United States: Key Takeaways From The New Proposed CFIUS Rules

On September 17, 2019, the Committee on Foreign Investment in the United States ("CFIUS" or the "Committee") published proposed rules (the "Proposals").  The Proposals would significantly expand CFIUS' jurisdiction but only slightly enlarge the number of transactions for which a filing is mandatory.  Five key takeaways for investors and companies regarding the Proposals are set forth immediately below; each is followed further below by additional explanation and context.

  1. The Proposals (here and here) are not final or binding at this time. The public has 30 days to comment (until October 17, 2019), after which time CFIUS will review those comments and publish final rules early next year.
  2. The Proposals would significantly expand CFIUS's jurisdiction.  CFIUS has broad jurisdiction to request or require filings for particular investments (often called "voluntary" filings because discretion about whether to file is left to the transaction parties until such time as a request is made by the Committee).  The Proposals would enable the Committee to review even more of those investments.  Most notably, the Committee's jurisdiction would now reach non-controlling foreign investments, even investments of 1% or less, in certain U.S. technology, infrastructure, and data businesses (referenced in the Proposals as "TID" businesses), as long as the foreign investor obtains certain rights in those TID businesses.  The set of TID businesses is broad, including any business that maintains or collects certain types of "sensitive personal data."  In addition, the Proposals would give CFIUS jurisdiction over a purchase or lease of "covered real estate" by a foreign person.
  3. The set of transactions that must file at CFIUS as a matter of law will increase, but potentially only slightly.  The Committee previously issued a "pilot program" rule, effective November 10, 2018, which created filing obligations (so-called "mandatory" filings" because the transaction parties have no discretion about whether to file) for certain categories of foreign investments into U.S. companies involved with "critical technologies."  Our summary of that rule is here, and it remains in effect.  In addition, the Proposals add a second mandatory filing trigger for transactions involving a foreign government "substantial interest."  This new mandatory filing trigger specifies that a foreign investment of 25% or more into a TID business must be filed with CFIUS if a foreign government has a stake of 49% or more in the foreign investor.
  4. The Proposals offer an exemption to certain foreign investors, but the exemption may be of little use in practice.  Although the Proposals include a process through which CFIUS can exempt from its jurisdiction certain foreign investments associated with certain countries, such exemptions would not be effective until 2022 at the earliest, and the exemptions are so narrow that their utility may be marginal.
  5. Beyond the slice of transactions for which CFIUS filings are mandatory, the Proposals' expansion of the Committee's jurisdiction is of uncertain practical effect.  The risk associated with failure to voluntarily file with CFIUS is in significant part keyed to the degree to which CFIUS elects to pursue foreign investors and compel filings after closing if parties do not file voluntarily.  Accordingly, the impact of the Proposals' expansion of the Committee's jurisdiction will depend on the frequency with which CFIUS's newly established monitoring and enforcement arm conducts reviews of the broad set of transactions that it has the right to reach under its new jurisdiction, but that are not subject to mandatory filings.

The upshot is that, except for small, purely passive foreign investments, there is a reasonable likelihood that after the rules set forth in the Proposals have been finalized, CFIUS will have jurisdiction to review nearly any foreign investment into a U.S. company involved in technology, infrastructure, and data businesses, and a significant number of covered real estate investments.  However, while the Proposals will undeniably expand CFIUS's reach, the impact of that expansion will only be apparent once the rules are finalized and the new enforcement regime is in place.

For more context on the Committee, its new authorities under the Foreign Investment Risk Review Modernization Act ("FIRRMA"), the Proposals, and the five key points above, please read on.  For an opportunity to understand how these rules will be implemented in practice by hearing from and speaking with experts and government decision-makers, readers should consider attending the second annual Emerging Technology Meets National Security conference, hosted by the National Venture Capital Association this November 7, 2019.  Details and registration information can be found here:  https://nvca.org/emerging-technology-meets-national-security/.

The CFIUS Basics

CFIUS is an interagency committee charged with conducting national security reviews of investments in, or acquisitions of, U.S. companies when the investments are made by foreign persons.  The Committee is chaired by the U.S. Department of the Treasury but includes many other cabinet agencies.

Prior to the fall of 2018, filing with CFIUS was voluntary unless the Committee individually requested or compelled the submission of a notice.  In addition, the Committee's jurisdiction was limited to transactions resulting in foreign "control" over a U.S. business.  While the test for control was broad, mere access to information about a company (through, e.g., a board observer) coupled with an investment of less than 10% generally did not create CFIUS jurisdiction.  With respect to controlling investments, though, CFIUS had the authority to review the transaction at any time, pre- or post-closing.  Parties concerned about CFIUS's authority to review their investments and force post-closing conditions or divestment often would make voluntary filings in order to obtain CFIUS clearance.  Such clearance insulates the transaction from post-closing Committee intervention.

In August 2018, Congress enacted FIRRMA to (i) broaden CFIUS's jurisdiction, (ii) create mandatory filing obligations for certain transactions, and (iii) infuse CFIUS with greater resources to expand its operations, including its ability to hunt for transactions of concern to CFIUS that are not filed with CFIUS voluntarily.

Part I: The Proposals – How the Sausage is Getting Made

FIRRMA's provisions, however, are not self-executing.  Rather, they require CFIUS to issue implementing rules.  CFIUS issued its first set of rules last fall, in the form of the pilot program rule mentioned above.  That pilot program is binding but temporary and focused just on some of FIRRMA's provisions, particularly mandatory filings for certain investments in critical technology businesses.  

The new Proposals set forth several hundred pages of proposed rules, including incorporation of the pilot program (which remains in effect) by reference.  FIRRMA requires full implementation early next year, and the Proposals are intended to advance the rulemaking process by soliciting public input and then giving the agencies sufficient time to consider and incorporate that input before the deadline.  Comments on all aspects of the Proposals are due on October 17.  The pilot program already has triggered numerous comments (see, for example, the comments of the National Venture Capital Association, linked here), but additional comments on those specific mandatory filing rules are re-solicited in the Proposals. 

Notably, a few aspects of FIRRMA are not addressed in the Proposals.  The two most salient aspects are so-called "emerging" and "foundational" technologies and the question of CFIUS filing fees.  The designation of emerging and foundational technologies will help scope the set of mandatory filings at CFIUS.  However, to ensure consistency with U.S. export control rules, those rules are being addressed through a parallel rulemaking run by the Department of Commerce.  With respect to filing fees, FIRRMA provides the Committee authority to charge $300,000 or 1% of the transaction value, whichever is less, for CFIUS filings.  CFIUS has not begun charging filing fees and is not required to do so; the Proposals state that consideration of such fees will be the subject of future proposed rules.

Part II: The Expansion of Jurisdiction – The Land Grab

Even prior to FIRRMA, CFIUS's jurisdiction, though limited to "control" investments, was surprisingly broad.  The definition of control is both broad and amorphous, potentially including not only circumstances in which a foreign investor acquires more than a 10% voting stake or a single board seat, but also circumstances in which a foreign investor holds certain veto rights, such as the right to veto dividend distributions.  The Committee also has substantial discretion in interpreting its regulations, and appeal from CFIUS to a court generally is not practical. CFIUS accordingly is judge, jury, and executioner and interprets its authorities aggressively when it is concerned about a transaction.

The new Proposals broaden CFIUS's jurisdiction even further.  As indicated below, the parameters of the Committee's proposed authority, together with virtually unfettered CFIUS interpretive discretion, might make it hard to conclude that any foreign investment into a technology, infrastructure, or data business is clearly outside CFIUS's jurisdiction, unless that investment does not confer any so-called "triggering rights."  Avoiding triggering rights means that any foreign investment:  (i) is non-controlling, (ii) does not provide for a board seat or observer seat or nomination rights, (iii) provides no access to "material non-public technical information," and (iv) does not enable the investor to become involved in substantive decision-making about the business.  The set of TID businesses includes:

  • Investments in "Critical Technology" Businesses.  The pilot program implemented last November created mandatory filing obligations for investments in U.S. businesses that are involved with critical technologies and that design or utilize those technologies in specified industries.  The Proposals would allow CFIUS to review an extended set of investments in critical technology businesses regardless of whether the technologies are designed for or utilized in any of the specified industries.  The set of "critical technologies" is defined by reference to several U.S. government lists, some of which remain under development (such as the lists of "emerging" and "foundational" technologies referenced above).
  • Investments in "Critical Infrastructure" Businesses.  For purposes of determining a "critical infrastructure" business, the Proposals define critical infrastructure by reference to an eight page appendix that cross-references a litany of other lists, e.g., "Any (a) internet protocol network that has access to every other internet protocol network solely via settlement-free peering; or (b) telecommunications service or information service, each as defined in section 3(a)(2) of the Communications Act of 1934 (47 U.S.C. 153), as amended, or fiber optic cable that directly serves any military installation identified in § 802.229."
  • Investments in "Sensitive Personal Data" Businesses.  The Proposals define "sensitive personal data" as data that facilitates identification and that falls into any one of many distinct categories.  Individuals' genetic information qualifies as sensitive at all times.  Several other categories qualify if the underlying business (i) holds or eventually intends to hold data on a million or more individuals or (ii) targets or tailors its products or services for certain government customers.  Personal data that would qualify as sensitive if falling into either of these latter categories, (i) or (ii), include certain electronic communications; data that can be used to analyze an individual's financial distress; geolocation data; and physical, mental, and psychological health data.

Given the potential breadth of the categories above and CFIUS's interpretive discretion, as long as a foreign investor expects to obtain one or more triggering rights, it would be hard to rule out the possibility of CFIUS taking jurisdiction for an investment into almost any technology, infrastructure, or data business.

In addition, under the Proposals, CFIUS also would acquire jurisdiction over foreign acquisitions, leases, and concessions of "covered real estate."

  • Concessions, Leases and Acquisitions of "Covered Real Estate."  The Proposals define "covered real estate" as real estate that is (a) physically within, or functionally a part of, an airport or maritime port; or (b) within specified areas indicated on a seven page appendix (e.g., 99 miles from Aberdeen Proving Ground in Aberdeen, MD; 99 miles from Vandenberg Air Force Base in Lompoc, CA; anywhere in Logan County, CO or anywhere in Cascade County, MT).  CFIUS would have jurisdiction over a foreign person acquiring ownership over, leasing, or obtaining a concession over such covered real estate if the ownership, lease, or concession were to give the foreign investor three or more of the following four rights: (i) the right to physically access the real estate; (ii) the right to exclude others; (iii) the right to improve or develop; (iv) the right to attach fixed or immovable structures or objects.

Part III: Mandatory Filings – The Silver Lining

It is worth re-emphasizing, however, that broad CFIUS jurisdiction is not the same as a mandatory CFIUS filing requirement.  The Proposals add only a relatively small category of transactions that would be subject to mandatory filing requirements.  FIRRMA required CFIUS to implement mandatory filings whenever a foreign investor has a "substantial interest" in a U.S. company and a foreign government has a "substantial interest" in the foreign investor.  CFIUS has proposed to implement this requirement in a manner that is narrower than it could have been.

  • Mandatory Filings for Foreign Government "Substantial Interest."  The Proposals would require mandatory filings if a foreign person has a 25% or greater interest (direct or indirect) in a U.S. TID business and a foreign government has a 49% or greater interest (direct or indirect) in the foreign investor.  So, for example, a sovereign wealth fund that owns 70% of a foreign investment company would trigger a mandatory filing if the foreign investment company acquires a 30% stake in a U.S. company that is involved with "critical technologies."

There are some ambiguities about these thresholds, particularly when the foreign investor is a limited partnership – e.g., the Proposals state that if the foreign government is a limited partner and holds 49% or more of the "voting interest of the limited partners," then the 49% threshold is satisfied.  It is unclear what voting interest means in this context.

Ambiguities aside, these thresholds may be a relief to many observers when compared to the first, broader set of mandatory filing rules implemented in November through the pilot program (explained here).  Comparatively, the second (and final) FIRRMA mandatory filing trigger – namely for foreign government substantial interests – looks as if it may be implemented in a manner that is narrower than feared.

Both sets of mandatory filing rules are, of course, only in draft form (though the pilot program nevertheless is currently binding).  The final rulemaking still could expand the set of transactions subject to either the critical technology or substantial interest mandatory filing requirements.

Part IV: The Excepted Investor Rules – Cold Comfort

Under FIRRMA, Congress offered the Committee two opportunities to limit the scope of its review to investors of particular concern.  The first such subsection in FIRRMA required the implementation of a process to exempt selected investors from the expansion of CFIUS jurisdiction, while the second suggested a waiver process to limit the applicability of the mandatory filing rules.  Unfortunately, the Proposals implement only the first of these two authorities, and do so in a manner that make it exceedingly difficult for an investor to qualify as exempt.

In order to qualify as an "excepted investor," the investing entity's nation of organization must first be qualified as an "excepted foreign state" – a status that can only be granted by CFIUS after a review process that will begin no sooner than two years after the rules are finalized.  Once the investor's nation of organization is so qualified, that entity must then satisfy several further tests, including guaranteeing that every one of its board members, observers, and 5% or greater shareholders is a U.S. person or from an excepted foreign state.  Even if the entity can satisfy all of the several tests, it can be removed from excepted investor status for violating any of several U.S. laws or regulations.  Moreover, qualifying as an excepted investor only grants an investor a reprieve from CFIUS's extended jurisdiction – such investors remain subject to CFIUS review for traditional "controlling" investments, and are still subject to mandatory filing requirements for such investments.  If implemented as shown in the Proposals, the excepted investor rules likely would have limited impact.

Part V: CFIUS and Enforcement – the Key Unanswered Question

When these new rules are put in place, what will the consequences be?  Most obviously, FIRRMA authorizes CFIUS to impose penalties up to the value of the transaction for failure to make a mandatory filing.  These fines can be imposed on the foreign investor, the U.S. company, or both.  Such penalties may be applicable when a filing is required under the pilot program rule (concerning certain investments in critical technology businesses); in addition, the Proposals would extend that penalty authority to mandatory filings triggered by the presence of a substantial foreign government interest (49% or more) in a foreign investor that has a substantial interest (25% or more) in a U.S. TID business.

As indicated above, however, except for the foreign government substantial interest provisions, the Proposals generally expand CFIUS jurisdiction without creating new mandatory filing obligations.  The proposed CFIUS jurisdiction is very broad.  Taken together, the Committee's jurisdiction over controlling investments, jurisdiction over non-controlling investments in TID businesses, and jurisdiction over foreign acquisitions and leases of certain real estate may give CFIUS jurisdiction over tens of thousands of transactions (or more) per year.  However, absent a legal obligation to make a filing to CFIUS (i.e., the mandatory filing rules referenced above), or some perception of risk from not making a filing, this expanded jurisdiction may be of limited practical import.

The perception of risk from not making a filing in those voluntary filing scenarios will depend in significant part on CFIUS enforcement activity once the new rules are finalized.  In particular, perceptions of risk likely will be shaped by (i) the frequency with which CFIUS uses its broad jurisdiction to request filings of transactions that were not subject to mandatory filing requirements, (ii) the nature of the transactions that give rise to such CFIUS requests (e.g., whether limited to investors from certain countries such as China and Russia), and (iii) the outcomes of such filings (e.g., whether CFIUS decides that the foreign investor must divest).  This enforcement environment, which may not be clear for a long time, can be expected to play a large part in determining the practical implications of CFIUS's expanded jurisdiction – at least as much as the nuances of the final rules.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

To print this article, all you need is to be registered on Mondaq.com.

Click to Login as an existing user or Register so you can print this article.

Similar Articles
Relevancy Powered by MondaqAI
In association with
Related Topics
Similar Articles
Relevancy Powered by MondaqAI
Related Articles
Related Video
Up-coming Events Search
Font Size:
Mondaq on Twitter
Mondaq Free Registration
Gain access to Mondaq global archive of over 375,000 articles covering 200 countries with a personalised News Alert and automatic login on this device.
Mondaq News Alert (some suggested topics and region)
Select Topics
Registration (please scroll down to set your data preferences)

Mondaq Ltd requires you to register and provide information that personally identifies you, including your content preferences, for three primary purposes (full details of Mondaq’s use of your personal data can be found in our Privacy and Cookies Notice):

  • To allow you to personalize the Mondaq websites you are visiting to show content ("Content") relevant to your interests.
  • To enable features such as password reminder, news alerts, email a colleague, and linking from Mondaq (and its affiliate sites) to your website.
  • To produce demographic feedback for our content providers ("Contributors") who contribute Content for free for your use.

Mondaq hopes that our registered users will support us in maintaining our free to view business model by consenting to our use of your personal data as described below.

Mondaq has a "free to view" business model. Our services are paid for by Contributors in exchange for Mondaq providing them with access to information about who accesses their content. Once personal data is transferred to our Contributors they become a data controller of this personal data. They use it to measure the response that their articles are receiving, as a form of market research. They may also use it to provide Mondaq users with information about their products and services.

Details of each Contributor to which your personal data will be transferred is clearly stated within the Content that you access. For full details of how this Contributor will use your personal data, you should review the Contributor’s own Privacy Notice.

Please indicate your preference below:

Yes, I am happy to support Mondaq in maintaining its free to view business model by agreeing to allow Mondaq to share my personal data with Contributors whose Content I access
No, I do not want Mondaq to share my personal data with Contributors

Also please let us know whether you are happy to receive communications promoting products and services offered by Mondaq:

Yes, I am happy to received promotional communications from Mondaq
No, please do not send me promotional communications from Mondaq
Terms & Conditions

Mondaq.com (the Website) is owned and managed by Mondaq Ltd (Mondaq). Mondaq grants you a non-exclusive, revocable licence to access the Website and associated services, such as the Mondaq News Alerts (Services), subject to and in consideration of your compliance with the following terms and conditions of use (Terms). Your use of the Website and/or Services constitutes your agreement to the Terms. Mondaq may terminate your use of the Website and Services if you are in breach of these Terms or if Mondaq decides to terminate the licence granted hereunder for any reason whatsoever.

Use of www.mondaq.com

To Use Mondaq.com you must be: eighteen (18) years old or over; legally capable of entering into binding contracts; and not in any way prohibited by the applicable law to enter into these Terms in the jurisdiction which you are currently located.

You may use the Website as an unregistered user, however, you are required to register as a user if you wish to read the full text of the Content or to receive the Services.

You may not modify, publish, transmit, transfer or sell, reproduce, create derivative works from, distribute, perform, link, display, or in any way exploit any of the Content, in whole or in part, except as expressly permitted in these Terms or with the prior written consent of Mondaq. You may not use electronic or other means to extract details or information from the Content. Nor shall you extract information about users or Contributors in order to offer them any services or products.

In your use of the Website and/or Services you shall: comply with all applicable laws, regulations, directives and legislations which apply to your Use of the Website and/or Services in whatever country you are physically located including without limitation any and all consumer law, export control laws and regulations; provide to us true, correct and accurate information and promptly inform us in the event that any information that you have provided to us changes or becomes inaccurate; notify Mondaq immediately of any circumstances where you have reason to believe that any Intellectual Property Rights or any other rights of any third party may have been infringed; co-operate with reasonable security or other checks or requests for information made by Mondaq from time to time; and at all times be fully liable for the breach of any of these Terms by a third party using your login details to access the Website and/or Services

however, you shall not: do anything likely to impair, interfere with or damage or cause harm or distress to any persons, or the network; do anything that will infringe any Intellectual Property Rights or other rights of Mondaq or any third party; or use the Website, Services and/or Content otherwise than in accordance with these Terms; use any trade marks or service marks of Mondaq or the Contributors, or do anything which may be seen to take unfair advantage of the reputation and goodwill of Mondaq or the Contributors, or the Website, Services and/or Content.

Mondaq reserves the right, in its sole discretion, to take any action that it deems necessary and appropriate in the event it considers that there is a breach or threatened breach of the Terms.

Mondaq’s Rights and Obligations

Unless otherwise expressly set out to the contrary, nothing in these Terms shall serve to transfer from Mondaq to you, any Intellectual Property Rights owned by and/or licensed to Mondaq and all rights, title and interest in and to such Intellectual Property Rights will remain exclusively with Mondaq and/or its licensors.

Mondaq shall use its reasonable endeavours to make the Website and Services available to you at all times, but we cannot guarantee an uninterrupted and fault free service.

Mondaq reserves the right to make changes to the services and/or the Website or part thereof, from time to time, and we may add, remove, modify and/or vary any elements of features and functionalities of the Website or the services.

Mondaq also reserves the right from time to time to monitor your Use of the Website and/or services.


The Content is general information only. It is not intended to constitute legal advice or seek to be the complete and comprehensive statement of the law, nor is it intended to address your specific requirements or provide advice on which reliance should be placed. Mondaq and/or its Contributors and other suppliers make no representations about the suitability of the information contained in the Content for any purpose. All Content provided "as is" without warranty of any kind. Mondaq and/or its Contributors and other suppliers hereby exclude and disclaim all representations, warranties or guarantees with regard to the Content, including all implied warranties and conditions of merchantability, fitness for a particular purpose, title and non-infringement. To the maximum extent permitted by law, Mondaq expressly excludes all representations, warranties, obligations, and liabilities arising out of or in connection with all Content. In no event shall Mondaq and/or its respective suppliers be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection with the use of the Content or performance of Mondaq’s Services.


Mondaq may alter or amend these Terms by amending them on the Website. By continuing to Use the Services and/or the Website after such amendment, you will be deemed to have accepted any amendment to these Terms.

These Terms shall be governed by and construed in accordance with the laws of England and Wales and you irrevocably submit to the exclusive jurisdiction of the courts of England and Wales to settle any dispute which may arise out of or in connection with these Terms. If you live outside the United Kingdom, English law shall apply only to the extent that English law shall not deprive you of any legal protection accorded in accordance with the law of the place where you are habitually resident ("Local Law"). In the event English law deprives you of any legal protection which is accorded to you under Local Law, then these terms shall be governed by Local Law and any dispute or claim arising out of or in connection with these Terms shall be subject to the non-exclusive jurisdiction of the courts where you are habitually resident.

You may print and keep a copy of these Terms, which form the entire agreement between you and Mondaq and supersede any other communications or advertising in respect of the Service and/or the Website.

No delay in exercising or non-exercise by you and/or Mondaq of any of its rights under or in connection with these Terms shall operate as a waiver or release of each of your or Mondaq’s right. Rather, any such waiver or release must be specifically granted in writing signed by the party granting it.

If any part of these Terms is held unenforceable, that part shall be enforced to the maximum extent permissible so as to give effect to the intent of the parties, and the Terms shall continue in full force and effect.

Mondaq shall not incur any liability to you on account of any loss or damage resulting from any delay or failure to perform all or any part of these Terms if such delay or failure is caused, in whole or in part, by events, occurrences, or causes beyond the control of Mondaq. Such events, occurrences or causes will include, without limitation, acts of God, strikes, lockouts, server and network failure, riots, acts of war, earthquakes, fire and explosions.

By clicking Register you state you have read and agree to our Terms and Conditions