CFIUS in 2020:

the Good,
the Bad,
and the Ugly

Stephen Heifetz & Josh Gruenspecht

January 2020
The Bottom Line Up Front

If a U.S. business and a foreign person are involved in a

transaction . . .
Then consider CFIUS risk (as early as possible) if any of these
additional ingredients are present:

• Foreign person will acquire “control”

• U.S. business is a “TID business”
• Produces, builds or tests critical technologies (the “T”)

• Owns, operates, manufactures or services critical infrastructure (the “I”)

• Maintains or collects, directly or indirectly, sensitive U.S. person data (the “D”)

• A foreign government will obtain a “substantial interest”

2
The Good: Many Transactions Still Won’t File

Under the new rules, many investments remain outside CFIUS jurisdiction,
including those in which there is:
• No “U.S. business” or
• No “foreign person” involvement or
• No grant of “control” rights to a foreign person (generally meaning 10% or less voting
stake and no significant veto rights), but . . .
• For “TID business,” also must show no other ‘triggering rights’
- board/observer seat

- information access

- involvement in decision-making

3
The Bad: More Transactions Likely Will File

However, the number of cases for which CFIUS filing is required or advisable is
likely to rise
• Continued obligation to file investments into certain businesses that work with “critical
technologies”
• New obligation to file investment into a “TID business” if there is a “substantial interest”
by a foreign government
• New emphasis on all foreign investments into “TID businesses” (various types of sensitive
businesses) and real estate transactions in certain locations
• Even when not obligatory to file, increased likelihood of post-closing CFIUS intervention

4
The Ugly: It Will Become Harder to Decide

The CFIUS rules have become more complex and ambiguous; as a result, risk
will be harder to estimate in many cases
• CFIUS retains jurisdiction over:
- “control” transactions;
- plus new CFIUS jurisdiction over (and interest in) non-controlling investments in
TID businesses and certain real estate transactions;
- plus required filings for certain critical technology and government interest deals
• New rules for exempting some foreign investments from CFIUS jurisdiction are
complex and difficult to satisfy
• There is a new CFIUS enforcement bureau, and it will significantly determine how
risky it is to avoid a filing
• There will be more rules!

5
A Brief CFIUS Background

6
CFIUS 101

The Committee on Foreign Investment in the United States (CFIUS) is an interagency committee
headed by the U.S. Treasury Department
Includes Departments of Commerce, Defense, Energy, Homeland Security, Justice, State, U.S. Trade
Representative, U.S. intelligence community, and others

CFIUS conducts national security reviews of investments into (and acquisitions of) U.S. businesses
CFIUS has the authority to block a transaction, impose conditions on governance or operation of the U.S.
business, or force divestment post-closing

For transactions for which filings are required, failing to make the required filing also can result in
substantial penalties (in addition to conditions or forced divestment)

How parties come before CFIUS

Some are obliged to file pre-closing under the CFIUS rules

Others are requested or required to file by CFIUS itself; the Committee can elect to reach a wide range of
transactions, either before or after closing (there is no statute of limitations)

Still others file voluntarily to obtain CFIUS clearance in advance of closing, and thereby obtain safe
harbor against future intervention

7
The Foreign Investment Risk Review Modernization Act (FIRRMA)

CFIUS was initially chartered in 1975, but was amended most recently by FIRRMA in 2018
FIRRMA represents the most significant change in CFIUS in 20 years

• Broadens CFIUS’ jurisdiction

• Creates mandatory filing obligations and indicates other areas of CFIUS interest

• Infuses CFIUS with additional resources

CFIUS has been operating under temporary rules for the last 15 months; now the first full set of
permanent FIRRMA rules has arrived
Implementation of FIRRMA began in Fall 2018

Rules published in January 2020

Effective on February 13, 2020

8
 A Few Misconceptions
(That This Presentation Will Clear
Up)

9
Misconceptions About Life Under FIRRMA So Far

“Only Chinese parties are obligated to file”

All of the filing rules under CFIUS are country-agnostic, including the required filings

CFIUS has the option to levy penalties up to the amount of the foreign investment – on each party

Without making a CFIUS filing, some companies may be in breach of their governmental consents
representation

BUT: It’s true that in practice some foreign investors present more CFIUS risk than others, and that
country of origin is an important factor!

“If I’m investing out of a U.S. entity, I’m a domestic investor, so CFIUS doesn’t apply to me”
Any party under foreign control is a foreign person for CFIUS purposes – including U.S. businesses

Example: A U.S. CVC fund with U.S. general partners whose sole LP is a foreign corporation is likely a
foreign investor

Example: A U.S. business in which a foreign investor, such as SoftBank, has taken a substantial stake is
likely a foreign investor

10
Misconceptions About Life Under FIRRMA So Far (cont’d)

“Filing will take months”

During the pilot program period, the new “short form” CFIUS filing was made available to a test group

Many cases using that process during that time have cleared in 30 days

Now, under the new rules, that “short form” filing will be available to all filers

BUT: Cases with highly sensitive technologies or riskier purchasers will likely take longer

11
Misconceptions About the New CFIUS Reforms

NO: The new reforms do not block foreign

investors from any country from investing into
any U.S. business; they merely make a filing
with CFIUS required or advisable in a broader
array of circumstances.

NO: The new reforms do not exempt investors

from any country from CFIUS jurisdiction.
Only certain investors meeting specific
qualifications are exempt, even those investors
are exempt only from certain CFIUS rules, and
that exemption can in some circumstances be
retroactively removed.

POSSIBLE, BUT UNLIKELY: CFIUS has been

granted broad new authorities in transactions
involving the leasing or acquisition of real
estate. However, in practice, its existing
authorities already may have permitted CFIUS
to reach most of the transactions of potential
interest, and thus the change may have limited
impact.

12
The Good: Limited Jurisdiction

13
The Good

Absent a “U.S. business,” there is no CFIUS jurisdiction, but . . .

“U.S. business” is defined broadly -- business with operations in the United States

FIRRMA amendment allows CFIUS to review non-U.S. operations of a business that has U.S. operations

Absent involvement of a “foreign person,” there is no CFIUS jurisdiction, but . . .

“Foreign person” is not only any non-U.S. national or non-U.S. entity, but also any entity over which
control can be exercised by a non-U.S. national or entity (e.g., U.S. fund managed by foreign persons)

Further, a foreign limited partner in a U.S. fund may be deemed an indirect investor in the fund’s
portfolio companies if the LP has governance or information rights

Absent a foreign person acquiring “control” rights, there is no CFIUS jurisdiction (unless there is a
TID business), but . . .
Control defined broadly

• Power to affect decision making with respect to important matters

• 10%+ equity, or a board seat, or a veto right, or other rights that could affect decision making =
possible control

14
The Good: TID Caveat

For a “TID business,” CFIUS may exercise jurisdiction even if the investment does not yield control
A TID business is a business that

• Produces, builds or tests critical technologies (the “T”)

• Owns, operates, manufactures or services critical infrastructure (the “I”)

• Maintains or collects, directly or indirectly, sensitive U.S. person data (the “D”)

CFIUS may exercise jurisdiction if the investment involves control or any one or more of the following
‘triggering rights’

• a board seat, observer seat or nomination rights

• access to “material non-public technical information”

• involvement in substantive decision-making about the business’s sensitive operations

15
The Bad: Mandatory Filings + TID Interest

16
The Bad: CFIUS Interest in TID Businesses

Through the issuance of new rules, CFIUS has specified categories of U.S. businesses that are of
particular interest:
“Critical technology” (T) defined by reference to six U.S. government lists (primarily export controls)

“Critical infrastructure” (I) defined according to an eight-page appendix

• Both categories above are highly fact-specific

“Sensitive personal data” (D) defined as falling into any one of many distinct categories:

• Identifiable genetic testing results are sensitive personal data when held by any U.S. business

• Several other categories qualify if the underlying business:

- Holds or eventually intends to hold data on a million or more individuals

- Targets or tailors its products or services for certain government customers
• Sensitive personal data that meet one of those two criteria includes (but is not limited to):

- non-public electronic communications; data that can be used to analyze an individual's financial
situation; geolocation data; physical, mental, and psychological health data

• Public records and company data on a company’s own employees are exempt

17
The Bad: Two Types of Mandatory CFIUS Filings

Investments into many critical technology businesses require filings 30 days in advance of closing
Investments in the broader set of TID businesses also require filings 30 days in advance of closing
if there is a foreign government with a “substantial interest”
But there is no filing required, and no CFIUS jurisdiction, if the investor will not get any of the control or
other ‘triggering rights’:

• a board seat, observer seat or nomination rights

• access to “material non-public technical information”

• involvement in substantive decision-making about the business’s sensitive operations

18
The Bad: Mandatory Filings for Critical Technologies

Five-part conjunctive test to determine whether there is a “critical technology” filing requirement
First, is there a U.S. business?

Second, is there a foreign person (a foreign natural person, foreign entity, foreign government, or U.S.
entity under control of any foreign person)?

Third, will the investor receive control or other triggering rights?

Fourth, does the target deal in “critical technologies”

• Defined by reference to six U.S. government lists, particularly export control lists,
such as the Commerce Control List

• The list of critical technologies will expand

Fifth, does the target use its technology in, or design it for use in, any of 27 designated industries?

• CFIUS is likely to alter this fifth prong in the near future

19
The Bad: Mandatory Filings for Government Substantial Interest
in TID Business
The government “substantial interest” test is the latest addition to the relatively narrow set of
transactions for which filings are mandatory
CFIUS filing required if –

• a foreign person will obtain a 25% or greater interest (direct or indirect) in a TID business; and

• a foreign government has a 49% or greater interest (direct or indirect) in the foreign investor

20
The Bad: TID Business Cases Need Review

CFIUS has lowered the threshold for taking jurisdiction over all TID businesses; however, only
some TID businesses always must file:
• Those subject to the critical technology mandatory filing test; or

• Those subject to the substantial government interest test

With that said CFIUS may elect to review any investment into a TID business not just in “control”
cases, but also when a foreign person obtains a triggering right
• CFIUS can block the transaction, impose conditions, or force divestment post-closing

• Obtaining CFIUS clearance before closing insulates the transaction from post-closing adverse action

Whether to make a filing or take the risk of post-closing adverse action depends on many factors,
including:
• Identity and history of the foreign party

• Details regarding the TID business (e.g., potential relevance to U.S. security)

• Timing and cost considerations

• CFIUS enforcement practices

• Parties’ risk tolerance and allocation of CFIUS risk in transaction documents

21
The Ugly: Ambiguity and Further Change

22
The Ugly: Ambiguous Rules

CFIUS jurisdiction is unclear in many core respects, e.g.:

• What is a U.S. business? If foreign company X has a small U.S. sales office and receives an
investment from foreign company Y, is company X a “U.S. business”?

• What is a foreign person? If a U.S. fund is managed by four U.S. citizens and one foreign
person, could the fund be deemed to be under foreign control and therefore a foreign person?

The mandatory filing rules are unclear in many respects, e.g.:

• If a software company has 30% of customers in one pilot program industry but does not
customize, does that satisfy the industry prong of the critical technology mandatory filing test?

• If a business incorporates a critical technology from a 3rd party and quality checks final
products, does that satisfy the critical technology prong of the mandatory filing test?

The TID rules are unclear in many respects, e.g.:

• Does it satisfy the requirement of intending to obtain personal data on one million individuals
if pitch materials merely note a potential market of more than one million individuals?

23
The Ugly: Ambiguous Enforcement

There is a new CFIUS enforcement bureau

Treasury’s CFIUS office aims to have more than a dozen “monitoring and enforcement” staff

• Small in comparison to the enforcement staff at many agencies, but many times the size of the
monitoring and enforcement staff prior to FIRRMA enactment in 2018

• In addition, Treasury’s CFIUS office has contract staff and other resources (e.g., data sources,
programs to scour that data)

• Supplemented by personnel and resources from other agencies, particularly the FBI

But enforcement aims and practices are unclear

Interest in all transactions involving TID businesses, even when the foreign investor is Canadian,
European, or other U.S. ally?

Focused exclusively on deals evincing China or Russia influence?

How frequently will CFIUS take enforcement actions, and will those actions be public?

Under what circumstances will CFIUS impose monetary penalties, and will CFIUS impose penalties on
both the U.S. company and the foreign investor?

24
The Ugly: Likely Limited Effect from “Excepted Investor”
Provisions
Three "excepted foreign states" were designated in the initial regulations - Canada, the UK, and
Australia – and others may be designated in the future
However, not all investors from those nations will qualify as “excepted investors,” and those that do may
find the benefits to be limited

Obtaining “excepted investor” status is complicated

The investor must have an “excepted foreign state” as its nation of organization and headquarters, and
that entity – as well as all of its parent entities – must confirm that:

• 75% of its board members and observers, and all 10% or greater shareholders, are U.S. persons or
from an excepted foreign state

• Certain “minimum excepted ownership” thresholds are satisfied

Even if the investor satisfies these conditions:

• Failing to satisfy these conditions going forward can remove excepted investor status retroactively

• Can be removed from excepted investor status for violating any of several U.S. laws or regulations

Moreover, the exception applies only to non-controlling investments in TID businesses

• Controlling investments by “excepted investors” remain subject to CFIUS review

25
The Ugly: Real Estate Rules and Related Ambiguity

“Covered real estate" is real estate that is either:

• Physically within, or functionally a part of, an airport or maritime port or

• Within areas specified on an appendix (e.g., 99 miles from Aberdeen Proving Ground in
Aberdeen, MD or anywhere in Cascade County, MT)

CFIUS has jurisdiction over a foreign person obtaining three or more of the following four rights
in covered real estate:
• The right to physically access the real estate, exclude others, improve/develop, attach fixed or
immovable structures or objects

Certain exceptions apply (e.g., for detached homes or in urban areas)

Not clear whether these rules will change CFIUS practice
• Impact will depend on the enforcement posture CFIUS takes

26
The Ugly: Not Finished Issuing/Changing Rules

Further rulemakings likely in the next year:

• Pending finalization of the “principal place of business” definition

• CFIUS has indicated an intent to charge filing fees for certain transactions

• CFIUS has indicated an intent to change the mandatory filing rules for investments in critical
technology

• Ongoing designations of new “emerging technologies” and “foundational technologies” that,

when designated, will be classified as “critical technology”

• Potential additional designations of “excepted foreign states” that may give rise to “excepted
investors”

27
Practical Takeaways

28
CFIUS Navigation Tips

Consider CFIUS as early as possible

• Know whether risk factors such as TID business status are present

• Transaction timing may be significantly affected by CFIUS considerations

CFIUS issues may be negated if foreign investor avoids triggering rights

Multi-stage transactions (triggering rights only after CFIUS clearance) may enable quick closing
of first stage

Risk allocation in transaction documents

• E.g., representation of “no critical technology” or “no foreign person”, or waiver of claims
premised on CFIUS intervention

• Agreement on how the parties should act if CFIUS intervenes, including CFIUS mitigation
standards

29