United States: CFIUS Proposes Rules To Implement FIRRMA

Last Updated: September 26 2019
Article by Reid Whitten, Brian D. Weimer and Eamon S. Tierney
  • Technology Infrastructure and Data. CFIUS will focus its review on investments in critical Technology, critical Infrastructure, and sensitive personal Data ("TID Businesses").
    • Critical technologies is defined to include certain items subject to export controls along with emerging and foundational technologies under the Export Control Reform Act of 2018.
    • CFIUS provides a very helpful list of critical infrastructure and functions to help assess whether any business is a TID Business. We reproduce most of this list at the end of this blog article. (Sneak preview: telecom, utilities, energy, and transportation dominate the list.)
    • The proposed regulations provide much-needed guidance on what constitutes sensitive personal data and also seek to limit the reach of the definition so it does not cast too wide a net over transactions in which CFIUS really should have no national security concern.
  • Exceptions for Certain Countries. Investors from certain countries may be excepted from CFIUS jurisdiction when making non-controlling investments.
  • New Set of Rules for Real Estate. In a companion piece, CFIUS proposed for the first time a detailed set of rules related to investments in real estate. We will cover this in a separate blog article to be published in the near future.
  • Expansion of Short-Form Declaration Use. The proposed rules provide parties the choice to use a short-form declaration for any transaction under CFIUS jurisdiction in lieu of a long-form notice.
  • Comments Due by October 17, 2019. Members of the public may submit comments on the proposed regulations any time between now and October 17, 2019. Final regulations must be adopted by CFIUS and become effective no later than February 13, 2020.

Technology controls are tightening in the U.S. and around the world. New regulations proposed this week by the Committee on Foreign Investment in the United States (CFIUS) continue and strengthen that trend.

On September 17, 2019, CFIUS published two separate proposed rules that will implement many of the changes to U.S. foreign investment review outlined in the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA): one rule expanding covered investments, and another clarifying controls on real estate investments. Although the public has been invited to comment, and the rules are subject to change before their final publication, it appears that the two rules will effectively expand and clarify CFIUS jurisdiction.

The Covered Investment Proposed Rule brings some bad news and some good news for investors. The changes proposed in this rule will increase CFIUS authority by expanding what constitutes a "covered investment" and clarifying the definition of a "covered transaction." However, on a positive note for some investors, the rule will also create a "Pre-Approved List" for certain countries where investors may be excepted from CFIUS review. The rule may also streamline the filing process for certain covered transactions.

1. Expansion of "Covered Investments"

The Committee will continue to exercise jurisdiction over any transaction which could result in a foreign person acquiring control of any U.S. business that could impact U.S. national security. Additionally, the Covered Investment Proposed Rule would expand CFIUS jurisdiction to cover investments that afford a foreign person any one of following three privileges:

  • Access to any material nonpublic technical information of the U.S. business;
  • Membership or observer rights on the board of directors (or equivalent) of the U.S. business or the right to nominate an individual to a position on the board; or
  • Any involvement in the substantive decision-making of the U.S. business regarding critical technology, critical infrastructure, or sensitive data. These three areas of business are known as "TID" (Technology Infrastructure Data).

Those points may look familiar from the FIRRMA pilot program, but the proposed rule contains two substantial changes to the pilot program: (1) the rule is not limited to the 27 industries of the pilot program; and (2) a filing for these new covered investments would not be mandatory under certain criteria.

2. TID U.S. Business

The new covered investments are specifically limited to U.S. businesses that will be considered "TID U.S. Businesses." A TID U.S. Business deals in one or more of (1) Critical Technologies, (2) Critical Infrastructure, or (3) Sensitive Personal Data, as described below.

  • Critical Technologies

The Covered Investment Proposed Rule provides CFIUS jurisdiction to review non-controlling foreign investment in businesses "producing, designing, testing, or developing one or more Critical Technologies.

The rule brings the definition of critical technologies in line with the definition from the FIRRMA pilot program, including the following:

  • Defense articles or defense services included on the United States Munitions List (USML) set forth in the International Traffic in Arms Regulations (ITAR);
  • Items included on the Commerce Control List (CCL) set forth in the Export Administration Regulations (EAR) and controlled (1) pursuant to multilateral regimes, including for reasons relating to national security, chemical and biological weapons proliferation, nuclear nonproliferation, or missile technology; or (2) for reasons relating to regional stability or surreptitious listening;
  • Specially designed and prepared nuclear equipment, parts and components, materials, software, and technology covered by 10 CFR part 810 (relating to assistance to foreign atomic energy activities);
  • Nuclear facilities, equipment, and material covered by 10 CFR part 110 (relating to export and import of nuclear equipment and material);
  • Select agents and toxins covered by 7 CFR part 331, 9 CFR part 121, or 42 CFR part 73; and
  • Emerging and foundational technologies controlled pursuant to section 1758 of the Export Control Reform Act of 2018 (ECRA).

"Emerging and foundational technologies" have not yet been defined in regulations, but an Advanced Notice of Proposed Rulemaking published in November 2018 indicated that technologies such as biomedicines, artificial intelligence, virtual reality, and robotics may be among those controlled under the ECRA.

  • Critical Infrastructure

The Covered Investment Proposed Rule also grants CFIUS authority to review non-controlling investments in U.S. businesses that own, operate, manufacture, supply, or service specified segments of critical infrastructure termed "covered investment critical infrastructure." The rule includes an Appendix detailing the critical infrastructure areas, which include the following, among others:

  • Telecommunications or information services;
  • Submarine cable system licensees and landing facilities;
  • Defense-related logistical and communications networks or systems;
  • Sole-source industrial resource businesses;
  • Utilities such as electric, oil, water, and gas; and
  • Specific airports and maritime ports.

Not every business in industries related to the critical infrastructure listed here will be considered covered. The Appendix to the proposed rule lists specific functions that the business must perform in the covered investment critical infrastructure area in order to be considered subject to CFIUS jurisdiction under the Covered Investment Proposed Rule.

  • Sensitive Personal Data

Finally, the Covered Investment Proposed Rule would authorize CFIUS to review non-controlling investments in U.S. businesses that maintain or collect the sensitive personal data of U.S. citizens. The proposed rule shows that CFIUS will take a broad view of what constitutes sensitive personal data, including the following categories:

  • Financial data, including bank account statements, home mortgages, and consumer transactions;
  • Consumer reporting agency data;
  • Personal insurance applications;
  • Health-related data;
  • Non-public electronic communications, including email;
  • Geo-location data;
  • Biometric data generated by companies providing biometric identification services; and
  • Data used to issue government identification.

However, the proposed rule will limit the scope of review to businesses that maintain or collect sensitive personal data in one of three ways:

  • By targeting or tailoring products or services to any U.S. executive branch agency or military department with national security responsibilities, or to its civilian personnel or contractors;
  • By maintaining or collecting sensitive personal data on greater than one million individuals at any point over the preceding 12 months; or
  • By demonstrating a business objective to maintain or collect sensitive personal data on greater than one million individuals where that data is an integrated part of the TID U.S. Business's primary products or services.

3. Country-Based Exceptions

The regulations create an exception from "covered investments" for certain foreign persons defined as "excepted investors." The scope and intended target of the excepted investor definition will be taken up in greater detail in a subsequent blog post, but for the moment suffice it to say that any private equity group or foreign entity that is or wants to be a repeat player in M&A markets in the U.S. will be well-advised to pay careful attention to this aspect of the new proposed rules. The definition of "excepted investor" incorporates the familiar five percent threshold that CFIUS practitioners have come to know as the level of investment CFIUS generally tracks closely. And the definition of "minimum excepted ownership" includes a nod to the familiar 10 percent safe harbor for private equity investors. The overriding issue with the definition of "excepted investors" will be which countries will be listed as "excepted foreign states," and we have no idea how long that process could take.

4. Streamlining the CFIUS Process

The Covered Investment Proposed Rule also provides that parties may choose to file a short-form declaration for any transaction subject to CFIUS jurisdiction in lieu of filing a notice. There has been much debate in the CFIUS Bar over whether the short-form declaration actually speeds the CFIUS approval process but, in theory, it can be a time saver. The outline of the declaration is the same as the declaration provided for in the pilot program. It includes the abbreviated fillable form for filing, a 30-day response window for the Committee to address the declaration, and the four potential CFIUS responses to the declaration, as follows:

  • Clearing the transaction by notifying the parties that CFIUS has concluded all action under Section 721;
  • Taking no action by informing the parties that action cannot be completed on the basis of the declaration and that they may file a full voluntary notice;
  • Requesting a full notice in order to review further information before providing clearance to the parties; or
  • Initiating a unilateral review of the transaction through an agency notice.

5. New Mandatory Filings

Currently, only Pilot Program Covered Transactions can trigger a mandatory filing with CFIUS. Under the Covered Investment Proposed Rule, a filing will be mandatory if a foreign person obtains a "substantial interest" in a U.S. business where a foreign government, in turn, holds a "substantial interest" in the foreign person. Substantial Interest means a 25 percent voting interest in a U.S. business held by a foreign person and a 49 percent or greater voting interest held by a foreign government in a foreign person. Any voting interest held by a parent will be deemed to be a 100 percent voting interest in any entity of which it is a parent. The mandatory filing in this case may be fulfilled by a short-form declaration or long-form notice.

6. Clarifications and Limitations on Covered Transactions

The Covered Investment Proposed Rule offers further, smaller but potentially important clarifications on the jurisdiction of CFIUS. First, the proposed rule clarifies CFIUS's jurisdiction over investment funds. If a foreign person indirectly invests in an unaffiliated TID U.S. Business through an investment fund that gives the foreign person membership as a limited partner on an advisory board or committee of the fund, that membership, by itself, does not render the foreign person's investment a covered investment. Unaffiliated TID U.S. Businesses are those in which a foreign person does not directly hold more than 50 percent of the outstanding voting interest or have the right to appoint more than half of the members of that business's board of directors.

Second, under current rules, a transaction is not within CFIUS jurisdiction if a foreign person or any of its direct or indirect wholly-owned subsidiaries previously acquired direct control in the U.S. business in a covered control transaction for which CFIUS concluded all action under Section 721. The Covered Investment Proposed Rule adds that this exception to a covered control transaction only applies to those for which CFIUS has concluded all actions based on a notice submission. This could mean that foreign persons who have already completed the CFIUS notice process may not have to repeat the process in a new transaction, but that would not apply to those covered transactions closed on the basis of a declaration. The proposed rule additionally clarifies that this exception does not apply to "incremental acquisitions" where the foreign person has not previously acquired control of a U.S. business or to a transaction that CFIUS has not cleared based on a notice submission.

7. Filing Fees

FIRRMA provided for the possibility that CFIUS could implement filing fees not to exceed the lesser of $300,000 or 1% of the value of the transaction. The Covered Investment Proposed Rule does not address those fees, except to note that Treasury is still considering how to implement them and will do so under a separately published proposed rule.

8. More to Come

The Covered Investment Proposed Rule introduces greater jurisdictional scope to CFIUS while clarifying certain exceptions and carve-outs. Please be on the lookout for our forthcoming blog explaining the proposed rule for how CFIUS will also be focusing on real estate investment. We will report on any major developments as the Covered Investment Proposed Rule makes its way to final publication.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

To print this article, all you need is to be registered on Mondaq.com.

Click to Login as an existing user or Register so you can print this article.

Events from this Firm
23 Oct 2019, Other, Dallas, United States

Marketing Wants To Do What? Sweepstakes, Influencers, Loyalty, and Other Advertising and Promotional Fun

25 Oct 2019, Webinar, Los Angeles, United States

Matthew Bonovich will be a speaker at this webinar.

State and local governments continue to incentivize renewable energy and battery storage, causing an increase in mergers and acquisitions among producers and specialized renewables.

29 Oct 2019, Seminar, California, United States

Please join us for Sheppard Mullin's Labor & Employment Law Update & Happy Hour Seminar Series. There are many new developments in California labor and employment laws that will significantly affect the way you run your day-to-day business operations.

Similar Articles
Relevancy Powered by MondaqAI
Pillsbury Winthrop Shaw Pittman LLP
In association with
Related Topics
Similar Articles
Relevancy Powered by MondaqAI
Pillsbury Winthrop Shaw Pittman LLP
Related Articles
Related Video
Up-coming Events Search
Font Size:
Mondaq on Twitter
Mondaq Free Registration
Gain access to Mondaq global archive of over 375,000 articles covering 200 countries with a personalised News Alert and automatic login on this device.
Mondaq News Alert (some suggested topics and region)
Select Topics
Registration (please scroll down to set your data preferences)

Mondaq Ltd requires you to register and provide information that personally identifies you, including your content preferences, for three primary purposes (full details of Mondaq’s use of your personal data can be found in our Privacy and Cookies Notice):

  • To allow you to personalize the Mondaq websites you are visiting to show content ("Content") relevant to your interests.
  • To enable features such as password reminder, news alerts, email a colleague, and linking from Mondaq (and its affiliate sites) to your website.
  • To produce demographic feedback for our content providers ("Contributors") who contribute Content for free for your use.

Mondaq hopes that our registered users will support us in maintaining our free to view business model by consenting to our use of your personal data as described below.

Mondaq has a "free to view" business model. Our services are paid for by Contributors in exchange for Mondaq providing them with access to information about who accesses their content. Once personal data is transferred to our Contributors they become a data controller of this personal data. They use it to measure the response that their articles are receiving, as a form of market research. They may also use it to provide Mondaq users with information about their products and services.

Details of each Contributor to which your personal data will be transferred is clearly stated within the Content that you access. For full details of how this Contributor will use your personal data, you should review the Contributor’s own Privacy Notice.

Please indicate your preference below:

Yes, I am happy to support Mondaq in maintaining its free to view business model by agreeing to allow Mondaq to share my personal data with Contributors whose Content I access
No, I do not want Mondaq to share my personal data with Contributors

Also please let us know whether you are happy to receive communications promoting products and services offered by Mondaq:

Yes, I am happy to received promotional communications from Mondaq
No, please do not send me promotional communications from Mondaq
Terms & Conditions

Mondaq.com (the Website) is owned and managed by Mondaq Ltd (Mondaq). Mondaq grants you a non-exclusive, revocable licence to access the Website and associated services, such as the Mondaq News Alerts (Services), subject to and in consideration of your compliance with the following terms and conditions of use (Terms). Your use of the Website and/or Services constitutes your agreement to the Terms. Mondaq may terminate your use of the Website and Services if you are in breach of these Terms or if Mondaq decides to terminate the licence granted hereunder for any reason whatsoever.

Use of www.mondaq.com

To Use Mondaq.com you must be: eighteen (18) years old or over; legally capable of entering into binding contracts; and not in any way prohibited by the applicable law to enter into these Terms in the jurisdiction which you are currently located.

You may use the Website as an unregistered user, however, you are required to register as a user if you wish to read the full text of the Content or to receive the Services.

You may not modify, publish, transmit, transfer or sell, reproduce, create derivative works from, distribute, perform, link, display, or in any way exploit any of the Content, in whole or in part, except as expressly permitted in these Terms or with the prior written consent of Mondaq. You may not use electronic or other means to extract details or information from the Content. Nor shall you extract information about users or Contributors in order to offer them any services or products.

In your use of the Website and/or Services you shall: comply with all applicable laws, regulations, directives and legislations which apply to your Use of the Website and/or Services in whatever country you are physically located including without limitation any and all consumer law, export control laws and regulations; provide to us true, correct and accurate information and promptly inform us in the event that any information that you have provided to us changes or becomes inaccurate; notify Mondaq immediately of any circumstances where you have reason to believe that any Intellectual Property Rights or any other rights of any third party may have been infringed; co-operate with reasonable security or other checks or requests for information made by Mondaq from time to time; and at all times be fully liable for the breach of any of these Terms by a third party using your login details to access the Website and/or Services

however, you shall not: do anything likely to impair, interfere with or damage or cause harm or distress to any persons, or the network; do anything that will infringe any Intellectual Property Rights or other rights of Mondaq or any third party; or use the Website, Services and/or Content otherwise than in accordance with these Terms; use any trade marks or service marks of Mondaq or the Contributors, or do anything which may be seen to take unfair advantage of the reputation and goodwill of Mondaq or the Contributors, or the Website, Services and/or Content.

Mondaq reserves the right, in its sole discretion, to take any action that it deems necessary and appropriate in the event it considers that there is a breach or threatened breach of the Terms.

Mondaq’s Rights and Obligations

Unless otherwise expressly set out to the contrary, nothing in these Terms shall serve to transfer from Mondaq to you, any Intellectual Property Rights owned by and/or licensed to Mondaq and all rights, title and interest in and to such Intellectual Property Rights will remain exclusively with Mondaq and/or its licensors.

Mondaq shall use its reasonable endeavours to make the Website and Services available to you at all times, but we cannot guarantee an uninterrupted and fault free service.

Mondaq reserves the right to make changes to the services and/or the Website or part thereof, from time to time, and we may add, remove, modify and/or vary any elements of features and functionalities of the Website or the services.

Mondaq also reserves the right from time to time to monitor your Use of the Website and/or services.


The Content is general information only. It is not intended to constitute legal advice or seek to be the complete and comprehensive statement of the law, nor is it intended to address your specific requirements or provide advice on which reliance should be placed. Mondaq and/or its Contributors and other suppliers make no representations about the suitability of the information contained in the Content for any purpose. All Content provided "as is" without warranty of any kind. Mondaq and/or its Contributors and other suppliers hereby exclude and disclaim all representations, warranties or guarantees with regard to the Content, including all implied warranties and conditions of merchantability, fitness for a particular purpose, title and non-infringement. To the maximum extent permitted by law, Mondaq expressly excludes all representations, warranties, obligations, and liabilities arising out of or in connection with all Content. In no event shall Mondaq and/or its respective suppliers be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection with the use of the Content or performance of Mondaq’s Services.


Mondaq may alter or amend these Terms by amending them on the Website. By continuing to Use the Services and/or the Website after such amendment, you will be deemed to have accepted any amendment to these Terms.

These Terms shall be governed by and construed in accordance with the laws of England and Wales and you irrevocably submit to the exclusive jurisdiction of the courts of England and Wales to settle any dispute which may arise out of or in connection with these Terms. If you live outside the United Kingdom, English law shall apply only to the extent that English law shall not deprive you of any legal protection accorded in accordance with the law of the place where you are habitually resident ("Local Law"). In the event English law deprives you of any legal protection which is accorded to you under Local Law, then these terms shall be governed by Local Law and any dispute or claim arising out of or in connection with these Terms shall be subject to the non-exclusive jurisdiction of the courts where you are habitually resident.

You may print and keep a copy of these Terms, which form the entire agreement between you and Mondaq and supersede any other communications or advertising in respect of the Service and/or the Website.

No delay in exercising or non-exercise by you and/or Mondaq of any of its rights under or in connection with these Terms shall operate as a waiver or release of each of your or Mondaq’s right. Rather, any such waiver or release must be specifically granted in writing signed by the party granting it.

If any part of these Terms is held unenforceable, that part shall be enforced to the maximum extent permissible so as to give effect to the intent of the parties, and the Terms shall continue in full force and effect.

Mondaq shall not incur any liability to you on account of any loss or damage resulting from any delay or failure to perform all or any part of these Terms if such delay or failure is caused, in whole or in part, by events, occurrences, or causes beyond the control of Mondaq. Such events, occurrences or causes will include, without limitation, acts of God, strikes, lockouts, server and network failure, riots, acts of war, earthquakes, fire and explosions.

By clicking Register you state you have read and agree to our Terms and Conditions