CFIUS Proposes New Rules Governing Mandatory Filing Requirements for Critical Technology Businesses

CFIUS Proposes New Rules Governing Mandatory Filing Requirements for Critical Technology Businesses

May 21, 2020, Covington Alert

On May 21, 2020, the Department of the Treasury, as chair of the Committee on Foreign Investment in the United States (“CFIUS”), published in the Federal Register a proposed rule (the “Proposed Rule”) that would amend the requirements to file with CFIUS certain transactions involving U.S. businesses that produce, design, test, manufacture, fabricate, or develop one or more “critical technologies.” The Proposed Rule modifies requirements that originally were imposed in October 2018 through temporary regulations known as the critical technology pilot program (the “Pilot Program”), and which were incorporated this past February into the final regulations implementing the Foreign Investment Risk Review Modernization Act (“FIRRMA”). The Proposed Rule also modifies the scope of an existing carve-out from the mandatory filing requirements for certain encryption technologies, and makes certain clarifying edits to the definition of “substantial interest,” which is relevant for determining whether transactions involving foreign government interests are subject to mandatory filing requirements.

As expected, the Proposed Rule abandons the two-part test first adopted in the Pilot Program that required the U.S. business involved in the transaction to: (1) undertake certain covered activities related to a critical technology (the “technologies prong”); and (2) utilize such critical technology or design it for use in one or more of 27 designated industries (the “industries prong”) in order for a mandatory filing to be triggered. Instead, the Proposed Rule adopts a new test based on whether “U.S. government authorizations would be required to export, re-export, transfer (in country), or retransfer the critical technology or technologies produced, designed, tested, manufactured, fabricated, or developed by the U.S. business to certain transaction parties and foreign persons in the ownership chain.”

The Proposed Rule is likely to provide greater clarity on which transactions are subject to mandatory filings. The now-abandoned industry analysis—which was defined by reference to North American Industry Classification (“NAICS”) codes—was widely viewed as ambiguous and challenging to administer. However, the Proposed Rule also is likely to expand the number of U.S. businesses that may be subject to mandatory filing requirements because the Proposed Rule is not limited by a U.S. business’s connection to certain industries. Any U.S. business that engages in covered activities related to one or more critical technologies will be considered a “critical technology” business, regardless of the industries in which it operates. Thus, investors from countries that are subject to more rigorous U.S. export controls will likely find that more of their investments are now subject to mandatory filings. Conversely, investors from countries that are subject to lighter export controls will likely see some relief, since fewer technologies are subject to regulatory authorization for export to those countries.

The Department of the Treasury is accepting comments on the Proposed Rule until June 22, 2020. It subsequently will issue a final rule implementing the Proposed Rule, as may be further modified to reflect comments received during the comment period.

New Scope of Mandatory Filing Requirements

As noted, under the Proposed Rule parties would be required to file a short-form declaration (or a full notice in lieu of a declaration) for any transaction subject to CFIUS jurisdiction involving a U.S. business that produces, designs, tests, manufactures, fabricates, or develops one or more critical technologies for which a U.S. regulatory authorization would be required for the export, re-export, transfer (in-country), or retransfer of such critical technology to a foreign person that is a party to the transaction.

“U.S. regulatory authorization” is defined to mean any authorization that is required under U.S. export control regimes, namely:

1. A license or other approval issued by the Department of State under the International Traffic in Arms Regulations (“ITAR”);
2. A license from the Department of Commerce under the Export Administration Regulations (“EAR”);
3. A specific or general authorization from the Department of Energy under the regulations governing assistance to foreign atomic energy activities at 10 CFR part 810 other than the general authorization described in 10 CFR 810.6(a); and
4. A specific license from the Nuclear Regulatory Commission under the regulations governing the export or import of nuclear equipment and material at 10 CFR part 110.

Whether a U.S. regulatory authorization would be required is generally determined without giving effect to any license exemption available under the ITAR or the EAR. In other words, in most cases, qualifying for a license exemption is not sufficient to avoid a transaction triggering a mandatory filing with CFIUS. The Proposed Rule specifies a few exceptions, however. Specifically, a U.S. regulatory authorization is deemed not to be required if each of the U.S. regulatory authorizations that would otherwise be required is satisfied by the foreign person’s eligibility for specified provisions of three License Exceptions in the EAR: any part of License Exception TSU (at 15 CFR 740.13); paragraph (b) of License Exception ENC (at 15 CFR 740.17(b)); or paragraph (c)(1) of License Exception STA (at 15 CFR 740.20(c)(1).

In determining whether a U.S. regulatory authorization would be required, CFIUS will consider the foreign person’s principal place of business (for entities), applying the definition of principal place of business set forth in the CFIUS regulations, or such foreign person’s nationality or nationalities (for individuals) under the relevant U.S. regulatory authorization, as applicable. Principal place of business for these purposes means the primary location where an entity’s management directs, controls, or coordinates the entity’s activities, or, in the case of an investment fund, where the fund’s activities and investments are primarily directed, controlled, or coordinated by, or on behalf of, the general partner, managing member, or equivalent. In cases where the applicable U.S. regulatory authorization is tied to the “end user” status of the person receiving the critical technology, the foreign person will be considered the end user(s).

This leaves the question of which foreign persons within an acquisition structure must be analyzed to determine whether a U.S. regulatory authorization is required, and in turn, whether a mandatory filing with CFIUS is triggered. The Proposed Rule provides that CFIUS, in determining which foreign persons qualify for purposes of the mandatory filing requirement, will consider the party(ies) that will directly control the U.S. business, any party that will directly acquire certain covered investment rights with respect to the U.S. business, and any party that will hold 25 percent or more, directly or indirectly, in the acquiring entity. Specifically, the Proposed Rule provides that if a U.S. regulatory authorization would be required with respect to a foreign person, a filing with CFIUS will be required if that foreign person:

1. Could directly control the U.S. business as a result of the transaction;
2. Is directly acquiring an interest that constitutes a “covered investment”—meaning that the foreign person is acquiring any equity interest along with certain triggering rights, such as a board seat, board observer, or access to material nonpublic technical information—in the U.S. business;
3. Already holds an equity interest and is acquiring certain new rights with respect to the U.S. business;
4. Is involved in a transaction, transfer, agreement, or arrangement, designed or intended to evade or circumvent CFIUS jurisdiction; or
5. Individually holds, or is part of a group of foreign persons that, in the aggregate, holds, a “voting interest” in any entity that meets the foregoing criteria.

“Voting interest” is defined for these purposes as a voting interest, direct or indirect, of 25 percent or more.  For entities that are controlled by a general partner, managing member, or equivalent, such as most investment funds, only interests in the general partner will be considered to be a “voting interest”; limited partner or similar interests will be disregarded. Further, for purposes of calculating whether the 25 percent voting interest threshold is met, any interest by a “parent”—meaning any entity holding a greater than 50 percent interest—will be deemed to be a 100 percent interest in the entity of which it is a parent.

Importantly, certain transactions remain exempt from the mandatory filing obligations, namely transactions involving “excepted investors”; entities subject to an agreement to mitigate foreign ownership, control, or influence (“FOCI”) pursuant to the National Industrial Security Program regulations; certain encryption technologies; and certain investment funds managed exclusively by, and ultimately controlled by, U.S. nationals.

Changes to the Exception for Certain Encryption Technologies

Encryption products—broadly speaking, hardware, components, or software that perform or use encryption for data security, or that are designed to use or call upon such functionality in other products—would ordinarily be classified as “critical technology” under CFIUS rules, unless the encryption product is a mass market product that is widely available at retail to the general public for use “off the shelf.” However, the final regulations implementing FIRRMA originally included a provision exempting from the mandatory filing requirement transactions that are subject to such requirements only because the U.S. business produces, designs, tests, manufactures, fabricates, or develops one or more such encryption items classified as critical technologies that is eligible for export, reexport, or transfer (in country) pursuant to License Exception ENC of the EAR (15 CFR 740.17). The Proposed Rule now clarifies that only paragraph (b) of that License Exception is relevant for this purpose, and that the encryption item must be eligible for authorized export, reexport or transfer pursuant to paragraph (b) to the foreign persons involved in the transaction. As a practical matter, many practitioners had already interpreted the scope of this exception in this way.

Items that meet the criteria for ENC subpart (b)(1) are generally eligible for export, reexport, and transfer to any end-user outside countries subject to comprehensive U.S. sanctions; other items described by subparts (b)(2) or (b)(3), qualify for export only to non-government end-users, or to certain less-sensitive government end-users. Since the requirements for a mandatory CFIUS filing depend in part on whether a U.S. regulatory authorization would be required for the export, re-export, transfer (in-country), or retransfer of such critical technology to a foreign person that is a party to the transaction, it will be important to confirm which subpart(s) of paragraph (b) describes the encryption critical technologies at issue, and whether the relevant foreign parties are in fact authorized to receive those items under that ENC (b) subpart.

The Proposed Rule also expanded the exception from mandatory filing requirements by adding two additional EAR License Exceptions: License Exception TSU (15 CFR 740.13), covering certain defined technology (technical data) and software, and paragraph (c)(1) of License Exception STA, covering certain defined items for export, reexport or transfer (in-country) with respect to countries in Country Group A:5, defined in the EAR. Again, both the item and the relevant foreign persons must meet the eligibility criteria defined in these License Exceptions in order to be exempt from mandatory filing that would otherwise be required.

Clarifications to “Substantial Interest” Definition

FIRRMA requires filings with CFIUS for certain transactions involving foreign government ownership and so called “TID U.S. businesses,” a category that encompasses U.S. businesses involved with critical technology, critical infrastructure, and sensitive personal data. Specifically, a CFIUS filing is required for any transaction through which a “foreign person in which a foreign government holds a substantial interest” acquires a “substantial interest” in a TID U.S. business. In the final regulations implementing FIRRMA, CFIUS defined “substantial interest” as a 49 percent or greater interest, directly or indirectly, between the foreign government and the foreign person, and a 25 percent or greater interest, directly or indirectly, between the foreign person and the TID U.S. business.

The Proposed Rule makes two clarifying edits to the substantial interest definition:

• First, the current definition provides that in the case of an entity “with a general partner, managing member, or equivalent, the national or subnational governments of a single foreign state will be considered to have a substantial interest in such an entity only if they hold 49 percent or more of the interest in the general partner, managing member, or equivalent of the entity.” The Proposed Rule revises the definition to require that the general partner, managing member, or equivalent “primarily directs, controls, or coordinates” the activities of the entity—it is not sufficient for the entity merely to have a general partner or equivalent. Accordingly, for any fund where the general partner or equivalent does not “primarily direct, control, or coordinate” the activities of the fund, then other interests, such as limited partner interests, could be deemed to be a “substantial interest.”
• Second, the Proposed Rule also provides certain revisions to clarify that for purposes of the substantial interest calculation, regardless of the type of entity at issue, a parent will be deemed to have 100 percent of the applicable interest in any entity of which it is a parent.

If you have any questions concerning the material discussed in this client alert, please contact the following members of our CFIUS and International Trade Controls practice groups.