The Committee on Foreign Investment in the US (CFIUS), which is led by the US Department of the Treasury and composed of US national security and economic agencies—including Defense, State, Justice, Commerce, Energy and Homeland Security—conducts national security reviews of foreign direct investment (FDI) into the US and certain real estate transactions.

The Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA) significantly overhauled the CFIUS process, including adding new types of transactions subject to CFIUS review, giving CFIUS additional resources to review transactions and address concerns, and, for the first time ever, mandating notification of CFIUS in certain cases. Regulations fully implementing FIRRMA's reforms took effect in 2020, and the CFIUS landscape has continued to evolve since then as CFIUS avails itself of its greater authorities and resources, and the US government makes clear that it views CFIUS as a key national security tool.

Summary of major changes in 2023

• The CFIUS is requiring mitigation measures for more transactions. In 2022 (the most recent year for which data is available), CFIUS required mitigation in nearly one out of every four transactions notified via full notices—by far the highest percentage of mitigation in CFIUS history and a significant increase since the enactment of FIRRMA
• Though the CFIUS is mitigating more transactions, it is not stopping more deals. Approximately 4 percent of CFIUS notices resulted in transactions being effectively blocked in 2022, up just slightly from 3.3 percent in 2021 and consistent with the percentages from 2020 and 2019
• The CFIUS saw a record number of filings in 2022, but the numbers were generally consistent with the prior year, which had seen a nearly 40 percent increase in filings and was also the first full year in which FIRRMA was implemented. Although CFIUS has not yet released statistics for 2023, our internal data indicates a decrease in filings (both short-form declarations and full notices) from 2022, but still a significant increase relative to the pre-FIRRMA era
• More short-form declarations are resulting in requests for notices. In 2022, 33 percent of declarations resulted in a request for a notice—nearly double the 18 pe-r cent in 2021. This means that the risk of a declaration extending the overall timeline and costs of CFIUS review has increased, so parties should consider carefully whether to start with a full notice, particularly if a given transaction has timing sensitivities
• The CFIUS process has been taking longer. In addition to more declarations leading to full- notice requests, more notices have been requiring an additional 45-day investigation following the initial 45-day review. In 2022, 57 percent of cases went to investigation, up from just under 50 percent in recent years and marking a return to higher investigation percentages that had otherwise dropped since FIRRMA's enactment in 2018. Additionally, withdrawals and resubmissions (where the statutory timeline is restarted, typically to allow more time to address CFIUS national security concerns, such as by negotiating mitigation measures) remained high in 2022, though in our experience CFIUS has been working since then to resolve more cases requiring mitigation in just one CFIUS cycle
• In May 2023, the CFIUS issued new guidance that ended a long-accepted workaround of the 30-day waiting period in mandatory filing cases, which means that parties can no longer use "springing rights" constructs to provide funding associated with minority investments quickly, while the investor's rights triggering CFIUS jurisdiction do not attach until after the 30-day period had ended or CFIUS has approved the transaction
• The CFIUS is highly focused on compliance and enforcement. Though historically the CFIUS has not been an enforcement body, following the release of penalty and enforcement guidance in late 2022, CFIUS officials have been clear that the Committee is devoting significant attention to monitoring and compliance, with enforcement priorities covering both non-notified mandatory filings and violations of mitigation requirements
• Though the CFIUS remains predominantly a voluntary review process, the CFIUS continues to expand its efforts to identify and review non-notified transactions of interest. The CFIUS has said it is largely through its backlog of older non-notified transactions, which indicates that the committee is primarily looking for more recent or active transactions that it wants to review. Notably, there has been an expansion in the countries of investors represented in non-notified transactions, with transactions involving investors well beyond China and Russia being called in for review. This evolving dynamic impacts the analysis of whether parties should voluntarily file at the outset—particularly if an investor wants to ensure that CFIUS surprises will not frustrate its transaction goals
• In addition to the CFIUS's focus on inbound investment, pursuant to President Biden's August 2023 Executive Order, the US government is establishing a new program to regulate certain outbound investments. Implementing regulations have not yet been released, but the program will target investment into China (including Chinese-owned entities) in the areas of semiconductors and microelectronics, artificial intelligence capabilities and quantum information technologies. Certain transactions will be prohibited under the program and others, at least initially, will only require notification to the US government

Who files?

CFIUS filings are usually submitted jointly by the parties to the notified transaction—typically the investing entity and the target.

Though the CFIUS regulations mandate filings for certain transactions, CFIUS review remains predominantly a voluntary process, as most transactions subject to the CFIUS's jurisdiction do not meet the mandatory filing criteria. Even for transactions under the CFIUS's voluntary authorities, CFIUS may request parties notify a transaction of interest and has the authority to initiate reviews directly. The CFIUS is pursuing non-notified transactions more aggressively, so the risk of CFIUS reaching out on a non-notified transaction has notably increased since FIRRMA was implemented —and CFIUS officials have indicated recently that even more resources are being dedicated to its non-notified process.

Mandatory filing requirements apply only to covered transactions (foreign investments subject to CFIUS jurisdiction) that involve TID US businesses, which are certain US businesses involved with critical Technologies, critical Infrastructure or sensitive personal Data.

Specifically, subject to certain exemptions, mandatory filings are required in the following two circumstances. The first is the acquisition of 25 percent or more of the voting interests in any TID US business by a person in which a single foreign government holds, directly or indirectly, a 49 percent or greater voting interest. All parents in the investor's ownership chain are deemed 100 percent owners, so dilution of ownership interests is not recognized for purposes of this test.

The second circumstance is where a foreign investment in a TID US business is involved with critical technologies, where one or more US regulatory authorizations such as export licenses would be required to export, re-export or retransfer any of the US business's critical technologies to the investor or any person holding a 25 percent or greater, direct or indirect, voting interest in the investor. With a few exceptions, mandatory filing is required even where such critical technologies would be eligible for export to the relevant foreign person under a license exception.

If a mandatory filing applies, notification by a declaration or notice must be submitted to the CFIUS at least 30 days prior to the transaction's completion date. Previously, it was possible in certain cases to structure transactions around the 30-day waiting period, but CFIUS guidance issued in May 2023 has largely precluded such strategies.

FIRRMA also introduced the concept of "excepted investors," which are not subject to the CFIUS's expanded jurisdiction for certain non-controlling investments or real estate transactions and are exempt from mandatory filing requirements. Excepted investors and their parents must meet relatively strict nationality-related criteria related to "excepted foreign states," which are currently Australia, Canada, the UK and New Zealand (although this list can change). Excepted investors are not exempt from the CFIUS's general jurisdiction, only from CFIUS's expanded authorities under FIRRMA.

Types of deals reviewed

Consistent with its longstanding authorities, the CFIUS has jurisdiction to review any transaction that could result in "control" of a US business by a foreign person. Control is defined as the power, direct or indirect, whether exercised or not, to determine, direct or decide important matters affecting an entity. The CFIUS interprets control broadly and, notably, control can be present even in minority investments. A US business is similarly defined and interpreted broadly by the CFIUS.

In addition to its traditional authorities regarding control transactions, under FIRRMA, the CFIUS also has expanded jurisdiction to review certain covered investments in TID US businesses.

These are businesses that: produce, design, test, manufacture, fabricate or develop one or more critical technologies subject to US export controls; perform certain actions in relation to identified critical infrastructure assets, referred to as "covered investment critical infrastructure"; or maintain or collect sensitive personal data of US citizens.

A covered investment is a non-controlling transaction that affords the foreign investor any of the following with respect to a TID US business: access to any "material nonpublic technical information" in its possession; board membership or observer rights (including nomination rights); or any involvement, other than through voting of shares, in substantive decision-making regarding sensitive personal data of US citizens, critical technologies or covered investment-critical infrastructure.

The CFIUS also has jurisdiction to review changes in rights that would provide control or, for a TID US business, covered investment rights, as well as transactions designed to evade CFIUS review.

Covered transactions—those subject to CFIUS's jurisdiction—include deals structured as stock or asset purchases, debt-to-equity conversions, foreign-foreign transactions where the target has US assets, private equity investments (in some cases even where the general partner is US-owned) and joint ventures into which a US business is being contributed.

Beyond its traditional investment focus, the CFIUS also has jurisdiction to review the purchase or lease by, or a concession to, a foreign person or real estate in the US that is located within, or will function as part of, certain air or maritime ports, or is located in or within certain proximity ranges of identified military installations and areas. The list of such military installations was expanded in 2023. Real estate transactions under CFIUS's jurisdiction are not subject to mandatory filing requirements.

Scope of the review

CFIUS reviews are focused on national security concerns. In each case, the CFIUS conducts a risk-based analysis based on the threat posed by the foreign investor, the vulnerabilities exposed by the target US business, and the consequences to US national security of combining that threat and vulnerability. The CFIUS statute and a CFIUS executive order issued by President Biden in 2022 each specify various factors for the CFIUS to consider in its reviews.

Based on its risk assessment, the CFIUS determines whether the transaction presents any national security concerns. If the CFIUS identifies such concerns, it first determines whether other provisions of US law can sufficiently address them. If no other provisions of US law adequately address the concerns, the CFIUS next determines whether any mitigation measures could resolve the concerns. If mitigation is warranted, the CFIUS will typically negotiate terms with the parties, which will be a prerequisite to CFIUS clearing the transaction.

If the CFIUS determines that mitigation cannot adequately resolve its concerns, the CFIUS will typically request that the parties abandon their transaction, or that the foreign buyer divest its interest in the US business if the review happens following closing.

If the parties will not agree to abandonment or divestment, the CFIUS can recommend that the president of the US block the investment, as only the president has the authority to prohibit a transaction. Presidential blocks are relatively rare, with only seven having occurred in history. It is more typical for parties to agree to terms for abandonment or divestment directly with the CFIUS. Although the CFIUS process is confidential, presidential block orders are public.

Review process timeline

There are two options for how parties can notify a transaction to the CFIUS: a declaration, which is a short-form filing reviewed on an expedited basis; or a voluntary notice, which is the traditional CFIUS notification mechanism. Both declarations and notices include required information about the investor and its owners, the US business that is the subject of the transaction and the transaction itself, although notices require more such information, including personal identifier information for directors and officers of the investor and its parent companies. For both declarations and notices, the CFIUS will also typically request additional information via Q&A during the review.

Following the initial submission, the declaration process typically takes approximately five to eight weeks, and the notice process usually takes approximately three to five months. Following its assessment of a declaration, the CFIUS may request the parties file a notice, so in those cases the total process for a transaction notified by declaration will take longer. A variety of factors can impact whether to file via a notice or declaration. For example, for more complex transactions, deals expected to be more sensitive from a national security standpoint or in cases where parties want to be assured the certainty of CFIUS clearance, it may be advisable for the parties to start with a notice.

Once accepted by the CFIUS, a declaration is assessed in 30 calendar days. At the end of the 30 days, the CFIUS may take one of four actions: clear the transaction; inform the parties that CFIUS cannot clear the transaction on the basis of the declaration, but not request a notice (commonly referred to as the "shrug"); request that the parties file a notice for the transaction; or initiate a unilateral review.

Though the shrug outcome does not confer "safe harbor" as a clearance does—after a shrug, the CFIUS could theoretically request a notice for the transaction in the future—in our experience transaction parties have typically treated the shrug outcome as sufficient for closing.

For a notice, the parties initially submit a draft "prefiling," on which the CFIUS will provide comments and follow-up questions. After addressing those comments, parties will formally file the notice with CFIUS. The CFIUS then has to accept the filing, at which time a 45-calendar-day initial review begins. At the end of the review, the CFIUS will either clear the transaction or proceed to a 45-calendar-day investigation. As of the most recent data published by the CFIUS, more than half of cases proceed to investigation.

If a transaction is referred to the president, the president has 15 calendar days to decide whether to prohibit the transaction.

In some cases, the CFIUS will need additional time to complete its process, such as when negotiating mitigation measures with the parties. An investigation may be extended for one 15- calendar-day period in "extraordinary circumstances", although this happens rarely. More typically, in such circumstances, the CFIUS will allow the parties to withdraw and resubmit their filing, which restarts the initial 45-day review period. Most transactions are cleared in one CFIUS cycle.

Filing fees apply to notices submitted to the CFIUS, but not to declarations—although they apply for notices submitted following CFIUS's assessment of a declaration. Fees are assessed based on a tiered approach, providing for a proportional cost equal to or less than 0.15 percent of the transaction value. The lowest fee is US$750 for transactions valued between US$500,000 and US$5 million (transactions under US$500,000 are not subject to fees), and the highest-tier fee is US$300,000 for transactions valued at US$750 million or more.

How foreign investors can protect themselves

It is critical for foreign investors to consider CFIUS issues—including assessing jurisdictional matters, whether mandatory CFIUS filing will apply or a voluntary filing is advisable, and potential substantive risks—as early as possible in cross-border transactions involving foreign investment (direct or indirect) in a US business. Notably, this includes minority and venture capital investments. Given potentially severe penalties for noncompliance, parties need to know early on whether filing will be required—and where it is not, may want to include relevant representations in the purchase agreement to provide additional protection.

In cases where filing is mandatory or the parties voluntarily notify the CFIUS, allocation of CFIUS mitigation risk will be a key issue. Most transactions are cleared without mitigation, but mitigation has become more frequent in recent years and when it is required it can have a substantial impact on transaction goals and present unexpected costs.

The range of mitigation measures that can be imposed by the CFIUS is quite broad, based on the risk profile of the deal, and it is important for investors in particular to have as clear an understanding as possible with respect to what mitigation measures would be acceptable to them. Between additional CFIUS resources enabling it to address concerns in a broader range of transactions and more focused review of certain national security considerations under both FIRRMA and the 2022 CFIUS executive order, mitigation may continue to increase in frequency.

_{White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.}

_{This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.}

_{© 2024 White & Case LLP}