21 January 2020

CFIUS Issues Final FIRRMA Implementing Regulations

By:Laura Luo, Matthew Dickerson

On January 13, 2020, the U.S. Department of the Treasury issued final regulations (the “Final Regulations”) to “comprehensively implement” the Foreign Investment Risk Review Modernization Act of 2018 (“FIRRMA”).The Final Regulations supersede the proposed regulations published on September 17, 2019 (see KWM alert) (the “Proposed Regulations”), and respond to a variety of public comments raised. 

As required by FIRRMA, the Final Regulations will take effect on February 13, 2020. Although the Final Regulations generally follow the Proposed Regulations, there are certain important differences which may affect deal feasibility, timing and cost. Changes to the Proposed Regulations include, amongst other things, the addition of newly defined terms, adding specificity to certain provisions, altering certain thresholds for exclusions, and the inclusion of illustrative examples. 

Except for certain provisions relating to filing fees, the Final Regulations fully implement all of the provisions of FIRRMA. Although the Pilot Program that has been effective since November 11, 2018 shall cease to be in effect from February 13, 2020, the substantive requirements for a mandatory filing for certain investments in critical technologies, in the same 27 sensitive industries, have been rolled into the Final Regulations. 

As summarized below with more details, the Final Regulations, among other things, expand CFIUS’ jurisdiction to cover non-controlling, non-passive investments in U.S. businesses involved in critical technologies, critical infrastructure or sensitive personal data (each a “TID U.S. business”) and to cover certain transactions involving real estate located proximate to identified U.S. government locations,  provide more guidance on how CFIUS will assess transactions affording foreign access to sensitive personal data of U.S. citizens, establish a category of “excepted investors” from certain nation states who will be exempt from CFIUS review, require mandatory declarations of certain investments in which a foreign government has a “substantial interest”, allow all CFIUS filings (whether voluntary or mandatory) to be made in an abbreviated declaration, define “critical technologies”, clarify further the “fund exception” and CFIUS’ method of determining U.S. national security risks, and impose additional penalty options for non-compliance of CFIUS regulations and mitigation arrangements. 

Below are some specific highlights of the Final Regulations:

Non-controlling and Non-passive Investments in a “TID” Business

The original CFIUS regulations gave CFIUS authority to review transactions affording a foreign person “control” over a U.S business. Under FIRRMA, CFIUS was granted authority to review non-controlling non-passive investments by foreign persons which afforded the foreign person certain rights. Under the Final Regulations, these rights are defined as access to: (i) material nonpublic technical information in the possession of a TID U.S. business; (ii) membership or observer rights on the board of a TID U.S. business; or (iii) any involvement in substantive decision-making of the TID U.S. business relating to its use of sensitive personal data of U.S. citizens, critical technologies or critical infrastructure. 

Mandatory Declaration of Transactions involving Critical Technologies or a Substantial Interest of a Foreign Government  

• Mandatory pre-Closing declarations, to be made at least 30 days prior to the Closing of the transaction, are required for:

o certain investments in critical technologies with a connection to 27 sensitive industries  listed by their NAICS codes (as before under the “old” Pilot Program), although mandatory filings are not required for certain “excepted investors”, certain investments which fall under the “fund exception”, certain acquisitions of encryption technology, and certain investments subject to regulatory mitigation[1];  and 

o certain transactions in which a foreign person (who is not an “excepted investor”) obtains a “substantial interest” in a U.S. business, where a foreign government in turn holds a “substantial interest” in the foreign person. “Substantial interest” means the foreign person holding at least a 25% voting interest in such U.S. business, and the foreign government holding at least a 49% voting interest in the foreign investor.[2]  It is important to note that, in the investment funds context, the 49% voting threshold for mandatory filing only applies to a foreign government holding interests in the general partner (and is not triggered by the foreign government solely holding an interest in a limited partnership which is not coupled with an interest in the general partner).[3]  

• All notifications to CFIUS, whether mandatory or voluntary, may now be made by way of an abbreviated declaration, instead of by a full notice. Previously, the parties could only file a declaration for mandatory filings under the Piot Program. It is intended that abbreviated declarations be no more than five pages in length and on a standard form; significantly shorter and less time consuming to prepare than a full notice. CFIUS has 30 days, following receipt of the declaration, to decide whether to issue a safe harbor letter (which in effect, gives a green light to the transaction), or to request that the parties proceed to the submission of a full notice. 

Sensitive Personal Data

• The Final Regulations establish a substantive list of categories of data which comprise “sensitive personal data” collected or maintained by a U.S. business, including financial, geolocation, health and genetic test data, amongst others.

• The Final Regulations describe when a U.S. business collecting or maintaining such sensitive personal data shall trigger CFIUS jurisdiction; such as where the U.S. business: (1) targets or tailors its products or services to sensitive U.S. government personnel or contractors; (2) maintains or collects such data on greater than one million individuals within the past 12 months[4] ; or (3) has demonstrated a business objective to maintain or collect such data on greater than one million individuals and such data is an integrated part of the primary products or services of the U.S. business.

Fund Exception Regulations

• The “fund exception” is retained. This acts as an exception from CFIUS jurisdiction where the investment in a U.S business is made through an investment fund managed exclusively by, and ultimately controlled by, U.S. nationals, provided that the advisory board of the fund and the foreign investor have limited control, decision-making and access rights. However, the Final Regulations  include a new definition of “principal place of business” as being the primary location of the entity’s management, control and coordination, or in the case of an investment fund, where the fund’s activities and investments are “primarily directed, controlled, or coordinated by or on behalf of the general partner…”.[5]  This provides clarification that U.S. private equity sponsors will not automatically be deemed “foreign persons” if they invest through non-U.S. investment vehicles, provided that investment decisions are primarily made in the U.S., and there are no other indications of foreign “control” (such as foreign co-investors) or foreign access to material nonpublic technical information.  [6]

• The Final Regulations clarify that the general partner of an entity will be deemed to be its “parent”.  

“Excepted Investors” tied to Australia, Canada and the United Kingdom 

• The Final Regulations provide that non-controlling investments by certain foreign persons, defined as “excepted investors”, shall not be deemed a “covered investment”. An “excepted investor” is defined as a foreign investor with a substantial connection to Australia, Canada and/or the United Kingdom[7]  (such a connection is established by reference to the satisfaction of certain enumerated factors,  with a requirement that, amongst other things, at least 75% of the board members, all 10% shareholders  and at least 80% [8]of the shareholder voting base, must be nationals of the U.S. or an excepted nation). Such excepted investor must have (together with its parent and subsidiary entities) a clean (at least five (5) year) track record of compliance with U.S. law, order and regulation (including with respect to past CFIUS filings), to benefit from the exception. An “excepted investor” must also remain so for a period of three (3) years after the completion of the investment. However, please note that this exemption does not apply with respect to controlling investments.

Penalties and Filing Fees

• The Final Regulations set forth additional penalties for lack of compliance with CFIUS regulations, including the imposition of remediation plans where mitigation agreements have been breached, the requirement for all future covered transactions to be notified to CFIUS, and the ability for CFIUS to seek injunctive relief.

• Filing fees for filing notice(s) to CFIUS are not yet determined. The rules relating to the implementation of CFIUS’s fee authority will be published at a later date.

Other Notable Changes

• The Final Regulations include a more defined rubric for determining U.S. national security risk; CFIUS will undertake a risk-based analysis of the transaction, by assessing the:

o threat - being the intent and capability of the foreign person to take action to impair the national security of the U.S;

o vulnerabilities - being whether the transaction presents any susceptibility or impairment of national security; and

o consequences – being the potential effects to national security that could reasonably result from the exploitation of the vulnerabilities by the foreign person.  

• The Final Regulations include, by way of an Appendix, a detailed description of “critical infrastructure”. The Appendix identifies a substantial list of both physical and virtual infrastructure, including internet networks, telecommunications services, internet exchange points, cable systems,  satellite and data centers and systems, as well as traditional physical infrastructure such as ports, pipelines and transportation infrastructure.

Separate Regulations Related to Real Estate 

Additionally, separately issued regulations relate to the acquisition of certain real estate in the United States by foreign persons, which is also effective from February 13, 2020. Coverage is focused on transactions in and/or around airports, maritime ports and military installations as specified or otherwise referred to in the Final Regulations. The Final Regulations also require proximity tests; with different tests for the acquisition of land within one mile and 100 miles of U.S. military installations, in addition to tests for the acquisition of land within areas associated with missile fields and off-shore ranges. Similarly, the Final Regulations also provide exception from coverage for excepted investors with substantial connections to Canada, Australia and the United Kingdom (as may be subsequently amended), acquisition of land in “urbanized areas” and of “housing units” or multi-unit commercial buildings or retail units.

Source: Press Release, U.S. Department of the Treasury, January 13, 2020


[1]Although not implemented in the Final Regulations, the Treasury Department anticipates future regulations which move away from classifications based upon NAICS codes, to one “based upon export control licensing requirements”.

[2]For purposes of determining the percentage of voting interest held indirectly by one entity in another entity, any voting interest of a parent will be deemed to be a 100 percent voting interest in any entity of which it is a parent §.800.244(c).  

[3]See §.800.244(b).

[4]See §.800.104(b) and 241(a)(1)(B), the 12-month period ends with the earliest of the following date:  the completion date, the

date of the parties to the transaction have executed a binding written agreement, or other binding document, establishingthe material terms of the transaction; the date a party has made a public offer to shareholders to buy shares of a U.S. business; ora shareholder has solicited proxies in connection with an election of the board of directors of a U.S. business or an owner or holder of a contingent equity interest has requested the conversion of the contingent equity interest, or the date of filing of a written notice or submission of a declaration. 

[5]Please note that if the entity has made any federal or state filings which represent that any of its principal place of business, office address, address of principal executive offices, headquarters or equivalent, is outside of the United States, then the location identified in such filing shall be deemed to be the entity’s principal place of business unless it can demonstrate otherwise §.800.239(b)

[6]This new definition is subject to further public comment.

[7]This is an initial determination of eligible nations, and CFIUS may expand this list over time. The designation will be reviewed on or before February 13, 2022 §.800.218

[8]When aggregated with their corporate group §.800.219(a)(3)(iv)



A Guide to Doing Business in China

We explore the key issues being considered by clients looking to unlock investment opportunities in the People’s Republic of China.

Doing Business in China
Share on LinkedIn Share on Facebook Share on Twitter
    You might also be interested in

    This article was written by George Zhao, Michael Lawson, David Phua and Haoqing Zhang. Introduction As the world’s largest consumer of energy, with the recently-achieved status of the...

    18 February 2020

    Education APPs, in particular those targeted at children, are very popular in the education sector in China in recent years. Despite combining the sensitive areas of telecoms and education, the...

    23 January 2020

    On January 15, 2020, China and the United States signed the phase-one Economic and Trade Agreement (“Agreement”) in Washington.

    21 January 2020

    China’s Belt and Road Initiative (BRI) is a monumental global development program initiated to connect China with the world to promote trade, economic integration, and growth.

    17 January 2020

    This site uses cookies to enhance your experience and to help us improve the site. Please see our Privacy Policy for further information. If you continue without changing your settings, we will assume that you are happy to receive these cookies. You can change your cookie settings at any time.

    For more information on which cookies we use then please refer to our Cookie Policy.