Treasury Proposes New Rules on CFIUS’s Jurisdiction: Opening the Black Box

On Sept. 24, the Federal Register published two proposed rules from the U.S. Treasury Department governing the implementation of provisions from the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA). The regulations would affect how the Committee on Foreign Investment in the United States (CFIUS) handles foreign investment (31 C.F.R. Part 800) and real estate (31 C.F.R. Part 802) transactions. CFIUS is an interagency committee that reviews transactions involving foreign investment in order to determine their impact on national security.

Passed as part of the National Defense Authorization Act in August 2018, FIRRMA is the most recent reform of the foreign investment review process since the Foreign Investment National Security Act of 2007.

Noting their concerns about China’s “weaponization” of investment, FIRRMA’s chief architects in Congress aimed to expand CFIUS’s jurisdiction to include certain noncontrolling investments and real estate transactions. For a more complete review of FIRRMA, please see previous Lawfare coverage here.

How Do These New Regulations Affect Investment?

The new rule explains that “covered investments” (defined in Section 800.211) are those that deal in critical technologies, critical infrastructure, and sensitive personal data and thus would potentially fall within CFIUS’s jurisdiction as a covered transaction. While foreign persons planning to invest in TID (technology, infrastructure and data) businesses were potentially already subject to CFIUS review, the proposed rule provides additional details about what constitutes a covered investment:

• Critical Technology. The rule would define “critical technology” consistent with FIRRMA. Examples of technology in FIRRMA’s definition include defense articles and defense services in the U.S. Munitions List, nuclear technology, and items controlled pursuant to international regimes on chemical and biological weapons proliferation. The new definition would also capture emerging and foundational technologies controlled pursuant to Section 1758 of the Export Control Reform Act of 2018 (ECRA). ECRA generally outlines a time horizon of five to 10 years for analysis on technologies that are “essential to the national security of the United States.”
• Critical Infrastructure. FIRRMA expanded CFIUS’s jurisdiction to include covered investments by a foreign person in an “unaffiliated U.S. business” that “owns, operates, manufactures, supplies, or services critical infrastructure.” An unaffiliated business is one in which the foreign person has neither majority voting rights nor the right to appoint a majority of the board. As directed by FIRMMA, CFIUS must limit its scope to a subset of critical infrastructure—known as “covered investment critical infrastructure”—specified in Appendix A to the rule. Restricting CFIUS to this subset is intended to limit the application of CFIUS’s review to critical infrastructure “likely to be of importance to the national security of the United States” (defined in FIRRMA Section 1703). The new rule provides a specific list in Appendix A that encompasses a variety of infrastructure categories including telecommunications, submarine cables, airports and industrial resources. However, to be considered a TID business for jurisdictional purposes of covered investment critical infrastructure, the U.S. business would have to perform a “specific function” (Column 2 of Appendix A) with respect to its “enumerated specific type of covered investment infrastructure” (Column 1 of Appendix A). In short, it’s not enough that a potential transaction involves Column 1, the actual piece of infrastructure. For the transaction to fall within CFIUS’s jurisdiction as covered investment critical infrastructure, the U.S. business would also have to perform the “specific” corollary function as enumerated in Column 2.
• Sensitive Personal Data. The proposed regulation specifies the business activities that implicate “sensitive personal data” and would thus fall under CFIUS’s jurisdiction. The new rule states that the “sensitive personal data” label applies only if the U.S. business in question:

(a) targets or tailors its products or services to sensitive U.S. Government personnel or contractors, (b) maintains or collects such data on greater than one million individuals, or (c) has a demonstrated business objective to maintain or collect such data on greater than one million individuals and such data is an integrated part of the U.S. business’s primary products or services.

Furthermore, the proposed rule does not limit “identifiable data” to names, but extends the category to include data that list “physical address, email address, social security number, phone number, or other information that identifies a specific individual.”

The new rule also defines what constitutes a “substantial interest” under FIRRMA. FIRRMA states that an individual must declare to CFIUS those investments that are “transactions in which a foreign person obtains a ‘substantial interest’ in a U.S. business where a foreign government in turn holds a ‘substantial interest’ in the foreign person.” Under the new rule, the substantial interest between a foreign person and U.S. business is defined as an at least 25 percent voting interest, while the substantial interest between a foreign government and a foreign person will be a 49 percent voting interest and above.

The proposed regulation on these investments, however, has several exceptions. Generally, if an investment qualifies as an exception, it would not count as a covered transaction and therefore would fall outside of CFIUS’s jurisdiction. However, each transaction must be assessed in its totality, and even those investments that may at first appear to qualify for exceptions may contain other elements (e.g., a third-party foreign investor that is not an excepted investor) that could bring the investment back within CFIUS’s review. Here are the exceptions to covered transactions and the limitations to those exceptions as defined by the new regulation:

• Excepted Investors. To be an “excepted investor,” an individual would first have to show a substantial connection to one or more “excepted foreign states.” The rule notes that the list of excepted foreign states will be published by the Treasury Department at some point in the future. While the rule does not specify clear criteria for a state to be an excepted foreign state, CFIUS would eventually require the state to establish “a robust process to assess foreign investments for national security risks and to facilitate coordination with the United States on matters relating to investment security.” The “excepted investor” category has an important caveat, however. Even if an investor was excepted at the time of the transaction, a transaction can revert to a covered transaction if the foreign actor either ceases to be a national of the excepted foreign state or otherwise loses the required connection to the excepted state. The foreign actor has to maintain excepted investor status up to three years after a transaction for it to fall outside of CFIUS’s jurisdiction. However, if a foreign state ceases to be an excepted foreign state, that change alone will not be grounds for a particular investment to become a covered investment and jurisdiction over the investment to revert to CFIUS.
• Incremental Acquisitions. A transaction by a foreign actor for an additional stake in a U.S. business will not be considered a covered transaction if the same foreign investor (or wholly owned subsidiary) previously attained direct control of the same U.S. business in a past transaction for which they submitted a written notice to CFIUS. The regulation additionally requires CFIUS to have concluded all actions related to the past transaction for the new one to qualify as an exception.
• Participation in Investment Funds. A foreign person’s limited partnership on the board of an investment fund that has invested in an unaffiliated TID business does not by itself render the indirect investment a covered transaction and trigger CFIUS’s jurisdiction over the transaction.

How Do These Regulations Affect Real Estate Transactions?

The expansion of CFIUS’s jurisdiction under the new rules would cover interests in real estate close to airports, maritime ports, military installations and other government sites linked to national security. The new regulation specifies that in order to be considered a “covered real estate,” the property in question must be located within one of the following:

• An airport or maritime port.
• Close proximity to (within one mile of) military installations (listed in Parts 1 and 2 of Appendix A of the proposed rule).
• The extended range (between one and 100 miles) of military installations specified in Part 2 of Appendix A, which includes: (1) Army combat training centers located in the continental U.S., (2) major range and test facility base activities defined in 10 U.S.C. § 196, and (3) military ranges defined in 10 U.S.C. § 101(e)(1) owned by the U.S. Navy or U.S. Air Force, or joint forces training centers located in Oregon, Nevada, Idaho, Wisconsin, Mississippi, North Carolina or Florida.
• A county or other geographic area identified in connection with active Air Force ballistic missile fields as identified in Part 3 of Appendix A.
• Any part of a U.S. Navy off-shore range complex or off-shore operating area, as identified in Part 4 of Appendix A, that is located within 12 nautical miles seaward of the coastline of the U.S.

But not all deals involving covered real estate are “covered real estate transactions.” The rule specifies what property rights covered real estate deals must include in order for the investment to be a covered real estate transaction. For an exchange to be a covered real estate transaction, the foreign person would have to acquire—through purchase, lease or concession—at least three property rights. These include the ability or right (a) to physical access to the real estate, (b) to exclude others from physical access, (c) to improve or develop the real estate, or (d) to attach fixed or immovable structures or objects to the real estate. The rule also broadens the category of covered real estate to include “any transaction, transfer, agreement, or arrangement, the structure of which is designed or intended to evade or circumvent the application of section 721 as it relates to real estate.”

The new rule stresses that even if a given transaction appears to fall within CFIUS’s jurisdiction as a covered real estate transaction, it is not immune from review under a separate set of regulations that give CFIUS the authority to review a broader set (i.e., not specific to real estate) foreign investment (codified in 31 C.F.R. Part 800), which would also be modified by the other proposed rule.

Notable exceptions to covered real estate transactions include the following:

• Excepted Real Estate Investors. Like the rules change adding an exception for those investors from excepted states, the new rule creates an exception for foreign real estate investors from “excepted real estate foreign states” who also meet additional criteria outlined in Section 802.216 of the proposed rule.
• Part 800 Covered Transaction. Under the new regulation, transactions covered under 31 C.F.R. Part 800 (the concurrent proposed rule described above that covers foreign investment) that happen to involve real estate will not be considered covered real estate transactions for the purposes of CFIUS jurisdiction. If a transaction is subject to Part 800, the parties should analyze whether to notify CFIUS of a transaction under Part 800, not under Part 802. In short, a covered investment transaction is not to be filed under Part 802 (described at the beginning of this section) even if it includes real estate.
• Urbanized Areas and Clusters. In line with FIRRMA, all property located within the Census Bureau’s definition of an urbanized area or cluster is excepted from CFIUS’s real estate jurisdiction unless the property is within an airport or maritime port or is within close proximity to a military installation or other sensitive facility.
• Single Housing Unit. A unit intended for occupancy as separate living quarters is excepted from CFIUS’s jurisdiction as specified in FIRRMA. This would include an apartment unit, for example.

While the new rule does not mandate that parties to covered real estate transactions submit a CFIUS declaration, parties may still decide to voluntarily file a notice or submit a declaration to CFIUS.

What Doesn’t Change?

The proposed regulations will not modify the Pilot Program Interim Rule, currently codified in 31 C.F.R. Part 801, that sets the guidelines (including mandatory declarations) for the review of certain transactions involving foreign persons and critical technologies. The pilot program expanded CFIUS’s jurisdiction to include noncontrolling investments over 27 industries where the transaction gives the foreign investor expanded access to the business’s information, board and decision-making on critical technologies. A few examples from the 27-industry list include aircraft manufacturing, nuclear electric power generation and semiconductor manufacturing. Again, under the new regulation, this expansion of CFIUS’s jurisdiction will remain in place.

Within the rule, the Treasury Department has said that while CFIUS will continue to evaluate the pilot program on critical technologies, the department welcomes comments on the retention provision that specifies the mandatory declarations for certain transactions involving critical technologies.

Additionally, while FIRRMA authorizes CFIUS to collect fees for written notices in covered transactions, the new regulations do not address this issue. The Treasury Department will publish a separate proposed rule for addressing fees at a later date.

The Way Ahead

The new rules provide much needed clarity in the government’s process for completing reviews of foreign investment transactions in the United States. The proposals build on FIRRMA and define what types of transactions fall within the purview of CFIUS. The new regulations add helpful specific details including the precise voting share thresholds and geographic locations of interest that determine whether an investment or real estate deal falls under CFIUS’s review. While the new rules do establish CFIUS’s jurisdiction in some areas, they also outline several factors that limit the scope of its authority including creating an exception for incremental investment and obviating the need for excepted foreign investors to file notice.

These new rules indicate that CFIUS is more concerned by foreign investment in a specified set of issues. The new regulations are not so broad that they cover all foreign investment within the United States. Instead, they focus on transactions of particular interest to Treasury and the rest of the departments involved. This rules change reflects the reality of CFIUS’s logistical capabilities. Resource limitations would certainly prevent CFIUS from taking on the expansive role of reviewing all foreign investment. Yet, the proposal may also be motivated by the government’s desire not to chill investment. By not casting too broad a net for enforcement, these rules aim to balance a need for robust review of foreign investment that implicates national security and a desire to continue to attract investment in the country.

Going forward, CFIUS will provide additional guidance on who constitutes an excepted foreign investor likely by defining what countries will qualify as excepted states. Additionally, CFIUS may work toward a more permanent solution to the pilot program.

The comment window closes on Oct. 17 for the real estate rule and Oct. 24 for the investment rule. In accordance with FIRRMA, final versions of the regulations will take effect no later than Feb. 13, 2020.