CFIUS Reform: Implications of FIRRMA for Fund Managers

After long debate concerning the need to reform the Committee on Foreign Investment in the United States (CFIUS) to address evolving national security threats and emerging technologies, the Foreign Investment Risk Review Modernization Act (FIRRMA) became law on August 13, 2018. FIRRMA expands CFIUS’s powers to review investments by “foreign persons” in two important ways. Once FIRRMA is fully effective, CFIUS will be authorized to review minority, non-controlling investments that afford the investor access to company management or technological know-how in a fashion typical of venture capital and private equity fund investments. In addition, FIRRMA expands CFIUS’s scope beyond historical coverage of US defense contractors and businesses dealing in technologies controlled under US export laws, to broader categories of technologies – that will be determined in part by regulations promulgated by CFIUS – as well as strategic infrastructure businesses and businesses that possess sensitive personal data of US citizens. FIRRMA also introduces the concept of mandatory CFIUS filings for transactions pursuant to which a foreign government acquires a “substantial interest” in a US business.

Some of the most significant changes effected by FIRRMA will not take immediate effect, and may not be implemented for up to 18 months. When FIRRMA’s changes come into effect, however, CFUIS’s expanded jurisdiction will be broad enough to reach foreign funds as well as US-based funds with foreign limited partners.

CFIUS overview

CFIUS is an inter-agency US government committee chaired by the Department of the Treasury tasked with reviewing acquisitions of and investments in US businesses by non-US persons and entities to determine whether such transactions will have a detrimental impact on US national security. Where CFIUS determines that a transaction within its jurisdiction raises security concerns, it can require the parties to mitigate those security risks (e.g., by requiring the US business to divest sensitive assets, or requiring the foreign investor to relinquish board representation on the US business). In extreme cases, CFIUS can recommend that the President block or suspend a transaction, or even unwind a transaction post-closing.

Historically, CFIUS has focused its reviews on “traditional” national security concerns, such as foreign investments in US defense contractors and acquisitions of companies that deal in technologies controlled under US export laws. In recent years, the government has grown increasingly concerned that CFIUS lacks the authority and resources necessary to address evolving national security risks, including efforts by foreign actors to access foundational and emerging technologies (e.g., artificial intelligence, virtual reality, autonomous vehicles) and sensitive information (e.g., personal and health data of US citizens).

Congress drafted FIRRMA to limit access to important US technologies and sensitive information through foreign investment, without unduly deterring the flow of foreign investment into the United States. Whether FIRRMA and its implementing regulations will strike an appropriate balance between those dual goals remains to be seen.

Broadening CFIUS jurisdiction to include “other investments”

Prior to FIRRMA’s enactment, CFIUS’s jurisdiction was limited to transactions that could result in a foreign person gaining “control” of certain US businesses. FIRRMA broadens the scope of CFIUS’s jurisdiction to include “other investments” that do notrequire a foreign person gaining control of a US business.

Only applies to certain US businesses

FIRRMA establishes the fundamental rule that to be an “other investment” the investment must be in a US business that:

1. owns, operates, manufactures, supplies, or services critical infrastructure;
2. produces, designs, tests, manufactures, fabricates, or develops one or more critical technologies; or
3. maintains or collects sensitive personal data of United States citizens that may be exploited in a manner that threatens national security.

The terms “critical infrastructure” and “critical technologies” will be further defined in forthcoming CFIUS regulations that may not come into effect for up to 18 months. FIRRMA’s definition of “critical technologies” includes categories of technology that already are subject to US export control laws, as well as an as-yet-undetermined list of “emerging and foundational technologies.” While the list of emerging and foundational technologies will be developed pursuant to a new US government inter-agency process and with input from CFIUS, “critical technologies” likely will include capabilities associated with artificial intelligence, quantum computing, virtual and augmented reality, autonomous vehicles, encryption, and nanoscale technologies, all of which have been the focus of recent attention by CFIUS. The definition of “critical technologies” may also include emerging financial services (i.e., “fintech”) sectors, including cryptocurrency and blockchain technology, especially where the business interconnects with sensitive personal data of US persons.

Direct or indirect investment by foreign person that “affords” certain covered rights

To be an “other investment,” the investment must be a direct or indirect investment by a foreign person. Therefore, a fund manager must assess whether the subject fund itself is a foreign person and whether such fund has any foreign person investors.

Under current CFIUS regulations, a “foreign person” means any “foreign national,” “foreign government,” “foreign entity,” or any entity controlled by any foreign person or group of foreign persons that are related or act in concert. A “foreign entity” is an entity that is organized under non-US law and has its principal place of business outside the US, or its equity securities are primarily traded on one or more foreign exchanges. Notably, however, the term “foreign entity” does not include an entity that, notwithstanding the satisfaction of the criteria above, can establish that a majority of its equity interest is ultimately owned by US nationals.

A fund will be controlled by a foreign person if the fund’s general partner (“GP”) itself is a foreign person or if the GP is controlled by a foreign person. Additionally, a fund can also be deemed controlled by a foreign person if an LP or group of LPs controls the fund. A determination of “control” will hinge on whether there is power to decide important matters, which may include investment decisions, management of portfolio companies, dismissal or compensation of the GP, dissolution of the fund or operating budgets.

In order to fall within CFIUS jurisdiction, the direct or indirect investment by a foreign person must also afford such foreign person any one of the following:

1. access to material non-public technical information of the business;
2. membership or observer seat on board of directors or similar body; or
3. any involvement (other than through the voting of shares) in substantive decision making regarding the use, development, acquisition, safekeeping or release of sensitive personal data of US citizens maintained or collected by the US business, the use, development, acquisition or release of critical technologies, or the management, operation, manufacture or supply of critical infrastructure.

“Material nonpublic technical information” is defined under FIRRMA as information that is not available in the public domain and that “provides knowledge, know-how, or understanding … of the design, location, or operation of critical infrastructure” or “is necessary to design, fabricate, develop, test, produce, or manufacture critical technologies, including processes, techniques, or methods.” In other words, it is information that would provide a foreign person access to the kinds of critical infrastructure and critical technologies that Congress intended FIRRMA to protect. Significantly, however, material nonpublic technical information does not include “financial information regarding the performance” of a US business, so basic financial data that a fund would ordinarily receive regarding a portfolio company and potentially report to its LP investors should be excluded from that definition.

General fund strategy documents or descriptions of US business portfolio companies also probably would not qualify as material nonpublic technical information, unless those documents or descriptions would provide a foreign LP insight into critical infrastructure or critical technologies that would not be available to the general public. Going forward, funds wishing to remain firmly outside of CFIUS’s review jurisdiction should carefully consider the types of information distributed to LPs to ensure that technical information about the US business is omitted from those distributions whenever possible.

Pending further guidance, questions exist regarding what “affords” means in the context access, membership or involvement in the enumerated matters, especially how this construction will be applied to indirect investment by foreign person LPs. For example, “affords” may not be limited strictly to contractual rights, but may take into account other facts and circumstances. For example, it may include information access certain investors obtain in due diligence or influence certain strategic investors of a fund may have in connection with rights to meet with portfolio company management.

Clarification regarding LPAC membership

FIRRMA includes a specific clarification regarding a foreign LP’s membership on a fund’s limited partner advisory committee (“LPAC”) or similar body. Specifically, a fund’s investment in a covered US business is not an “other transaction” solely by reason of having a foreign LP who sits on LPAC or has the right to appoint LPAC representatives, so long as (a) the foreign LP does not control the fund (i.e., no power to approve, disapprove or control investment decisions or GP decisions with respect to portfolio companies or to unilaterally dismiss, select or determine the compensation of, the GP), (b) the GP is not a foreign person and is the exclusive manager of the fund, (c) the LPAC has limited powers (i.e., no power to approve, disapprove or control investment decisions (except waivers of conflicts, allocation limits, or similar activity) or GP decisions with respect to portfolio companies), (d) the foreign LP has no access to material nonpublic technical information through LPAC, and (e) the foreign LP is not otherwise afforded covered rights.

It is important to note that the clarification for LPAC participation is not a broad exemption for investment funds, but instead narrowly states that LPAC status of a foreign LP does not by itself cause a fund’s investment to fall within the “other investment” category so long as the conditions described above are met. Additionally, the provision does not address the situation where the fund itself is a foreign person.

Introducing mandatory declarations

Another key innovation introduced by FIRRMA is the concept of a “mandatory declaration” for certain transactions, including “other investments” in which a foreign government will directly or indirectly acquire an as-yet-undefined threshold interest in a US business. While CFIUS has historically permitted voluntary notice of transactions, under FIRRMA parties to a transaction will be required to file mandatory declarations with CFIUS in advance of closing for investments in which a foreign investor directly or indirectly acquires a “substantial interest” in a US business, and a foreign government has a “substantial interest” in the foreign investor. Although the term “substantial interest” will be defined in forthcoming regulations, FIRRMA provides that a “substantial interest” will not include an interest that is less than a 10 percent voting interest or an interest arising from an investment that meets the requirements for exclusion from the definition of “other investment” under the LPAC rule. Notably, the 10 percent voting interest threshold for “substantial interest” will apply both to the foreign government interest in the foreign investor, and to the foreign investor’s interest in the US business. In other words, the mandatory declaration requirement would not be triggered in cases where a foreign government controls less than 10 percent of the voting interest in a foreign investor, even if the foreign investor will acquire a greater than 10 percent voting interest in a US business.

An exception to the requirement for mandatory declarations is also available for investments by investment funds if the GP of the fund is not a foreign person and is the exclusive manager of the fund, and if any foreign person serves on the LPAC of the fund, the foreign LP does not control the fund and the LPAC has limited powers.

Finally, FIRRMA gives CFIUS discretion to require a mandatory declaration for any“other investment” transaction involving foreign access to “critical technologies,” another term that has yet to be defined. Because FIRRMA leaves this and other important terms to be defined pursuant to future regulatory action, FIRRMA’s provisions calling for mandatory declarations will not come into immediate effect.

Considerations for fund managers going forward

Although FIRRMA’s full impact on venture capital and private equity funds will depend in significant part on the substance of the forthcoming CFIUS regulations that will implement FIRRMA’s changes, funds that anticipate making investments in US technology companies should consider how their organization and participation by non-US LPs in future investments will implicate CFIUS jurisdiction. For example, funds can take steps now to ensure that (i) they are controlled by a GP that will not qualify as a “foreign person” for CFIUS purposes, (ii) any non-US LPs will not have access to information about portfolio companies that would provide insight into critical infrastructure or critical technologies that is not available to the general public (including limiting access to such information in the diligence process and in connection with the granting of strategic rights), and (iii) non-US LPs are not granted rights that could be construed as “controlling” the fund.

Additionally, funds with investors backed by foreign governments will want to pay close attention to the mandatory declaration requirements as the relevant regulations are implemented.