US Treasury Department CFIUS Proposed Regulations Released

The U.S. Treasury Department has recently issued new regulations for review concerning the Committee on Foreign Investment in the United States (CFIUS).  CFIUS reviews transactions implicating national security concerns.  The Fact Sheet concerning the new proposed regulations from the U.S. Treasury Department states: 

FIRRMA Provisions on Non-Controlling Investments

FIRRMA expands CFIUS’s jurisdiction beyond transactions that could result in foreign control of a U.S. business to also include a non-controlling investment, direct or indirect, by a foreign person that affords the foreign person: 

access to any material nonpublic technical information in the possession of the U.S. business;  membership or observer rights on the board of directors or equivalent governing body of the U.S. business or the right to nominate an individual to a position on the board of directors or equivalent governing body; or any involvement, other than through voting of shares, in substantive decisionmaking of the U.S. business regarding— the use, development, acquisition, safekeeping, or release of sensitive personal data of U.S. citizens maintained or collected by the U.S. business; the use, development, acquisition, or release of critical technologies; or the management, operation, manufacture, or supply of critical infrastructure.  

This new authority only applies to a non-controlling investment in a U.S. business that:  produces, designs, tests, manufactures, fabricates, or develops one or more critical technologies;   owns, operates, manufactures, supplies, or services critical infrastructure; or maintains or collects sensitive personal data of U.S. citizens that may be exploited in a manner that threatens national security.

FIRRMA also requires that CFIUS prescribe regulations that further define the term “foreign person” in the context of non-controlling investments by specifying criteria to limit its applicability over certain categories of foreign persons.

Key Aspects of the Proposed Regulations Regarding “Covered Investments”

Types of investments covered:  Non-controlling investments that afford a foreign person certain access, rights, or involvement in certain U.S. businesses (referred to as “covered investments”).

Largely a voluntary process:  Process remains largely voluntary, where parties may file a notice or submit a short-form declaration notifying CFIUS of a covered investment in order to receive a potential “safe harbor” letter (after which CFIUS does not initiate a review of a transaction except in certain limited circumstances).  In some circumstances, filing a declaration for a transaction is mandatory.  In particular, FIRRMA creates a mandatory declaration requirement for specified covered transactions where a foreign government has a “substantial interest”.  Additionally, FIRRMA authorizes CFIUS to mandate declarations for covered transactions involving certain U.S. businesses that produce, design, test, manufacture, fabricate, or develop one or more critical technologies.  

U.S. businesses covered:  The new provisions on covered investments only apply to investments in U.S. businesses involved in specified ways with critical technologies, critical infrastructure, or sensitive personal data—referred to as “TID U.S. businesses” for technology, infrastructure, and data.  

 Critical technologies:  CFIUS may review transactions related to U.S. businesses that design, test, manufacture, fabricate, or develop one or more critical technologies.  “Critical technologies” is defined to include certain items subject to export controls and other existing regulatory schemes, as well as emerging and foundational technologies controlled pursuant to the Export Control Reform Act of 2018.  

 Critical infrastructure:  CFIUS may review transactions related to U.S. businesses that perform specified functions—owning, operating, manufacturing, supplying, or servicing—with respect to critical infrastructure across subsectors such as telecommunications, utilities, energy, and transportation, each as identified in an appendix to the proposed regulations.  

 Sensitive personal data:  CFIUS may review transactions related to U.S. businesses that maintain or collect sensitive personal data of U.S. citizens that may be exploited in a manner that threatens national security. “Sensitive personal data” is defined to include ten categories of data maintained or collected by U.S. businesses that (i) target or tailor products or services to sensitive populations, including U.S. military members and employees of federal agencies involved in national security, (ii) collect or maintain such data on at least one million individuals, or (iii) have a demonstrated business objective to maintain or collect such data on greater than one million individuals and such data is an integrated part of the U.S. business’s primary products or services.  The categories of data include types of financial, geolocation, and health data, among others.  Genetic information is also included in the definition regardless of whether it meets (i), (ii), or (iii).  

 Foreign person and excepted investor:  The regulations create an exception from “covered investments” for certain foreign persons defined as “excepted investors” based on their ties to certain countries identified as “excepted foreign states,” and their compliance with certain laws, orders, and regulations.  The regulations do not except these persons from control transactions previously subject to CFIUS jurisdiction; investments from all foreign persons remain subject to CFIUS’s jurisdiction over transactions that could result in foreign control of a U.S. business.

FIRRMA Provisions on Real Estate Transactions

In FIRRMA, Congress authorized CFIUS to review “the purchase or lease by, or a concession to, a foreign person of private or public real estate that”

“is, is located within, or will function as part of, an air or maritime port…” 

“is in close proximity to a United States military installation or another facility or property of the United States Government that is sensitive for reasons relating to national security;”

 “could reasonably provide the foreign person the ability to collect intelligence on activities being conducted at such an installation, facility, or property; or”

 “could otherwise expose national security activities at such an installation, facility, or property to the risk of foreign surveillance.”

 Pursuant to FIRRMA, this authority does not extend to “a single ‘housing unit.’”  This authority also does not apply to “real estate in ‘urbanized areas’ . . . except as otherwise prescribed by [CFIUS] in regulations in consultation with the Secretary of Defense.” (emphasis added)

 FIRRMA directs CFIUS to “prescribe regulations to ensure that the term “close proximity” refers only to a distance or distances within which the purchase, lease, or concession of real estate could pose a national security risk.”

 FIRRMA also requires that CFIUS prescribe regulations that further define the term “foreign person” for real estate transactions by specifying criteria to limit its applicability over certain categories of foreign persons.

The full text of the regulations is available, here.