CFIUS Proposes Dramatic Expansion of US Foreign Investment Review, Seeks Public Input

On September 24, 2019 the US Department of the Treasury (Treasury) published two proposed rules that would significantly expand the jurisdiction of the Committee on Foreign Investment in the United States (CFIUS) to review inbound US foreign investment for national security risks. The proposed rules, which have been in the works for months, would implement the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA) by expanding CFIUS's jurisdiction over transactions involving foreign government-controlled investors, US critical infrastructure and critical technology companies, companies that hold significant amounts of sensitive personal data, and certain US real estate. The rules would also make relatively modest changes to CFIUS's procedures. Interested parties must submit written comments to Treasury on or before October 17, 2019. 

In this advisory, we summarize the background for this important CFIUS rulemaking, and we highlight some of the key areas of proposed changes that may be of interest to parties in affected industries who are considering submitting comments to Treasury. 

Background 

For many years CFIUS's jurisdiction was limited to transactions in which a foreign person would acquire "control" of a US business. FIRRMA was enacted on August 13, 2018 to address widely perceived gaps and shortcomings in CFIUS’s authority to review foreign investments that do not result in foreign control of a US business. In particular, FIRRMA extended CFIUS's jurisdiction to review non-controlling investments involving foreign governments and state-owned entities; US critical technology, critical infrastructure, or sensitive US person data; US real estate transactions; and certain perceived procedural gaps in CFIUS's jurisdiction. (For additional background on FIRRMA please see our previous International Law Advisory). 

Most of the key FIRRMA provisions do not go into effect until Treasury publishes implementing regulations. On October 10, 2018, Treasury published an interim rule implementing certain procedural provisions of FIRRMA. On October 10, 2018, Treasury also published an interim rule creating a "pilot program" that subjects certain controlling and non-controlling investments in US critical technology companies to mandatory CFIUS review. (Our earlier analysis of these interim rules is available on our International Compliance Blog.) 

On September 24, 2019, Treasury published two proposed rules that would implement most of the remaining provisions of FIRRMA. These proposed rules reflect a serious and sober effort by Treasury to balance US and foreign investor interests in transparency, certainty, and efficiency with US government national security interests. They do not go into effect immediately; Treasury is seeking public comments through October 17, 2019, and it anticipates publishing final rules no later than February 2020. 

One of the proposed rules would amend, expand, and republish CFIUS's existing rules at 31 C.F.R. Part 800 by adding provisions related to foreign government-controlled investments, investments in US critical infrastructure companies, and companies that hold sensitive US person data; and by making certain other procedural changes to the CFIUS process. The other proposed rule would create a new set of regulations at 31 C.F.R. Part 802 to implement CFIUS's new authority to review certain US real estate transactions. 

The proposed rules do not alter the critical technology pilot program contained at 31 C.F.R Part 801. However, Treasury is continuing to evaluate that program and could renew the pilot program (which is currently set to expire on March 5, 2020) or implement changes to it at a later date. 

Key Proposed Changes to CFIUS's Regulations 31 CFR Part 800

1. CFIUS would have authority to review new categories of non-controlling investments. The proposed regulations extend CFIUS's jurisdiction to review non-controlling transactions, referred to as "covered investments," in US businesses engaged in specified activities involving critical technology, critical infrastructure, or sensitive personal data. Such businesses are referred to as "TID" (technology, infrastructure, and data) US businesses. Section 800.211 would track the language of FIRRMA by defining a covered investment as a non-controlling transaction that affords the foreign person: (1) "Access to any material nonpublic technical information in the possession of the TID US business,"^[1] (2) "Membership or observer rights on the board of directors or equivalent governing body of the TID US business or the right to nominate an individual to a position on the board of directors or equivalent governing body of the TID US business," or (3) involvement, other than through voting of shares, in "substantive decisionmaking of the TID US business" with regard to certain actions related to sensitive personal data, critical technologies, or critical infrastructure. 

2. CFIUS would be authorized to review non-controlling investments in 28 categories of US "critical infrastructure" companies. FIRRMA requires Treasury to limit its review of non-controlling investments in critical infrastructure to a subset of critical infrastructure that is to be identified in regulations. The proposed regulations identify 28 different categories of critical infrastructure for additional CFIUS foreign investment review. As specified in proposed Appendix A to Part 800, these critical technology industries include, among others, telecommunications and satellite networks; US defense industrial resource providers; power utilities; specialty metals and materials manufacturers; oil and gas pipelines, refineries and storage facilities; air and maritime ports; rail lines; and public water systems. Appendix A also identifies specific "functions" in each industry that would trigger CFIUS's jurisdiction. For example, category (iv) of Appendix A relates to "any satellite or satellite system providing services directly to the Department of Defense" and lists the applicable functions as owning or operating such satellite or satellite system.^[2] 

3. The regulations would include a detailed definition of "sensitive personal data" that could trigger expanded CFIUS review. FIRRMA expands CFIUS's jurisdiction to review non-controlling foreign investments in unaffiliated US businesses that maintain or collect sensitive personal data of US citizens. Treasury explains that its proposed definition of "sensitive personal data" at Section 800.241 is an attempt to "minimize any chilling effect on beneficial foreign ownership" by "focusing on the sensitivity of the data itself, as well as the sensitivity of the population about whom the data is maintained or collected." The proposed definition of sensitive personal data is complex and detailed. It identifies 10 categories of covered personal data (for example, data "that could be used to analyze or determine an individual's financial distress or hardship" or "relating to the physical, mental, or psychological health condition of an individual," among other categories). CFIUS would have the authority to review non-controlling investments where such data was maintained or collected by a US business that: 

1. "Targets or tailors" products or services to US federal government entities with "intelligence, national security, or homeland security responsibilities" or to their personnel or contractors;

2. Maintains or collects data on over one million individuals at any time during the preceding 12 months; or

3. Has a business objective to collect such data on over one million individuals and such data is "an integral part of" of the company's "primary products or services."

US businesses that maintain or collect genetic information would be covered regardless of whether the above three criteria are met. The regulations would exclude US businesses that maintain or collect data regarding their own employees (with exceptions for government contractors holding personnel security clearances) and data that is a matter of public record. 

4. A process would be created for exempting certain "limited" categories of foreign investors from CFIUS's expanded jurisdiction over non-controlling covered investments. FIRRMA requires CFIUS to limit its expanded jurisdiction over covered non-controlling investments to a limited subset of categories of foreign persons. Many investors are hoping that CFIUS will publish a "white list" of favored countries whose investors will not be subject to expanded review. The proposed rules create a process for exempting certain categories of investors, but without exempting anyone at present. The regulations would exempt "excepted investors" with sufficiently substantial connections, as enumerated at Section 800.220, to one or more "expected foreign states."^[3] The proposed rules do not presently include any countries within the category of "excepted foreign state" and note that CFIUS intends this category to be "limited." (A similar carveout would apply to Section 802's real estate provisions discussed below.) 

5. Foreign government-controlled investors would be required to file with CFIUS when acquiring a "substantial interest" in a US TID business. Proposed Section 800.401 would implement FIRRMA's requirement for mandatory declarations to be filed for covered transactions where a foreign person obtains a "substantial interest" in a US critical technology, critical infrastructure, or US person data (TID) business and a foreign government holds a "substantial interest" in the foreign person. The term "substantial interest" would be defined at Section 800.224 to mean "a voting interest, direct or indirect, of 25 percent or more by a foreign person in a US business and a voting interest, direct or indirect, of 49 percent or more by a foreign government in a foreign person." The definition further provides that "[f]or purposes of determining the percentage of voting interest held indirectly by one entity in another entity, any voting interest of a parent will be deemed to be a 100 percent voting interest in any entity of which it is a parent." With respect to limited partnerships a foreign government has a substantial interest if: (1) it holds a 49% or greater interest in the general partner or (2) it is a limited partner and holds a 49% or greater voting interest of the limited partners. Mandatory declarations must be submitted at least 30 days in advance of the transaction completion date. 

6. The filing of short-form declarations would be authorized for any covered transaction. Under the proposed rules, the short-form declaration filing process, first introduced for the CFIUS pilot program and described in our prior blog post, would be made available on a voluntary basis to any proposed or completed transaction instead of filing a more lengthy notice. The declaration process allows for parties to submit a shorter filing and provides for CFIUS review on a more condensed timeframe (30 days). However, industry reaction to the CFIUS pilot program has been mixed, and many parties have opted to file full notices instead of declarations under the pilot program because of CFIUS's decision in the great majority of cases not to clear a transaction based solely on review of a declaration. 

7. The regulations would clarify when "lending transactions" could trigger CFIUS review. The proposed rules attempt to clarify the application of CFIUS's jurisdiction over loans and other financing transactions. Section 800.306 would clarify that the "extension of a loan or a similar financing arrangement by a foreign person to a US business, regardless of whether accompanied by the creation in favor of the foreign person of a secured interest over securities or other assets of the US business, shall not, by itself, constitute a covered transaction." Further, CFIUS will not review notices or declarations with respect to such lending until such a time as "because of imminent or actual default or other condition, there is a significant possibility that the foreign person may obtain control of a US business, or acquire equity interest and access, rights, or involvement…over a TID US business, as a result of the default or other condition." The proposed regulations further provide that if a loan is accompanied by "financial or governance rights characteristic of an equity investment but not of a typical loan" such a loan may be considered a covered transaction. 

Section 800.306 also states that an acquisition of voting interests or assets of a US business by a foreign person "upon default or other condition involving a loan or a similar financing arrangement" is not a covered transaction if the loan was made by a syndicate of banks where the foreign lender in the syndicate: (1) "[n]eeds the majority consent of the US participants in the syndicate to take action" or (2) "[d]oes not have a lead role in the syndicate, and is subject to a provision in the loan or financing documents limiting its ability to control the debtor such that control" could not be acquired. 

Finally, the proposed rule states that "the Committee will take into account whether the foreign person has made any arrangements to transfer management decisions, or day-to-day control over the US business to US nationals for purposes of determining whether such loan or financing arrangement constitutes a covered transaction." This seems to contemplate a scenario in which a foreign person could obtain title to assets, but authorize to a US national to manage a sale or similar disposition of the assets in a manner that would not trigger CFIUS jurisdiction. 

8. The regulations would clarify when "incremental investments" would be subject to CFIUS review. Section 800.305 provides that a transaction where a foreign investor acquires an additional interest in a US business over which the foreign investor had previously acquired direct control will not require additional CFIUS review if CFIUS completed review of a full notification regarding the parties' earlier investment. On the other hand, the definition of "covered investment" at Section 800.213 would clarify that any other transaction resulting in "a change of rights that a foreign person has with respect to a US business in which the foreign person has an investment" would be considered a covered transaction "if that change could result in a covered control transaction or a covered investment."

9. The regulations would implement FIRRMA's exception for certain investment funds. Investments by investment funds with foreign person limited partners would not be considered "covered investments" if the fund meets criteria contained at Section 800.307 (for example, that the fund is managed exclusively by a general partner (or equivalent) who is a US person). 

10. Treasury is not imposing CFIUS filing fees…yet. Although FIRRMA authorizes CFIUS to impose filing fees, the proposed regulations do not address filing fees and note that Treasury intends to publish a separate proposed rule with respect to fees at a later date. 

The New CFIUS "Real Estate" Rules at 31 CFR Part 802 

Part 802 contains Treasury's proposed rules for implementing CFIUS's new authority from FIRRMA for reviewing US real estate transactions of potential national security concern. 

Part 802 would apply to "covered real estate transactions," which are defined as "the purchase or lease by, or a concession to," a foreign person of "covered real estate" that provides the foreign person with certain property rights, and that are not otherwise carved out by CFIUS's definition of "excepted real estate transactions."

Real estate transactions covered by Part 802 would not be subject to any mandatory filing requirement, unlike certain transactions in Part 800. (However, certain transactions involving real estate could fall under CFIUS's expanded jurisdiction under Part 800, discussed above, and thus could require a filing under Part 800.) Part 802 authorizes the filing of either a short-form declaration or a full notice by parties to covered real estate transactions.

1. The proposed regulations include detailed proposed definitions and guidance on "covered real estate." Section 802.211 and Appendix A to Part 800 define "covered real estate" as follows: 

• Covered airports and maritime ports: Covered real estate includes real estate that is located within or that "will function as part of" certain airports or maritime ports. Section 802.201 limits covered airports to joint use airports (airports with a civilian and military use), "large hub" airports, and airports with over 124 billion pounds in aggregate cargo. Section 802.227 limits covered maritime ports to "strategic seaports" or top-25 ports by tonnage, as identified by the US Department of Transportation. 

• Covered military installations: Covered real estate also includes real estate within a certain distance from specified US military installations. The proposed regulations include a detailed list of relevant military installations at Appendix A to Part 802. Covered real estate transactions include real estate: within one mile of an installation listed in parts 1 and 2 of the Appendix; within 100 miles of an installation listed in part 2 of the Appendix; within specifically enumerated counties or geographic areas listed in connection with installations in part 3 of the Appendix; and within certain off-shore range complexes and operating areas, located within 12 nautical miles of the US coastline, and listed in part 4 of the Appendix. 

• Subsurface and submerged land is considered "real estate" and therefore subject to CFIUS jurisdiction if it fits within one of the categories outlined above. This could have important implications for extractives industries. 

2. The proposed regulations define "purchase," "lease," and "concessions" related to covered real estate. The proposed regulations define "purchase" and "lease" (among other things, to include subleasing) and define "concession" as the grant by "a US public entity" of "a right to use real estate for the purpose of developing or operating an airport or maritime port."

3. The proposed regulations seek comments on the property rights that must be acquired in order for a real estate transaction to be covered. These rights include the right to physically access, exclude others from physical access, improve or develop, and attach structures or objects. Under the proposed regulations, a real estate transaction must involve at least three of these four fundamental property rights to be subject to Part 802. Treasury has indicated that it "is seeking comments, in particular, on the impact of this approach." The regulations would also provide guidance (see 31 CFR 802.304) for when rights that could be acquired through contingency equity interests in real estate would be included in CFIUS's analysis. In order to trigger review, these property rights can be acquired through a new purchase, lease or concession, or through a change in rights regarding covered real estate that is subject to an existing purchase, lease or concession. 

4. Several categories of real estate transactions would be carved out from Part 802 as "excepted real estate transactions." As identified at Part 802.217, these include: 

• Transactions with "excepted real estate investors" based on their ties to "excepted real estate foreign states." These terms are similar to the "excepted investors" and "excepted foreign states" rules contained in Part 800 and discussed above. At present, no transactions would be covered by this carveout because no countries have been identified as "excepted real estate foreign states."

• Transactions governed by 31 CFR Part 800 would not require separate filings under 31 CFR Part 802. Instead, Part 802 would apply only to covered real estate transactions that are not subject to CFIUS's broader review procedures in Part 800. 

• Real estate within an "urbanized area" or "urban cluster," as identified in the most recent US Census. However, real estate within these areas that is located within, or will function as part of an airport or maritime port, or is located within one mile of military installations listed in parts 1 and 2 of Appendix A are not carved out. 

• Single housing units, including fixtures and adjacent land that is incidental to the use of such real estate. 

• Retail establishments at airports and maritime ports. The regulations exclude leases or concessions of real estate in airports or maritime ports that, according to the terms of the concession or lease may only be used as a retail trade, accommodation, or food service sector establishment. 

• Commercial office space in a multi-unit commercial building, if the foreign person and its affiliates have neither an interest in more than 10 percent of the square footage nor represent more than 10 percent of the tenants in the building. 

• Land owned by Alaska natives or held in trust by the United States for American Indians, Indian tribes, Alaska Natives, and Alaska Native entities. 

In addition to these exclusions, Section 802.302 states that the following would not be considered a covered real estate transaction: (1) "an acquisition of securities by a person acting as a securities underwriter, in the ordinary course of business and process of underwriting" and (2) "an acquisition pursuant to a condition in a contract of insurance relating to fidelity, surety, or casualty obligations if the contract was made by an insurer in the ordinary course of business."

The proposed regulations also clarify that lending transactions are generally not considered "covered real estate transactions" in a manner similar to the clarification provided in Part 800. Specifically, Section 802.303 states that
"[t]he extension of a mortgage, loan, or similar financing arrangement by a foreign person to another person for the purpose of the purchase, lease, or concession of covered real estate shall not, by itself, constitute a covered real estate transaction." In determining whether a lending transaction would constitute a covered real estate transaction CFIUS will consider a number of factors including: (1) the imminence of the default or similar event and (2) "whether the foreign person has made any arrangements to transfer the ownership and property rights over the covered real estate to US persons for purposes of determining whether such mortgage, loan, or financing arrangement constitutes a covered real estate transaction."

[1] Section 800.233 defines material non-public technical information to mean information that (1) "[p]rovides knowledge, know-how, or understanding not available in the public domain, of the design, location, or operation of critical infrastructure, including without limitation vulnerability information such as that related to physical security or cybersecurity," or (2) "[i]s not available in the public domain and is necessary to design, fabricate, develop, test, produce, or manufacture a critical technology, including without limitation processes, techniques, or methods."

[2] Notably, this appendix is only for use in determining whether something is critical infrastructure with respect to covered investments. It is possible that a given piece of infrastructure would not meet the definition of "covered investment critical infrastructure," but still meet the general definition of "critical infrastructure" contained in the CFIUS regulations as currently drafted with respect to the Committee's jurisdiction over control transactions.

[3] Foreign persons who have, in the prior 5 years, been determined to have violated certain US sanctions, export controls, or investment laws or committed other felony crimes, or settled related allegations would not be eligible for excepted investor status. See Section 800.220. Similarly, persons no longer meeting the excepted investor criteria within a three-year period following the completion date of the transaction are "not an excepted investor with respect to the transaction from the completion date onward."