The Committee on Foreign Investment in the United States (CFIUS), which is led by the US Department of the Treasury and made up of US national security and economic agencies—including Defense, State, Justice, Commerce, Energy and Homeland Security—conducts national security reviews of foreign direct investment (FDI) into the United States and certain real estate transactions.

The Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA) significantly overhauled the CFIUS process, including by adding new types of transactions subject to CFIUS review, giving CFIUS additional resources to review transactions and address concerns, and, for the first time ever, mandating notification of CFIUS in certain cases. New regulations fully implementing FIRRMA's reforms took effect in 2020, and the CFIUS landscape has continued to evolve since then as CFIUS avails itself of its greater authorities and resources, and the US government makes clear that it views CFIUS as a key national security tool.

Recent updates

• CFIUS filings have been increasing. In a 39 percent leap from 2020, CFIUS filings reached all-time highs in 2021, the first full year in which FIRRMA was implemented. Although CFIUS has not yet released statistics for 2022, our internal data indicates a further slight increase in filings in 2022 despite overall M&A activity declining compared to 2021
• Despite the increase in cases, CFIUS has generally maintained efficiency in reviewing transactions. In 2021, the one notable decline in CFIUS's efficiency pertained to transactions that were withdrawn and refiled, which is likely due to more time being needed to negotiate mitigation measures in those cases
• The vast majority of CFIUS reviews clear without mitigation, but there has been an uptick in the number of transactions resulting in mitigation. This likely reflects a combination of CFIUS having additional resources—meaning it can require more mitigation as it has greater ability to monitor compliance—and the Biden administration viewing CFIUS as a key national security tool, including as reflected in the September 2022 Executive Order
• The Biden administration issued a new executive order in September 2022 that provides guidance on how CFIUS should examine national security risks associated with a given transaction. President Biden's Executive Order 14083 emphasizes the administration's focus on CFIUS's role in using its foreign investment review authorities to protect US national security and highlights areas of particular national security concern. Although the Executive Order does not change the CFIUS process or authorities—and the factors it sets forth were likely already being considered by CFIUS in reviews—it provides a useful (but not comprehensive) guide for considering whether contemplated transactions have a potential nexus to national security and could have CFIUS implications
• In October 2022, the US Treasury also published new Enforcement and Penalty Guidelines that provide the first public insight in CFIUS history on the Committee's calculus when determining the appropriateness and number of penalties for violations. Although there has not been a significant number of announced penalty actions since FIRRMA was enacted, we anticipate that CFIUS intends to start using these authorities more going forward, particularly as parties are now on notice about criteria CFIUS will utilize to assess whether penalties should apply

Who files

CFIUS filings are usually submitted jointly by the parties to the notified transaction—typically the investing entity and the target.

Though the CFIUS regulations now mandate filings for certain transactions, CFIUS review remains predominantly a voluntary process, as most transactions subject to CFIUS's jurisdiction do not meet the mandatory filing criteria. Even for transactions under CFIUS's voluntary authorities, CFIUS may request parties notify a transaction of interest and has the authority to initiate reviews directly. CFIUS is pursuing non-notified transactions more aggressively, so the risk of CFIUS reaching out on a non-notified transaction has notably increased since FIRRMA was implemented.

Mandatory filing requirements apply only to covered transactions (i.e., foreign investments subject to CFIUS jurisdiction) that involve "TID US businesses," which (as discussed below) are certain US businesses involved with critical technologies, critical infrastructure or sensitive personal data. Specifically, subject to certain exemptions, mandatory filings are required in the following two circumstances:

• The acquisition of 25 percent or more of the voting interests in a TID US business by a person in which a single foreign government holds, directly or indirectly, a 49-percent-or-greater voting interest. All parents in the investor's ownership chain are deemed 100 percent owners, so dilution of ownership interests is not recognized for purposes of this test
• A foreign investment in a TID US business involved with critical technologies, where one or more "US regulatory authorizations" (e.g., export licenses) would be required to export, re-export or retransfer any of the US business's critical technologies to the investor or any person holding a 25-percent or greater, direct or indirect, voting interest in the investor. With a few exceptions, mandatory filing is required even where such critical technologies would be eligible for export to the relevant foreign person under a license exception

If a mandatory filing applies, notification by a declaration or notice must be submitted to CFIUS at least 30 days prior to the transaction's completion date.

FIRRMA also introduced the concept of "excepted investors," which are not subject to CFIUS's expanded jurisdiction for certain non-controlling investments or real estate transactions and are exempt from mandatory filing requirements. Excepted investors and their parents must meet relatively strict nationality-related criteria related to "excepted foreign states," which are currently Australia, Canada, the United Kingdom and New Zealand (though this list can change). Excepted investors are not exempt from CFIUS's general jurisdiction, only from CFIUS's expanded authorities under FIRRMA.

Types of deals reviewed

Consistent with its long standing authorities, CFIUS has jurisdiction to review any transaction that could result in "control" of a US business by a foreign person. Control is defined as the power, direct or indirect, whether exercised or not, to determine, direct or decide important matters affecting an entity. CFIUS interprets control broadly, and notably control can be present even in minority investments. A "US business" is similarly defined and interpreted broadly by CFIUS.

In addition to its traditional authorities regarding control transactions, under FIRRMA CFIUS now has expanded jurisdiction to review certain "covered investments" in sensitive US businesses referred to as "TID US businesses." "TID" stands for Technology, critical Infrastructure and sensitive personal Data. Specifically, TID US businesses are US businesses that:

• Produce, design, test, manufacture, fabricate or develop one or more critical technologies (i.e., certain items and technology subject to US export controls)
• Perform certain actions in relation to identified critical infrastructure assets, referred to as "covered investment critical infrastructure" or
• Maintain or collect sensitive personal data of US citizens

A covered investment is a non-controlling transaction that affords the foreign investor any of the following with respect to a TID US business:

• Access to any "material nonpublic technical information" in its possession
• Board membership or observer rights (including nomination rights) or
• Any involvement, other than through voting of shares, in substantive decision-making regarding sensitive personal data of US citizens, critical technologies or covered investment-critical infrastructure

CFIUS also has jurisdiction to review changes in rights that would provide control or, for a TID US business, covered investment rights, as well as transactions designed to evade CFIUS review.

Covered transactions (i.e., those subject to CFIUS's jurisdiction) include deals structured as stock or asset purchases, debt-to-equity conversions, foreign-foreign transactions where the target has US assets, private equity investments (in some cases even where the general partner is US-owned) and joint ventures into which a US business is being contributed.

Beyond its traditional investment focus, CFIUS now also has jurisdiction to review the purchase or lease by, or a concession to, a foreign person or real estate in the US that is located within, or will function as part of, certain air or maritime ports, or is located in or within certain proximity ranges of identified military installations and areas. Real estate transactions under CFIUS's jurisdiction are not subject to mandatory filing requirements.

Scope of the review

CFIUS reviews are focused on national security concerns. CFIUS conducts a risk-based analysis based on the threat posed by the foreign investor, the vulnerabilities exposed by the target US business, and the consequences to US national security of combining that threat and vulnerability.

Based on its risk assessment, CFIUS determines whether the transaction presents any national security concerns. If CFIUS identifies such concerns, it first determines whether other provisions of US law can sufficiently address them. If no other provisions of US law adequately address the concerns, CFIUS next determines whether any mitigation measures could resolve the concerns. If mitigation is warranted, CFIUS will typically negotiate terms with the parties, which will be a prerequisite to CFIUS clearing the transaction.

If CFIUS determines that mitigation cannot adequately resolve its concerns, CFIUS will typically request that the parties abandon their transaction (or that the foreign buyer divest its interest in the US business if the review happens following closing).

If the parties will not agree to abandonment or divestment, CFIUS can recommend that the president of the United States block the transaction, as only the president has the authority to prohibit a transaction. Presidential blocks are relatively rare, though they have happened more frequently in recent years. It is more typical for parties to agree to terms for abandonment or divestment directly with CFIUS. Although the CFIUS process is confidential, presidential block orders are public.

Review process timeline

There are now two options for how parties can notify a transaction to CFIUS: a declaration, which is a short-form filing reviewed on an expedited basis; or a voluntary notice, which is the traditional CFIUS notification mechanism. Both declarations and notices include required information about the investor and its owners, the US business that is the subject of the transaction and the transaction itself, although notices require more such information (e.g., personal identifier information for directors and officers of the investor and its parent companies). For both declarations and notices, CFIUS will also typically request additional information via Q&A during the review.

Following the initial submission, the declaration process typically takes approximately five to six weeks, and the notice process usually takes approximately three to five months. Following its assessment of a declaration, CFIUS may request the parties file a notice, so in those cases, the total process for a transaction notified by declaration will take longer. For complex transactions, deals expected to be more sensitive from a national security standpoint or in cases where parties want to be assured the certainty of CFIUS clearance, it may be advisable for the parties to start with a notice.

Once accepted by CFIUS, a declaration is assessed in 30 calendar days. At the end of the 30 days, CFIUS may take one of four actions: 1) clear the transaction; 2) inform the parties that CFIUS cannot clear the transaction on the basis of the declaration, but not request a notice (commonly referred to as the "shrug"); 3) request that the parties file a notice for the transaction; or 4) initiate a unilateral review.

Though the shrug outcome does not confer "safe harbor" as a clearance does—after a shrug, CFIUS could theoretically request a notice for the transaction in the future—in our experience transaction parties have typically treated the shrug outcome as sufficient for closing.

For a notice, the parties initially submit a draft "prefiling," on which CFIUS will provide comments and follow-up questions. After addressing those comments, parties will formally file the notice with CFIUS. CFIUS then has to accept the filing, at which time a 45-calendar-day initial review begins. At the end of the review, CFIUS will either clear the transaction or proceed to a 45-calendar-day investigation. About half of cases proceed to investigation.

If a transaction is referred to the president, the president has 15 calendar days to decide whether to prohibit the transaction.

In some cases, CFIUS will need additional time to complete its process, such as when negotiating mitigation measures with the parties. An investigation may be extended for one 15-calendar­-day period in "extraordinary circumstances," though this happens rarely. More typically, in such circumstances, CFIUS will allow the parties to withdraw and resubmit their filing, which restarts the initial 45-day review period. Most transactions are cleared in one CFIUS cycle.

Filing fees apply to notices submitted to CFIUS, but not to declarations—though they apply for notices submitted following CFIUS's assessment of a declaration. Fees are assessed based on a tiered approach, providing for a proportional cost equal to or less than 0.15 percent of the transaction value. The lowest fee is US$750 for transactions valued between US$500,000 and US$5 million (transactions under US$500,000 are not subject to fees), and the highest-tier fee is US$300,000 for transactions valued at US$750 million or more.

How foreign investors can protect themselves

It is critical for foreign investors to consider CFIUS issues—including assessing jurisdictional matters, whether mandatory CFIUS filing will apply, and potential substantive risks—as early as possible in cross-border transactions involving foreign investment (direct or indirect) in a US business. Notably, this includes minority and venture capital investments. Given potentially severe penalties for noncompliance, parties need to know early on whether filing will be required—and where it is not, may want to include relevant representations in the purchase agreement to provide additional protection.

In cases where filing is mandatory or the parties voluntarily notify CFIUS, allocation of CFIUS mitigation risk will be a key issue. Most transactions are cleared without mitigation, but when it is required, mitigation can have a substantial impact on transaction goals and present unexpected costs. The range of mitigation measures that can be imposed by CFIUS is quite broad (based on the risk profile of the deal), and it is important for investors in particular to have as clear an understanding as possible with respect to what mitigation measures would be acceptable to them. Between additional CFIUS resources enabling CFIUS to address concerns in a broader range of transactions and more focused review of certain national security considerations under both FIRRMA and the Executive Order, mitigation may increase in frequency.

_{White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.}

_{This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.}

_{© 2023 White & Case LLP}