the proposed rules (and the prior critical technology pilot program) and captures non-controlling investments that afford the foreign person: (1) "Access to any material nonpublic technical information in the possession of the TID US business,"¹ (2) "Membership or observer rights on the board of directors or equivalent governing body of the TID US business or the right to nominate an individual to a position on the board of directors or equivalent governing body of the TID US business," or (3) involvement, other than through voting of shares, in "substantive decisionmaking of the TID US business" with regard to certain actions related to sensitive personal data, critical technologies, or critical infrastructure. 

The CFIUS investment review process remains largely voluntary. In most cases, parties may file a notice or submit a short-form declaration notifying CFIUS of an investment in order to receive a "safe harbor" from future CFIUS review. In some circumstances, filing a declaration for a transaction is mandatory. Specifically, the regulations continue to require the filing of declarations for most covered transactions involving US critical technology businesses. In addition, the regulations implement FIRRMA's requirement for mandatory declarations for covered transactions where a foreign government is acquiring a "substantial interest" in a TID US business. 

1. Non-controlling investments in US "critical technology" companies

Part 800 incorporates most of the CFIUS pilot program previously contained in Part 801, which requires mandatory declarations for transactions constituting a "covered investment" in or that could result in foreign control of a US business that "produces, designs, tests, manufactures, fabricates, or develops one or more critical technologies" involving certain specifically enumerated industries based on North American Industry Classification System (NAICS) codes.² In the Federal Register notice, the Department of the Treasury (Treasury) indicated that it anticipates issuing a separate notice of proposed rulemaking that would replace this requirement "with a mandatory declaration requirement based upon export control licensing requirements." Notably, the final rule contains a number of exemptions from these provisions including for FOCI-mitigated entities, certain US businesses involved in encryption technology, investment funds managed and controlled by US nationals, and air carriers. (See our previous blog post on the CFIUS pilot program on Steptoe's International Compliance Blog). 

2. Non-controlling investments in US "critical infrastructure" companies 

For the first time, CFIUS has established a process for reviewing non-controlling investments in US critical infrastructure. The final regulations identify 28 different categories of critical infrastructure for additional CFIUS foreign investment review. As specified in Appendix A to Part 800, these critical infrastructure industries include, among others, telecommunications and satellite networks; US defense industrial resource providers; power utilities; specialty metals and materials manufacturers; oil and gas pipelines, refineries and storage facilities; air and maritime ports; rail lines; and public water systems. Appendix A also identifies specific "functions" in each industry that would trigger CFIUS's jurisdiction. For example, category (vi) of Appendix A relates to "any satellite or satellite system providing services directly to the Department of Defense or any component thereof" and lists the applicable functions as owning or operating such satellite or satellite system.³ 

3. Non-controlling investments in US companies with "sensitive personal data" 

FIRRMA expands CFIUS's jurisdiction to review non-controlling foreign investments in unaffiliated US businesses that maintain or collect sensitive personal data of US citizens. As noted by CFIUS in its proposed rules, the regulations attempt to "minimize any chilling effect on beneficial foreign ownership" by "focusing on the sensitivity of the data itself, as well as the sensitivity of the population about whom the data is maintained or collected." The final rule defining sensitive personal data, contained at Section 800.241, is complex and detailed. It identifies 11 categories of covered personal data (for example, financial data "that could be used to analyze or determine an individual's financial distress or hardship" or data "relating to the physical, mental, or psychological health condition of an individual," among other categories). 

The final rules scrap the category of "genetic information" and instead replace it with "[t]he results of an individual's genetic tests, including any related genetic sequencing data, whenever such results constitute identifiable data." The final rules also note that genetic test results "shall not include data derived from databases maintained by the US Government and routinely provided to private parties for purposes of research."

The regulations give CFIUS the authority to review non-controlling investments where such data is maintained or collected by a US business that: 

In a change from the proposed rules, the final rules clarify that category b) applies "unless the US business can demonstrate that at the time of the completion date of the transaction it had or will have neither the capability to maintain nor the capability to collect any identifiable data within one or more categories" of sensitive personal data on greater than one million individuals. 

US businesses that maintain or collect genetic test results would be covered regardless of whether the above three criteria are met. The regulations would exclude US businesses that maintain or collect data regarding their own employees (with the exception of government contractors holding personnel security clearances) and data that is a matter of public record. 

4. Rules exempt some "excepted investors" from Canada, Australia, and the UK from CFIUS's expanded jurisdiction over non-controlling covered investments 

FIRRMA requires CFIUS to limit its expanded jurisdiction over covered non-controlling investments to a limited subset of categories of foreign persons, defined under the final rules as "excepted investors."⁴ In order to qualify as an excepted investor a foreign person must meet one or more of the criteria laid out in Section 800.219, which includes (1) individuals who are nationals only of one or more "excepted foreign states," (2) foreign governments of an "excepted foreign state," and (3) foreign entities meeting a variety of requirements with respect to its place of incorporation, principal place of business,⁵ and nationality of directors and owners demonstrating the entities closeness to an "excepted foreign state."⁶ 

The final rules give excepted foreign state status to Canada, Australia, and the United Kingdom through February 13, 2022. Their status may be extended after that period if CFIUS determines they have "established and [are] effectively utilizing a robust process to analyze foreign investments for national security risks and to facilitate coordination with the United States on matters relating to investment security." According to the Federal Register notice promulgating the final rule, CFIUS "may expand the list in the future." However, it is not clear if this will happen or what other states might be included. 

Investments from all foreign persons (including "excepted investors") remain subject to CFIUS's jurisdiction over transactions that could result in foreign control of a US business. 

5. Foreign government-controlled investors are required to file with CFIUS when acquiring a "substantial" or controlling interest in a US TID business 

Section 800.401 of the final rules implement FIRRMA's requirement for mandatory declarations to be filed for covered transactions where a foreign person obtains a "substantial interest" in a US TID business and a foreign government holds a "substantial interest" in the foreign person. The term "substantial interest" is defined at Section 800.244 to mean "a voting interest, direct or indirect, of 25 percent or more, and, in the context of a foreign person in which the national or subnational governments of a single foreign state have an interest…a voting interest, direct or indirect, of 49 percent or more." However, in cases involving interest in a general partner, managing member, or equivalent person "the national or subnational governments of a single foreign state will be considered to have a substantial interest in such entity only if they hold 49 percent or more of the interest" in that general partner, managing member, or equivalent. The definition further provides that "for purposes of determining the percentage of voting interest held indirectly by one entity in another entity, any voting interest of a parent will be deemed to be a 100% voting interest in any entity of which it is a parent." 

6. Short-form declarations are authorized for any covered transaction

Under Section 800.402 of the final rules, the short-form declaration filing process, first introduced for the CFIUS pilot program (and described in our prior blog post), is available on a voluntary basis for any proposed or completed transaction instead of filing a more lengthy notice. The declaration process allows for parties to submit a shorter filing and provides for CFIUS review on a more condensed timeframe (30 days). However, industry reaction to the CFIUS pilot program has been mixed, and many parties have opted to file full notices instead of declarations under the pilot program because of CFIUS's decision in the great majority of cases not to clear a transaction based solely on review of a declaration. 

7. The regulations clarify when "lending transactions" trigger CFIUS review

The final rules clarify the application of CFIUS's jurisdiction over loans and other financing transactions. Section 800.306 clarifies that the "extension of a loan or a similar financing arrangement by a foreign person to a US business, regardless of whether accompanied by the creation in favor of the foreign person of a secured interest over securities or other assets of the US business, shall not, by itself, constitute a covered transaction." Furthermore, CFIUS will not review notices or declarations with respect to such lending until such a time as "because of imminent or actual default or other condition, there is a significant possibility that the foreign person may obtain control of a US business, or acquire equity interest and access, rights, or involvement…over a TID US business, as a result of the default or other condition." The final regulations further provide that if a loan is accompanied by "financial or governance rights characteristic of an equity investment but not of a typical loan" such a loan may be considered a covered transaction. 

Section 800.306 also states that an acquisition of voting interests or assets of a US business by a foreign person "upon default or other condition involving a loan or a similar financing arrangement" is not a covered transaction if the loan was made by a syndicate of banks where the foreign lender in the syndicate: (1) "[n]eeds the majority consent of the US participants in the syndicate to take action" or (2) "[d]oes not have a lead role in the syndicate, and is subject to a provision in the loan or financing documents limiting its ability to" (a) "[c]ontrol the debtor such that control…could not be acquired" and (b) "[e]xercise any access, rights, or involvement" constituting a “covered investment” as defined at Section 800.211. 

Finally, the final rule states that "the Committee will take into account whether the foreign person has made any arrangements to transfer management decisions, or day-to-day control over the US business to US nationals or, as applicable, excepted investors for purposes of determining whether such loan or financing arrangement constitutes a covered transaction." This seems to contemplate a scenario in which a foreign person could obtain title to assets, but authorize a US national to manage a sale or similar disposition of the assets in a manner that would not trigger CFIUS jurisdiction. 

8. The regulations clarify when "incremental investments" are subject to CFIUS review 

Section 800.305 provides that a transaction where a foreign investor acquires an additional interest in a US business over which the foreign investor had previously acquired direct control will not require additional CFIUS review if CFIUS completed review of a full notification regarding the parties' earlier investment. On the other hand, the definition of "covered transaction" at Section 800.213 clarifies that any other transaction resulting in "a change of rights that a foreign person has with respect to a US business in which the foreign person has an investment" would be considered a covered transaction "if that change could result in a covered control transaction or a covered investment."

9. The regulations implement FIRRMA's exception for certain investment funds

Investments by investment funds with foreign person limited partners would not be considered "covered investments" if the fund meets criteria contained at Section 800.307 (for example, that the fund is managed exclusively by a general partner (or equivalent) who is a US person). 

10. Treasury is not imposing CFIUS filing fees…yet

Although FIRRMA authorizes CFIUS to impose filing fees, the final regulations do not address filing fees and note that Treasury intends to publish a separate proposed rule with respect to fees at a later date. 

Real Estate Transactions

Part 802 applies to "covered real estate transactions," which are defined as "the purchase or lease by, or a concession to," a foreign person of real estate within proximity of US airports, maritime ports and military facilities described below (covered real estate), that provides the foreign person with certain property rights, and that are not otherwise carved out by CFIUS's definition of "excepted real estate transactions." 

Real estate transactions covered by Part 802 are not subject to mandatory filing requirements. (However, certain transactions involving real estate could fall under CFIUS's expanded jurisdiction under Part 800, discussed above, and thus could require a filing under Part 800.) Part 802 authorizes the filing of either a short-form declaration or a full notice by parties to covered real estate transactions. 

1. The final regulations include detailed definitions and guidance on "covered real estate" 

Section 802.211 and Appendix A to Part 802 define "covered real estate" to include transactions in and around specified US airports, maritime ports, and military installations. 

Covered airports and maritime ports: Covered real estate includes real estate that is located within or that "will function as part of" certain covered ports. While the proposed rules contained sections defining "airport" and "maritime port," the final rules do away with that construction and instead utilize a single definition of "Covered Port" at Section 802.210. Despite this change, the new combined definition continues to limit its application to airports that are (1) defined by the Federal Aviation Administration as "large hub airports," (2) have an annual aggregate all-cargo landed weight greater than 1.24 billion pounds, and (3) airports with a civilian and military use. Maritime ports are limited to (1) "strategic seaports" as determined by the Maritime Administration and (2) ports listed by the Bureau of Transportation Statistics as a "top 25 tonnage, container, or dry bulk port."

Covered military installations: Covered real estate also includes real estate within a certain distance from specified US military installations. The final regulations include a detailed list of relevant military installations at Appendix A to Part 802. Covered real estate transactions include real estate: within one mile of an installation listed in parts 1 and 2 of the Appendix; within 99 miles of an installation listed in part 2 of the Appendix; within specifically enumerated counties or geographic areas listed in connection with installations in part 3 of the Appendix; and within certain offshore range complexes and operating areas listed in part 4 of the Appendix. 

Subsurface and submerged land is considered "real estate" and therefore subject to CFIUS jurisdiction if it fits within one of the categories outlined above, which could have important implications for extractive industries. 

The Federal Register notice acknowledges the complexity of these provisions and states that CFIUS “anticipates making available a web-based tool to help the public understand the geographic coverage of the rule.” 

2. The final regulations define "purchase," "lease," and "concessions" related to covered real estate

The final regulations define "purchase" and "lease" (among other things, to include subleasing) and define "concession" as the grant by "a US public entity" of "a right to use real estate for the purpose of developing or operating infrastructure for a covered port." 

3. The final regulations define the property rights that must be acquired in order for a real estate transaction to be covered

These rights include the right to physically access, exclude others from physical access, improve or develop, and attach structures or objects. Under the final regulations, a real estate transaction must involve at least three of these four fundamental property rights to be subject to Part 802. The regulations also provide guidance (see 31 CFR 802.304) for when rights that are acquired through contingency equity interests in real estate are included in CFIUS's analysis. In order to trigger review, these property rights can be acquired through a new purchase, lease or concession, or through a change in rights regarding covered real estate that is subject to an existing purchase, lease, or concession. 

4. Several categories of real estate transactions would be carved out from Part 802 as "excepted real estate transactions"

As identified at Part 802.216, these excepted transactions include: 

• Transactions with "excepted real estate investors" based on their ties to "excepted real estate foreign states." These terms are similar to the "excepted investors" and "excepted foreign states" rules contained in Part 800 and discussed above. As with Part 800, only Australia, Canada, and the United Kingdom are considered "excepted real estate foreign states" as of now. 
• Transactions governed by Part 800 do not require separate filings under Part 802. Instead, Part 802 applies only to covered real estate transactions that are not subject to CFIUS's broader review procedures in Part 800. 
• Real estate within an "urbanized area" or "urban cluster," as identified in the most recent US Census. However, real estate within these areas that is located within, or will function as part of, a covered port, or is located within one mile of military installations listed in parts 1 and 2 of Appendix A are not carved out. 
• Single housing units, including fixtures and adjacent land that is incidental to the use of such real estate. 
• Leases or concessions of real estate in covered ports that, according to the terms of the concession or lease may only be used "for the purpose of engaging in the retail sale of consumer goods or services to the public" or involving foreign air carriers for whom the Transportation Security Administration "has accepted a security program under 49 CFR 1546.105." 
• Commercial office space in a multi-unit commercial building, if the foreign person and its affiliates have neither an interest in more than 10% of the square footage nor represent more than 10% of the tenants in the building. 
• Land owned by Alaska natives or held in trust by the United States for American Indians, Indian tribes, Alaska Natives, and Alaska Native entities. 

In addition to these exclusions, Section 802.302 states that the following are not to be considered a covered real estate transaction: (1) "an acquisition of securities by a person acting as a securities underwriter, in the ordinary course of business and process of underwriting" and (2) "an acquisition pursuant to a condition in a contract of insurance relating to fidelity, surety, or casualty obligations if the contract was made by an insurer in the ordinary course of business." 

The final regulations also clarify that lending transactions are generally not considered "covered real estate transactions" in a manner similar to the clarification provided in Part 800. Specifically, Section 802.303 states that
"[t]he extension of a mortgage, loan, or similar financing arrangement by a foreign person to another person for the purpose of the purchase, lease, or concession of covered real estate, regardless of whether accompanied by the creation in favor of the foreign person of a secured interest in the covered real estate, shall not, by itself, constitute a covered real estate transaction." In determining whether a lending transaction would constitute a covered real estate transaction CFIUS will consider a number of factors including: (1) the imminence of the default or similar event and (2) "whether the foreign person has made any arrangements to transfer the ownership and property rights over the covered real estate to US nationals or excepted real estate investors for purposes of determining whether such mortgage, loan, or financing arrangement constitutes a covered real estate transaction."

Footnotes

1 Part 802.232 defines material non-public technical information to mean information that (1) "[p]rovides knowledge, know-how, or understanding not available in the public domain, of the design, location, or operation of critical infrastructure, including without limitation vulnerability information such as that related to physical security or cybersecurity," or (2) "[i]s not available in the public domain and is necessary to design, fabricate, develop, test, produce, or manufacture a critical technology, including without limitation processes, techniques, or methods."

2 Part 801 is no longer in effect as of February 12, 2020, and critical technologies filings are now covered by Part 800.

3 Notably, this appendix is only for use in determining whether something is critical infrastructure with respect to covered investments. It is possible that a given piece of infrastructure would not meet the definition of "covered investment critical infrastructure," but still meet the general definition of "critical infrastructure" contained in the CFIUS regulations with respect to the Committee's jurisdiction over control transactions.

4 Foreign persons who have, in the prior 5 years, been determined to have violated certain US sanctions, export controls, or investment laws or committed other felony crimes, or settled related allegations would not be eligible for excepted investor status. See Section 800.219. Similarly, persons no longer meeting the excepted investor criteria within a three-year period following the completion date of the transaction are "not an excepted investor with respect to the transaction from the completion date onward."

5 The regulations define principal place of business as "the primary location where an entity's management directs, controls, or coordinates the entity's activities, or, in the case of an investment fund, where the fund's activities and investments are primarily directed, controlled, or coordinated by or on behalf of the general partner, managing member, or equivalent." However, the Federal Register notice promulgating the rules explains that the definition of "principal place of business" is an interim rule and CFIUS will accept comments on the definition through February 18, 2020.

6 The final regulations loosen the requirements, compared to the proposed rules, with respect to both directors and owners in seeming response to industry comments.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.