Last week, the U.S. Department of the Treasury released final regulations that will formalize changes to the foreign investment review process of the Committee on Foreign Investment in the United States (CFIUS). Triggered by the adoption of the Foreign Investment Risk Review Modernization Act (FIRRMA) in 2018, the process of expanding CFIUS jurisdiction and refining its procedures has culminated in two rules, one governing foreign investment in U.S. businesses and the other governing certain real estate transactions. The provisions will take effect on February 13, 2020. On September 24, 2019, the Treasury published these two rules in proposed form and solicited public comments. While most provisions remain unchanged from the proposed versions, changes made to the final rules provide additional clarity in certain areas, including the fate of CFIUS’s pilot program.
The foreign investment rule, 31 C.F.R. Part 800, pertains to CFIUS’s authority and procedures to review “covered transactions,” which include (1) its traditional jurisdiction over any merger, acquisition, or takeover that could result in foreign control of a U.S. business (known as “covered control” transactions); and (2) its expanded jurisdiction to review noncontrolling “covered investments” that provide a foreign person with specified rights or access to information of U.S. businesses related to critical technologies, critical infrastructure, or sensitive personal data (known as “TID U.S. businesses”). Covered transactions will also include a change in rights for a foreign person with a preexisting investment in a U.S business if such change could result in the foreign person’s control or other specified rights over the business. The real estate rule, Part 802, is limited to CFIUS’s authority and procedures in reviewing certain real estate transactions.
Part 800 – Foreign Acquisitions or Investments in U.S. Businesses
Mandatory declarations and exemptions
The foreign investment rule mandates the submission of declarations to CFIUS for two transaction types: (1) transactions that will result in the acquisition of a substantial interest in a TID U.S. business by a foreign person in which a foreign government has a substantial interest; and (2) certain investments in a TID U.S. business that produces, designs, tests, manufactures, fabricates, or develops one or more critical technologies. The latter replaces the mandatory declaration requirement of the soon-to-end pilot program.
The foreign investment rule exempts certain covered transactions from the mandatory declaration requirement. First, the rule exempts investments resulting in the acquisition of a substantial interest in a TID U.S. business by a foreign government that are (1) covered investments by investment funds that are ultimately controlled by U.S. persons; and (2) covered control transactions involving air carriers that are certified by the U.S. Department of Transportation. Second, for covered transactions in TID U.S. businesses involved with critical technologies, the foreign investment rule exempts:
- Covered control transactions made by “excepted foreign investors.”
- Indirect investments in businesses operating under certain security agreements and facility security clearances.
- Transactions by investment funds that are ultimately controlled by U.S. persons.
- Certain investments where the foreign investor lost status as an “excepted foreign investor.”
- Transactions involving certified air carriers.
- Investments in a U.S. company whose only “critical technologies” are certain encryption software.
Additionally, the foreign investment rule includes an option for voluntary declarations as an alternative to the traditional voluntary notice. This option will allow parties to submit basic information about a transaction to CFIUS, which then has 30 days to respond with a decision to clear or further review the transaction, request that the parties submit a full notice, or advise the parties that it cannot conclude all action and they may elect to file a full notice.
The end of the pilot program
The foreign investment rule adopts many aspects of the pilot program, including mandatory declarations for covered transactions involving critical technologies. Though for now the rule still identifies covered industries (formerly known as “pilot program industries”) by NAICS codes, CFIUS anticipates releasing another proposed rule that would remove the NAICS-based system and instead identify relevant technologies by export control licensing requirements. The pilot program itself will be ending but remains active until February 13, 2020, meaning any parties to pilot program–covered transactions with a completion date, binding agreement, public offer, or solicited proxies occurring on or before February 13 will still be subject to the program’s procedures and requirements.
Excepted foreign states and investors
The foreign investment rule includes an initial list of foreign states eligible for the status of an “excepted foreign state.” Though more were hoping for this coveted status, only Australia, Canada, and the United Kingdom made the cut, but Treasury explains that it may expand the list in the future and these three foreign states were selected due to “their robust intelligence-sharing and defense industrial base integration mechanisms with the United States.”
Foreign persons, including entities, who meet the foreign investment rule’s criteria for nationals of an excepted foreign state are defined as “excepted investors.” Excepted investors will not be subject to CFIUS’s expanded jurisdiction for transactions involving TID U.S. businesses and mandatory reporting requirements. However, the same does not hold true for CFIUS’s traditional jurisdiction over covered control transactions. Therefore, any acquisition, merger, or takeover of a U.S. business by an Australian, Canadian, or UK entity is still considered a covered control transaction that is subject to CFIUS jurisdiction, though a submission to CFIUS is not mandatory.
To become an excepted foreign state, a country must meet the following criteria: (1) be identified by CFIUS as an eligible foreign state; and (2) satisfy CFIUS’s determination that the foreign state has established “a robust process to analyze foreign investments for national security risks and to facilitate coordination with the United States on matters relating to investment security.” Australia, Canada, and the United Kingdom have two years, ending on February 13, 2022, to meet the second requirement.
Clarifications on sensitive personal data
One of the three types of TID U.S. businesses are those that collect or maintain “sensitive personal data,” which includes 10 categories of data. U.S. businesses that (1) target products or services to sensitive populations, including U.S. military and federal employees; or (2) collect or maintain data on at least 1 million individuals or “has a demonstrated business objective to maintain or collect [such] data … [on] greater than one million individuals and such data is an integrated part of the” business will be considered a TID U.S. business. The 10 categories of data will apply to a wide variety of U.S. businesses, including those centered around mobile applications. “Sensitive personal data” includes information ranging from geolocation, health data, financial information, or even private third-party communications facilitated by a mobile application.
CFIUS did not respond to public comments on the proposed rule to narrow the data categories but did add five examples intended to clarify certain issues. For instance, one example indicates what factors may suggest that a business has a “demonstrated business objective to maintain or collect data” on more than 1 million individuals, including pitch materials, financial projections, or increases in workforce to facilitate IT infrastructure in anticipation of more users. The foreign investment rule also clarifies that TID U.S. businesses will include those that directly and indirectly collect sensitive personal data.
Investment funds
In response to public comments, CFIUS revised the final rule to clarify applicability to investments funds. The final rule clarifies that the “substantial interest” definition that triggers mandatory filings for certain transactions involving TID U.S. businesses applies only to a single foreign government, which removes the concern that noncontrolling transactions by an investment fund with partners of various nationalities may trigger the need for a CFIUS filing. The rule also further revises the definition of “substantial interest” for limited partners of investment funds, clarifying that only the foreign government’s interests in the general partner is relevant, disregarding limited-partner interests. This change removes potential uncertainty about the mandatory declaration requirement being applicable due to a foreign government holding limited partnership interests in a fund. Treasury explains that it made such changes to provide clarity in the investment fund context and more uniformly focus the substantial interest analysis on the entity that is responsible for the day-to-day decision-making.
Proposed definition for “principal place of business”
Not defined in the proposed version, the final rule defines “principal place of business” as “the primary location where an entity’s management directs, controls, or coordinates the entity’s activities, or, in the case of an investment fund, where the fund’s activities and investments are primarily directed, controlled, or coordinated by or on behalf of the general partner, managing member, or equivalent.” The definition is relevant in the context of determining who is a foreign entity and excepted investor. CFIUS included the definition as an interim rule, providing a 30-day period for public comments.
Part 802 – Real Estate Transactions
Under CFIUS’s expanded jurisdiction, the purchase by, lease by, or concession to a foreign person of certain U.S. real estate will be covered even when no U.S. business is involved. Covered real estate will include land in and around specific airports, maritime ports, and military installations that are sensitive for reasons relating to national security or could provide the foreign person the ability to collect intelligence on activities being conducted at the property or otherwise expose national security activities. The real estate rule applies to transactions of covered sites that will provide the foreign person with three or more of the following property rights: physical access, exclusion of others, improvement or development, and the right to affix structures or objects. Real estate transactions will not be subject to a mandatory filing requirement.
Generally speaking, the real estate rule allows parties to real estate transactions to more definitively identify transactions subject to CFIUS jurisdiction, as opposed to parties to certain transactions subject to the foreign investment rule (e.g., determining whether the U.S. business is one that collects sensitive personal data fitting into one of the 10 categories or whether it demonstrates a business objective to collect data on more than 1 million persons). The real estate rule covers two categories of real estate: a site that (1) “is, is located within, or will function as part of, a covered” airport or maritime port specifically defined or identified by the Federal Aviation Administration or U.S. Department of Transportation, respectively; or (2) is within “close proximity” (defined as 1 mile) of specified U.S. military installations, within the “extended range” (defined as between 1 mile and 99 miles) of certain other U.S. military installations, or within certain geographic areas associated with missile fields and offshore ranges. For the latter category, the real estate rule provides a list of the relevant U.S. military installations and their locations, leaving no ambiguity whether the site subject to the transaction is a CFIUS-covered site.
Some noteworthy points and changes included in the real estate rule include:
- U.S. Business Transactions vs. Real Estate Transactions: The rule emphasizes that transactions focused on real estate could be covered transactions under Part 800, and parties will need to carefully assess which rule applies to their transaction. It gives the example that a collection of real estate assets can constitute a U.S. business, as well as scenarios where the lessee makes business decisions concerning the operation of the leased entity. Making the determination of whether a U.S business is involved is particularly important in mandatory declarations for investments in TID U.S. businesses involving critical technologies or critical infrastructure. Various scenarios could involve real estate sites associated with businesses with critical technologies or be included in sectors identified as critical infrastructure, overlapping with covered real estate sites.
- Web-based Tool for Geographic Coverage: CFIUS anticipates providing a web-based tool, such as an interactive map, that will allow the public to see what areas are covered real estate sites. Until then, CFIUS suggests parties use online sources like those from the Census Bureau, National Oceanic and Atmospheric Administration, and Bureau of Ocean Energy Management to determine relevant U.S. boundaries and sites.
- Excepted Real Estate Transactions: The final rule expands the provision for excepted real estate transactions, including leases or concessions related to foreign air carriers (specifically because of the Department of Homeland Security’s existing oversight for foreign air carriers). It also eliminates reference to NAICS codes in identifying excepted real estate sites for retail, accommodation, and food service and instead applies the exception more generally to real estate used for retail sales of consumer goods or services.