Key Points

  • United States export control, sanctions, and foreign investment (CFIUS) regulations advance U.S. national security and foreign policy interests, but in very different ways. They are also quite complex. As a result, media reporting, commentary, and blogs often confuse their scope and how they work. Over the past week, the scope and impact of these regulations and laws have been the subject of considerable discussion worldwide as the media discusses U.S.-based NVIDIA's recently announced acquisition of U.K.-based Arm, which is currently owned by Japanese-based Softbank. The media coverage has amplified a series of particularly incorrect comments and fundamental misunderstandings about how these rules would affect NVIDIA's or any U.S. company's acquisition of a foreign company. To help resolve the confusion and reset the discussion to the correct legal foundation, I thought it would be useful to set out the basics of each.
  • U.S. dual-use export control regulations apply to technologies, commodities, and software, regardless of the nationality or corporate relationships of the companies involved in a transaction. The nature of the product is the key issue – not its owner. Thus, contrary to suggestions in the media, a U.S. company's acquisition of a non-U.S. company formerly owned and controlled by foreign nationals does not, as a result, subject the target to any new export controls. Whatever controls did or did not apply to the non-U.S. company's products will be the same after the acquisition.
  • U.S. sanctions primarily restrict U.S. companies from engaging in transactions involving specific designated persons — such as terrorists, drug kingpins, and human rights violators — or comprehensively sanctioned countries and regions. But contrary to recent suggestions in the media, non-U.S. companies are also subject to restrictions from U.S. sanctions in several ways, for example, if they use the U.S. financial system for their transactions. Arm is already subject to applicable U.S. sanctions and this transaction does not change that. Except for transactions involving Iran or Cuba, a U.S. company's acquisition of a non-U.S. company formerly owned and controlled by foreign nationals does not, in and of itself, subject the non-U.S. target to any new U.S. sanctions restrictions.
  • U.S. foreign-direct investment (i.e., CFIUS) controls apply to transactions involving foreign investment into the United States, most commonly when a foreign investor would acquire control of or non-passive rights in a U.S. business. Contrary to some recent suggestions in the media, CFIUS jurisdiction and review does not regulate the activities of a non-U.S. business operating outside the United States following its acquisition by a U.S. company.


U.S. export control, sanctions, and foreign investment regulations have recently been making global news headlines, particularly in matters involving China. Their inherent complexity and novel application have often led to well-intentioned, but incorrect or confusing descriptions of their scope, jurisdiction, and impact on various types of transactions. In particular, I have seen multiple reports that the possible acquisition by the U.S. company NVIDIA of the U.K. company Arm Limited, now owned by Japanese parent Softbank, will cause U.S. export controls, sanctions, and foreign investment regulations to apply to Arm in new ways. That is, several commentators and politicians have incorrectly said that a U.S. company's ownership of Arm would somehow mean that Arm would need the U.S. government's permission to engage in the types of international trade it has always engaged in, particularly with respect to China.

This simply is not how these regulations work. U.S. dual-use export controls are based on the export, reexport, or transfer of items (commodities, software or technology) that are subject to the Export Administration Regulations (EAR), whether by U.S. or non-U.S. parties. The export control status of any particular item is not affected by which company owns it or whether it is in some way affiliated with a U.S. company. U.S. sanctions apply to transactions with specific designated persons and sanctioned countries and regions. Except for transactions involving Cuba or Iran, a non-U.S. company's status as being owned by a U.S. company does not, in and of itself, impose any sanctions-related restrictions that did not already apply to the company. U.S. foreign investment review is focused on assessing and mitigating any risk to U.S. national security caused by foreign investments in U.S. businesses, not the other way around.

The following are summary descriptions of the agencies and the jurisdictional rules that govern each of these areas.

Dual-Use Export Controls — the Bureau of Industry and Security

The Bureau of Industry and Security (BIS) of the U.S. Department of Commerce administers the U.S. dual-use export control system through the EAR. The EAR regulates the export, reexport, and transfer of items subject to its jurisdiction, and certain activities of U.S. persons related to weapons of mass destruction. All U.S.-origin items, wherever they are in the world, are "subject to the EAR," which is the phrase the EAR uses to define what is subject to their jurisdiction. All items physically in the United States, whatever their origin, are also "subject to the EAR." The EAR apply to a number of foreign-made items outside the United States if they (i) contain more than "de minimis" amounts of sensitive U.S.-origin content, (ii) are the "direct product" of specific types of U.S. technology or software, or (iii) are produced by certain types of equipment that is the "direct product" of U.S. technology. The precise scope of the various "de minimis" and "direct product" rules is far more complicated, but the point for purposes of this alert is that determining whether foreign-made items outside the United States are subject to the jurisdiction of the EAR has nothing to do with the nationality of the shipper involved in a transaction or whether its corporate parent is in the United States.

Another export control tool BIS has to protect U.S. national security and foreign policy interests is the Entity List. In essence, the EAR prohibit the unlicensed export, reexport, and transfer of commodities, software, and technology "subject to the EAR" to entities on the list. Although it is an end-user control (as opposed to a control based on a list of items), its jurisdictional scope is nonetheless limited to situations where the items at issue are "subject to the EAR." The licensing obligations apply regardless of whether the parties involved are U.S. persons, foreign persons, or owned or controlled by a U.S. company.

For example, in NVIDIA's acquisition of Arm, there will be no change to the universe of Arm's commodities, software, and technologies that will or will not be subject to the EAR based on the transaction. Arm products that were subject to the EAR prior to the acquisition will continue to be covered because, for example, they are U.S. origin or incorporate more than a "de minimis" amount of controlled U.S.-origin content. Arm products that were not "subject to the EAR" before the transaction because, for example, they were foreign-origin, outside the United States, and not the "direct product" of certain types of U.S.-origin technology, will continue not to be "subject to the EAR." An Arm decision after the transaction to export, reexport, or transfer any of its commodities, software, or technologies will thus need to go through exactly the same compliance review that existed before the transaction. If Arm wants to export, reexport, or transfer an item "subject to the EAR" after the acquisition, the same license requirements will apply as was the case before the acquisition, assuming all other facts are the same.

Sanctions Regulations — Office of Foreign Assets Control

The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) administers and enforces primary U.S. economic sanctions that prohibit U.S. persons, and in limited instances, non-U.S. persons that are owned or controlled by U.S. persons, from engaging in transactions or dealings involving certain sanctioned countries, regions, and persons. Additionally, the U.S. Department of State and OFAC also enforce certain secondary sanctions that target non-U.S. companies that engage in certain proscribed conduct that contravenes U.S. national security, foreign policy, or economic interests.

U.S. primary sanctions generally apply to "U.S. persons." As used in U.S. sanctions law, the term "U.S. persons" refers to U.S. citizens, U.S. permanent resident aliens, entities organized under the laws of the United States (including their foreign branches), or any person within the United States. The only sanctions programs that apply their restrictions to foreign persons as a result of their being owned or controlled by U.S. persons are those pertaining to Cuba and Iran. Thus, if a non-U.S. company is not engaged in transactions involving Iran or Cuba, its being owned by a U.S. company will not increase, as such, its exposure or obligations under U.S. sanctions law.

Considering how broad U.S. sanctions already apply to transactions by a foreign company, OFAC sanctions already reach non-U.S. companies in many ways, even if such companies are not owned or controlled by U.S. persons. For example, a non-U.S. company, regardless of its owners, can be subject to OFAC enforcement actions for engaging in U.S. dollar transactions with sanctioned countries, regions, or persons because such transactions are generally processed through the U.S. financial system. Similarly, no matter who owns a non-U.S. company, its U.S. person employees, officers, directors, contractors, subsidiaries, and agents are prohibited from engaging in, approving, financing, guaranteeing, or otherwise facilitating any transaction that would be prohibited for them under U.S. sanctions. Non-U.S. companies, regardless of their owners, can also be exposed to OFAC sanctions enforcement risk for purchasing U.S.-origin goods with the specific intent of re-exporting, transferring, or selling the items to a person, country, or region subject to U.S. sanctions. Thus, there will be no change to the Arm's exposure to, or obligations under, U.S. sanctions as a result of the NVIDIA acquisition in the absence of U.S. person involvement, except with respect to transactions involving Cuba or Iran.

Committee on Foreign Investment in the United States — Foreign Direct Investment Regulations

The U.S. government's regulatory authority exercised through the Committee on Foreign Investment in the United States (CFIUS) is separate from its export control or sanctions authorities and is focused on screening foreign investment in the United States. CFIUS does not review acquisitions by U.S. companies. CFIUS is not involved in overseeing the type of day-to-day commercial transactions that are the purview of BIS with respect to export controls or OFAC with respect to sanctions. Rather, CFIUS is the inter-agency mechanism through which the U.S. government formally monitors and reviews foreign investment in the United States for possible national security concerns. Chaired by the U.S. Department of the Treasury, CFIUS has the authority to initiate reviews of covered transactions, suspend transactions, impose mitigation measures, and recommend that the President block pending transactions or order divestitures of completed transactions when national security concerns cannot be mitigated. Parties can voluntarily file with CFIUS to obtain clearance to address the risk that CFIUS will intervene in a pending or completed covered transaction. In certain cases, filing with CFIUS is mandatory.

Although CFIUS has attracted a lot of attention recently for its high-profile review of ByteDance's acquisition of TikTok-predecessor and President Trump's recent blocks of Beijing Shiji Information Technology's acquisition of StayNTouch, it is important to keep in mind that CFIUS does not review all transactions involving U.S. entities. Rather, CFIUS's jurisdiction over, and scrutiny of, a transaction is determined on a case-by-case basis generally based on the identities of the buyer and target and the rights being afforded to the foreign investor by virtue of the transaction.

First, CFIUS's review is limited to transactions involving investments by "foreign persons" in "U.S. businesses." The CFIUS regulations define "U.S. business" as "any entity, irrespective of nationality of the persons that control it, engaged in interstate commerce in the United States."

"Foreign persons" are foreign nationals, foreign governments, or foreign entities (i.e., entities organized under the law of a foreign state with a principal place of business outside the United States or equity securities that are primarily trade on a foreign exchange).  Simply put, CFIUS reviews inbound foreign investment, not outbound investment by U.S. persons in non-U.S. businesses. For example, CFIUS would have jurisdiction to review a foreign entity's acquisition of another foreign entity's U.S. subsidiary. It would not, however, have jurisdiction to review a foreign entity's acquisition of a U.S. entity's foreign subsidiary that is operating wholly outside the United States or a U.S. entity's acquisition of a foreign entity or its U.S. subsidiary.

Second, even if the transaction involves a foreign investor and U.S. business target, CFIUS jurisdiction is primarily limited to three types of transactions where a foreign investor: (1) acquires control of a business; (2) makes a non-controlling investment that affords it specific rights in a U.S. business' critical technologies, critical infrastructure, or sensitive personal data (a "TID U.S. business"); or (3) engages in a real estate transaction involving property in certain sensitive locations. As with the identity of the investor and the target, whether control exists or whether the foreign investor will acquire the relevant non-controlling rights — or even whether the target qualifies as a TID U.S. business — are fact-specific inquiries that are considered on a case-by-case basis.

Whatever the complexity with respect to such analyses, using NVIDIA/Arm as an example, CFIUS simply does not have jurisdiction over a U.S. company's acquisition of a non-U.S. company. Even if CFIUS were interested in changing its regulations to give it jurisdiction over the transaction, it would not have the statutory authority to do so. Finally, none of the recent changes to the CFIUS regulations change these conclusions.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.