Briefing
CFIUS and Export Control Reforms Have Arrived
What Now and What is Coming?
The National Defense Authorization Act for Fiscal Year 2019 (NDAA) – containing both the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA) and the Export Control Reform Act of 2018 (ECRA) – has become law. This bipartisan legislation passed the Senate by a vote of 87-10, the House by a vote of 359-54, and was signed into law by President Trump on August 13, 2018. Combined, FIRRMA and the ECRA seek to address concerns that existing authorities are not adequate to address threats to US national security emanating from inbound investment, and from outbound technology transfers via exports. FIRRMA and the ECRA provide the US government with expanded authority to control both more strictly.
FIRRMA Amends the US National Security Review Process
FIRRMA amends certain jurisdictional and procedural aspects of the US national security review process conducted by the Committee on Foreign Investment in the United States (CFIUS or the Committee) (1), but it likely will have minimal immediate impact. With the exception of modestly extending CFIUS’ deadlines (2) and the potential creation of filing fees (3), the remaining provisions of FIRRMA likely will take more than a year to implement (4). When implemented, there will be some sweeping changes to be sure, but, as was the case with the last amendments in 2007, many FIRRMA provisions merely codify existing practices. Despite the extended timeline for some provisions, the CFIUS process will look substantially different in the mid-to-long term. Accordingly, it would be advisable to start preparing in advance.
Significant Changes for Investments in Critical and Sensitive Businesses
One of the motivating forces behind the CFIUS reform movement was to ensure that CFIUS would have the authority to review and take action with respect to any investment in certain US businesses that pose potentially significant national security concerns. One of the most prominent features of FIRRMA is that it creates special rules applicable to foreign investment in these businesses – specifically those involving US critical infrastructure, critical technology or sensitive personal data (collectively, a Critical or Sensitive Business). Under FIRRMA, foreign investment at any level in a Critical or Sensitive Business can be subject to CFIUS jurisdiction, and foreign government investors in such businesses will be subject to a mandatory notification requirement if the investment crosses a yet-to-be determined threshold. Arguably, the former point merely reflects current practice, while the latter institutes a first-time mandatory requirement. Neither of these provisions, though, will go into effect until CFIUS issues its implementing regulations.
FIRRMA explicitly brings all investment in Critical or Sensitive Businesses within CFIUS’ jurisdiction effectively by creating a presumption that a minority investment of any size is subject to CFIUS jurisdiction, whereas today that presumption largely exists with respect only to acquisitions of greater than 10 percent (5). FIRRMA does this by creating a new jurisdictional standard, the so-called “Other Investment” standard, distinct from the existing control standard, which will continue to be operative. The impact of the “Other Investment” provision may be limited by a combination of several factors. First, it only applies to investments involving Critical and Sensitive Businesses. Second, FIRRMA does not change the current definition of critical infrastructure, and CFIUS rarely has declared, as authorized under its existing authorities, that a transaction involves critical infrastructure. Third, the term “critical technologies,” with one exception, is defined by reference to pre-existing export control laws. The exception requires the creation of a new category of export controls with respect to “emergent and foundational technologies,” as discussed in more detail below. This process will be subject to intense public scrutiny and interagency consultation, which may provide a restraint. Finally, while the application to investments involving sensitive personal data has the greatest potential for overreach, CFIUS recently approved China Oceanwide’s acquisition of Genworth Financial subject to a novel and comprehensive new solution to mitigate its data security concerns. This suggests CFIUS may be willing to reach mitigation solutions in this area even as it asserts its jurisdiction more aggressively.
The creation of a short-form mandatory “declaration” with respect to the acquisition of a “substantial interest” in a Critical or Sensitive Business by a foreign person in which a foreign government holds a “substantial interest” likely will be one of the most problematic aspects of FIRRMA – for both transacting parties and CFIUS (6). This new obligation, triggered by a newly introduced standard, likely will have the most unintended consequences, notably by forcing CFIUS to clearly and transparently define by regulation what constitutes a “substantial interest.” Today, CFIUS enjoys significant discretion because its voluntary review process is governed by a vague jurisdictional standard, i.e., whether a transaction confers “control,” adjudicated in CFIUS’ sole discretion as an ability to “determine, direct, or decide important matters affecting the US business.” Implementing a mandatory legal obligation with fines for non-compliance requires brighter lines to withstand legal challenge, lines that will be difficult to draw (7). For example, investments below 10 percent of the voting interest explicitly are carved out of the mandatory obligation. This exemption is seemingly easy enough to apply to a direct acquisition by a 100 percent state-owned enterprise, but the implementing regulations will need to address with reasonable clarity its application to indirect and convoluted structures. CFIUS also may institute via regulations a mandatory declaration requirement with respect to any investment in a critical technology company, regardless of whether it involves a foreign government investor.
Expansion to Real Estate Muted
Other notable remaining provisions include the provisions expanding CFIUS’ jurisdiction to include real estate acquisitions near sensitive facilities. The impact of the real estate expansion will be limited because Congress mercifully excluded acquisitions of single family homes and any real estate acquisition in an urbanized areas, both as defined by the US Census. But real estate acquisitions today are not subject to CFIUS review, so this will be a significant change for acquisitions not exempted.
Beneficial Impacts Expected from Behind-the-Scenes Changes
The most beneficial aspect of FIRRMA likely will be the creation of a dedicated budget and special hiring authority for the CFIUS member agencies. FIRRMA creates and funds a dedicated annual CFIUS budget of $20 million. This means that, for the first time in its history, CFIUS as a body will have direct access to funds rather than being beholden to the allocations available from each member agency to fund its own participation on the Committee. This is important because CFIUS will be able to fund, for example, solutions to automate and expedite some of its routine processes, which should decrease the currently routine administrative delays. But some funding will be allocated also to fulfilling CFIUS’ mandate to monitor M&A activity, which may result in CFIUS using its call-in powers more frequently.
FIRRMA also grants each member Direct Hiring Authority (DHA). This is important because replacing or increasing CFIUS staff (who must have specialized experience and clearances) in a timely manner has long been a challenge for CFIUS. DHA greatly expedites the bureaucratic government hiring process. While these provisions take effect immediately, it will take CFIUS some time to use them effectively.
ECRA Requires Updating Existing Export Control Rules
ECRA effectively repeals the Export Administration Act of 1979 (EAA), which expired in 1994 and has continued in effect pursuant to the International Emergency Economic Powers Act (IEEPA) (8). ECRA directs the President to establish export controls for certain dual use and military items similar to the current export control regime, but additional controls are to be enacted with respect to a new category of “emerging and foundational technologies.” This addresses another motivating factor behind the CFIUS reform movement – to impose greater controls on the transfer abroad of certain otherwise largely uncontrolled technologies. Once a technology is added to this new category, ECRA requires a license at a minimum in order to export, re-export, or transfer technologies under the new category to embargoed destinations, including China. ECRA also provides robust authorities to enforce such controls, including penalty provisions (i.e., criminal penalties of up to US$1 million and 20 years imprisonment or civil penalties of up to US$300,000 or twice the value of the transaction, plus revocation of export licenses) similar to those found in the IEEPA.
While the creation of a new export control category for emerging and foundational technologies is significant, it is notable that the authority to develop this category was vested with the Department of Commerce (DOC), rather than with CFIUS. The Secretary of Commerce will administer the reform effort in consultation with the Secretary of Defense, the Secretary of State, the Director of National Intelligence, and other appropriate federal agencies (9). Thus, CFIUS has no means to expand the scope of critical (including emerging and foundational) technologies for purposes of FIRRMA other than through the new export control process created by ECRA and administered by DOC. This should ensure greater transparency and consistency.
Footnotes
1.) CFIUS is an inter-agency committee of the US government charged with reviewing acquisitions of potential control by foreign persons of US businesses, and if applicable, addressing any national security concerns posed. CFIUS can refer a transaction to the US President with a recommendation that he block it entirely if national security concerns cannot otherwise be addressed. A transaction subject to CFIUS jurisdiction that is not voluntarily notified to CFIUS, and cleared, remains subject to potentially significant remedial action.
2.) FIRRMA immediately extends the current Phase 1 review from 30 to 45 calendar days. It also permits CFIUS to extend the Phase 2 investigation from 75 to 90 calendar days in extraordinary circumstances.
3.) While CFIUS can start imposing a filing fee of 1 percent of the transaction value, up to a maximum of US$300,000, it likely will need considerable time to establish a collection process.
4.) The last amendments, pursuant to the Foreign Investment and National Security Act of 2007 (FINSA) enacted in July 2007, were not fully implemented for over a year (i.e., until December 2008). Notwithstanding this implementation timeline, FIRRMA authorizes CFIUS to establish pilot programs to implement any new authority that is not otherwise immediately effective. While it is not yet clear whether CFIUS intends to avail itself of this option, CFIUS can do so by merely publishing a determination in the Federal Register that covers the scope and procedures for the pilot program.
5.) To be sure, CFIUS today would assert jurisdiction with respect to certain investments of less than 10 percent, and may not assert jurisdiction with respect to certain investments above 10 percent. Going forward, though, at least with respect to investments in a Critical or Sensitive Business, the presumption will be that all investments will be subject to CFIUS jurisdiction, and some of them – i.e., ones involving acquisitions of a “substantial interest” by a foreign government investor – will be subject to a mandatory notification requirement.
6.) FIRRMA provides that any party, not just foreign government investors caught by the mandatory notification requirement, can submit a short-form declaration. While the ostensible purpose of this option is to create an expedited review for relatively benign cases, it could just as easily result instead in an extended process, as CFIUS does not have to take decisive action with respect to a short-form declaration. It can instead simply suggest that the parties submit a long-form notice. Ironically, the ideal test candidates for this voluntary declaration process are likely the most benign acquisitions, for which the parties could choose not to file in any event.
7.) The existing “control” standard, and new “Other Investment” standard will remain discretionary and applicable to voluntary filings.
8.) Transitional provisions preserve existing export controls until changed or revoked under the new authorities.
9.) The ECRA also requires the same set of executive agencies to conduct a review of license requirements for countries, such as China, that are subject to comprehensive US arms embargoes, with a view to revising them as deemed appropriate.
