FIRRMA Regulations Finalized

Updates

February 12, 2020

FIRRMA Regulations Finalized

The Committee on Foreign Investment in the United States (CFIUS) published two final rules on January 17, 2020, to implement the Foreign Investment Risk Review Modernization Act (FIRRMA) enacted in August 2018. The first rule, which can be found here, will completely replace the existing CFIUS regulations, 31 CFR Part 800, and supplant the CFIUS pilot program described in 31 CFR Part 801. The second rule, which can be found here, introduces a new Part 802 to Chapter 31 of the Code of Federal Regulations (CFR) covering real estate transactions.

These two rules, which take effect February 13, 2020, permanently expand CFIUS's jurisdiction beyond transactions that could result in foreign control of a U.S. business to include certain non-controlling investments and real estate transactions.

The current regulations applicable to control transactions and the critical technology pilot program will remain in effect until that date and will continue to apply thereafter to certain transactions.

Expanded Scope of CFIUS Jurisdiction

Traditionally, CFIUS has had jurisdiction to review for national security concerns transactions that could result in a foreign investor's control of a U.S. business. FIRRMA expanded CFIUS's jurisdiction to include certain non-controlling investments in certain U.S. businesses involved with critical technology, critical infrastructure, or sensitive personal data (referred to as "TID businesses" as discussed below). CFIUS's jurisdiction was initially expanded through the Pilot Program to Review Certain Transactions Involving Foreign Persons and Critical Technologies (Pilot Program), which took effect on November 10, 2018, and expires on February 13, 2020. However, the new rule on investments in U.S. business includes the substance of, and builds upon, the Pilot Program.

Covered Control Transactions

The new rule unsurprisingly retains CFIUS's jurisdiction to review "covered control transactions," defined as transactions that could result in foreign control of any U.S. business, including transactions carried out through joint ventures. CFIUS jurisdiction over covered control transactions does not depend on the nature or national security sensitivity of the U.S. business, though these factors will influence the likelihood that CFIUS would unilaterally assert jurisdiction with respect to a particular transaction in the absence of a declaration or notice filed by the parties to the transaction.

Covered Investments (Non-Controlling)

The new rule also incorporates CFIUS's expanded jurisdiction under FIRRMA to review "covered investments," defined as certain non-controlling investments in certain U.S. businesses. First, to be a covered investment, the investment must include at least one of the following rights:

Access to any material non-public technical information in the possession of the U.S. business
Membership or observer rights on the board of directors (or equivalent) of the U.S. business or the right to nominate an individual to such a position
Any involvement, other than through voting of shares, in substantive decision-making of the U.S. business regarding critical technology, critical infrastructure, or sensitive personal data

Second, to be a covered investment, that investment must be in a "TID U.S. business" (i.e., a Technology, Infrastructure, or Data U.S. business), which is a business that falls in at least one of the following three categories: critical technology; critical infrastructure; or sensitive personal data.

Critical Technology

A U.S. business that produces, designs, tests, manufactures, fabricates, or develops one or more "critical technologies" is a "TID U.S. business." Consistent with FIRRMA and the Pilot Program, "critical technology" is defined to include the following:

Defense articles and defense services included on the U.S. Munitions List
Items included on the Commerce Control List (CCL), other than those controlled only for anti-terrorism reasons
Certain nuclear-related items and facilities identified in the CFR
Certain biological agents and toxins identified in the CFR
Emerging and foundational technologies identified by the Bureau of Industry and Security (BIS) pursuant to the Export Control Reform Act of 2018[i]

Critical Infrastructure

A U.S. business that performs certain functions with regard to certain infrastructure systems and assets, the incapacity or destruction of which would have a debilitating impact on national security, is also a "TID U.S. business." The new rule includes an appendix with two extensive and detailed lists that include 28 types of "covered investment critical infrastructure," along with the functions that a U.S. business must perform with respect to each of these 28 types of critical infrastructure" in order to be a "TID U.S. business."

Broadly speaking, "covered investment critical infrastructure" includes the following:

Telecommunications and internet
Manufacturing of critical defense articles and materials
Power generation, distribution, and storage
Oil and gas production and distribution
Financial market utilities and resources
Airports, ports, and rail lines
Public water systems

Generally, a U.S. business that owns or operates any "covered investment critical infrastructure" is a "TID U.S. business." However, in certain instances a U.S. business that supplies, services, or manufactures the "covered investment critical infrastructure" may also be a "TID U.S. business." U.S. businesses involved with critical infrastructure will need to carefully review Appendix A to determine whether they are covered.

Sensitive Personal Data

A U.S. business that maintains or collects, directly or indirectly, "sensitive personal data" of U.S. citizens is a "TID U.S. business." The new rule creates two classes of sensitive personal data:

Identifiable data that falls within one of ten specific categories[ii] and is collected or maintained by a U.S. business that does the following:
- Specifically provides products or services to U.S. agencies and personnel with national security responsibilities
- Had such data on more than one million individuals within 12 months of certain events relevant to CFIUS review
- Intends to maintain or collect such data on greater than one million individuals as part of its products or services
Identifiable data that results from an individual's genetic tests, including any related genetic sequencing data, but not including data derived from databases maintained by the U.S. government and routinely provided to private parties for purposes of research

The new rule exempts from the definition of "sensitive personal data" any data concerning the U.S. business' own employees (other than U.S. government contractors with security clearances) and data that is a matter of public record.

Expanded Definition of "U.S. Business"

The new rule arguably expands the scope of what constitutes a "U.S. business" falling within the purview of the CFIUS. The existing rules define "U.S. business" to mean any entity engaged in interstate commerce in the United States, but only to the extent of its activities in interstate commerce. The new rule omits the limiting clause, defining "U.S. business" as any entity engaged in interstate commerce in the United States. Accordingly, it is unclear to what extent the activities of a U.S. business conducted entirely outside the United States will be subject to CFIUS review.

Clarification of the "Principal Place of Business" of an Entity

The new rule proposes a definition of "principal place of business," a term that CFIUS had not previously defined, and which informs whether an investor that is an entity will be deemed foreign. Under the proposed definition, "principal place of business" means the primary location where an entity's management directs, controls, or coordinates the entity's activities, or, in the case of an investment fund, where the fund's activities and investments are primarily directed, controlled, or coordinated by or on behalf of the general partner, managing member, or equivalent.

This proposed definition may provide limited relief from CFIUS review for entities, and especially investment funds, that are organized in favorable tax jurisdictions but managed in the United States. CFIUS is accepting comments on the proposed definition through February 13, 2020, and the proposed definition will be in effect on an interim basis until CFIUS publishes a final rule.

Mandatory Filings for Certain Investments in "TID US Businesses"

Consistent with the Pilot Program, the new rule includes mandatory submissions for two categories of transactions within CFIUS's jurisdiction. The first, patterned on the Pilot Program, pertains to investments in U.S. TID businesses that deal in "critical technologies." The second, which is new, pertains to investments in U.S. TID businesses by foreign investors with substantial foreign government ownership.

For all other transactions within CFIUS's jurisdiction, submission to CFIUS is voluntary. However, CFIUS may independently initiate a review, or ask parties to submit a voluntary submission, with respect to any such transaction.

Critical Technology

With respect to critical technology, the new rule preserves the system established by the Pilot Program. In other words, it is defined as a covered control transaction or covered investment in a TID U.S. business that produces, designs, tests, manufactures, fabricates, or develops one or more critical technologies in connection with the TID U.S. business' activity in, or designed by the TID U.S. business specifically for use in, one of 27 industries. Those 27 industries continue to be defined by reference to the North American Industry Classification System (NAICS).

However, the new rule explains that it is CFIUS's intention to move away from the industry model established in the Pilot Program in the near future.[iii]

An important change in the new rule is the inclusion of specific exemptions to the mandatory filing requirements. For TID U.S. businesses involved in critical technology the following investments are not subject to mandatory filing:

A covered control transaction by an "excepted investor" (discussed in more detail here)
A covered control transaction or covered investment made solely and directly by a company holding an active facility security clearance and operating pursuant to a foreign ownership, control, or influence (FOCI) mitigation agreement
A covered control transaction or covered investment by an investment fund if the fund is managed exclusively by a general partner, managing member, or equivalent that is either ultimately controlled by U.S. nationals or is not a foreign person and does not allow any foreign limited partner to control the fund, or its investment decisions
An investment that becomes a covered investment solely because the investor ceases to be an "excepted investor" (discussed in more detail here) within three years of the completion date
A covered control transaction involving an air carrier that holds an air transportation certificate
A covered control transaction or covered investment in a TID U.S. business that is a TID U.S. business solely because it produces, designs, tests, manufactures, fabricates, or develops encryption items, software, or technology eligible for License Exception ENC of the Export Administration Regulations (15 CFR § 740.17)

Substantial Foreign Government Interest

The new rule requires a mandatory filing for any covered control transaction or covered investment that results in a foreign person (in which the national or subnational governments of a single foreign state have a direct or indirect voting interest of 49% or more) acquiring a direct or indirect voting interest of 25% or more in a TID U.S. business.

The new rule also provides two exemptions. In the case of mandatory filing requirements for investments in TID U.S. businesses in which a foreign government would acquire a substantial interest, the following investments are not subject to mandatory filing:

A covered control transaction or covered investment by an investment fund if the fund is managed exclusively by a general partner, managing member, or equivalent that is either ultimately controlled by U.S. nationals or is not a foreign person and does not allow any foreign limited partner to control the fund, or its investment decisions
A covered control transaction involving an air carrier that holds an air transportation certificate

Exemption for U.S. Investment Funds

Investments made by an investment fund are exempt from the mandatory submission requirements in the following circumstance:

The fund is managed exclusively by a general partner, a managing member, or equivalent that is not a foreign person
Any advisory board or committee of the fund that includes foreign persons does not have the ability to approve, disapprove, or otherwise control investments of the fund
Foreign persons do not otherwise have the ability to control the investment fund

Timing

The new rule also made an important change to the timing of mandatory submissions. Under the Pilot Program, the submission had to be made no less than 45 days before the "completion date" of the transaction. That has now been shortened to 30 days before the "completion date." The completion date is the earliest date upon which any ownership interest (including a contingent equity interest) is transferred, or a change in rights occurs that could result in a covered control transaction or covered investment occurs.

Penalties

Failure to make a mandatory submission required by the new rule may result in a civil penalty of up to $250,000 or the value of the transaction, whichever is greater. CFIUS has indicated that it is considering whether it can make additional information available to assist the public in understanding its enforcement priorities.

Safe Harbor for Incremental Acquisitions

The new rule also codifies the long-standing incremental acquisition rule, whereby a subsequent acquisition by a foreign person of an additional interest in, or additional rights with respect to, a U.S. business will not be subject to CFIUS jurisdiction if:

That same foreign investor previously acquired direct control of the U.S. business as a result of a "covered control transaction"
CFIUS concluded all action with respect to such prior "covered control transaction"

Jurisdiction Over Investments in US Real Estate

Under the new rule, CFIUS has jurisdiction to review "covered real estate transactions," which include any purchase or lease by, or concession to, a foreign person of "covered real estate" that affords the foreign person at least three of the following property rights:

Physically access the real estate
Exclude others from physically accessing the real estate
Improve or develop the real estate
Attach fixed or immovable structures or objects to the real estate

However, "covered real estate transactions" do not include any of the eight expressly defined "excepted real estate transactions" as discussed here in more detail.

There are no mandatory submissions pursuant to the new rules applicable to real estate transactions.

Option to Submit a Short-Form Declaration or Long-Form Notice

Under the new rules, parties may elect between a short-form declaration or long-form notice for both mandatory submissions and voluntary submissions (including voluntary submissions under Part 802 for covered real estate transactions). Currently, declarations are only permitted for mandatory submissions under the Pilot Program.

A declaration offers both advantages and disadvantages compared to the traditional long-form notice. A declaration can be completed much more quickly and cheaply than a notice. This will especially be the case if CFIUS implements its authorization under FIRRMA to charge a filing fee in connection with notices. CFIUS must also provide its response to a declaration within 30 days. However, in that response, CFIUS can take any of the following actions:

Request that the parties file a long-form notice
Inform the parties that CFIUS is unable to conclude its review based on the declaration and that the parties may submit a notice to allow CFIUS to conclude its review
Initiate a unilateral review of the transaction because the transaction may threaten national security
Notify the parties that CFIUS has concluded all action with respect to the transaction

It has been our experience with declarations submitted under the Pilot Program that only a relatively small portion of declarations result in CFIUS concluding all action with respect to the transaction. Accordingly, submitting a declaration may not provide certainty to parties to a transaction.

CFIUS Filing Fees

FIRRMA authorizes CFIUS to impose a filing fee for notices (but not for declarations) up to the lesser of 1% of the value of the transaction or $300,000 (adjusted for inflation). The new rules do not provide for such a filing fee. However, CFIUS states it will publish a proposed rule implementing this fee authority later.

Appendix

The current regulations will continue to apply to any transaction so long as one of the following occurs prior February 13, 2020:

The completion date of the transaction
The parties to the transaction have executed a binding written agreement, or other binding document, establishing the material terms of the transaction
A party has made a public offer to shareholders to buy shares of a U.S. business
A shareholder has solicited proxies in connection with an election of the board of directors of a U.S. business or an owner or holder of a contingent equity interest has requested the conversion of the contingent equity interest

As discussed, "covered real estate transactions" do not include any of the eight expressly defined "excepted real estate transactions" discussed below.

Covered Real Estate

The following are the five types of "covered real estate:"

Real estate that is located within, or will function as part of, a "covered port," which the rule defines to include any "large hub airport" as defined in 49 U.S.C. § 40102; any airport with annual aggregate cargo over 1.24 billion pounds; any "joint use airport" as defined in 49 U.S.C. § 47175; any commercial strategic seaport within the National Port Readiness Network; and the top 25 seaports by tonnage, containers, or dry bulk
Real estate within one mile of any military installation listed on parts 1 or 2 of Appendix A to Part 802 of Chapter 31 of the CFR
Real estate within the "extended range" (generally 100 miles) of any military installation listed on part 2 of Appendix A
Real estate located within any the counties or geographic areas listed in part 3 of Appendix A
Real estate located within any part of the offshore military areas listed on part 4 of Appendix A

Excepted Real Estate Transactions

The following are the eight types of "excepted real estate transactions:"

Transactions by "excepted real estate investors" (see here)
Transactions that are "covered control transactions" or "covered investments" under Part 800 of Chapter 31 of the CFR, which must be evaluated pursuant to the rules applicable to investments in a U.S. business, regardless of any real estate
Transactions involving real estate within an "urbanized area" or "urban cluster," unless the real estate is located within, or will function as part of, a "covered port" or is within one mile of any military installation listed on part 1 or part 2 of Appendix A
Transactions involving a single housing unit, including fixtures and adjacent land
Leases or concessions at a "covered port" to a foreign air carrier approved by the Transportation Security Administration, but only to the extent the lease or concession is in furtherance of its activities as a foreign air carrier, or for the purpose of engaging in the retail sale of consumer goods or services to the public
Leases and concessions involving covered real estate at covered ports that may be used only for the purpose of engaging in the retail sale of consumer goods or services to the public. This is meant to exclude leases by retail vendors within an airport, including with respect to car rental and parking
Transactions involving commercial space in a multi-tenant building, so long as the foreign person and its affiliates do not exceed 10% of the total square footage or 10% of the total number of tenants
Transactions involving real estate owned by (or held in trust on behalf of) certain Alaskan Native and American Indian groups or entities

Excepted Foreign Investors

The new rules exempt certain foreign investors from both the rules on investments in U.S. businesses ("excepted investors" as defined in Part 800) and real estate ("excepted real estate investors" as defined in Part 802). The precise criteria for determining whether a foreign investor is an "excepted investor" or "excepted real estate investor" are highly technical and not readily summarized here. In general, the foreign investor must be one of the following, and remain so for the three years following the "completion date" of the transaction:

A foreign national who is only a national of "excepted foreign states" (see below)
A foreign government of an "excepted foreign state"
A foreign entity that is organized under the laws of an "excepted foreign state" or in the United States, has its principal place of business in an "excepted foreign state" or in the United States, and meets minimum thresholds for directors and observers, major stakeholders, and overall stakeholders

In addition, the foreign investors cannot appear on the Entity List or Unverified List maintained by the Bureau of Industry & Security and cannot have committed felonies or certain regulatory violations in the five year prior to the "completion date" of the transaction.

The definitions of "excepted investors" in Part 800 and "excepted real estate investors" in Part 802 refer to the list of "excepted foreign states" and list of "excepted real estate foreign states," respectively. Currently those lists are identical, and include only Australia, Canada, and the United Kingdom, due to their robust intelligence-sharing and defense industrial base integration mechanisms with the United States.

The new rules do not establish the precise criteria by which CFIUS may add additional countries to the lists of "excepted foreign states" and "excepted real estate foreign states." However, for a country to remain on the lists after February 13, 2022, CFIUS must determine that the country has a robust process to analyze national security risks posed by foreign investment and facilitate coordination with the United States on investment security.

Endnotes

[i] On January 6, 2020, BIS published its first rule covering an "emerging technology": software specially designed to automate the analysis of geospatial imagery. Additional rules on emerging technologies have been anticipated since BIS issued an Advance Notice of Proposed Rulemaking in November 2018. Based on the advance notice, such rules could cover technologies in a broad range of fields, including biotechnology, artificial intelligence, microprocessors, quantum computing, 3D printing, and robotics. IS has yet to publish a similar advance notice with respect to foundational technologies. BIS previously indicated that an advance notice would issue before the end of 2019.

[ii] (1) Financial data that could be used to analyze or determine an individual's financial distress or hardship; (2) The set of data in a consumer report; (3) The set of data in an application for health insurance, long-term care insurance, professional liability insurance, mortgage insurance, or life insurance; (4) Data relating to the physical, mental, or psychological health condition of an individual; (5) Non-public electronic communications, including email, messaging, or chat communications, between or among users of a U.S. business's products or services if a primary purpose of such product or service is to facilitate third-party user communications; (6) Geolocation data collected using positioning systems, cell phone towers, or WiFi access points, such as via a mobile application, vehicle GPS, other onboard mapping tool, or wearable electronic device; (7) Biometric enrollment data including facial, voice, retina/iris, and palm/fingerprint templates; (8) Data stored and processed for generating a state or federal government identification card; (9) Data concerning U.S. Government personnel security clearance status; or (10) The set of data in an application for a U.S. Government personnel security clearance or an application for employment in a position of public trust;

[iii] CFIUS expects to promulgate proposed rules that would replace the focus on specific industries and NAICS codes with a mandatory declaration requirement based upon export control licensing requirements of the critical technology.