Treasury Finalizes New CFIUS Regulations

On January 13, 2020, the Department of the Treasury issued two sets of final regulations implementing the Foreign Investment Risk Review Modernization Act of 2018 (“FIRRMA”). As described in our prior alerts—CFIUS Update: Congress Enacts the Foreign Investment Risk Review Modernization Act and CFIUS Update: Interim Regulations, FIRRMA Pilot Program, and Proposed Rulemaking on Emerging Technologies—FIRRMA, enacted in August 2018, expanded and clarified CFIUS’s authority in various ways, including jurisdiction to review certain non-controlling investments in U.S. businesses, and requiring that certain transactions be notified to CFIUS. The final regulations largely track the proposed regulations that Treasury issued in September 2019.

As described in our prior alert, Treasury Issues Long-Awaited Proposed CFIUS Regulations, the first set of rules will amend the current CFIUS regulations (“Part 800 Regulations”). In addition to numerous updates to the prior rules, which were promulgated in 2008, the Part 800 Regulations implement FIRRMA’s expansion of CFIUS jurisdiction to cover non-controlling investments (“covered investments”) in certain U.S. businesses in the critical technology, critical infrastructure, and sensitive personal data industries. The second set of rules (the “Part 802 Regulations”) solely addresses CFIUS’s newly enlarged jurisdiction over certain previously uncovered real estate transactions.”

Documents comprising the final rules collectively exceed 300 pages. We address the key developments and changes from the proposed rules below. As explained below, both the Part 800 Regulations and the Part 802 Regulations become effective on February 13, 2020.

FIRRMA Pilot Program

In November 2018, CFIUS implemented a “Pilot Program” to test new rules that, for the first time, mandated notification to CFIUS of certain foreign investments in “critical technology” companies. “Critical technology” means items controlled pursuant to: (1) the International Traffic in Arms Regulations; (2) certain controls of the Export Administration Regulations; (3) nuclear-related equipment and materials; (4) select agents and toxins; and (5) “emerging and foundational technologies.” The Commerce Department issued an advanced notice of proposed rulemaking regarding “emerging technologies” in November 2018, and is in the process of issuing final and proposed rules for specific technologies that will fall within that category. The Commerce Department plans to begin the rulemaking process for “foundational technologies” in early 2020. The Pilot Program also included short-form “declarations” contemplated by FIRRMA that could be used for transactions within the scope of the mandate.

The Part 800 Regulations provide for the Pilot Program to end on February 12, 2020. The Part 800 Regulations will essentially incorporate the Pilot Program’s construct for mandatory declarations regarding investments in U.S. businesses involved with “critical technology.” Notably, the final rules continue to define the scope of this requirement by reference to 27 specific industries identified by North American Industry Classification System (“NAICS”) codes. The Treasury Department, however, anticipates issuing a notice of proposed rulemaking to revise the mandatory declaration requirement for critical technology from an NAICS code-based system to one based on export control licensing requirements.

The final rules also exempt certain transactions from the critical technology mandatory filing requirement that were not exempt under the Pilot Program. Newly exempt transactions include, among others: transactions in which the foreign investors qualify as “excepted investors” (discussed below); transactions in which the U.S. business’s sole “critical technology” is encryption technology eligible for License Exception ENC; and investments from investment funds managed exclusively by, and ultimately controlled by, U.S. nationals.

Excepted Foreign States and Excepted Investors

In conjunction with expanding CFIUS’ jurisdiction to “covered investments,” FIRRMA required CFIUS to identify a category of foreign persons to whom the expanded jurisdiction would not apply. The proposed regulations addressed this requirement by introducing the concept of “excepted investors,” who would be identified based on a substantial connection to an “excepted foreign state.” The proposed regulations, however, did not identify any such excepted countries.

The final regulations identify the initial “excepted foreign states” as Australia, Canada, and the United Kingdom. CFIUS selected those countries because “of their robust intelligence-sharing and defense industrial base integration mechanisms with the United States.” CFIUS reportedly has discussed with numerous other countries the potential for future listing as excepted states.

Investors from those “excepted foreign states” qualify as “excepted investors” if they are either: (a) foreign nationals of only “excepted foreign states;” (b) a government of an “excepted foreign state;” or (c) a foreign entity that meets all five of certain conditions for itself and its parents (if any). Those conditions are: (1) the entity is organized under the laws of an “excepted foreign state” or the United States; (2) the entity’s principal place of business is in an “excepted foreign state” or the United States; (3) 75% of the directors and observers of the board, or equivalent body, are non-dual citizens of the “excepted foreign state” or U.S. citizens; (4) shareholders that individually hold 10% or more of the equity or other significant rights are from an “excepted foreign state;” and (5) the “minimum excepted ownership” of the foreign entity must be held by shareholders from an “excepted foreign state” or the United States. For entities whose equity securities are primarily traded on an exchange in an “excepted foreign state” or the United States, the “minimum excepted ownership” is a majority of the voting interests, right to profits, and assets in the event of dissolution. For entities whose equity securities are not primarily traded on an exchange in an “excepted foreign state” or the United States, the “minimum excepted ownership” is 80% of the voting interests, right to profits, and assets in the event of dissolution.

An investor is disqualified from excepted status if CFIUS has previously found that the investor—or its parent or subsidiaries—submitted a material misrepresentation in a joint voluntary notice, violated a mitigation agreement, or was the subject of a past decision by the President to block a transaction to which the investor or its parent was a party. In addition, other actions by the U.S. Government against an investor or its affiliates also can preclude an investor from being treated as an “excepted investor;” for example, findings of violations of U.S. economic sanctions issued by the Office of Foreign Assets Control or a final order, including a settlement order, for violations of U.S. export control laws issued by the Department of Commerce’s Bureau of Investment Security.

New and Revised Definitions

In response to public comments, the final rules add to and revise certain of the definitions published in the proposed rules.

Of particular note, the final rules provisionally define “principal place of business,” as follows: “the primary location where an entity’s management directs, controls, or coordinates the entity’s activities, or, in the case of an investment fund, where the fund’s activities and investments are primarily directed, controlled, or coordinated by or on behalf of the general partner, managing member, or equivalent.” This term is relevant to the definitions of “foreign entity” and “excepted investor.” CFIUS included the definition as an interim rule, with a 30-day period for public comments. That process suggests that CFIUS will be prepared to finalize the definition fairly soon after the effective date of the regulations on February 13.

As noted above, a key element of the Part 800 Regulations is finalization of rules implementing FIRRMA’s extension of CFIUS jurisdiction to non-controlling investments involving critical technology, critical infrastructure, and sensitive personal data industries—collectively designated as “TID US businesses” (for “Technology, Infrastructure, Data”). These covered transactions are ones that afford a foreign person: (1) access to material non-public technical information about the TID US business; (2) membership or observer rights on the TID US business’s board of directors; or (3) involvement in substantive decision making of the TID US business relating to critical technology, critical infrastructure, or sensitive personal data. Among other things, the proposed definition of “sensitive personal data” included “genetic information” as defined in regulations implementing the Health Insurance Portability and Accountability Act (“HIPAA”). The proposed rules also attempted to limit the impact of the mandate in respect of businesses that collected or maintained data concerning fewer than one million individuals during the prior 12 months.

The proposed rules elicited substantial comment on the scope of “sensitive personal data,” but CFIUS made few material changes. Principally, the final rules revise the definition of “genetic information.” As defined by HIPAA, “genetic information” encompassed: “(i) The individual's genetic tests; (ii) The genetic tests of family members of the individual; (iii) The manifestation of a disease or disorder in family members of such individual; or (iv) Any request for, or receipt of, genetic services, or participation in clinical research which includes genetic services, by the individual or any family member of the individual.” The final rules eliminate the simple cross-reference to the HIPAA definition, and instead define the term specifically and more narrowly to include the “results of an individual’s genetic tests, including any related genetic sequencing data, whenever such results constitute identifiable data.”

The second notable revision to the proposed definition of “sensitive personal data” concerns when to measure the threshold database size. As finalized, the rule clarifies that the 12-month period dates from any of several milestones, including filing of a declaration or notice and completion of the transaction. CFIUS also added numerous examples intended to illustrate the application of the sensitive personal data rule as it relates to covered transactions.

Voluntary Declarations

As of February 13, 2020, CFIUS will begin accepting short-form declarations for transactions voluntarily notified to CFIUS as an alternative to the traditional notice. CFIUS plans to make a standard template form for voluntary declarations available on its website prior to February 13.

Real Estate Transactions

In parallel with the Part 800 regulations, CFIUS issued final Part 802 Regulations implementing its expanded jurisdiction over “covered real estate transactions.” The final rules update various definitions from the proposed Part 802 Regulations. These changes include introducing the term “covered port” to more clearly address the specific airports and maritime ports subject to CFIUS jurisdiction, and the terms “excepted real estate foreign state” and “excepted real estate investor,” which largely mirror the excepted investor concept in the Part 800 regulations. The final rules also refine the geographic coverage of the Part 802 Regulations related to real estate in proximity to air force base missile fields in Colorado, Montana, Nebraska, North Dakota, and Wyoming.

To assist with understanding the geographic coverage of the Part 802 Regulations, CFIUS plans to make a web-based tool available on its website. In the interim, the Census Bureau’s TigerWeb tool, https://tigerweb.geo.census.gov/tigerweb/, is a helpful reference.

Filing Fees

The final rules do not establish filing fees authorized under FIRRMA. The Treasury Department plans to publish separate proposed regulations regarding filing fees at a later date.

Effective Date

Both the Part 800 Regulations and the Part 802 Regulations become effective on February 13, 2020. With regard to transactions proposed or pending on that date, the rules will apply as follows: (a) For any transaction that was subject to the Pilot Program rules through February 12, those rules will continue to apply. (b) The Part 800 regulations that were in effect prior to February 13 will continue to apply to any transaction for which any of the following has occurred prior to February 13: (1) the transaction has closed; (2) the parties have executed a binding written agreement establishing the material terms of the transaction; (3) a party has made a public offer to shareholders to buy shares of a U.S. business; or (4) a shareholder has solicited proxies in connection with an election of the board of directors of a U.S. business or an owner or holder of a contingent equity interest has requested the conversion of the contingent equity interest.

These transition rules effectively mean that the new Part 800 Regulations will apply to transactions that are signed, or otherwise initiated as described above beginning February 13, 2020. For parties already engaged with CFIUS on a covered transaction, the current rules (or Pilot Program rules) continue to apply.

This memorandum is a summary for general information and discussion only and may be considered an advertisement for certain purposes. It is not a full analysis of the matters presented, may not be relied upon as legal advice, and does not purport to represent the views of our clients or the Firm. Greta Lichtenbaum, an O’Melveny partner licensed to practice law in the District of Columbia, Theodore W. Kassinger, an O’Melveny of counsel licensed to practice law in the District of Columbia and Georgia, David J. Ribner, an O’Melveny counsel licensed to practice law in the District of Columbia and New York, Mary Pat Dwyer, an O’Melveny associate licensed to practice law in the District of Columbia and Pennsylvania, contributed to the content of this newsletter. The views expressed in this newsletter are the views of the authors except as otherwise noted.

© 2020 O’Melveny & Myers LLP. All Rights Reserved. Portions of this communication may contain attorney advertising. Prior results do not guarantee a similar outcome. Please direct all inquiries regarding New York’s Rules of Professional Conduct to O’Melveny & Myers LLP, Times Square Tower, 7 Times Square, New York, NY, 10036, T: +1 212 326 2000.